1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/module.h> 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/skbuff.h> 12 #include <linux/netlink.h> 13 #include <linux/vmalloc.h> 14 #include <linux/rhashtable.h> 15 #include <linux/audit.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nfnetlink.h> 18 #include <linux/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_flow_table.h> 20 #include <net/netfilter/nf_tables_core.h> 21 #include <net/netfilter/nf_tables.h> 22 #include <net/netfilter/nf_tables_offload.h> 23 #include <net/net_namespace.h> 24 #include <net/sock.h> 25 26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) 27 #define NFT_SET_MAX_ANONLEN 16 28 29 /* limit compaction to avoid huge kmalloc/krealloc sizes. */ 30 #define NFT_MAX_SET_NELEMS ((2048 - sizeof(struct nft_trans_elem)) / sizeof(struct nft_trans_one_elem)) 31 32 unsigned int nf_tables_net_id __read_mostly; 33 34 static LIST_HEAD(nf_tables_expressions); 35 static LIST_HEAD(nf_tables_objects); 36 static LIST_HEAD(nf_tables_flowtables); 37 static LIST_HEAD(nf_tables_gc_list); 38 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock); 39 static DEFINE_SPINLOCK(nf_tables_gc_list_lock); 40 41 enum { 42 NFT_VALIDATE_SKIP = 0, 43 NFT_VALIDATE_NEED, 44 NFT_VALIDATE_DO, 45 }; 46 47 static struct rhltable nft_objname_ht; 48 49 static u32 nft_chain_hash(const void *data, u32 len, u32 seed); 50 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed); 51 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *); 52 53 static u32 nft_objname_hash(const void *data, u32 len, u32 seed); 54 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed); 55 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *); 56 57 static const struct rhashtable_params nft_chain_ht_params = { 58 .head_offset = offsetof(struct nft_chain, rhlhead), 59 .key_offset = offsetof(struct nft_chain, name), 60 .hashfn = nft_chain_hash, 61 .obj_hashfn = nft_chain_hash_obj, 62 .obj_cmpfn = nft_chain_hash_cmp, 63 .automatic_shrinking = true, 64 }; 65 66 static const struct rhashtable_params nft_objname_ht_params = { 67 .head_offset = offsetof(struct nft_object, rhlhead), 68 .key_offset = offsetof(struct nft_object, key), 69 .hashfn = nft_objname_hash, 70 .obj_hashfn = nft_objname_hash_obj, 71 .obj_cmpfn = nft_objname_hash_cmp, 72 .automatic_shrinking = true, 73 }; 74 75 struct nft_audit_data { 76 struct nft_table *table; 77 int entries; 78 int op; 79 struct list_head list; 80 }; 81 82 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types 83 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, 84 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, 85 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, 86 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, 87 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, 88 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, 89 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, 90 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, 91 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, 92 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, 93 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, 94 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, 95 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, 96 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, 97 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, 98 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, 99 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, 100 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, 101 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, 102 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, 103 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, 104 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, 105 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, 106 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, 107 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 108 [NFT_MSG_GETSETELEM_RESET] = AUDIT_NFT_OP_SETELEM_RESET, 109 }; 110 111 static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state) 112 { 113 switch (table->validate_state) { 114 case NFT_VALIDATE_SKIP: 115 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); 116 break; 117 case NFT_VALIDATE_NEED: 118 break; 119 case NFT_VALIDATE_DO: 120 if (new_validate_state == NFT_VALIDATE_NEED) 121 return; 122 } 123 124 table->validate_state = new_validate_state; 125 } 126 static void nf_tables_trans_destroy_work(struct work_struct *w); 127 128 static void nft_trans_gc_work(struct work_struct *work); 129 static DECLARE_WORK(trans_gc_work, nft_trans_gc_work); 130 131 static void nft_ctx_init(struct nft_ctx *ctx, 132 struct net *net, 133 const struct sk_buff *skb, 134 const struct nlmsghdr *nlh, 135 u8 family, 136 struct nft_table *table, 137 struct nft_chain *chain, 138 const struct nlattr * const *nla) 139 { 140 ctx->net = net; 141 ctx->family = family; 142 ctx->level = 0; 143 ctx->table = table; 144 ctx->chain = chain; 145 ctx->nla = nla; 146 ctx->portid = NETLINK_CB(skb).portid; 147 ctx->report = nlmsg_report(nlh); 148 ctx->flags = nlh->nlmsg_flags; 149 ctx->seq = nlh->nlmsg_seq; 150 151 bitmap_zero(ctx->reg_inited, NFT_REG32_NUM); 152 } 153 154 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, 155 int msg_type, u32 size) 156 { 157 struct nft_trans *trans; 158 159 trans = kzalloc(size, GFP_KERNEL); 160 if (trans == NULL) 161 return NULL; 162 163 INIT_LIST_HEAD(&trans->list); 164 trans->msg_type = msg_type; 165 166 trans->net = ctx->net; 167 trans->table = ctx->table; 168 trans->seq = ctx->seq; 169 trans->flags = ctx->flags; 170 trans->report = ctx->report; 171 172 return trans; 173 } 174 175 static struct nft_trans_binding *nft_trans_get_binding(struct nft_trans *trans) 176 { 177 switch (trans->msg_type) { 178 case NFT_MSG_NEWCHAIN: 179 case NFT_MSG_NEWSET: 180 return container_of(trans, struct nft_trans_binding, nft_trans); 181 } 182 183 return NULL; 184 } 185 186 static void nft_trans_list_del(struct nft_trans *trans) 187 { 188 struct nft_trans_binding *trans_binding; 189 190 list_del(&trans->list); 191 192 trans_binding = nft_trans_get_binding(trans); 193 if (trans_binding) 194 list_del(&trans_binding->binding_list); 195 } 196 197 static void nft_trans_destroy(struct nft_trans *trans) 198 { 199 nft_trans_list_del(trans); 200 kfree(trans); 201 } 202 203 static void __nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set, 204 bool bind) 205 { 206 struct nftables_pernet *nft_net; 207 struct net *net = ctx->net; 208 struct nft_trans *trans; 209 210 if (!nft_set_is_anonymous(set)) 211 return; 212 213 nft_net = nft_pernet(net); 214 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 215 switch (trans->msg_type) { 216 case NFT_MSG_NEWSET: 217 if (nft_trans_set(trans) == set) 218 nft_trans_set_bound(trans) = bind; 219 break; 220 case NFT_MSG_NEWSETELEM: 221 if (nft_trans_elem_set(trans) == set) 222 nft_trans_elem_set_bound(trans) = bind; 223 break; 224 } 225 } 226 } 227 228 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) 229 { 230 return __nft_set_trans_bind(ctx, set, true); 231 } 232 233 static void nft_set_trans_unbind(const struct nft_ctx *ctx, struct nft_set *set) 234 { 235 return __nft_set_trans_bind(ctx, set, false); 236 } 237 238 static void __nft_chain_trans_bind(const struct nft_ctx *ctx, 239 struct nft_chain *chain, bool bind) 240 { 241 struct nftables_pernet *nft_net; 242 struct net *net = ctx->net; 243 struct nft_trans *trans; 244 245 if (!nft_chain_binding(chain)) 246 return; 247 248 nft_net = nft_pernet(net); 249 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 250 switch (trans->msg_type) { 251 case NFT_MSG_NEWCHAIN: 252 if (nft_trans_chain(trans) == chain) 253 nft_trans_chain_bound(trans) = bind; 254 break; 255 case NFT_MSG_NEWRULE: 256 if (nft_trans_rule_chain(trans) == chain) 257 nft_trans_rule_bound(trans) = bind; 258 break; 259 } 260 } 261 } 262 263 static void nft_chain_trans_bind(const struct nft_ctx *ctx, 264 struct nft_chain *chain) 265 { 266 __nft_chain_trans_bind(ctx, chain, true); 267 } 268 269 int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain) 270 { 271 if (!nft_chain_binding(chain)) 272 return 0; 273 274 if (nft_chain_binding(ctx->chain)) 275 return -EOPNOTSUPP; 276 277 if (chain->bound) 278 return -EBUSY; 279 280 if (!nft_use_inc(&chain->use)) 281 return -EMFILE; 282 283 chain->bound = true; 284 nft_chain_trans_bind(ctx, chain); 285 286 return 0; 287 } 288 289 void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain) 290 { 291 __nft_chain_trans_bind(ctx, chain, false); 292 } 293 294 static int nft_netdev_register_hooks(struct net *net, 295 struct list_head *hook_list) 296 { 297 struct nf_hook_ops *ops; 298 struct nft_hook *hook; 299 int err, j; 300 301 j = 0; 302 list_for_each_entry(hook, hook_list, list) { 303 list_for_each_entry(ops, &hook->ops_list, list) { 304 err = nf_register_net_hook(net, ops); 305 if (err < 0) 306 goto err_register; 307 308 j++; 309 } 310 } 311 return 0; 312 313 err_register: 314 list_for_each_entry(hook, hook_list, list) { 315 list_for_each_entry(ops, &hook->ops_list, list) { 316 if (j-- <= 0) 317 break; 318 319 nf_unregister_net_hook(net, ops); 320 } 321 } 322 return err; 323 } 324 325 static void nft_netdev_hook_free_ops(struct nft_hook *hook) 326 { 327 struct nf_hook_ops *ops, *next; 328 329 list_for_each_entry_safe(ops, next, &hook->ops_list, list) { 330 list_del(&ops->list); 331 kfree(ops); 332 } 333 } 334 335 static void nft_netdev_hook_free(struct nft_hook *hook) 336 { 337 nft_netdev_hook_free_ops(hook); 338 kfree(hook); 339 } 340 341 static void __nft_netdev_hook_free_rcu(struct rcu_head *rcu) 342 { 343 struct nft_hook *hook = container_of(rcu, struct nft_hook, rcu); 344 345 nft_netdev_hook_free(hook); 346 } 347 348 static void nft_netdev_hook_free_rcu(struct nft_hook *hook) 349 { 350 call_rcu(&hook->rcu, __nft_netdev_hook_free_rcu); 351 } 352 353 static void nft_netdev_unregister_hooks(struct net *net, 354 struct list_head *hook_list, 355 bool release_netdev) 356 { 357 struct nft_hook *hook, *next; 358 struct nf_hook_ops *ops; 359 360 list_for_each_entry_safe(hook, next, hook_list, list) { 361 list_for_each_entry(ops, &hook->ops_list, list) 362 nf_unregister_net_hook(net, ops); 363 if (release_netdev) { 364 list_del(&hook->list); 365 nft_netdev_hook_free_rcu(hook); 366 } 367 } 368 } 369 370 static int nf_tables_register_hook(struct net *net, 371 const struct nft_table *table, 372 struct nft_chain *chain) 373 { 374 struct nft_base_chain *basechain; 375 const struct nf_hook_ops *ops; 376 377 if (table->flags & NFT_TABLE_F_DORMANT || 378 !nft_is_base_chain(chain)) 379 return 0; 380 381 basechain = nft_base_chain(chain); 382 ops = &basechain->ops; 383 384 if (basechain->type->ops_register) 385 return basechain->type->ops_register(net, ops); 386 387 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 388 return nft_netdev_register_hooks(net, &basechain->hook_list); 389 390 return nf_register_net_hook(net, &basechain->ops); 391 } 392 393 static void __nf_tables_unregister_hook(struct net *net, 394 const struct nft_table *table, 395 struct nft_chain *chain, 396 bool release_netdev) 397 { 398 struct nft_base_chain *basechain; 399 const struct nf_hook_ops *ops; 400 401 if (table->flags & NFT_TABLE_F_DORMANT || 402 !nft_is_base_chain(chain)) 403 return; 404 basechain = nft_base_chain(chain); 405 ops = &basechain->ops; 406 407 if (basechain->type->ops_unregister) 408 return basechain->type->ops_unregister(net, ops); 409 410 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 411 nft_netdev_unregister_hooks(net, &basechain->hook_list, 412 release_netdev); 413 else 414 nf_unregister_net_hook(net, &basechain->ops); 415 } 416 417 static void nf_tables_unregister_hook(struct net *net, 418 const struct nft_table *table, 419 struct nft_chain *chain) 420 { 421 return __nf_tables_unregister_hook(net, table, chain, false); 422 } 423 424 static bool nft_trans_collapse_set_elem_allowed(const struct nft_trans_elem *a, const struct nft_trans_elem *b) 425 { 426 /* NB: the ->bound equality check is defensive, at this time we only merge 427 * a new nft_trans_elem transaction request with the transaction tail 428 * element, but a->bound != b->bound would imply a NEWRULE transaction 429 * is queued in-between. 430 * 431 * The set check is mandatory, the NFT_MAX_SET_NELEMS check prevents 432 * huge krealloc() requests. 433 */ 434 return a->set == b->set && a->bound == b->bound && a->nelems < NFT_MAX_SET_NELEMS; 435 } 436 437 static bool nft_trans_collapse_set_elem(struct nftables_pernet *nft_net, 438 struct nft_trans_elem *tail, 439 struct nft_trans_elem *trans) 440 { 441 unsigned int nelems, old_nelems = tail->nelems; 442 struct nft_trans_elem *new_trans; 443 444 if (!nft_trans_collapse_set_elem_allowed(tail, trans)) 445 return false; 446 447 /* "cannot happen", at this time userspace element add 448 * requests always allocate a new transaction element. 449 * 450 * This serves as a reminder to adjust the list_add_tail 451 * logic below in case this ever changes. 452 */ 453 if (WARN_ON_ONCE(trans->nelems != 1)) 454 return false; 455 456 if (check_add_overflow(old_nelems, trans->nelems, &nelems)) 457 return false; 458 459 /* krealloc might free tail which invalidates list pointers */ 460 list_del_init(&tail->nft_trans.list); 461 462 new_trans = krealloc(tail, struct_size(tail, elems, nelems), 463 GFP_KERNEL); 464 if (!new_trans) { 465 list_add_tail(&tail->nft_trans.list, 466 &nft_net->commit_list); 467 return false; 468 } 469 470 /* 471 * new_trans->nft_trans.list contains garbage, but 472 * list_add_tail() doesn't care. 473 */ 474 new_trans->nelems = nelems; 475 new_trans->elems[old_nelems] = trans->elems[0]; 476 list_add_tail(&new_trans->nft_trans.list, &nft_net->commit_list); 477 478 return true; 479 } 480 481 static bool nft_trans_try_collapse(struct nftables_pernet *nft_net, 482 struct nft_trans *trans) 483 { 484 struct nft_trans *tail; 485 486 if (list_empty(&nft_net->commit_list)) 487 return false; 488 489 tail = list_last_entry(&nft_net->commit_list, struct nft_trans, list); 490 491 if (tail->msg_type != trans->msg_type) 492 return false; 493 494 switch (trans->msg_type) { 495 case NFT_MSG_NEWSETELEM: 496 case NFT_MSG_DELSETELEM: 497 return nft_trans_collapse_set_elem(nft_net, 498 nft_trans_container_elem(tail), 499 nft_trans_container_elem(trans)); 500 } 501 502 return false; 503 } 504 505 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans) 506 { 507 struct nftables_pernet *nft_net = nft_pernet(net); 508 struct nft_trans_binding *binding; 509 struct nft_trans_set *trans_set; 510 511 list_add_tail(&trans->list, &nft_net->commit_list); 512 513 binding = nft_trans_get_binding(trans); 514 if (!binding) 515 return; 516 517 switch (trans->msg_type) { 518 case NFT_MSG_NEWSET: 519 trans_set = nft_trans_container_set(trans); 520 521 if (!nft_trans_set_update(trans) && 522 nft_set_is_anonymous(nft_trans_set(trans))) 523 list_add_tail(&binding->binding_list, &nft_net->binding_list); 524 525 list_add_tail(&trans_set->list_trans_newset, &nft_net->commit_set_list); 526 break; 527 case NFT_MSG_NEWCHAIN: 528 if (!nft_trans_chain_update(trans) && 529 nft_chain_binding(nft_trans_chain(trans))) 530 list_add_tail(&binding->binding_list, &nft_net->binding_list); 531 break; 532 } 533 } 534 535 static void nft_trans_commit_list_add_elem(struct net *net, struct nft_trans *trans) 536 { 537 struct nftables_pernet *nft_net = nft_pernet(net); 538 539 WARN_ON_ONCE(trans->msg_type != NFT_MSG_NEWSETELEM && 540 trans->msg_type != NFT_MSG_DELSETELEM); 541 542 if (nft_trans_try_collapse(nft_net, trans)) { 543 kfree(trans); 544 return; 545 } 546 547 nft_trans_commit_list_add_tail(net, trans); 548 } 549 550 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 551 { 552 struct nft_trans *trans; 553 554 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 555 if (trans == NULL) 556 return -ENOMEM; 557 558 if (msg_type == NFT_MSG_NEWTABLE) 559 nft_activate_next(ctx->net, ctx->table); 560 561 nft_trans_commit_list_add_tail(ctx->net, trans); 562 return 0; 563 } 564 565 static int nft_deltable(struct nft_ctx *ctx) 566 { 567 int err; 568 569 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 570 if (err < 0) 571 return err; 572 573 nft_deactivate_next(ctx->net, ctx->table); 574 return err; 575 } 576 577 static struct nft_trans * 578 nft_trans_alloc_chain(const struct nft_ctx *ctx, int msg_type) 579 { 580 struct nft_trans_chain *trans_chain; 581 struct nft_trans *trans; 582 583 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 584 if (!trans) 585 return NULL; 586 587 trans_chain = nft_trans_container_chain(trans); 588 INIT_LIST_HEAD(&trans_chain->nft_trans_binding.binding_list); 589 trans_chain->chain = ctx->chain; 590 591 return trans; 592 } 593 594 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 595 { 596 struct nft_trans *trans; 597 598 trans = nft_trans_alloc_chain(ctx, msg_type); 599 if (trans == NULL) 600 return ERR_PTR(-ENOMEM); 601 602 if (msg_type == NFT_MSG_NEWCHAIN) { 603 nft_activate_next(ctx->net, ctx->chain); 604 605 if (ctx->nla[NFTA_CHAIN_ID]) { 606 nft_trans_chain_id(trans) = 607 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID])); 608 } 609 } 610 nft_trans_commit_list_add_tail(ctx->net, trans); 611 612 return trans; 613 } 614 615 static int nft_delchain(struct nft_ctx *ctx) 616 { 617 struct nft_trans *trans; 618 619 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 620 if (IS_ERR(trans)) 621 return PTR_ERR(trans); 622 623 nft_use_dec(&ctx->table->use); 624 nft_deactivate_next(ctx->net, ctx->chain); 625 626 return 0; 627 } 628 629 void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule) 630 { 631 struct nft_expr *expr; 632 633 expr = nft_expr_first(rule); 634 while (nft_expr_more(rule, expr)) { 635 if (expr->ops->activate) 636 expr->ops->activate(ctx, expr); 637 638 expr = nft_expr_next(expr); 639 } 640 } 641 642 void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule, 643 enum nft_trans_phase phase) 644 { 645 struct nft_expr *expr; 646 647 expr = nft_expr_first(rule); 648 while (nft_expr_more(rule, expr)) { 649 if (expr->ops->deactivate) 650 expr->ops->deactivate(ctx, expr, phase); 651 652 expr = nft_expr_next(expr); 653 } 654 } 655 656 static int 657 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 658 { 659 /* You cannot delete the same rule twice */ 660 if (nft_is_active_next(ctx->net, rule)) { 661 nft_deactivate_next(ctx->net, rule); 662 nft_use_dec(&ctx->chain->use); 663 return 0; 664 } 665 return -ENOENT; 666 } 667 668 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 669 struct nft_rule *rule) 670 { 671 struct nft_trans *trans; 672 673 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 674 if (trans == NULL) 675 return NULL; 676 677 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) { 678 nft_trans_rule_id(trans) = 679 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); 680 } 681 nft_trans_rule(trans) = rule; 682 nft_trans_rule_chain(trans) = ctx->chain; 683 nft_trans_commit_list_add_tail(ctx->net, trans); 684 685 return trans; 686 } 687 688 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 689 { 690 struct nft_flow_rule *flow; 691 struct nft_trans *trans; 692 int err; 693 694 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 695 if (trans == NULL) 696 return -ENOMEM; 697 698 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) { 699 flow = nft_flow_rule_create(ctx->net, rule); 700 if (IS_ERR(flow)) { 701 nft_trans_destroy(trans); 702 return PTR_ERR(flow); 703 } 704 705 nft_trans_flow_rule(trans) = flow; 706 } 707 708 err = nf_tables_delrule_deactivate(ctx, rule); 709 if (err < 0) { 710 nft_trans_destroy(trans); 711 return err; 712 } 713 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE); 714 715 return 0; 716 } 717 718 static int nft_delrule_by_chain(struct nft_ctx *ctx) 719 { 720 struct nft_rule *rule; 721 int err; 722 723 list_for_each_entry(rule, &ctx->chain->rules, list) { 724 if (!nft_is_active_next(ctx->net, rule)) 725 continue; 726 727 err = nft_delrule(ctx, rule); 728 if (err < 0) 729 return err; 730 } 731 return 0; 732 } 733 734 static int __nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 735 struct nft_set *set, 736 const struct nft_set_desc *desc) 737 { 738 struct nft_trans_set *trans_set; 739 struct nft_trans *trans; 740 741 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 742 if (trans == NULL) 743 return -ENOMEM; 744 745 trans_set = nft_trans_container_set(trans); 746 INIT_LIST_HEAD(&trans_set->nft_trans_binding.binding_list); 747 INIT_LIST_HEAD(&trans_set->list_trans_newset); 748 749 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] && !desc) { 750 nft_trans_set_id(trans) = 751 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 752 nft_activate_next(ctx->net, set); 753 } 754 nft_trans_set(trans) = set; 755 if (desc) { 756 nft_trans_set_update(trans) = true; 757 nft_trans_set_gc_int(trans) = desc->gc_int; 758 nft_trans_set_timeout(trans) = desc->timeout; 759 nft_trans_set_size(trans) = desc->size; 760 } 761 nft_trans_commit_list_add_tail(ctx->net, trans); 762 763 return 0; 764 } 765 766 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 767 struct nft_set *set) 768 { 769 return __nft_trans_set_add(ctx, msg_type, set, NULL); 770 } 771 772 static int nft_mapelem_deactivate(const struct nft_ctx *ctx, 773 struct nft_set *set, 774 const struct nft_set_iter *iter, 775 struct nft_elem_priv *elem_priv) 776 { 777 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 778 779 if (!nft_set_elem_active(ext, iter->genmask)) 780 return 0; 781 782 nft_set_elem_change_active(ctx->net, set, ext); 783 nft_setelem_data_deactivate(ctx->net, set, elem_priv); 784 785 return 0; 786 } 787 788 struct nft_set_elem_catchall { 789 struct list_head list; 790 struct rcu_head rcu; 791 struct nft_elem_priv *elem; 792 }; 793 794 static void nft_map_catchall_deactivate(const struct nft_ctx *ctx, 795 struct nft_set *set) 796 { 797 u8 genmask = nft_genmask_next(ctx->net); 798 struct nft_set_elem_catchall *catchall; 799 struct nft_set_ext *ext; 800 801 list_for_each_entry(catchall, &set->catchall_list, list) { 802 ext = nft_set_elem_ext(set, catchall->elem); 803 if (!nft_set_elem_active(ext, genmask)) 804 continue; 805 806 nft_set_elem_change_active(ctx->net, set, ext); 807 nft_setelem_data_deactivate(ctx->net, set, catchall->elem); 808 break; 809 } 810 } 811 812 static void nft_map_deactivate(const struct nft_ctx *ctx, struct nft_set *set) 813 { 814 struct nft_set_iter iter = { 815 .genmask = nft_genmask_next(ctx->net), 816 .type = NFT_ITER_UPDATE, 817 .fn = nft_mapelem_deactivate, 818 }; 819 820 set->ops->walk(ctx, set, &iter); 821 WARN_ON_ONCE(iter.err); 822 823 nft_map_catchall_deactivate(ctx, set); 824 } 825 826 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set) 827 { 828 int err; 829 830 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 831 if (err < 0) 832 return err; 833 834 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 835 nft_map_deactivate(ctx, set); 836 837 nft_deactivate_next(ctx->net, set); 838 nft_use_dec(&ctx->table->use); 839 840 return err; 841 } 842 843 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, 844 struct nft_object *obj) 845 { 846 struct nft_trans *trans; 847 848 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj)); 849 if (trans == NULL) 850 return -ENOMEM; 851 852 if (msg_type == NFT_MSG_NEWOBJ) 853 nft_activate_next(ctx->net, obj); 854 855 nft_trans_obj(trans) = obj; 856 nft_trans_commit_list_add_tail(ctx->net, trans); 857 858 return 0; 859 } 860 861 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj) 862 { 863 int err; 864 865 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj); 866 if (err < 0) 867 return err; 868 869 nft_deactivate_next(ctx->net, obj); 870 nft_use_dec(&ctx->table->use); 871 872 return err; 873 } 874 875 static struct nft_trans * 876 nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, 877 struct nft_flowtable *flowtable) 878 { 879 struct nft_trans *trans; 880 881 trans = nft_trans_alloc(ctx, msg_type, 882 sizeof(struct nft_trans_flowtable)); 883 if (trans == NULL) 884 return ERR_PTR(-ENOMEM); 885 886 if (msg_type == NFT_MSG_NEWFLOWTABLE) 887 nft_activate_next(ctx->net, flowtable); 888 889 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 890 nft_trans_flowtable(trans) = flowtable; 891 nft_trans_commit_list_add_tail(ctx->net, trans); 892 893 return trans; 894 } 895 896 static int nft_delflowtable(struct nft_ctx *ctx, 897 struct nft_flowtable *flowtable) 898 { 899 struct nft_trans *trans; 900 901 trans = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); 902 if (IS_ERR(trans)) 903 return PTR_ERR(trans); 904 905 nft_deactivate_next(ctx->net, flowtable); 906 nft_use_dec(&ctx->table->use); 907 908 return 0; 909 } 910 911 static void __nft_reg_track_clobber(struct nft_regs_track *track, u8 dreg) 912 { 913 int i; 914 915 for (i = track->regs[dreg].num_reg; i > 0; i--) 916 __nft_reg_track_cancel(track, dreg - i); 917 } 918 919 static void __nft_reg_track_update(struct nft_regs_track *track, 920 const struct nft_expr *expr, 921 u8 dreg, u8 num_reg) 922 { 923 track->regs[dreg].selector = expr; 924 track->regs[dreg].bitwise = NULL; 925 track->regs[dreg].num_reg = num_reg; 926 } 927 928 void nft_reg_track_update(struct nft_regs_track *track, 929 const struct nft_expr *expr, u8 dreg, u8 len) 930 { 931 unsigned int regcount; 932 int i; 933 934 __nft_reg_track_clobber(track, dreg); 935 936 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 937 for (i = 0; i < regcount; i++, dreg++) 938 __nft_reg_track_update(track, expr, dreg, i); 939 } 940 EXPORT_SYMBOL_GPL(nft_reg_track_update); 941 942 void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len) 943 { 944 unsigned int regcount; 945 int i; 946 947 __nft_reg_track_clobber(track, dreg); 948 949 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 950 for (i = 0; i < regcount; i++, dreg++) 951 __nft_reg_track_cancel(track, dreg); 952 } 953 EXPORT_SYMBOL_GPL(nft_reg_track_cancel); 954 955 void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg) 956 { 957 track->regs[dreg].selector = NULL; 958 track->regs[dreg].bitwise = NULL; 959 track->regs[dreg].num_reg = 0; 960 } 961 EXPORT_SYMBOL_GPL(__nft_reg_track_cancel); 962 963 /* 964 * Tables 965 */ 966 967 static struct nft_table *nft_table_lookup(const struct net *net, 968 const struct nlattr *nla, 969 u8 family, u8 genmask, u32 nlpid) 970 { 971 struct nftables_pernet *nft_net; 972 struct nft_table *table; 973 974 if (nla == NULL) 975 return ERR_PTR(-EINVAL); 976 977 nft_net = nft_pernet(net); 978 list_for_each_entry_rcu(table, &nft_net->tables, list, 979 lockdep_is_held(&nft_net->commit_mutex)) { 980 if (!nla_strcmp(nla, table->name) && 981 table->family == family && 982 nft_active_genmask(table, genmask)) { 983 if (nft_table_has_owner(table) && 984 nlpid && table->nlpid != nlpid) 985 return ERR_PTR(-EPERM); 986 987 return table; 988 } 989 } 990 991 return ERR_PTR(-ENOENT); 992 } 993 994 static struct nft_table *nft_table_lookup_byhandle(const struct net *net, 995 const struct nlattr *nla, 996 int family, u8 genmask, u32 nlpid) 997 { 998 struct nftables_pernet *nft_net; 999 struct nft_table *table; 1000 1001 nft_net = nft_pernet(net); 1002 list_for_each_entry(table, &nft_net->tables, list) { 1003 if (be64_to_cpu(nla_get_be64(nla)) == table->handle && 1004 table->family == family && 1005 nft_active_genmask(table, genmask)) { 1006 if (nft_table_has_owner(table) && 1007 nlpid && table->nlpid != nlpid) 1008 return ERR_PTR(-EPERM); 1009 1010 return table; 1011 } 1012 } 1013 1014 return ERR_PTR(-ENOENT); 1015 } 1016 1017 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 1018 { 1019 return ++table->hgenerator; 1020 } 1021 1022 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; 1023 1024 static const struct nft_chain_type * 1025 __nft_chain_type_get(u8 family, enum nft_chain_types type) 1026 { 1027 if (family >= NFPROTO_NUMPROTO || 1028 type >= NFT_CHAIN_T_MAX) 1029 return NULL; 1030 1031 return chain_type[family][type]; 1032 } 1033 1034 static const struct nft_chain_type * 1035 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) 1036 { 1037 const struct nft_chain_type *type; 1038 int i; 1039 1040 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 1041 type = __nft_chain_type_get(family, i); 1042 if (!type) 1043 continue; 1044 if (!nla_strcmp(nla, type->name)) 1045 return type; 1046 } 1047 return NULL; 1048 } 1049 1050 struct nft_module_request { 1051 struct list_head list; 1052 char module[MODULE_NAME_LEN]; 1053 bool done; 1054 }; 1055 1056 #ifdef CONFIG_MODULES 1057 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, 1058 ...) 1059 { 1060 char module_name[MODULE_NAME_LEN]; 1061 struct nftables_pernet *nft_net; 1062 struct nft_module_request *req; 1063 va_list args; 1064 int ret; 1065 1066 va_start(args, fmt); 1067 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); 1068 va_end(args); 1069 if (ret >= MODULE_NAME_LEN) 1070 return 0; 1071 1072 nft_net = nft_pernet(net); 1073 list_for_each_entry(req, &nft_net->module_list, list) { 1074 if (!strcmp(req->module, module_name)) { 1075 if (req->done) 1076 return 0; 1077 1078 /* A request to load this module already exists. */ 1079 return -EAGAIN; 1080 } 1081 } 1082 1083 req = kmalloc(sizeof(*req), GFP_KERNEL); 1084 if (!req) 1085 return -ENOMEM; 1086 1087 req->done = false; 1088 strscpy(req->module, module_name, MODULE_NAME_LEN); 1089 list_add_tail(&req->list, &nft_net->module_list); 1090 1091 return -EAGAIN; 1092 } 1093 EXPORT_SYMBOL_GPL(nft_request_module); 1094 #endif 1095 1096 static void lockdep_nfnl_nft_mutex_not_held(void) 1097 { 1098 #ifdef CONFIG_PROVE_LOCKING 1099 if (debug_locks) 1100 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES)); 1101 #endif 1102 } 1103 1104 static const struct nft_chain_type * 1105 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, 1106 u8 family, bool autoload) 1107 { 1108 const struct nft_chain_type *type; 1109 1110 type = __nf_tables_chain_type_lookup(nla, family); 1111 if (type != NULL) 1112 return type; 1113 1114 lockdep_nfnl_nft_mutex_not_held(); 1115 #ifdef CONFIG_MODULES 1116 if (autoload) { 1117 if (nft_request_module(net, "nft-chain-%u-%.*s", family, 1118 nla_len(nla), 1119 (const char *)nla_data(nla)) == -EAGAIN) 1120 return ERR_PTR(-EAGAIN); 1121 } 1122 #endif 1123 return ERR_PTR(-ENOENT); 1124 } 1125 1126 static unsigned int nft_base_seq(const struct net *net) 1127 { 1128 return READ_ONCE(net->nft.base_seq); 1129 } 1130 1131 static __be16 nft_base_seq_be16(const struct net *net) 1132 { 1133 return htons(nft_base_seq(net) & 0xffff); 1134 } 1135 1136 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 1137 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 1138 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1139 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 1140 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, 1141 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY, 1142 .len = NFT_USERDATA_MAXLEN } 1143 }; 1144 1145 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 1146 u32 portid, u32 seq, int event, u32 flags, 1147 int family, const struct nft_table *table) 1148 { 1149 struct nlmsghdr *nlh; 1150 1151 nlh = nfnl_msg_put(skb, portid, seq, 1152 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 1153 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 1154 if (!nlh) 1155 goto nla_put_failure; 1156 1157 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 1158 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || 1159 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), 1160 NFTA_TABLE_PAD)) 1161 goto nla_put_failure; 1162 1163 if (event == NFT_MSG_DELTABLE || 1164 event == NFT_MSG_DESTROYTABLE) { 1165 nlmsg_end(skb, nlh); 1166 return 0; 1167 } 1168 1169 if (nla_put_be32(skb, NFTA_TABLE_FLAGS, 1170 htonl(table->flags & NFT_TABLE_F_MASK))) 1171 goto nla_put_failure; 1172 1173 if (nft_table_has_owner(table) && 1174 nla_put_be32(skb, NFTA_TABLE_OWNER, htonl(table->nlpid))) 1175 goto nla_put_failure; 1176 1177 if (table->udata) { 1178 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata)) 1179 goto nla_put_failure; 1180 } 1181 1182 nlmsg_end(skb, nlh); 1183 return 0; 1184 1185 nla_put_failure: 1186 nlmsg_trim(skb, nlh); 1187 return -1; 1188 } 1189 1190 struct nftnl_skb_parms { 1191 bool report; 1192 }; 1193 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb)) 1194 1195 static void nft_notify_enqueue(struct sk_buff *skb, bool report, 1196 struct list_head *notify_list) 1197 { 1198 NFT_CB(skb).report = report; 1199 list_add_tail(&skb->list, notify_list); 1200 } 1201 1202 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) 1203 { 1204 struct nftables_pernet *nft_net; 1205 struct sk_buff *skb; 1206 u16 flags = 0; 1207 int err; 1208 1209 if (!ctx->report && 1210 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1211 return; 1212 1213 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1214 if (skb == NULL) 1215 goto err; 1216 1217 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 1218 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 1219 1220 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 1221 event, flags, ctx->family, ctx->table); 1222 if (err < 0) { 1223 kfree_skb(skb); 1224 goto err; 1225 } 1226 1227 nft_net = nft_pernet(ctx->net); 1228 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 1229 return; 1230 err: 1231 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1232 } 1233 1234 static int nf_tables_dump_tables(struct sk_buff *skb, 1235 struct netlink_callback *cb) 1236 { 1237 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1238 struct nftables_pernet *nft_net; 1239 const struct nft_table *table; 1240 unsigned int idx = 0, s_idx = cb->args[0]; 1241 struct net *net = sock_net(skb->sk); 1242 int family = nfmsg->nfgen_family; 1243 1244 rcu_read_lock(); 1245 nft_net = nft_pernet(net); 1246 cb->seq = nft_base_seq(net); 1247 1248 list_for_each_entry_rcu(table, &nft_net->tables, list) { 1249 if (family != NFPROTO_UNSPEC && family != table->family) 1250 continue; 1251 1252 if (idx < s_idx) 1253 goto cont; 1254 if (idx > s_idx) 1255 memset(&cb->args[1], 0, 1256 sizeof(cb->args) - sizeof(cb->args[0])); 1257 if (!nft_is_active(net, table)) 1258 continue; 1259 if (nf_tables_fill_table_info(skb, net, 1260 NETLINK_CB(cb->skb).portid, 1261 cb->nlh->nlmsg_seq, 1262 NFT_MSG_NEWTABLE, NLM_F_MULTI, 1263 table->family, table) < 0) 1264 goto done; 1265 1266 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1267 cont: 1268 idx++; 1269 } 1270 done: 1271 rcu_read_unlock(); 1272 cb->args[0] = idx; 1273 return skb->len; 1274 } 1275 1276 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb, 1277 const struct nlmsghdr *nlh, 1278 struct netlink_dump_control *c) 1279 { 1280 int err; 1281 1282 if (!try_module_get(THIS_MODULE)) 1283 return -EINVAL; 1284 1285 rcu_read_unlock(); 1286 err = netlink_dump_start(nlsk, skb, nlh, c); 1287 rcu_read_lock(); 1288 module_put(THIS_MODULE); 1289 1290 return err; 1291 } 1292 1293 /* called with rcu_read_lock held */ 1294 static int nf_tables_gettable(struct sk_buff *skb, const struct nfnl_info *info, 1295 const struct nlattr * const nla[]) 1296 { 1297 struct netlink_ext_ack *extack = info->extack; 1298 u8 genmask = nft_genmask_cur(info->net); 1299 u8 family = info->nfmsg->nfgen_family; 1300 const struct nft_table *table; 1301 struct net *net = info->net; 1302 struct sk_buff *skb2; 1303 int err; 1304 1305 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1306 struct netlink_dump_control c = { 1307 .dump = nf_tables_dump_tables, 1308 .module = THIS_MODULE, 1309 }; 1310 1311 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 1312 } 1313 1314 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask, 0); 1315 if (IS_ERR(table)) { 1316 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]); 1317 return PTR_ERR(table); 1318 } 1319 1320 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 1321 if (!skb2) 1322 return -ENOMEM; 1323 1324 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 1325 info->nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 1326 0, family, table); 1327 if (err < 0) 1328 goto err_fill_table_info; 1329 1330 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 1331 1332 err_fill_table_info: 1333 kfree_skb(skb2); 1334 return err; 1335 } 1336 1337 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) 1338 { 1339 struct nft_chain *chain; 1340 u32 i = 0; 1341 1342 list_for_each_entry(chain, &table->chains, list) { 1343 if (!nft_is_active_next(net, chain)) 1344 continue; 1345 if (!nft_is_base_chain(chain)) 1346 continue; 1347 1348 if (cnt && i++ == cnt) 1349 break; 1350 1351 nf_tables_unregister_hook(net, table, chain); 1352 } 1353 } 1354 1355 static int nf_tables_table_enable(struct net *net, struct nft_table *table) 1356 { 1357 struct nft_chain *chain; 1358 int err, i = 0; 1359 1360 list_for_each_entry(chain, &table->chains, list) { 1361 if (!nft_is_active_next(net, chain)) 1362 continue; 1363 if (!nft_is_base_chain(chain)) 1364 continue; 1365 1366 err = nf_tables_register_hook(net, table, chain); 1367 if (err < 0) 1368 goto err_register_hooks; 1369 1370 i++; 1371 } 1372 return 0; 1373 1374 err_register_hooks: 1375 if (i) 1376 nft_table_disable(net, table, i); 1377 return err; 1378 } 1379 1380 static void nf_tables_table_disable(struct net *net, struct nft_table *table) 1381 { 1382 table->flags &= ~NFT_TABLE_F_DORMANT; 1383 nft_table_disable(net, table, 0); 1384 table->flags |= NFT_TABLE_F_DORMANT; 1385 } 1386 1387 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1) 1388 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0) 1389 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1) 1390 #define __NFT_TABLE_F_WAS_ORPHAN (__NFT_TABLE_F_INTERNAL << 2) 1391 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ 1392 __NFT_TABLE_F_WAS_AWAKEN | \ 1393 __NFT_TABLE_F_WAS_ORPHAN) 1394 1395 static bool nft_table_pending_update(const struct nft_ctx *ctx) 1396 { 1397 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1398 struct nft_trans *trans; 1399 1400 if (ctx->table->flags & __NFT_TABLE_F_UPDATE) 1401 return true; 1402 1403 list_for_each_entry(trans, &nft_net->commit_list, list) { 1404 if (trans->table == ctx->table && 1405 ((trans->msg_type == NFT_MSG_NEWCHAIN && 1406 nft_trans_chain_update(trans)) || 1407 (trans->msg_type == NFT_MSG_DELCHAIN && 1408 nft_is_base_chain(nft_trans_chain(trans))))) 1409 return true; 1410 } 1411 1412 return false; 1413 } 1414 1415 static int nf_tables_updtable(struct nft_ctx *ctx) 1416 { 1417 struct nft_trans *trans; 1418 u32 flags; 1419 int ret; 1420 1421 if (!ctx->nla[NFTA_TABLE_FLAGS]) 1422 return 0; 1423 1424 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 1425 if (flags & ~NFT_TABLE_F_MASK) 1426 return -EOPNOTSUPP; 1427 1428 if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) 1429 return 0; 1430 1431 if ((nft_table_has_owner(ctx->table) && 1432 !(flags & NFT_TABLE_F_OWNER)) || 1433 (flags & NFT_TABLE_F_OWNER && 1434 !nft_table_is_orphan(ctx->table))) 1435 return -EOPNOTSUPP; 1436 1437 if ((flags ^ ctx->table->flags) & NFT_TABLE_F_PERSIST) 1438 return -EOPNOTSUPP; 1439 1440 /* No dormant off/on/off/on games in single transaction */ 1441 if (nft_table_pending_update(ctx)) 1442 return -EINVAL; 1443 1444 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 1445 sizeof(struct nft_trans_table)); 1446 if (trans == NULL) 1447 return -ENOMEM; 1448 1449 if ((flags & NFT_TABLE_F_DORMANT) && 1450 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 1451 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1452 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) 1453 ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN; 1454 } else if (!(flags & NFT_TABLE_F_DORMANT) && 1455 ctx->table->flags & NFT_TABLE_F_DORMANT) { 1456 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 1457 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) { 1458 ret = nf_tables_table_enable(ctx->net, ctx->table); 1459 if (ret < 0) 1460 goto err_register_hooks; 1461 1462 ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT; 1463 } 1464 } 1465 1466 if ((flags & NFT_TABLE_F_OWNER) && 1467 !nft_table_has_owner(ctx->table)) { 1468 ctx->table->nlpid = ctx->portid; 1469 ctx->table->flags |= NFT_TABLE_F_OWNER | 1470 __NFT_TABLE_F_WAS_ORPHAN; 1471 } 1472 1473 nft_trans_table_update(trans) = true; 1474 nft_trans_commit_list_add_tail(ctx->net, trans); 1475 1476 return 0; 1477 1478 err_register_hooks: 1479 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1480 nft_trans_destroy(trans); 1481 return ret; 1482 } 1483 1484 static u32 nft_chain_hash(const void *data, u32 len, u32 seed) 1485 { 1486 const char *name = data; 1487 1488 return jhash(name, strlen(name), seed); 1489 } 1490 1491 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed) 1492 { 1493 const struct nft_chain *chain = data; 1494 1495 return nft_chain_hash(chain->name, 0, seed); 1496 } 1497 1498 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg, 1499 const void *ptr) 1500 { 1501 const struct nft_chain *chain = ptr; 1502 const char *name = arg->key; 1503 1504 return strcmp(chain->name, name); 1505 } 1506 1507 static u32 nft_objname_hash(const void *data, u32 len, u32 seed) 1508 { 1509 const struct nft_object_hash_key *k = data; 1510 1511 seed ^= hash_ptr(k->table, 32); 1512 1513 return jhash(k->name, strlen(k->name), seed); 1514 } 1515 1516 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed) 1517 { 1518 const struct nft_object *obj = data; 1519 1520 return nft_objname_hash(&obj->key, 0, seed); 1521 } 1522 1523 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg, 1524 const void *ptr) 1525 { 1526 const struct nft_object_hash_key *k = arg->key; 1527 const struct nft_object *obj = ptr; 1528 1529 if (obj->key.table != k->table) 1530 return -1; 1531 1532 return strcmp(obj->key.name, k->name); 1533 } 1534 1535 static bool nft_supported_family(u8 family) 1536 { 1537 return false 1538 #ifdef CONFIG_NF_TABLES_INET 1539 || family == NFPROTO_INET 1540 #endif 1541 #ifdef CONFIG_NF_TABLES_IPV4 1542 || family == NFPROTO_IPV4 1543 #endif 1544 #ifdef CONFIG_NF_TABLES_ARP 1545 || family == NFPROTO_ARP 1546 #endif 1547 #ifdef CONFIG_NF_TABLES_NETDEV 1548 || family == NFPROTO_NETDEV 1549 #endif 1550 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) 1551 || family == NFPROTO_BRIDGE 1552 #endif 1553 #ifdef CONFIG_NF_TABLES_IPV6 1554 || family == NFPROTO_IPV6 1555 #endif 1556 ; 1557 } 1558 1559 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 1560 const struct nlattr * const nla[]) 1561 { 1562 struct nftables_pernet *nft_net = nft_pernet(info->net); 1563 struct netlink_ext_ack *extack = info->extack; 1564 u8 genmask = nft_genmask_next(info->net); 1565 u8 family = info->nfmsg->nfgen_family; 1566 struct net *net = info->net; 1567 const struct nlattr *attr; 1568 struct nft_table *table; 1569 struct nft_ctx ctx; 1570 u32 flags = 0; 1571 int err; 1572 1573 if (!nft_supported_family(family)) 1574 return -EOPNOTSUPP; 1575 1576 lockdep_assert_held(&nft_net->commit_mutex); 1577 attr = nla[NFTA_TABLE_NAME]; 1578 table = nft_table_lookup(net, attr, family, genmask, 1579 NETLINK_CB(skb).portid); 1580 if (IS_ERR(table)) { 1581 if (PTR_ERR(table) != -ENOENT) 1582 return PTR_ERR(table); 1583 } else { 1584 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 1585 NL_SET_BAD_ATTR(extack, attr); 1586 return -EEXIST; 1587 } 1588 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 1589 return -EOPNOTSUPP; 1590 1591 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1592 1593 return nf_tables_updtable(&ctx); 1594 } 1595 1596 if (nla[NFTA_TABLE_FLAGS]) { 1597 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 1598 if (flags & ~NFT_TABLE_F_MASK) 1599 return -EOPNOTSUPP; 1600 } 1601 1602 err = -ENOMEM; 1603 table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT); 1604 if (table == NULL) 1605 goto err_kzalloc; 1606 1607 table->validate_state = nft_net->validate_state; 1608 table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); 1609 if (table->name == NULL) 1610 goto err_strdup; 1611 1612 if (nla[NFTA_TABLE_USERDATA]) { 1613 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT); 1614 if (table->udata == NULL) 1615 goto err_table_udata; 1616 1617 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]); 1618 } 1619 1620 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params); 1621 if (err) 1622 goto err_chain_ht; 1623 1624 INIT_LIST_HEAD(&table->chains); 1625 INIT_LIST_HEAD(&table->sets); 1626 INIT_LIST_HEAD(&table->objects); 1627 INIT_LIST_HEAD(&table->flowtables); 1628 table->family = family; 1629 table->flags = flags; 1630 table->handle = ++nft_net->table_handle; 1631 if (table->flags & NFT_TABLE_F_OWNER) 1632 table->nlpid = NETLINK_CB(skb).portid; 1633 1634 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1635 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 1636 if (err < 0) 1637 goto err_trans; 1638 1639 list_add_tail_rcu(&table->list, &nft_net->tables); 1640 return 0; 1641 err_trans: 1642 rhltable_destroy(&table->chains_ht); 1643 err_chain_ht: 1644 kfree(table->udata); 1645 err_table_udata: 1646 kfree(table->name); 1647 err_strdup: 1648 kfree(table); 1649 err_kzalloc: 1650 return err; 1651 } 1652 1653 static int nft_flush_table(struct nft_ctx *ctx) 1654 { 1655 struct nft_flowtable *flowtable, *nft; 1656 struct nft_chain *chain, *nc; 1657 struct nft_object *obj, *ne; 1658 struct nft_set *set, *ns; 1659 int err; 1660 1661 list_for_each_entry(chain, &ctx->table->chains, list) { 1662 if (!nft_is_active_next(ctx->net, chain)) 1663 continue; 1664 1665 if (nft_chain_binding(chain)) 1666 continue; 1667 1668 ctx->chain = chain; 1669 1670 err = nft_delrule_by_chain(ctx); 1671 if (err < 0) 1672 goto out; 1673 } 1674 1675 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 1676 if (!nft_is_active_next(ctx->net, set)) 1677 continue; 1678 1679 if (nft_set_is_anonymous(set)) 1680 continue; 1681 1682 err = nft_delset(ctx, set); 1683 if (err < 0) 1684 goto out; 1685 } 1686 1687 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { 1688 if (!nft_is_active_next(ctx->net, flowtable)) 1689 continue; 1690 1691 err = nft_delflowtable(ctx, flowtable); 1692 if (err < 0) 1693 goto out; 1694 } 1695 1696 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { 1697 if (!nft_is_active_next(ctx->net, obj)) 1698 continue; 1699 1700 err = nft_delobj(ctx, obj); 1701 if (err < 0) 1702 goto out; 1703 } 1704 1705 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 1706 if (!nft_is_active_next(ctx->net, chain)) 1707 continue; 1708 1709 if (nft_chain_binding(chain)) 1710 continue; 1711 1712 ctx->chain = chain; 1713 1714 err = nft_delchain(ctx); 1715 if (err < 0) 1716 goto out; 1717 } 1718 1719 err = nft_deltable(ctx); 1720 out: 1721 return err; 1722 } 1723 1724 static int nft_flush(struct nft_ctx *ctx, int family) 1725 { 1726 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1727 const struct nlattr * const *nla = ctx->nla; 1728 struct nft_table *table, *nt; 1729 int err = 0; 1730 1731 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 1732 if (family != AF_UNSPEC && table->family != family) 1733 continue; 1734 1735 ctx->family = table->family; 1736 1737 if (!nft_is_active_next(ctx->net, table)) 1738 continue; 1739 1740 if (nft_table_has_owner(table) && table->nlpid != ctx->portid) 1741 continue; 1742 1743 if (nla[NFTA_TABLE_NAME] && 1744 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 1745 continue; 1746 1747 ctx->table = table; 1748 1749 err = nft_flush_table(ctx); 1750 if (err < 0) 1751 goto out; 1752 } 1753 out: 1754 return err; 1755 } 1756 1757 static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, 1758 const struct nlattr * const nla[]) 1759 { 1760 struct netlink_ext_ack *extack = info->extack; 1761 u8 genmask = nft_genmask_next(info->net); 1762 u8 family = info->nfmsg->nfgen_family; 1763 struct net *net = info->net; 1764 const struct nlattr *attr; 1765 struct nft_table *table; 1766 struct nft_ctx ctx; 1767 1768 nft_ctx_init(&ctx, net, skb, info->nlh, 0, NULL, NULL, nla); 1769 if (family == AF_UNSPEC || 1770 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) 1771 return nft_flush(&ctx, family); 1772 1773 if (nla[NFTA_TABLE_HANDLE]) { 1774 attr = nla[NFTA_TABLE_HANDLE]; 1775 table = nft_table_lookup_byhandle(net, attr, family, genmask, 1776 NETLINK_CB(skb).portid); 1777 } else { 1778 attr = nla[NFTA_TABLE_NAME]; 1779 table = nft_table_lookup(net, attr, family, genmask, 1780 NETLINK_CB(skb).portid); 1781 } 1782 1783 if (IS_ERR(table)) { 1784 if (PTR_ERR(table) == -ENOENT && 1785 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYTABLE) 1786 return 0; 1787 1788 NL_SET_BAD_ATTR(extack, attr); 1789 return PTR_ERR(table); 1790 } 1791 1792 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 1793 table->use > 0) 1794 return -EBUSY; 1795 1796 ctx.family = family; 1797 ctx.table = table; 1798 1799 return nft_flush_table(&ctx); 1800 } 1801 1802 static void nf_tables_table_destroy(struct nft_table *table) 1803 { 1804 if (WARN_ON(table->use > 0)) 1805 return; 1806 1807 rhltable_destroy(&table->chains_ht); 1808 kfree(table->name); 1809 kfree(table->udata); 1810 kfree(table); 1811 } 1812 1813 void nft_register_chain_type(const struct nft_chain_type *ctype) 1814 { 1815 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1816 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) { 1817 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1818 return; 1819 } 1820 chain_type[ctype->family][ctype->type] = ctype; 1821 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1822 } 1823 EXPORT_SYMBOL_GPL(nft_register_chain_type); 1824 1825 void nft_unregister_chain_type(const struct nft_chain_type *ctype) 1826 { 1827 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1828 chain_type[ctype->family][ctype->type] = NULL; 1829 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1830 } 1831 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 1832 1833 /* 1834 * Chains 1835 */ 1836 1837 static struct nft_chain * 1838 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask) 1839 { 1840 struct nft_chain *chain; 1841 1842 list_for_each_entry(chain, &table->chains, list) { 1843 if (chain->handle == handle && 1844 nft_active_genmask(chain, genmask)) 1845 return chain; 1846 } 1847 1848 return ERR_PTR(-ENOENT); 1849 } 1850 1851 static bool lockdep_commit_lock_is_held(const struct net *net) 1852 { 1853 #ifdef CONFIG_PROVE_LOCKING 1854 struct nftables_pernet *nft_net = nft_pernet(net); 1855 1856 return lockdep_is_held(&nft_net->commit_mutex); 1857 #else 1858 return true; 1859 #endif 1860 } 1861 1862 static struct nft_chain *nft_chain_lookup(struct net *net, 1863 struct nft_table *table, 1864 const struct nlattr *nla, u8 genmask) 1865 { 1866 char search[NFT_CHAIN_MAXNAMELEN + 1]; 1867 struct rhlist_head *tmp, *list; 1868 struct nft_chain *chain; 1869 1870 if (nla == NULL) 1871 return ERR_PTR(-EINVAL); 1872 1873 nla_strscpy(search, nla, sizeof(search)); 1874 1875 WARN_ON(!rcu_read_lock_held() && 1876 !lockdep_commit_lock_is_held(net)); 1877 1878 chain = ERR_PTR(-ENOENT); 1879 rcu_read_lock(); 1880 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params); 1881 if (!list) 1882 goto out_unlock; 1883 1884 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 1885 if (nft_active_genmask(chain, genmask)) 1886 goto out_unlock; 1887 } 1888 chain = ERR_PTR(-ENOENT); 1889 out_unlock: 1890 rcu_read_unlock(); 1891 return chain; 1892 } 1893 1894 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 1895 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING, 1896 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1897 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 1898 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 1899 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1900 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 1901 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 1902 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING, 1903 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 1904 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 1905 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 }, 1906 [NFTA_CHAIN_ID] = { .type = NLA_U32 }, 1907 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY, 1908 .len = NFT_USERDATA_MAXLEN }, 1909 }; 1910 1911 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 1912 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 1913 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 1914 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 1915 .len = IFNAMSIZ - 1 }, 1916 }; 1917 1918 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 1919 { 1920 struct nft_stats *cpu_stats, total; 1921 struct nlattr *nest; 1922 unsigned int seq; 1923 u64 pkts, bytes; 1924 int cpu; 1925 1926 if (!stats) 1927 return 0; 1928 1929 memset(&total, 0, sizeof(total)); 1930 for_each_possible_cpu(cpu) { 1931 cpu_stats = per_cpu_ptr(stats, cpu); 1932 do { 1933 seq = u64_stats_fetch_begin(&cpu_stats->syncp); 1934 pkts = cpu_stats->pkts; 1935 bytes = cpu_stats->bytes; 1936 } while (u64_stats_fetch_retry(&cpu_stats->syncp, seq)); 1937 total.pkts += pkts; 1938 total.bytes += bytes; 1939 } 1940 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS); 1941 if (nest == NULL) 1942 goto nla_put_failure; 1943 1944 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts), 1945 NFTA_COUNTER_PAD) || 1946 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 1947 NFTA_COUNTER_PAD)) 1948 goto nla_put_failure; 1949 1950 nla_nest_end(skb, nest); 1951 return 0; 1952 1953 nla_put_failure: 1954 return -ENOSPC; 1955 } 1956 1957 static bool hook_is_prefix(struct nft_hook *hook) 1958 { 1959 return strlen(hook->ifname) >= hook->ifnamelen; 1960 } 1961 1962 static int nft_nla_put_hook_dev(struct sk_buff *skb, struct nft_hook *hook) 1963 { 1964 int attr = hook_is_prefix(hook) ? NFTA_DEVICE_PREFIX : NFTA_DEVICE_NAME; 1965 1966 return nla_put_string(skb, attr, hook->ifname); 1967 } 1968 1969 static int nft_dump_basechain_hook(struct sk_buff *skb, 1970 const struct net *net, int family, 1971 const struct nft_base_chain *basechain, 1972 const struct list_head *hook_list) 1973 { 1974 const struct nf_hook_ops *ops = &basechain->ops; 1975 struct nft_hook *hook, *first = NULL; 1976 struct nlattr *nest, *nest_devs; 1977 int n = 0; 1978 1979 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK); 1980 if (nest == NULL) 1981 goto nla_put_failure; 1982 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 1983 goto nla_put_failure; 1984 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 1985 goto nla_put_failure; 1986 1987 if (nft_base_chain_netdev(family, ops->hooknum)) { 1988 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS); 1989 if (!nest_devs) 1990 goto nla_put_failure; 1991 1992 if (!hook_list) 1993 hook_list = &basechain->hook_list; 1994 1995 list_for_each_entry_rcu(hook, hook_list, list, 1996 lockdep_commit_lock_is_held(net)) { 1997 if (!first) 1998 first = hook; 1999 2000 if (nft_nla_put_hook_dev(skb, hook)) 2001 goto nla_put_failure; 2002 n++; 2003 } 2004 nla_nest_end(skb, nest_devs); 2005 2006 if (n == 1 && 2007 !hook_is_prefix(first) && 2008 nla_put_string(skb, NFTA_HOOK_DEV, first->ifname)) 2009 goto nla_put_failure; 2010 } 2011 nla_nest_end(skb, nest); 2012 2013 return 0; 2014 nla_put_failure: 2015 return -1; 2016 } 2017 2018 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 2019 u32 portid, u32 seq, int event, u32 flags, 2020 int family, const struct nft_table *table, 2021 const struct nft_chain *chain, 2022 const struct list_head *hook_list) 2023 { 2024 struct nlmsghdr *nlh; 2025 2026 nlh = nfnl_msg_put(skb, portid, seq, 2027 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 2028 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 2029 if (!nlh) 2030 goto nla_put_failure; 2031 2032 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name) || 2033 nla_put_string(skb, NFTA_CHAIN_NAME, chain->name) || 2034 nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), 2035 NFTA_CHAIN_PAD)) 2036 goto nla_put_failure; 2037 2038 if (!hook_list && 2039 (event == NFT_MSG_DELCHAIN || 2040 event == NFT_MSG_DESTROYCHAIN)) { 2041 nlmsg_end(skb, nlh); 2042 return 0; 2043 } 2044 2045 if (nft_is_base_chain(chain)) { 2046 const struct nft_base_chain *basechain = nft_base_chain(chain); 2047 struct nft_stats __percpu *stats; 2048 2049 if (nft_dump_basechain_hook(skb, net, family, basechain, hook_list)) 2050 goto nla_put_failure; 2051 2052 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 2053 htonl(basechain->policy))) 2054 goto nla_put_failure; 2055 2056 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 2057 goto nla_put_failure; 2058 2059 stats = rcu_dereference_check(basechain->stats, 2060 lockdep_commit_lock_is_held(net)); 2061 if (nft_dump_stats(skb, stats)) 2062 goto nla_put_failure; 2063 } 2064 2065 if (chain->flags && 2066 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags))) 2067 goto nla_put_failure; 2068 2069 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 2070 goto nla_put_failure; 2071 2072 if (chain->udata && 2073 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata)) 2074 goto nla_put_failure; 2075 2076 nlmsg_end(skb, nlh); 2077 return 0; 2078 2079 nla_put_failure: 2080 nlmsg_trim(skb, nlh); 2081 return -1; 2082 } 2083 2084 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, 2085 const struct list_head *hook_list) 2086 { 2087 struct nftables_pernet *nft_net; 2088 struct sk_buff *skb; 2089 u16 flags = 0; 2090 int err; 2091 2092 if (!ctx->report && 2093 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 2094 return; 2095 2096 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 2097 if (skb == NULL) 2098 goto err; 2099 2100 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 2101 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 2102 2103 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 2104 event, flags, ctx->family, ctx->table, 2105 ctx->chain, hook_list); 2106 if (err < 0) { 2107 kfree_skb(skb); 2108 goto err; 2109 } 2110 2111 nft_net = nft_pernet(ctx->net); 2112 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 2113 return; 2114 err: 2115 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 2116 } 2117 2118 static int nf_tables_dump_chains(struct sk_buff *skb, 2119 struct netlink_callback *cb) 2120 { 2121 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 2122 unsigned int idx = 0, s_idx = cb->args[0]; 2123 struct net *net = sock_net(skb->sk); 2124 int family = nfmsg->nfgen_family; 2125 struct nftables_pernet *nft_net; 2126 const struct nft_table *table; 2127 const struct nft_chain *chain; 2128 2129 rcu_read_lock(); 2130 nft_net = nft_pernet(net); 2131 cb->seq = nft_base_seq(net); 2132 2133 list_for_each_entry_rcu(table, &nft_net->tables, list) { 2134 if (family != NFPROTO_UNSPEC && family != table->family) 2135 continue; 2136 2137 list_for_each_entry_rcu(chain, &table->chains, list) { 2138 if (idx < s_idx) 2139 goto cont; 2140 if (idx > s_idx) 2141 memset(&cb->args[1], 0, 2142 sizeof(cb->args) - sizeof(cb->args[0])); 2143 if (!nft_is_active(net, chain)) 2144 continue; 2145 if (nf_tables_fill_chain_info(skb, net, 2146 NETLINK_CB(cb->skb).portid, 2147 cb->nlh->nlmsg_seq, 2148 NFT_MSG_NEWCHAIN, 2149 NLM_F_MULTI, 2150 table->family, table, 2151 chain, NULL) < 0) 2152 goto done; 2153 2154 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 2155 cont: 2156 idx++; 2157 } 2158 } 2159 done: 2160 rcu_read_unlock(); 2161 cb->args[0] = idx; 2162 return skb->len; 2163 } 2164 2165 /* called with rcu_read_lock held */ 2166 static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, 2167 const struct nlattr * const nla[]) 2168 { 2169 struct netlink_ext_ack *extack = info->extack; 2170 u8 genmask = nft_genmask_cur(info->net); 2171 u8 family = info->nfmsg->nfgen_family; 2172 const struct nft_chain *chain; 2173 struct net *net = info->net; 2174 struct nft_table *table; 2175 struct sk_buff *skb2; 2176 int err; 2177 2178 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 2179 struct netlink_dump_control c = { 2180 .dump = nf_tables_dump_chains, 2181 .module = THIS_MODULE, 2182 }; 2183 2184 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 2185 } 2186 2187 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 0); 2188 if (IS_ERR(table)) { 2189 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2190 return PTR_ERR(table); 2191 } 2192 2193 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask); 2194 if (IS_ERR(chain)) { 2195 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2196 return PTR_ERR(chain); 2197 } 2198 2199 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 2200 if (!skb2) 2201 return -ENOMEM; 2202 2203 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 2204 info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 2205 0, family, table, chain, NULL); 2206 if (err < 0) 2207 goto err_fill_chain_info; 2208 2209 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 2210 2211 err_fill_chain_info: 2212 kfree_skb(skb2); 2213 return err; 2214 } 2215 2216 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 2217 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 2218 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 2219 }; 2220 2221 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 2222 { 2223 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 2224 struct nft_stats __percpu *newstats; 2225 struct nft_stats *stats; 2226 int err; 2227 2228 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr, 2229 nft_counter_policy, NULL); 2230 if (err < 0) 2231 return ERR_PTR_PCPU(err); 2232 2233 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 2234 return ERR_PTR_PCPU(-EINVAL); 2235 2236 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 2237 if (newstats == NULL) 2238 return ERR_PTR_PCPU(-ENOMEM); 2239 2240 /* Restore old counters on this cpu, no problem. Per-cpu statistics 2241 * are not exposed to userspace. 2242 */ 2243 preempt_disable(); 2244 stats = this_cpu_ptr(newstats); 2245 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 2246 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 2247 preempt_enable(); 2248 2249 return newstats; 2250 } 2251 2252 static void nft_chain_stats_replace(struct nft_trans_chain *trans) 2253 { 2254 const struct nft_trans *t = &trans->nft_trans_binding.nft_trans; 2255 struct nft_base_chain *chain = nft_base_chain(trans->chain); 2256 2257 if (!trans->stats) 2258 return; 2259 2260 trans->stats = 2261 rcu_replace_pointer(chain->stats, trans->stats, 2262 lockdep_commit_lock_is_held(t->net)); 2263 2264 if (!trans->stats) 2265 static_branch_inc(&nft_counters_enabled); 2266 } 2267 2268 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) 2269 { 2270 struct nft_rule_blob *g0 = rcu_dereference_raw(chain->blob_gen_0); 2271 struct nft_rule_blob *g1 = rcu_dereference_raw(chain->blob_gen_1); 2272 2273 if (g0 != g1) 2274 kvfree(g1); 2275 kvfree(g0); 2276 2277 /* should be NULL either via abort or via successful commit */ 2278 WARN_ON_ONCE(chain->blob_next); 2279 kvfree(chain->blob_next); 2280 } 2281 2282 void nf_tables_chain_destroy(struct nft_chain *chain) 2283 { 2284 const struct nft_table *table = chain->table; 2285 struct nft_hook *hook, *next; 2286 2287 if (WARN_ON(chain->use > 0)) 2288 return; 2289 2290 /* no concurrent access possible anymore */ 2291 nf_tables_chain_free_chain_rules(chain); 2292 2293 if (nft_is_base_chain(chain)) { 2294 struct nft_base_chain *basechain = nft_base_chain(chain); 2295 2296 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { 2297 list_for_each_entry_safe(hook, next, 2298 &basechain->hook_list, list) { 2299 list_del_rcu(&hook->list); 2300 nft_netdev_hook_free_rcu(hook); 2301 } 2302 } 2303 module_put(basechain->type->owner); 2304 if (rcu_access_pointer(basechain->stats)) { 2305 static_branch_dec(&nft_counters_enabled); 2306 free_percpu(rcu_dereference_raw(basechain->stats)); 2307 } 2308 kfree(chain->name); 2309 kfree(chain->udata); 2310 kfree(basechain); 2311 } else { 2312 kfree(chain->name); 2313 kfree(chain->udata); 2314 kfree(chain); 2315 } 2316 } 2317 2318 static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 2319 const struct nlattr *attr, 2320 bool prefix) 2321 { 2322 struct nf_hook_ops *ops; 2323 struct net_device *dev; 2324 struct nft_hook *hook; 2325 int err; 2326 2327 hook = kzalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT); 2328 if (!hook) 2329 return ERR_PTR(-ENOMEM); 2330 2331 INIT_LIST_HEAD(&hook->ops_list); 2332 2333 err = nla_strscpy(hook->ifname, attr, IFNAMSIZ); 2334 if (err < 0) 2335 goto err_hook_free; 2336 2337 /* include the terminating NUL-char when comparing non-prefixes */ 2338 hook->ifnamelen = strlen(hook->ifname) + !prefix; 2339 2340 /* nf_tables_netdev_event() is called under rtnl_mutex, this is 2341 * indirectly serializing all the other holders of the commit_mutex with 2342 * the rtnl_mutex. 2343 */ 2344 for_each_netdev(net, dev) { 2345 if (strncmp(dev->name, hook->ifname, hook->ifnamelen)) 2346 continue; 2347 2348 ops = kzalloc(sizeof(struct nf_hook_ops), GFP_KERNEL_ACCOUNT); 2349 if (!ops) { 2350 err = -ENOMEM; 2351 goto err_hook_free; 2352 } 2353 ops->dev = dev; 2354 list_add_tail(&ops->list, &hook->ops_list); 2355 } 2356 return hook; 2357 2358 err_hook_free: 2359 nft_netdev_hook_free(hook); 2360 return ERR_PTR(err); 2361 } 2362 2363 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, 2364 const struct nft_hook *this) 2365 { 2366 struct nft_hook *hook; 2367 2368 list_for_each_entry(hook, hook_list, list) { 2369 if (!strncmp(hook->ifname, this->ifname, 2370 min(hook->ifnamelen, this->ifnamelen))) 2371 return hook; 2372 } 2373 2374 return NULL; 2375 } 2376 2377 static int nf_tables_parse_netdev_hooks(struct net *net, 2378 const struct nlattr *attr, 2379 struct list_head *hook_list, 2380 struct netlink_ext_ack *extack) 2381 { 2382 struct nft_hook *hook, *next; 2383 const struct nlattr *tmp; 2384 int rem, n = 0, err; 2385 bool prefix; 2386 2387 nla_for_each_nested(tmp, attr, rem) { 2388 switch (nla_type(tmp)) { 2389 case NFTA_DEVICE_NAME: 2390 prefix = false; 2391 break; 2392 case NFTA_DEVICE_PREFIX: 2393 prefix = true; 2394 break; 2395 default: 2396 err = -EINVAL; 2397 goto err_hook; 2398 } 2399 2400 hook = nft_netdev_hook_alloc(net, tmp, prefix); 2401 if (IS_ERR(hook)) { 2402 NL_SET_BAD_ATTR(extack, tmp); 2403 err = PTR_ERR(hook); 2404 goto err_hook; 2405 } 2406 if (nft_hook_list_find(hook_list, hook)) { 2407 NL_SET_BAD_ATTR(extack, tmp); 2408 nft_netdev_hook_free(hook); 2409 err = -EEXIST; 2410 goto err_hook; 2411 } 2412 list_add_tail(&hook->list, hook_list); 2413 n++; 2414 2415 if (n == NFT_NETDEVICE_MAX) { 2416 err = -EFBIG; 2417 goto err_hook; 2418 } 2419 } 2420 2421 return 0; 2422 2423 err_hook: 2424 list_for_each_entry_safe(hook, next, hook_list, list) { 2425 list_del(&hook->list); 2426 nft_netdev_hook_free(hook); 2427 } 2428 return err; 2429 } 2430 2431 struct nft_chain_hook { 2432 u32 num; 2433 s32 priority; 2434 const struct nft_chain_type *type; 2435 struct list_head list; 2436 }; 2437 2438 static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[], 2439 struct list_head *hook_list, 2440 struct netlink_ext_ack *extack, u32 flags) 2441 { 2442 struct nft_hook *hook; 2443 int err; 2444 2445 if (tb[NFTA_HOOK_DEV]) { 2446 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV], false); 2447 if (IS_ERR(hook)) { 2448 NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]); 2449 return PTR_ERR(hook); 2450 } 2451 2452 list_add_tail(&hook->list, hook_list); 2453 } else if (tb[NFTA_HOOK_DEVS]) { 2454 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS], 2455 hook_list, extack); 2456 if (err < 0) 2457 return err; 2458 2459 } 2460 2461 if (flags & NFT_CHAIN_HW_OFFLOAD && 2462 list_empty(hook_list)) 2463 return -EINVAL; 2464 2465 return 0; 2466 } 2467 2468 static int nft_chain_parse_hook(struct net *net, 2469 struct nft_base_chain *basechain, 2470 const struct nlattr * const nla[], 2471 struct nft_chain_hook *hook, u8 family, 2472 u32 flags, struct netlink_ext_ack *extack) 2473 { 2474 struct nftables_pernet *nft_net = nft_pernet(net); 2475 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 2476 const struct nft_chain_type *type; 2477 int err; 2478 2479 lockdep_assert_held(&nft_net->commit_mutex); 2480 lockdep_nfnl_nft_mutex_not_held(); 2481 2482 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX, 2483 nla[NFTA_CHAIN_HOOK], 2484 nft_hook_policy, NULL); 2485 if (err < 0) 2486 return err; 2487 2488 if (!basechain) { 2489 if (!ha[NFTA_HOOK_HOOKNUM] || 2490 !ha[NFTA_HOOK_PRIORITY]) { 2491 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2492 return -ENOENT; 2493 } 2494 2495 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2496 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2497 2498 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT); 2499 if (!type) 2500 return -EOPNOTSUPP; 2501 2502 if (nla[NFTA_CHAIN_TYPE]) { 2503 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE], 2504 family, true); 2505 if (IS_ERR(type)) { 2506 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2507 return PTR_ERR(type); 2508 } 2509 } 2510 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num))) 2511 return -EOPNOTSUPP; 2512 2513 if (type->type == NFT_CHAIN_T_NAT && 2514 hook->priority <= NF_IP_PRI_CONNTRACK) 2515 return -EOPNOTSUPP; 2516 } else { 2517 if (ha[NFTA_HOOK_HOOKNUM]) { 2518 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2519 if (hook->num != basechain->ops.hooknum) 2520 return -EOPNOTSUPP; 2521 } 2522 if (ha[NFTA_HOOK_PRIORITY]) { 2523 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2524 if (hook->priority != basechain->ops.priority) 2525 return -EOPNOTSUPP; 2526 } 2527 2528 if (nla[NFTA_CHAIN_TYPE]) { 2529 type = __nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE], 2530 family); 2531 if (!type) { 2532 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2533 return -ENOENT; 2534 } 2535 } else { 2536 type = basechain->type; 2537 } 2538 } 2539 2540 if (!try_module_get(type->owner)) { 2541 if (nla[NFTA_CHAIN_TYPE]) 2542 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2543 return -ENOENT; 2544 } 2545 2546 hook->type = type; 2547 2548 INIT_LIST_HEAD(&hook->list); 2549 if (nft_base_chain_netdev(family, hook->num)) { 2550 err = nft_chain_parse_netdev(net, ha, &hook->list, extack, flags); 2551 if (err < 0) { 2552 module_put(type->owner); 2553 return err; 2554 } 2555 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) { 2556 module_put(type->owner); 2557 return -EOPNOTSUPP; 2558 } 2559 2560 return 0; 2561 } 2562 2563 static void nft_chain_release_hook(struct nft_chain_hook *hook) 2564 { 2565 struct nft_hook *h, *next; 2566 2567 list_for_each_entry_safe(h, next, &hook->list, list) { 2568 list_del(&h->list); 2569 nft_netdev_hook_free(h); 2570 } 2571 module_put(hook->type->owner); 2572 } 2573 2574 static void nft_last_rule(const struct nft_chain *chain, const void *ptr) 2575 { 2576 struct nft_rule_dp_last *lrule; 2577 2578 BUILD_BUG_ON(offsetof(struct nft_rule_dp_last, end) != 0); 2579 2580 lrule = (struct nft_rule_dp_last *)ptr; 2581 lrule->end.is_last = 1; 2582 lrule->chain = chain; 2583 /* blob size does not include the trailer rule */ 2584 } 2585 2586 static struct nft_rule_blob *nf_tables_chain_alloc_rules(const struct nft_chain *chain, 2587 unsigned int size) 2588 { 2589 struct nft_rule_blob *blob; 2590 2591 if (size > INT_MAX) 2592 return NULL; 2593 2594 size += sizeof(struct nft_rule_blob) + sizeof(struct nft_rule_dp_last); 2595 2596 blob = kvmalloc(size, GFP_KERNEL_ACCOUNT); 2597 if (!blob) 2598 return NULL; 2599 2600 blob->size = 0; 2601 nft_last_rule(chain, blob->data); 2602 2603 return blob; 2604 } 2605 2606 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family, 2607 const struct nft_chain_hook *hook, 2608 struct nft_chain *chain) 2609 { 2610 ops->pf = family; 2611 ops->hooknum = hook->num; 2612 ops->priority = hook->priority; 2613 ops->priv = chain; 2614 ops->hook = hook->type->hooks[ops->hooknum]; 2615 ops->hook_ops_type = NF_HOOK_OP_NF_TABLES; 2616 } 2617 2618 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, 2619 struct nft_chain_hook *hook, u32 flags) 2620 { 2621 struct nft_chain *chain; 2622 struct nf_hook_ops *ops; 2623 struct nft_hook *h; 2624 2625 basechain->type = hook->type; 2626 INIT_LIST_HEAD(&basechain->hook_list); 2627 chain = &basechain->chain; 2628 2629 if (nft_base_chain_netdev(family, hook->num)) { 2630 list_splice_init(&hook->list, &basechain->hook_list); 2631 list_for_each_entry(h, &basechain->hook_list, list) { 2632 list_for_each_entry(ops, &h->ops_list, list) 2633 nft_basechain_hook_init(ops, family, hook, chain); 2634 } 2635 } 2636 nft_basechain_hook_init(&basechain->ops, family, hook, chain); 2637 2638 chain->flags |= NFT_CHAIN_BASE | flags; 2639 basechain->policy = NF_ACCEPT; 2640 if (chain->flags & NFT_CHAIN_HW_OFFLOAD && 2641 !nft_chain_offload_support(basechain)) { 2642 list_splice_init(&basechain->hook_list, &hook->list); 2643 return -EOPNOTSUPP; 2644 } 2645 2646 flow_block_init(&basechain->flow_block); 2647 2648 return 0; 2649 } 2650 2651 int nft_chain_add(struct nft_table *table, struct nft_chain *chain) 2652 { 2653 int err; 2654 2655 err = rhltable_insert_key(&table->chains_ht, chain->name, 2656 &chain->rhlhead, nft_chain_ht_params); 2657 if (err) 2658 return err; 2659 2660 list_add_tail_rcu(&chain->list, &table->chains); 2661 2662 return 0; 2663 } 2664 2665 static u64 chain_id; 2666 2667 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 policy, 2668 u32 flags, struct netlink_ext_ack *extack) 2669 { 2670 const struct nlattr * const *nla = ctx->nla; 2671 struct nft_table *table = ctx->table; 2672 struct nft_base_chain *basechain; 2673 struct net *net = ctx->net; 2674 char name[NFT_NAME_MAXLEN]; 2675 struct nft_rule_blob *blob; 2676 struct nft_trans *trans; 2677 struct nft_chain *chain; 2678 int err; 2679 2680 if (nla[NFTA_CHAIN_HOOK]) { 2681 struct nft_stats __percpu *stats = NULL; 2682 struct nft_chain_hook hook = {}; 2683 2684 if (table->flags & __NFT_TABLE_F_UPDATE) 2685 return -EINVAL; 2686 2687 if (flags & NFT_CHAIN_BINDING) 2688 return -EOPNOTSUPP; 2689 2690 err = nft_chain_parse_hook(net, NULL, nla, &hook, family, flags, 2691 extack); 2692 if (err < 0) 2693 return err; 2694 2695 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT); 2696 if (basechain == NULL) { 2697 nft_chain_release_hook(&hook); 2698 return -ENOMEM; 2699 } 2700 chain = &basechain->chain; 2701 2702 if (nla[NFTA_CHAIN_COUNTERS]) { 2703 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2704 if (IS_ERR_PCPU(stats)) { 2705 nft_chain_release_hook(&hook); 2706 kfree(basechain); 2707 return PTR_ERR_PCPU(stats); 2708 } 2709 rcu_assign_pointer(basechain->stats, stats); 2710 } 2711 2712 err = nft_basechain_init(basechain, family, &hook, flags); 2713 if (err < 0) { 2714 nft_chain_release_hook(&hook); 2715 kfree(basechain); 2716 free_percpu(stats); 2717 return err; 2718 } 2719 if (stats) 2720 static_branch_inc(&nft_counters_enabled); 2721 } else { 2722 if (flags & NFT_CHAIN_BASE) 2723 return -EINVAL; 2724 if (flags & NFT_CHAIN_HW_OFFLOAD) 2725 return -EOPNOTSUPP; 2726 2727 chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT); 2728 if (chain == NULL) 2729 return -ENOMEM; 2730 2731 chain->flags = flags; 2732 } 2733 ctx->chain = chain; 2734 2735 INIT_LIST_HEAD(&chain->rules); 2736 chain->handle = nf_tables_alloc_handle(table); 2737 chain->table = table; 2738 2739 if (nla[NFTA_CHAIN_NAME]) { 2740 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2741 } else { 2742 if (!(flags & NFT_CHAIN_BINDING)) { 2743 err = -EINVAL; 2744 goto err_destroy_chain; 2745 } 2746 2747 snprintf(name, sizeof(name), "__chain%llu", ++chain_id); 2748 chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT); 2749 } 2750 2751 if (!chain->name) { 2752 err = -ENOMEM; 2753 goto err_destroy_chain; 2754 } 2755 2756 if (nla[NFTA_CHAIN_USERDATA]) { 2757 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT); 2758 if (chain->udata == NULL) { 2759 err = -ENOMEM; 2760 goto err_destroy_chain; 2761 } 2762 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]); 2763 } 2764 2765 blob = nf_tables_chain_alloc_rules(chain, 0); 2766 if (!blob) { 2767 err = -ENOMEM; 2768 goto err_destroy_chain; 2769 } 2770 2771 RCU_INIT_POINTER(chain->blob_gen_0, blob); 2772 RCU_INIT_POINTER(chain->blob_gen_1, blob); 2773 2774 if (!nft_use_inc(&table->use)) { 2775 err = -EMFILE; 2776 goto err_destroy_chain; 2777 } 2778 2779 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN); 2780 if (IS_ERR(trans)) { 2781 err = PTR_ERR(trans); 2782 goto err_trans; 2783 } 2784 2785 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET; 2786 if (nft_is_base_chain(chain)) 2787 nft_trans_chain_policy(trans) = policy; 2788 2789 err = nft_chain_add(table, chain); 2790 if (err < 0) 2791 goto err_chain_add; 2792 2793 /* This must be LAST to ensure no packets are walking over this chain. */ 2794 err = nf_tables_register_hook(net, table, chain); 2795 if (err < 0) 2796 goto err_register_hook; 2797 2798 return 0; 2799 2800 err_register_hook: 2801 nft_chain_del(chain); 2802 err_chain_add: 2803 nft_trans_destroy(trans); 2804 err_trans: 2805 nft_use_dec_restore(&table->use); 2806 err_destroy_chain: 2807 nf_tables_chain_destroy(chain); 2808 2809 return err; 2810 } 2811 2812 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 2813 u32 flags, const struct nlattr *attr, 2814 struct netlink_ext_ack *extack) 2815 { 2816 const struct nlattr * const *nla = ctx->nla; 2817 struct nft_base_chain *basechain = NULL; 2818 struct nft_table *table = ctx->table; 2819 struct nft_chain *chain = ctx->chain; 2820 struct nft_chain_hook hook = {}; 2821 struct nft_stats __percpu *stats = NULL; 2822 struct nftables_pernet *nft_net; 2823 struct nft_hook *h, *next; 2824 struct nf_hook_ops *ops; 2825 struct nft_trans *trans; 2826 bool unregister = false; 2827 int err; 2828 2829 if (chain->flags ^ flags) 2830 return -EOPNOTSUPP; 2831 2832 INIT_LIST_HEAD(&hook.list); 2833 2834 if (nla[NFTA_CHAIN_HOOK]) { 2835 if (!nft_is_base_chain(chain)) { 2836 NL_SET_BAD_ATTR(extack, attr); 2837 return -EEXIST; 2838 } 2839 2840 basechain = nft_base_chain(chain); 2841 err = nft_chain_parse_hook(ctx->net, basechain, nla, &hook, 2842 ctx->family, flags, extack); 2843 if (err < 0) 2844 return err; 2845 2846 if (basechain->type != hook.type) { 2847 nft_chain_release_hook(&hook); 2848 NL_SET_BAD_ATTR(extack, attr); 2849 return -EEXIST; 2850 } 2851 2852 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 2853 list_for_each_entry_safe(h, next, &hook.list, list) { 2854 list_for_each_entry(ops, &h->ops_list, list) { 2855 ops->pf = basechain->ops.pf; 2856 ops->hooknum = basechain->ops.hooknum; 2857 ops->priority = basechain->ops.priority; 2858 ops->priv = basechain->ops.priv; 2859 ops->hook = basechain->ops.hook; 2860 } 2861 2862 if (nft_hook_list_find(&basechain->hook_list, h)) { 2863 list_del(&h->list); 2864 nft_netdev_hook_free(h); 2865 continue; 2866 } 2867 2868 nft_net = nft_pernet(ctx->net); 2869 list_for_each_entry(trans, &nft_net->commit_list, list) { 2870 if (trans->msg_type != NFT_MSG_NEWCHAIN || 2871 trans->table != ctx->table || 2872 !nft_trans_chain_update(trans)) 2873 continue; 2874 2875 if (nft_hook_list_find(&nft_trans_chain_hooks(trans), h)) { 2876 nft_chain_release_hook(&hook); 2877 return -EEXIST; 2878 } 2879 } 2880 } 2881 } else { 2882 ops = &basechain->ops; 2883 if (ops->hooknum != hook.num || 2884 ops->priority != hook.priority) { 2885 nft_chain_release_hook(&hook); 2886 NL_SET_BAD_ATTR(extack, attr); 2887 return -EEXIST; 2888 } 2889 } 2890 } 2891 2892 if (nla[NFTA_CHAIN_HANDLE] && 2893 nla[NFTA_CHAIN_NAME]) { 2894 struct nft_chain *chain2; 2895 2896 chain2 = nft_chain_lookup(ctx->net, table, 2897 nla[NFTA_CHAIN_NAME], genmask); 2898 if (!IS_ERR(chain2)) { 2899 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2900 err = -EEXIST; 2901 goto err_hooks; 2902 } 2903 } 2904 2905 if (table->flags & __NFT_TABLE_F_UPDATE && 2906 !list_empty(&hook.list)) { 2907 NL_SET_BAD_ATTR(extack, attr); 2908 err = -EOPNOTSUPP; 2909 goto err_hooks; 2910 } 2911 2912 if (!(table->flags & NFT_TABLE_F_DORMANT) && 2913 nft_is_base_chain(chain) && 2914 !list_empty(&hook.list)) { 2915 basechain = nft_base_chain(chain); 2916 ops = &basechain->ops; 2917 2918 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { 2919 err = nft_netdev_register_hooks(ctx->net, &hook.list); 2920 if (err < 0) 2921 goto err_hooks; 2922 2923 unregister = true; 2924 } 2925 } 2926 2927 if (nla[NFTA_CHAIN_COUNTERS]) { 2928 if (!nft_is_base_chain(chain)) { 2929 err = -EOPNOTSUPP; 2930 goto err_hooks; 2931 } 2932 2933 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2934 if (IS_ERR_PCPU(stats)) { 2935 err = PTR_ERR_PCPU(stats); 2936 goto err_hooks; 2937 } 2938 } 2939 2940 err = -ENOMEM; 2941 trans = nft_trans_alloc_chain(ctx, NFT_MSG_NEWCHAIN); 2942 if (trans == NULL) 2943 goto err_trans; 2944 2945 nft_trans_chain_stats(trans) = stats; 2946 nft_trans_chain_update(trans) = true; 2947 2948 if (nla[NFTA_CHAIN_POLICY]) 2949 nft_trans_chain_policy(trans) = policy; 2950 else 2951 nft_trans_chain_policy(trans) = -1; 2952 2953 if (nla[NFTA_CHAIN_HANDLE] && 2954 nla[NFTA_CHAIN_NAME]) { 2955 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 2956 struct nft_trans *tmp; 2957 char *name; 2958 2959 err = -ENOMEM; 2960 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2961 if (!name) 2962 goto err_trans; 2963 2964 err = -EEXIST; 2965 list_for_each_entry(tmp, &nft_net->commit_list, list) { 2966 if (tmp->msg_type == NFT_MSG_NEWCHAIN && 2967 tmp->table == table && 2968 nft_trans_chain_update(tmp) && 2969 nft_trans_chain_name(tmp) && 2970 strcmp(name, nft_trans_chain_name(tmp)) == 0) { 2971 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2972 kfree(name); 2973 goto err_trans; 2974 } 2975 } 2976 2977 nft_trans_chain_name(trans) = name; 2978 } 2979 2980 nft_trans_basechain(trans) = basechain; 2981 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 2982 list_splice(&hook.list, &nft_trans_chain_hooks(trans)); 2983 if (nla[NFTA_CHAIN_HOOK]) 2984 module_put(hook.type->owner); 2985 2986 nft_trans_commit_list_add_tail(ctx->net, trans); 2987 2988 return 0; 2989 2990 err_trans: 2991 free_percpu(stats); 2992 kfree(trans); 2993 err_hooks: 2994 if (nla[NFTA_CHAIN_HOOK]) { 2995 list_for_each_entry_safe(h, next, &hook.list, list) { 2996 if (unregister) { 2997 list_for_each_entry(ops, &h->ops_list, list) 2998 nf_unregister_net_hook(ctx->net, ops); 2999 } 3000 list_del(&h->list); 3001 nft_netdev_hook_free_rcu(h); 3002 } 3003 module_put(hook.type->owner); 3004 } 3005 3006 return err; 3007 } 3008 3009 static struct nft_chain *nft_chain_lookup_byid(const struct net *net, 3010 const struct nft_table *table, 3011 const struct nlattr *nla, u8 genmask) 3012 { 3013 struct nftables_pernet *nft_net = nft_pernet(net); 3014 u32 id = ntohl(nla_get_be32(nla)); 3015 struct nft_trans *trans; 3016 3017 list_for_each_entry(trans, &nft_net->commit_list, list) { 3018 if (trans->msg_type == NFT_MSG_NEWCHAIN && 3019 nft_trans_chain(trans)->table == table && 3020 id == nft_trans_chain_id(trans) && 3021 nft_active_genmask(nft_trans_chain(trans), genmask)) 3022 return nft_trans_chain(trans); 3023 } 3024 return ERR_PTR(-ENOENT); 3025 } 3026 3027 static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, 3028 const struct nlattr * const nla[]) 3029 { 3030 struct nftables_pernet *nft_net = nft_pernet(info->net); 3031 struct netlink_ext_ack *extack = info->extack; 3032 u8 genmask = nft_genmask_next(info->net); 3033 u8 family = info->nfmsg->nfgen_family; 3034 struct nft_chain *chain = NULL; 3035 struct net *net = info->net; 3036 const struct nlattr *attr; 3037 struct nft_table *table; 3038 u8 policy = NF_ACCEPT; 3039 struct nft_ctx ctx; 3040 u64 handle = 0; 3041 u32 flags = 0; 3042 3043 lockdep_assert_held(&nft_net->commit_mutex); 3044 3045 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 3046 NETLINK_CB(skb).portid); 3047 if (IS_ERR(table)) { 3048 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 3049 return PTR_ERR(table); 3050 } 3051 3052 chain = NULL; 3053 attr = nla[NFTA_CHAIN_NAME]; 3054 3055 if (nla[NFTA_CHAIN_HANDLE]) { 3056 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 3057 chain = nft_chain_lookup_byhandle(table, handle, genmask); 3058 if (IS_ERR(chain)) { 3059 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]); 3060 return PTR_ERR(chain); 3061 } 3062 attr = nla[NFTA_CHAIN_HANDLE]; 3063 } else if (nla[NFTA_CHAIN_NAME]) { 3064 chain = nft_chain_lookup(net, table, attr, genmask); 3065 if (IS_ERR(chain)) { 3066 if (PTR_ERR(chain) != -ENOENT) { 3067 NL_SET_BAD_ATTR(extack, attr); 3068 return PTR_ERR(chain); 3069 } 3070 chain = NULL; 3071 } 3072 } else if (!nla[NFTA_CHAIN_ID]) { 3073 return -EINVAL; 3074 } 3075 3076 if (nla[NFTA_CHAIN_POLICY]) { 3077 if (chain != NULL && 3078 !nft_is_base_chain(chain)) { 3079 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 3080 return -EOPNOTSUPP; 3081 } 3082 3083 if (chain == NULL && 3084 nla[NFTA_CHAIN_HOOK] == NULL) { 3085 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 3086 return -EOPNOTSUPP; 3087 } 3088 3089 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 3090 switch (policy) { 3091 case NF_DROP: 3092 case NF_ACCEPT: 3093 break; 3094 default: 3095 return -EINVAL; 3096 } 3097 } 3098 3099 if (nla[NFTA_CHAIN_FLAGS]) 3100 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS])); 3101 else if (chain) 3102 flags = chain->flags; 3103 3104 if (flags & ~NFT_CHAIN_FLAGS) 3105 return -EOPNOTSUPP; 3106 3107 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3108 3109 if (chain != NULL) { 3110 if (chain->flags & NFT_CHAIN_BINDING) 3111 return -EINVAL; 3112 3113 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 3114 NL_SET_BAD_ATTR(extack, attr); 3115 return -EEXIST; 3116 } 3117 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 3118 return -EOPNOTSUPP; 3119 3120 flags |= chain->flags & NFT_CHAIN_BASE; 3121 return nf_tables_updchain(&ctx, genmask, policy, flags, attr, 3122 extack); 3123 } 3124 3125 return nf_tables_addchain(&ctx, family, policy, flags, extack); 3126 } 3127 3128 static int nft_delchain_hook(struct nft_ctx *ctx, 3129 struct nft_base_chain *basechain, 3130 struct netlink_ext_ack *extack) 3131 { 3132 const struct nft_chain *chain = &basechain->chain; 3133 const struct nlattr * const *nla = ctx->nla; 3134 struct nft_chain_hook chain_hook = {}; 3135 struct nft_hook *this, *hook; 3136 LIST_HEAD(chain_del_list); 3137 struct nft_trans *trans; 3138 int err; 3139 3140 if (ctx->table->flags & __NFT_TABLE_F_UPDATE) 3141 return -EOPNOTSUPP; 3142 3143 err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook, 3144 ctx->family, chain->flags, extack); 3145 if (err < 0) 3146 return err; 3147 3148 list_for_each_entry(this, &chain_hook.list, list) { 3149 hook = nft_hook_list_find(&basechain->hook_list, this); 3150 if (!hook) { 3151 err = -ENOENT; 3152 goto err_chain_del_hook; 3153 } 3154 list_move(&hook->list, &chain_del_list); 3155 } 3156 3157 trans = nft_trans_alloc_chain(ctx, NFT_MSG_DELCHAIN); 3158 if (!trans) { 3159 err = -ENOMEM; 3160 goto err_chain_del_hook; 3161 } 3162 3163 nft_trans_basechain(trans) = basechain; 3164 nft_trans_chain_update(trans) = true; 3165 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 3166 list_splice(&chain_del_list, &nft_trans_chain_hooks(trans)); 3167 nft_chain_release_hook(&chain_hook); 3168 3169 nft_trans_commit_list_add_tail(ctx->net, trans); 3170 3171 return 0; 3172 3173 err_chain_del_hook: 3174 list_splice(&chain_del_list, &basechain->hook_list); 3175 nft_chain_release_hook(&chain_hook); 3176 3177 return err; 3178 } 3179 3180 static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, 3181 const struct nlattr * const nla[]) 3182 { 3183 struct netlink_ext_ack *extack = info->extack; 3184 u8 genmask = nft_genmask_next(info->net); 3185 u8 family = info->nfmsg->nfgen_family; 3186 struct net *net = info->net; 3187 const struct nlattr *attr; 3188 struct nft_table *table; 3189 struct nft_chain *chain; 3190 struct nft_rule *rule; 3191 struct nft_ctx ctx; 3192 u64 handle; 3193 u32 use; 3194 int err; 3195 3196 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 3197 NETLINK_CB(skb).portid); 3198 if (IS_ERR(table)) { 3199 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 3200 return PTR_ERR(table); 3201 } 3202 3203 if (nla[NFTA_CHAIN_HANDLE]) { 3204 attr = nla[NFTA_CHAIN_HANDLE]; 3205 handle = be64_to_cpu(nla_get_be64(attr)); 3206 chain = nft_chain_lookup_byhandle(table, handle, genmask); 3207 } else { 3208 attr = nla[NFTA_CHAIN_NAME]; 3209 chain = nft_chain_lookup(net, table, attr, genmask); 3210 } 3211 if (IS_ERR(chain)) { 3212 if (PTR_ERR(chain) == -ENOENT && 3213 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN) 3214 return 0; 3215 3216 NL_SET_BAD_ATTR(extack, attr); 3217 return PTR_ERR(chain); 3218 } 3219 3220 if (nft_chain_binding(chain)) 3221 return -EOPNOTSUPP; 3222 3223 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3224 3225 if (nla[NFTA_CHAIN_HOOK]) { 3226 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN || 3227 chain->flags & NFT_CHAIN_HW_OFFLOAD) 3228 return -EOPNOTSUPP; 3229 3230 if (nft_is_base_chain(chain)) { 3231 struct nft_base_chain *basechain = nft_base_chain(chain); 3232 3233 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 3234 return nft_delchain_hook(&ctx, basechain, extack); 3235 } 3236 } 3237 3238 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 3239 chain->use > 0) 3240 return -EBUSY; 3241 3242 use = chain->use; 3243 list_for_each_entry(rule, &chain->rules, list) { 3244 if (!nft_is_active_next(net, rule)) 3245 continue; 3246 use--; 3247 3248 err = nft_delrule(&ctx, rule); 3249 if (err < 0) 3250 return err; 3251 } 3252 3253 /* There are rules and elements that are still holding references to us, 3254 * we cannot do a recursive removal in this case. 3255 */ 3256 if (use > 0) { 3257 NL_SET_BAD_ATTR(extack, attr); 3258 return -EBUSY; 3259 } 3260 3261 return nft_delchain(&ctx); 3262 } 3263 3264 /* 3265 * Expressions 3266 */ 3267 3268 /** 3269 * nft_register_expr - register nf_tables expr type 3270 * @type: expr type 3271 * 3272 * Registers the expr type for use with nf_tables. Returns zero on 3273 * success or a negative errno code otherwise. 3274 */ 3275 int nft_register_expr(struct nft_expr_type *type) 3276 { 3277 if (WARN_ON_ONCE(type->maxattr > NFT_EXPR_MAXATTR)) 3278 return -ENOMEM; 3279 3280 nfnl_lock(NFNL_SUBSYS_NFTABLES); 3281 if (type->family == NFPROTO_UNSPEC) 3282 list_add_tail_rcu(&type->list, &nf_tables_expressions); 3283 else 3284 list_add_rcu(&type->list, &nf_tables_expressions); 3285 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 3286 return 0; 3287 } 3288 EXPORT_SYMBOL_GPL(nft_register_expr); 3289 3290 /** 3291 * nft_unregister_expr - unregister nf_tables expr type 3292 * @type: expr type 3293 * 3294 * Unregisters the expr typefor use with nf_tables. 3295 */ 3296 void nft_unregister_expr(struct nft_expr_type *type) 3297 { 3298 nfnl_lock(NFNL_SUBSYS_NFTABLES); 3299 list_del_rcu(&type->list); 3300 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 3301 } 3302 EXPORT_SYMBOL_GPL(nft_unregister_expr); 3303 3304 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 3305 struct nlattr *nla) 3306 { 3307 const struct nft_expr_type *type, *candidate = NULL; 3308 3309 list_for_each_entry_rcu(type, &nf_tables_expressions, list) { 3310 if (!nla_strcmp(nla, type->name)) { 3311 if (!type->family && !candidate) 3312 candidate = type; 3313 else if (type->family == family) 3314 candidate = type; 3315 } 3316 } 3317 return candidate; 3318 } 3319 3320 #ifdef CONFIG_MODULES 3321 static int nft_expr_type_request_module(struct net *net, u8 family, 3322 struct nlattr *nla) 3323 { 3324 if (nft_request_module(net, "nft-expr-%u-%.*s", family, 3325 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN) 3326 return -EAGAIN; 3327 3328 return 0; 3329 } 3330 #endif 3331 3332 static const struct nft_expr_type *nft_expr_type_get(struct net *net, 3333 u8 family, 3334 struct nlattr *nla) 3335 { 3336 const struct nft_expr_type *type; 3337 3338 if (nla == NULL) 3339 return ERR_PTR(-EINVAL); 3340 3341 rcu_read_lock(); 3342 type = __nft_expr_type_get(family, nla); 3343 if (type != NULL && try_module_get(type->owner)) { 3344 rcu_read_unlock(); 3345 return type; 3346 } 3347 rcu_read_unlock(); 3348 3349 lockdep_nfnl_nft_mutex_not_held(); 3350 #ifdef CONFIG_MODULES 3351 if (type == NULL) { 3352 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN) 3353 return ERR_PTR(-EAGAIN); 3354 3355 if (nft_request_module(net, "nft-expr-%.*s", 3356 nla_len(nla), 3357 (char *)nla_data(nla)) == -EAGAIN) 3358 return ERR_PTR(-EAGAIN); 3359 } 3360 #endif 3361 return ERR_PTR(-ENOENT); 3362 } 3363 3364 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 3365 [NFTA_EXPR_NAME] = { .type = NLA_STRING, 3366 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 3367 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 3368 }; 3369 3370 static int nf_tables_fill_expr_info(struct sk_buff *skb, 3371 const struct nft_expr *expr, bool reset) 3372 { 3373 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 3374 goto nla_put_failure; 3375 3376 if (expr->ops->dump) { 3377 struct nlattr *data = nla_nest_start_noflag(skb, 3378 NFTA_EXPR_DATA); 3379 if (data == NULL) 3380 goto nla_put_failure; 3381 if (expr->ops->dump(skb, expr, reset) < 0) 3382 goto nla_put_failure; 3383 nla_nest_end(skb, data); 3384 } 3385 3386 return skb->len; 3387 3388 nla_put_failure: 3389 return -1; 3390 }; 3391 3392 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 3393 const struct nft_expr *expr, bool reset) 3394 { 3395 struct nlattr *nest; 3396 3397 nest = nla_nest_start_noflag(skb, attr); 3398 if (!nest) 3399 goto nla_put_failure; 3400 if (nf_tables_fill_expr_info(skb, expr, reset) < 0) 3401 goto nla_put_failure; 3402 nla_nest_end(skb, nest); 3403 return 0; 3404 3405 nla_put_failure: 3406 return -1; 3407 } 3408 3409 struct nft_expr_info { 3410 const struct nft_expr_ops *ops; 3411 const struct nlattr *attr; 3412 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 3413 }; 3414 3415 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 3416 const struct nlattr *nla, 3417 struct nft_expr_info *info) 3418 { 3419 const struct nft_expr_type *type; 3420 const struct nft_expr_ops *ops; 3421 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3422 int err; 3423 3424 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3425 nft_expr_policy, NULL); 3426 if (err < 0) 3427 return err; 3428 3429 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]); 3430 if (IS_ERR(type)) 3431 return PTR_ERR(type); 3432 3433 if (tb[NFTA_EXPR_DATA]) { 3434 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3435 tb[NFTA_EXPR_DATA], 3436 type->policy, NULL); 3437 if (err < 0) 3438 goto err1; 3439 } else 3440 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 3441 3442 if (type->select_ops != NULL) { 3443 ops = type->select_ops(ctx, 3444 (const struct nlattr * const *)info->tb); 3445 if (IS_ERR(ops)) { 3446 err = PTR_ERR(ops); 3447 #ifdef CONFIG_MODULES 3448 if (err == -EAGAIN) 3449 if (nft_expr_type_request_module(ctx->net, 3450 ctx->family, 3451 tb[NFTA_EXPR_NAME]) != -EAGAIN) 3452 err = -ENOENT; 3453 #endif 3454 goto err1; 3455 } 3456 } else 3457 ops = type->ops; 3458 3459 info->attr = nla; 3460 info->ops = ops; 3461 3462 return 0; 3463 3464 err1: 3465 module_put(type->owner); 3466 return err; 3467 } 3468 3469 int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, 3470 struct nft_expr_info *info) 3471 { 3472 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3473 const struct nft_expr_type *type; 3474 int err; 3475 3476 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3477 nft_expr_policy, NULL); 3478 if (err < 0) 3479 return err; 3480 3481 if (!tb[NFTA_EXPR_DATA] || !tb[NFTA_EXPR_NAME]) 3482 return -EINVAL; 3483 3484 rcu_read_lock(); 3485 3486 type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); 3487 if (!type) { 3488 err = -ENOENT; 3489 goto out_unlock; 3490 } 3491 3492 if (!type->inner_ops) { 3493 err = -EOPNOTSUPP; 3494 goto out_unlock; 3495 } 3496 3497 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3498 tb[NFTA_EXPR_DATA], 3499 type->policy, NULL); 3500 if (err < 0) 3501 goto out_unlock; 3502 3503 info->attr = nla; 3504 info->ops = type->inner_ops; 3505 3506 /* No module reference will be taken on type->owner. 3507 * Presence of type->inner_ops implies that the expression 3508 * is builtin, so it cannot go away. 3509 */ 3510 rcu_read_unlock(); 3511 return 0; 3512 3513 out_unlock: 3514 rcu_read_unlock(); 3515 return err; 3516 } 3517 3518 static int nf_tables_newexpr(const struct nft_ctx *ctx, 3519 const struct nft_expr_info *expr_info, 3520 struct nft_expr *expr) 3521 { 3522 const struct nft_expr_ops *ops = expr_info->ops; 3523 int err; 3524 3525 expr->ops = ops; 3526 if (ops->init) { 3527 err = ops->init(ctx, expr, (const struct nlattr **)expr_info->tb); 3528 if (err < 0) 3529 goto err1; 3530 } 3531 3532 return 0; 3533 err1: 3534 expr->ops = NULL; 3535 return err; 3536 } 3537 3538 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 3539 struct nft_expr *expr) 3540 { 3541 const struct nft_expr_type *type = expr->ops->type; 3542 3543 if (expr->ops->destroy) 3544 expr->ops->destroy(ctx, expr); 3545 module_put(type->owner); 3546 } 3547 3548 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 3549 const struct nlattr *nla) 3550 { 3551 struct nft_expr_info expr_info; 3552 struct nft_expr *expr; 3553 struct module *owner; 3554 int err; 3555 3556 err = nf_tables_expr_parse(ctx, nla, &expr_info); 3557 if (err < 0) 3558 goto err_expr_parse; 3559 3560 err = -EOPNOTSUPP; 3561 if (!(expr_info.ops->type->flags & NFT_EXPR_STATEFUL)) 3562 goto err_expr_stateful; 3563 3564 err = -ENOMEM; 3565 expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT); 3566 if (expr == NULL) 3567 goto err_expr_stateful; 3568 3569 err = nf_tables_newexpr(ctx, &expr_info, expr); 3570 if (err < 0) 3571 goto err_expr_new; 3572 3573 return expr; 3574 err_expr_new: 3575 kfree(expr); 3576 err_expr_stateful: 3577 owner = expr_info.ops->type->owner; 3578 if (expr_info.ops->type->release_ops) 3579 expr_info.ops->type->release_ops(expr_info.ops); 3580 3581 module_put(owner); 3582 err_expr_parse: 3583 return ERR_PTR(err); 3584 } 3585 3586 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src, gfp_t gfp) 3587 { 3588 int err; 3589 3590 if (WARN_ON_ONCE(!src->ops->clone)) 3591 return -EINVAL; 3592 3593 dst->ops = src->ops; 3594 err = src->ops->clone(dst, src, gfp); 3595 if (err < 0) 3596 return err; 3597 3598 __module_get(src->ops->type->owner); 3599 3600 return 0; 3601 } 3602 3603 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 3604 { 3605 nf_tables_expr_destroy(ctx, expr); 3606 kfree(expr); 3607 } 3608 3609 /* 3610 * Rules 3611 */ 3612 3613 static struct nft_rule *__nft_rule_lookup(const struct net *net, 3614 const struct nft_chain *chain, 3615 u64 handle) 3616 { 3617 struct nft_rule *rule; 3618 3619 // FIXME: this sucks 3620 list_for_each_entry_rcu(rule, &chain->rules, list, 3621 lockdep_commit_lock_is_held(net)) { 3622 if (handle == rule->handle) 3623 return rule; 3624 } 3625 3626 return ERR_PTR(-ENOENT); 3627 } 3628 3629 static struct nft_rule *nft_rule_lookup(const struct net *net, 3630 const struct nft_chain *chain, 3631 const struct nlattr *nla) 3632 { 3633 if (nla == NULL) 3634 return ERR_PTR(-EINVAL); 3635 3636 return __nft_rule_lookup(net, chain, be64_to_cpu(nla_get_be64(nla))); 3637 } 3638 3639 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 3640 [NFTA_RULE_TABLE] = { .type = NLA_STRING, 3641 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3642 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 3643 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 3644 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 3645 [NFTA_RULE_EXPRESSIONS] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy), 3646 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 3647 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 3648 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 3649 .len = NFT_USERDATA_MAXLEN }, 3650 [NFTA_RULE_ID] = { .type = NLA_U32 }, 3651 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 }, 3652 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 }, 3653 }; 3654 3655 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 3656 u32 portid, u32 seq, int event, 3657 u32 flags, int family, 3658 const struct nft_table *table, 3659 const struct nft_chain *chain, 3660 const struct nft_rule *rule, u64 handle, 3661 bool reset) 3662 { 3663 struct nlmsghdr *nlh; 3664 const struct nft_expr *expr, *next; 3665 struct nlattr *list; 3666 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 3667 3668 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, 3669 nft_base_seq_be16(net)); 3670 if (!nlh) 3671 goto nla_put_failure; 3672 3673 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 3674 goto nla_put_failure; 3675 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 3676 goto nla_put_failure; 3677 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle), 3678 NFTA_RULE_PAD)) 3679 goto nla_put_failure; 3680 3681 if (event != NFT_MSG_DELRULE && handle) { 3682 if (nla_put_be64(skb, NFTA_RULE_POSITION, cpu_to_be64(handle), 3683 NFTA_RULE_PAD)) 3684 goto nla_put_failure; 3685 } 3686 3687 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 3688 nft_flow_rule_stats(chain, rule); 3689 3690 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS); 3691 if (list == NULL) 3692 goto nla_put_failure; 3693 nft_rule_for_each_expr(expr, next, rule) { 3694 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 3695 goto nla_put_failure; 3696 } 3697 nla_nest_end(skb, list); 3698 3699 if (rule->udata) { 3700 struct nft_userdata *udata = nft_userdata(rule); 3701 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 3702 udata->data) < 0) 3703 goto nla_put_failure; 3704 } 3705 3706 nlmsg_end(skb, nlh); 3707 return 0; 3708 3709 nla_put_failure: 3710 nlmsg_trim(skb, nlh); 3711 return -1; 3712 } 3713 3714 static void nf_tables_rule_notify(const struct nft_ctx *ctx, 3715 const struct nft_rule *rule, int event) 3716 { 3717 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3718 const struct nft_rule *prule; 3719 struct sk_buff *skb; 3720 u64 handle = 0; 3721 u16 flags = 0; 3722 int err; 3723 3724 if (!ctx->report && 3725 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 3726 return; 3727 3728 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3729 if (skb == NULL) 3730 goto err; 3731 3732 if (event == NFT_MSG_NEWRULE && 3733 !list_is_first(&rule->list, &ctx->chain->rules) && 3734 !list_is_last(&rule->list, &ctx->chain->rules)) { 3735 prule = list_prev_entry(rule, list); 3736 handle = prule->handle; 3737 } 3738 if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) 3739 flags |= NLM_F_APPEND; 3740 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 3741 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 3742 3743 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 3744 event, flags, ctx->family, ctx->table, 3745 ctx->chain, rule, handle, false); 3746 if (err < 0) { 3747 kfree_skb(skb); 3748 goto err; 3749 } 3750 3751 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 3752 return; 3753 err: 3754 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 3755 } 3756 3757 static void audit_log_rule_reset(const struct nft_table *table, 3758 unsigned int base_seq, 3759 unsigned int nentries) 3760 { 3761 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", 3762 table->name, base_seq); 3763 3764 audit_log_nfcfg(buf, table->family, nentries, 3765 AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC); 3766 kfree(buf); 3767 } 3768 3769 struct nft_rule_dump_ctx { 3770 unsigned int s_idx; 3771 char *table; 3772 char *chain; 3773 bool reset; 3774 }; 3775 3776 static int __nf_tables_dump_rules(struct sk_buff *skb, 3777 unsigned int *idx, 3778 struct netlink_callback *cb, 3779 const struct nft_table *table, 3780 const struct nft_chain *chain) 3781 { 3782 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3783 struct net *net = sock_net(skb->sk); 3784 const struct nft_rule *rule, *prule; 3785 unsigned int entries = 0; 3786 int ret = 0; 3787 u64 handle; 3788 3789 prule = NULL; 3790 list_for_each_entry_rcu(rule, &chain->rules, list) { 3791 if (!nft_is_active(net, rule)) 3792 goto cont_skip; 3793 if (*idx < ctx->s_idx) 3794 goto cont; 3795 if (prule) 3796 handle = prule->handle; 3797 else 3798 handle = 0; 3799 3800 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 3801 cb->nlh->nlmsg_seq, 3802 NFT_MSG_NEWRULE, 3803 NLM_F_MULTI | NLM_F_APPEND, 3804 table->family, 3805 table, chain, rule, handle, ctx->reset) < 0) { 3806 ret = 1; 3807 break; 3808 } 3809 entries++; 3810 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 3811 cont: 3812 prule = rule; 3813 cont_skip: 3814 (*idx)++; 3815 } 3816 3817 if (ctx->reset && entries) 3818 audit_log_rule_reset(table, cb->seq, entries); 3819 3820 return ret; 3821 } 3822 3823 static int nf_tables_dump_rules(struct sk_buff *skb, 3824 struct netlink_callback *cb) 3825 { 3826 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3827 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3828 struct nft_table *table; 3829 const struct nft_chain *chain; 3830 unsigned int idx = 0; 3831 struct net *net = sock_net(skb->sk); 3832 int family = nfmsg->nfgen_family; 3833 struct nftables_pernet *nft_net; 3834 3835 rcu_read_lock(); 3836 nft_net = nft_pernet(net); 3837 cb->seq = nft_base_seq(net); 3838 3839 list_for_each_entry_rcu(table, &nft_net->tables, list) { 3840 if (family != NFPROTO_UNSPEC && family != table->family) 3841 continue; 3842 3843 if (ctx->table && strcmp(ctx->table, table->name) != 0) 3844 continue; 3845 3846 if (ctx->table && ctx->chain) { 3847 struct rhlist_head *list, *tmp; 3848 3849 list = rhltable_lookup(&table->chains_ht, ctx->chain, 3850 nft_chain_ht_params); 3851 if (!list) 3852 goto done; 3853 3854 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 3855 if (!nft_is_active(net, chain)) 3856 continue; 3857 __nf_tables_dump_rules(skb, &idx, 3858 cb, table, chain); 3859 break; 3860 } 3861 goto done; 3862 } 3863 3864 list_for_each_entry_rcu(chain, &table->chains, list) { 3865 if (__nf_tables_dump_rules(skb, &idx, 3866 cb, table, chain)) 3867 goto done; 3868 } 3869 3870 if (ctx->table) 3871 break; 3872 } 3873 done: 3874 rcu_read_unlock(); 3875 3876 ctx->s_idx = idx; 3877 return skb->len; 3878 } 3879 3880 static int nf_tables_dumpreset_rules(struct sk_buff *skb, 3881 struct netlink_callback *cb) 3882 { 3883 struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); 3884 int ret; 3885 3886 /* Mutex is held is to prevent that two concurrent dump-and-reset calls 3887 * do not underrun counters and quotas. The commit_mutex is used for 3888 * the lack a better lock, this is not transaction path. 3889 */ 3890 mutex_lock(&nft_net->commit_mutex); 3891 ret = nf_tables_dump_rules(skb, cb); 3892 mutex_unlock(&nft_net->commit_mutex); 3893 3894 return ret; 3895 } 3896 3897 static int nf_tables_dump_rules_start(struct netlink_callback *cb) 3898 { 3899 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3900 const struct nlattr * const *nla = cb->data; 3901 3902 BUILD_BUG_ON(sizeof(*ctx) > sizeof(cb->ctx)); 3903 3904 if (nla[NFTA_RULE_TABLE]) { 3905 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE], GFP_ATOMIC); 3906 if (!ctx->table) 3907 return -ENOMEM; 3908 } 3909 if (nla[NFTA_RULE_CHAIN]) { 3910 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN], GFP_ATOMIC); 3911 if (!ctx->chain) { 3912 kfree(ctx->table); 3913 return -ENOMEM; 3914 } 3915 } 3916 return 0; 3917 } 3918 3919 static int nf_tables_dumpreset_rules_start(struct netlink_callback *cb) 3920 { 3921 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3922 3923 ctx->reset = true; 3924 3925 return nf_tables_dump_rules_start(cb); 3926 } 3927 3928 static int nf_tables_dump_rules_done(struct netlink_callback *cb) 3929 { 3930 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3931 3932 kfree(ctx->table); 3933 kfree(ctx->chain); 3934 return 0; 3935 } 3936 3937 /* Caller must hold rcu read lock or transaction mutex */ 3938 static struct sk_buff * 3939 nf_tables_getrule_single(u32 portid, const struct nfnl_info *info, 3940 const struct nlattr * const nla[], bool reset) 3941 { 3942 struct netlink_ext_ack *extack = info->extack; 3943 u8 genmask = nft_genmask_cur(info->net); 3944 u8 family = info->nfmsg->nfgen_family; 3945 const struct nft_chain *chain; 3946 const struct nft_rule *rule; 3947 struct net *net = info->net; 3948 struct nft_table *table; 3949 struct sk_buff *skb2; 3950 int err; 3951 3952 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0); 3953 if (IS_ERR(table)) { 3954 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3955 return ERR_CAST(table); 3956 } 3957 3958 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask); 3959 if (IS_ERR(chain)) { 3960 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3961 return ERR_CAST(chain); 3962 } 3963 3964 rule = nft_rule_lookup(net, chain, nla[NFTA_RULE_HANDLE]); 3965 if (IS_ERR(rule)) { 3966 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3967 return ERR_CAST(rule); 3968 } 3969 3970 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 3971 if (!skb2) 3972 return ERR_PTR(-ENOMEM); 3973 3974 err = nf_tables_fill_rule_info(skb2, net, portid, 3975 info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 3976 family, table, chain, rule, 0, reset); 3977 if (err < 0) { 3978 kfree_skb(skb2); 3979 return ERR_PTR(err); 3980 } 3981 3982 return skb2; 3983 } 3984 3985 static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, 3986 const struct nlattr * const nla[]) 3987 { 3988 u32 portid = NETLINK_CB(skb).portid; 3989 struct net *net = info->net; 3990 struct sk_buff *skb2; 3991 3992 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3993 struct netlink_dump_control c = { 3994 .start= nf_tables_dump_rules_start, 3995 .dump = nf_tables_dump_rules, 3996 .done = nf_tables_dump_rules_done, 3997 .module = THIS_MODULE, 3998 .data = (void *)nla, 3999 }; 4000 4001 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4002 } 4003 4004 skb2 = nf_tables_getrule_single(portid, info, nla, false); 4005 if (IS_ERR(skb2)) 4006 return PTR_ERR(skb2); 4007 4008 return nfnetlink_unicast(skb2, net, portid); 4009 } 4010 4011 static int nf_tables_getrule_reset(struct sk_buff *skb, 4012 const struct nfnl_info *info, 4013 const struct nlattr * const nla[]) 4014 { 4015 struct nftables_pernet *nft_net = nft_pernet(info->net); 4016 u32 portid = NETLINK_CB(skb).portid; 4017 struct net *net = info->net; 4018 struct sk_buff *skb2; 4019 char *buf; 4020 4021 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 4022 struct netlink_dump_control c = { 4023 .start= nf_tables_dumpreset_rules_start, 4024 .dump = nf_tables_dumpreset_rules, 4025 .done = nf_tables_dump_rules_done, 4026 .module = THIS_MODULE, 4027 .data = (void *)nla, 4028 }; 4029 4030 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4031 } 4032 4033 if (!try_module_get(THIS_MODULE)) 4034 return -EINVAL; 4035 rcu_read_unlock(); 4036 mutex_lock(&nft_net->commit_mutex); 4037 skb2 = nf_tables_getrule_single(portid, info, nla, true); 4038 mutex_unlock(&nft_net->commit_mutex); 4039 rcu_read_lock(); 4040 module_put(THIS_MODULE); 4041 4042 if (IS_ERR(skb2)) 4043 return PTR_ERR(skb2); 4044 4045 buf = kasprintf(GFP_ATOMIC, "%.*s:%u", 4046 nla_len(nla[NFTA_RULE_TABLE]), 4047 (char *)nla_data(nla[NFTA_RULE_TABLE]), 4048 nft_base_seq(net)); 4049 audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1, 4050 AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC); 4051 kfree(buf); 4052 4053 return nfnetlink_unicast(skb2, net, portid); 4054 } 4055 4056 void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule) 4057 { 4058 struct nft_expr *expr, *next; 4059 4060 /* 4061 * Careful: some expressions might not be initialized in case this 4062 * is called on error from nf_tables_newrule(). 4063 */ 4064 expr = nft_expr_first(rule); 4065 while (nft_expr_more(rule, expr)) { 4066 next = nft_expr_next(expr); 4067 nf_tables_expr_destroy(ctx, expr); 4068 expr = next; 4069 } 4070 kfree(rule); 4071 } 4072 4073 /* can only be used if rule is no longer visible to dumps */ 4074 static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) 4075 { 4076 WARN_ON_ONCE(!lockdep_commit_lock_is_held(ctx->net)); 4077 4078 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); 4079 nf_tables_rule_destroy(ctx, rule); 4080 } 4081 4082 /** nft_chain_validate - loop detection and hook validation 4083 * 4084 * @ctx: context containing call depth and base chain 4085 * @chain: chain to validate 4086 * 4087 * Walk through the rules of the given chain and chase all jumps/gotos 4088 * and set lookups until either the jump limit is hit or all reachable 4089 * chains have been validated. 4090 */ 4091 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) 4092 { 4093 struct nft_expr *expr, *last; 4094 struct nft_rule *rule; 4095 int err; 4096 4097 if (ctx->level == NFT_JUMP_STACK_SIZE) 4098 return -EMLINK; 4099 4100 list_for_each_entry(rule, &chain->rules, list) { 4101 if (fatal_signal_pending(current)) 4102 return -EINTR; 4103 4104 if (!nft_is_active_next(ctx->net, rule)) 4105 continue; 4106 4107 nft_rule_for_each_expr(expr, last, rule) { 4108 if (!expr->ops->validate) 4109 continue; 4110 4111 /* This may call nft_chain_validate() recursively, 4112 * callers that do so must increment ctx->level. 4113 */ 4114 err = expr->ops->validate(ctx, expr); 4115 if (err < 0) 4116 return err; 4117 } 4118 } 4119 4120 return 0; 4121 } 4122 EXPORT_SYMBOL_GPL(nft_chain_validate); 4123 4124 static int nft_table_validate(struct net *net, const struct nft_table *table) 4125 { 4126 struct nft_chain *chain; 4127 struct nft_ctx ctx = { 4128 .net = net, 4129 .family = table->family, 4130 }; 4131 int err; 4132 4133 list_for_each_entry(chain, &table->chains, list) { 4134 if (!nft_is_base_chain(chain)) 4135 continue; 4136 4137 ctx.chain = chain; 4138 err = nft_chain_validate(&ctx, chain); 4139 if (err < 0) 4140 return err; 4141 4142 cond_resched(); 4143 } 4144 4145 return 0; 4146 } 4147 4148 int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, 4149 const struct nft_set_iter *iter, 4150 struct nft_elem_priv *elem_priv) 4151 { 4152 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 4153 struct nft_ctx *pctx = (struct nft_ctx *)ctx; 4154 const struct nft_data *data; 4155 int err; 4156 4157 if (!nft_set_elem_active(ext, iter->genmask)) 4158 return 0; 4159 4160 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 4161 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 4162 return 0; 4163 4164 data = nft_set_ext_data(ext); 4165 switch (data->verdict.code) { 4166 case NFT_JUMP: 4167 case NFT_GOTO: 4168 pctx->level++; 4169 err = nft_chain_validate(ctx, data->verdict.chain); 4170 if (err < 0) 4171 return err; 4172 pctx->level--; 4173 break; 4174 default: 4175 break; 4176 } 4177 4178 return 0; 4179 } 4180 4181 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set) 4182 { 4183 struct nft_set_iter dummy_iter = { 4184 .genmask = nft_genmask_next(ctx->net), 4185 }; 4186 struct nft_set_elem_catchall *catchall; 4187 4188 struct nft_set_ext *ext; 4189 int ret = 0; 4190 4191 list_for_each_entry_rcu(catchall, &set->catchall_list, list, 4192 lockdep_commit_lock_is_held(ctx->net)) { 4193 ext = nft_set_elem_ext(set, catchall->elem); 4194 if (!nft_set_elem_active(ext, dummy_iter.genmask)) 4195 continue; 4196 4197 ret = nft_setelem_validate(ctx, set, &dummy_iter, catchall->elem); 4198 if (ret < 0) 4199 return ret; 4200 } 4201 4202 return ret; 4203 } 4204 4205 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 4206 const struct nft_chain *chain, 4207 const struct nlattr *nla); 4208 4209 #define NFT_RULE_MAXEXPRS 128 4210 4211 static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 4212 const struct nlattr * const nla[]) 4213 { 4214 struct nftables_pernet *nft_net = nft_pernet(info->net); 4215 struct netlink_ext_ack *extack = info->extack; 4216 unsigned int size, i, n, ulen = 0, usize = 0; 4217 u8 genmask = nft_genmask_next(info->net); 4218 struct nft_rule *rule, *old_rule = NULL; 4219 struct nft_expr_info *expr_info = NULL; 4220 u8 family = info->nfmsg->nfgen_family; 4221 struct nft_flow_rule *flow = NULL; 4222 struct net *net = info->net; 4223 struct nft_userdata *udata; 4224 struct nft_table *table; 4225 struct nft_chain *chain; 4226 struct nft_trans *trans; 4227 u64 handle, pos_handle; 4228 struct nft_expr *expr; 4229 struct nft_ctx ctx; 4230 struct nlattr *tmp; 4231 int err, rem; 4232 4233 lockdep_assert_held(&nft_net->commit_mutex); 4234 4235 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 4236 NETLINK_CB(skb).portid); 4237 if (IS_ERR(table)) { 4238 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 4239 return PTR_ERR(table); 4240 } 4241 4242 if (nla[NFTA_RULE_CHAIN]) { 4243 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 4244 genmask); 4245 if (IS_ERR(chain)) { 4246 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 4247 return PTR_ERR(chain); 4248 } 4249 4250 } else if (nla[NFTA_RULE_CHAIN_ID]) { 4251 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID], 4252 genmask); 4253 if (IS_ERR(chain)) { 4254 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]); 4255 return PTR_ERR(chain); 4256 } 4257 } else { 4258 return -EINVAL; 4259 } 4260 4261 if (nft_chain_is_bound(chain)) 4262 return -EOPNOTSUPP; 4263 4264 if (nla[NFTA_RULE_HANDLE]) { 4265 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 4266 rule = __nft_rule_lookup(net, chain, handle); 4267 if (IS_ERR(rule)) { 4268 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 4269 return PTR_ERR(rule); 4270 } 4271 4272 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 4273 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 4274 return -EEXIST; 4275 } 4276 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 4277 old_rule = rule; 4278 else 4279 return -EOPNOTSUPP; 4280 } else { 4281 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE) || 4282 info->nlh->nlmsg_flags & NLM_F_REPLACE) 4283 return -EINVAL; 4284 handle = nf_tables_alloc_handle(table); 4285 4286 if (nla[NFTA_RULE_POSITION]) { 4287 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 4288 old_rule = __nft_rule_lookup(net, chain, pos_handle); 4289 if (IS_ERR(old_rule)) { 4290 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); 4291 return PTR_ERR(old_rule); 4292 } 4293 } else if (nla[NFTA_RULE_POSITION_ID]) { 4294 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]); 4295 if (IS_ERR(old_rule)) { 4296 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); 4297 return PTR_ERR(old_rule); 4298 } 4299 } 4300 } 4301 4302 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 4303 4304 n = 0; 4305 size = 0; 4306 if (nla[NFTA_RULE_EXPRESSIONS]) { 4307 expr_info = kvmalloc_array(NFT_RULE_MAXEXPRS, 4308 sizeof(struct nft_expr_info), 4309 GFP_KERNEL); 4310 if (!expr_info) 4311 return -ENOMEM; 4312 4313 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 4314 err = -EINVAL; 4315 if (nla_type(tmp) != NFTA_LIST_ELEM) 4316 goto err_release_expr; 4317 if (n == NFT_RULE_MAXEXPRS) 4318 goto err_release_expr; 4319 err = nf_tables_expr_parse(&ctx, tmp, &expr_info[n]); 4320 if (err < 0) { 4321 NL_SET_BAD_ATTR(extack, tmp); 4322 goto err_release_expr; 4323 } 4324 size += expr_info[n].ops->size; 4325 n++; 4326 } 4327 } 4328 /* Check for overflow of dlen field */ 4329 err = -EFBIG; 4330 if (size >= 1 << 12) 4331 goto err_release_expr; 4332 4333 if (nla[NFTA_RULE_USERDATA]) { 4334 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 4335 if (ulen > 0) 4336 usize = sizeof(struct nft_userdata) + ulen; 4337 } 4338 4339 err = -ENOMEM; 4340 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT); 4341 if (rule == NULL) 4342 goto err_release_expr; 4343 4344 nft_activate_next(net, rule); 4345 4346 rule->handle = handle; 4347 rule->dlen = size; 4348 rule->udata = ulen ? 1 : 0; 4349 4350 if (ulen) { 4351 udata = nft_userdata(rule); 4352 udata->len = ulen - 1; 4353 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 4354 } 4355 4356 expr = nft_expr_first(rule); 4357 for (i = 0; i < n; i++) { 4358 err = nf_tables_newexpr(&ctx, &expr_info[i], expr); 4359 if (err < 0) { 4360 NL_SET_BAD_ATTR(extack, expr_info[i].attr); 4361 goto err_release_rule; 4362 } 4363 4364 if (expr_info[i].ops->validate) 4365 nft_validate_state_update(table, NFT_VALIDATE_NEED); 4366 4367 expr_info[i].ops = NULL; 4368 expr = nft_expr_next(expr); 4369 } 4370 4371 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { 4372 flow = nft_flow_rule_create(net, rule); 4373 if (IS_ERR(flow)) { 4374 err = PTR_ERR(flow); 4375 goto err_release_rule; 4376 } 4377 } 4378 4379 if (!nft_use_inc(&chain->use)) { 4380 err = -EMFILE; 4381 goto err_release_rule; 4382 } 4383 4384 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) { 4385 if (nft_chain_binding(chain)) { 4386 err = -EOPNOTSUPP; 4387 goto err_destroy_flow_rule; 4388 } 4389 4390 err = nft_delrule(&ctx, old_rule); 4391 if (err < 0) 4392 goto err_destroy_flow_rule; 4393 4394 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 4395 if (trans == NULL) { 4396 err = -ENOMEM; 4397 goto err_destroy_flow_rule; 4398 } 4399 list_add_tail_rcu(&rule->list, &old_rule->list); 4400 } else { 4401 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 4402 if (!trans) { 4403 err = -ENOMEM; 4404 goto err_destroy_flow_rule; 4405 } 4406 4407 if (info->nlh->nlmsg_flags & NLM_F_APPEND) { 4408 if (old_rule) 4409 list_add_rcu(&rule->list, &old_rule->list); 4410 else 4411 list_add_tail_rcu(&rule->list, &chain->rules); 4412 } else { 4413 if (old_rule) 4414 list_add_tail_rcu(&rule->list, &old_rule->list); 4415 else 4416 list_add_rcu(&rule->list, &chain->rules); 4417 } 4418 } 4419 kvfree(expr_info); 4420 4421 if (flow) 4422 nft_trans_flow_rule(trans) = flow; 4423 4424 if (table->validate_state == NFT_VALIDATE_DO) 4425 return nft_table_validate(net, table); 4426 4427 return 0; 4428 4429 err_destroy_flow_rule: 4430 nft_use_dec_restore(&chain->use); 4431 if (flow) 4432 nft_flow_rule_destroy(flow); 4433 err_release_rule: 4434 nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR); 4435 nf_tables_rule_destroy(&ctx, rule); 4436 err_release_expr: 4437 for (i = 0; i < n; i++) { 4438 if (expr_info[i].ops) { 4439 module_put(expr_info[i].ops->type->owner); 4440 if (expr_info[i].ops->type->release_ops) 4441 expr_info[i].ops->type->release_ops(expr_info[i].ops); 4442 } 4443 } 4444 kvfree(expr_info); 4445 4446 return err; 4447 } 4448 4449 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 4450 const struct nft_chain *chain, 4451 const struct nlattr *nla) 4452 { 4453 struct nftables_pernet *nft_net = nft_pernet(net); 4454 u32 id = ntohl(nla_get_be32(nla)); 4455 struct nft_trans *trans; 4456 4457 list_for_each_entry(trans, &nft_net->commit_list, list) { 4458 if (trans->msg_type == NFT_MSG_NEWRULE && 4459 nft_trans_rule_chain(trans) == chain && 4460 id == nft_trans_rule_id(trans)) 4461 return nft_trans_rule(trans); 4462 } 4463 return ERR_PTR(-ENOENT); 4464 } 4465 4466 static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 4467 const struct nlattr * const nla[]) 4468 { 4469 struct netlink_ext_ack *extack = info->extack; 4470 u8 genmask = nft_genmask_next(info->net); 4471 u8 family = info->nfmsg->nfgen_family; 4472 struct nft_chain *chain = NULL; 4473 struct net *net = info->net; 4474 struct nft_table *table; 4475 struct nft_rule *rule; 4476 struct nft_ctx ctx; 4477 int err = 0; 4478 4479 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 4480 NETLINK_CB(skb).portid); 4481 if (IS_ERR(table)) { 4482 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 4483 return PTR_ERR(table); 4484 } 4485 4486 if (nla[NFTA_RULE_CHAIN]) { 4487 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 4488 genmask); 4489 if (IS_ERR(chain)) { 4490 if (PTR_ERR(chain) == -ENOENT && 4491 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 4492 return 0; 4493 4494 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 4495 return PTR_ERR(chain); 4496 } 4497 if (nft_chain_binding(chain)) 4498 return -EOPNOTSUPP; 4499 } 4500 4501 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 4502 4503 if (chain) { 4504 if (nla[NFTA_RULE_HANDLE]) { 4505 rule = nft_rule_lookup(info->net, chain, nla[NFTA_RULE_HANDLE]); 4506 if (IS_ERR(rule)) { 4507 if (PTR_ERR(rule) == -ENOENT && 4508 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 4509 return 0; 4510 4511 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 4512 return PTR_ERR(rule); 4513 } 4514 4515 err = nft_delrule(&ctx, rule); 4516 } else if (nla[NFTA_RULE_ID]) { 4517 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); 4518 if (IS_ERR(rule)) { 4519 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); 4520 return PTR_ERR(rule); 4521 } 4522 4523 err = nft_delrule(&ctx, rule); 4524 } else { 4525 err = nft_delrule_by_chain(&ctx); 4526 } 4527 } else { 4528 list_for_each_entry(chain, &table->chains, list) { 4529 if (!nft_is_active_next(net, chain)) 4530 continue; 4531 if (nft_chain_binding(chain)) 4532 continue; 4533 4534 ctx.chain = chain; 4535 err = nft_delrule_by_chain(&ctx); 4536 if (err < 0) 4537 break; 4538 } 4539 } 4540 4541 return err; 4542 } 4543 4544 /* 4545 * Sets 4546 */ 4547 static const struct nft_set_type *nft_set_types[] = { 4548 &nft_set_hash_fast_type, 4549 &nft_set_hash_type, 4550 &nft_set_rhash_type, 4551 &nft_set_bitmap_type, 4552 &nft_set_rbtree_type, 4553 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML) 4554 &nft_set_pipapo_avx2_type, 4555 #endif 4556 &nft_set_pipapo_type, 4557 }; 4558 4559 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ 4560 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \ 4561 NFT_SET_EVAL) 4562 4563 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags) 4564 { 4565 return (flags & type->features) == (flags & NFT_SET_FEATURES); 4566 } 4567 4568 /* 4569 * Select a set implementation based on the data characteristics and the 4570 * given policy. The total memory use might not be known if no size is 4571 * given, in that case the amount of memory per element is used. 4572 */ 4573 static const struct nft_set_ops * 4574 nft_select_set_ops(const struct nft_ctx *ctx, u32 flags, 4575 const struct nft_set_desc *desc) 4576 { 4577 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4578 const struct nft_set_ops *ops, *bops; 4579 struct nft_set_estimate est, best; 4580 const struct nft_set_type *type; 4581 int i; 4582 4583 lockdep_assert_held(&nft_net->commit_mutex); 4584 lockdep_nfnl_nft_mutex_not_held(); 4585 4586 bops = NULL; 4587 best.size = ~0; 4588 best.lookup = ~0; 4589 best.space = ~0; 4590 4591 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) { 4592 type = nft_set_types[i]; 4593 ops = &type->ops; 4594 4595 if (!nft_set_ops_candidate(type, flags)) 4596 continue; 4597 if (!ops->estimate(desc, flags, &est)) 4598 continue; 4599 4600 switch (desc->policy) { 4601 case NFT_SET_POL_PERFORMANCE: 4602 if (est.lookup < best.lookup) 4603 break; 4604 if (est.lookup == best.lookup && 4605 est.space < best.space) 4606 break; 4607 continue; 4608 case NFT_SET_POL_MEMORY: 4609 if (!desc->size) { 4610 if (est.space < best.space) 4611 break; 4612 if (est.space == best.space && 4613 est.lookup < best.lookup) 4614 break; 4615 } else if (est.size < best.size || !bops) { 4616 break; 4617 } 4618 continue; 4619 default: 4620 break; 4621 } 4622 4623 bops = ops; 4624 best = est; 4625 } 4626 4627 if (bops != NULL) 4628 return bops; 4629 4630 return ERR_PTR(-EOPNOTSUPP); 4631 } 4632 4633 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 4634 [NFTA_SET_TABLE] = { .type = NLA_STRING, 4635 .len = NFT_TABLE_MAXNAMELEN - 1 }, 4636 [NFTA_SET_NAME] = { .type = NLA_STRING, 4637 .len = NFT_SET_MAXNAMELEN - 1 }, 4638 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 4639 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 4640 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 4641 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 4642 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 4643 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 4644 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 4645 [NFTA_SET_ID] = { .type = NLA_U32 }, 4646 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 4647 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 4648 [NFTA_SET_USERDATA] = { .type = NLA_BINARY, 4649 .len = NFT_USERDATA_MAXLEN }, 4650 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, 4651 [NFTA_SET_HANDLE] = { .type = NLA_U64 }, 4652 [NFTA_SET_EXPR] = { .type = NLA_NESTED }, 4653 [NFTA_SET_EXPRESSIONS] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy), 4654 [NFTA_SET_TYPE] = { .type = NLA_REJECT }, 4655 [NFTA_SET_COUNT] = { .type = NLA_REJECT }, 4656 }; 4657 4658 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = { 4659 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 }, 4660 }; 4661 4662 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 4663 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 4664 [NFTA_SET_DESC_CONCAT] = NLA_POLICY_NESTED_ARRAY(nft_concat_policy), 4665 }; 4666 4667 static struct nft_set *nft_set_lookup(const struct net *net, 4668 const struct nft_table *table, 4669 const struct nlattr *nla, u8 genmask) 4670 { 4671 struct nft_set *set; 4672 4673 if (nla == NULL) 4674 return ERR_PTR(-EINVAL); 4675 4676 list_for_each_entry_rcu(set, &table->sets, list, 4677 lockdep_commit_lock_is_held(net)) { 4678 if (!nla_strcmp(nla, set->name) && 4679 nft_active_genmask(set, genmask)) 4680 return set; 4681 } 4682 return ERR_PTR(-ENOENT); 4683 } 4684 4685 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, 4686 const struct nlattr *nla, 4687 u8 genmask) 4688 { 4689 struct nft_set *set; 4690 4691 list_for_each_entry(set, &table->sets, list) { 4692 if (be64_to_cpu(nla_get_be64(nla)) == set->handle && 4693 nft_active_genmask(set, genmask)) 4694 return set; 4695 } 4696 return ERR_PTR(-ENOENT); 4697 } 4698 4699 static struct nft_set *nft_set_lookup_byid(const struct net *net, 4700 const struct nft_table *table, 4701 const struct nlattr *nla, u8 genmask) 4702 { 4703 struct nftables_pernet *nft_net = nft_pernet(net); 4704 u32 id = ntohl(nla_get_be32(nla)); 4705 struct nft_trans_set *trans; 4706 4707 /* its likely the id we need is at the tail, not at start */ 4708 list_for_each_entry_reverse(trans, &nft_net->commit_set_list, list_trans_newset) { 4709 struct nft_set *set = trans->set; 4710 4711 if (id == trans->set_id && 4712 set->table == table && 4713 nft_active_genmask(set, genmask)) 4714 return set; 4715 } 4716 return ERR_PTR(-ENOENT); 4717 } 4718 4719 struct nft_set *nft_set_lookup_global(const struct net *net, 4720 const struct nft_table *table, 4721 const struct nlattr *nla_set_name, 4722 const struct nlattr *nla_set_id, 4723 u8 genmask) 4724 { 4725 struct nft_set *set; 4726 4727 set = nft_set_lookup(net, table, nla_set_name, genmask); 4728 if (IS_ERR(set)) { 4729 if (!nla_set_id) 4730 return set; 4731 4732 set = nft_set_lookup_byid(net, table, nla_set_id, genmask); 4733 } 4734 return set; 4735 } 4736 EXPORT_SYMBOL_GPL(nft_set_lookup_global); 4737 4738 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 4739 const char *name) 4740 { 4741 const struct nft_set *i; 4742 const char *p; 4743 unsigned long *inuse; 4744 unsigned int n = 0, min = 0; 4745 4746 p = strchr(name, '%'); 4747 if (p != NULL) { 4748 if (p[1] != 'd' || strchr(p + 2, '%')) 4749 return -EINVAL; 4750 4751 if (strnlen(name, NFT_SET_MAX_ANONLEN) >= NFT_SET_MAX_ANONLEN) 4752 return -EINVAL; 4753 4754 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 4755 if (inuse == NULL) 4756 return -ENOMEM; 4757 cont: 4758 list_for_each_entry(i, &ctx->table->sets, list) { 4759 int tmp; 4760 4761 if (!nft_is_active_next(ctx->net, i)) 4762 continue; 4763 if (!sscanf(i->name, name, &tmp)) 4764 continue; 4765 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 4766 continue; 4767 4768 set_bit(tmp - min, inuse); 4769 } 4770 4771 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 4772 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 4773 min += BITS_PER_BYTE * PAGE_SIZE; 4774 memset(inuse, 0, PAGE_SIZE); 4775 goto cont; 4776 } 4777 free_page((unsigned long)inuse); 4778 } 4779 4780 set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n); 4781 if (!set->name) 4782 return -ENOMEM; 4783 4784 list_for_each_entry(i, &ctx->table->sets, list) { 4785 if (!nft_is_active_next(ctx->net, i)) 4786 continue; 4787 if (!strcmp(set->name, i->name)) { 4788 kfree(set->name); 4789 set->name = NULL; 4790 return -ENFILE; 4791 } 4792 } 4793 return 0; 4794 } 4795 4796 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) 4797 { 4798 u64 ms = be64_to_cpu(nla_get_be64(nla)); 4799 u64 max = (u64)(~((u64)0)); 4800 4801 max = div_u64(max, NSEC_PER_MSEC); 4802 if (ms >= max) 4803 return -ERANGE; 4804 4805 ms *= NSEC_PER_MSEC; 4806 *result = nsecs_to_jiffies64(ms) ? : !!ms; 4807 return 0; 4808 } 4809 4810 __be64 nf_jiffies64_to_msecs(u64 input) 4811 { 4812 return cpu_to_be64(jiffies64_to_msecs(input)); 4813 } 4814 4815 static int nf_tables_fill_set_concat(struct sk_buff *skb, 4816 const struct nft_set *set) 4817 { 4818 struct nlattr *concat, *field; 4819 int i; 4820 4821 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT); 4822 if (!concat) 4823 return -ENOMEM; 4824 4825 for (i = 0; i < set->field_count; i++) { 4826 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 4827 if (!field) 4828 return -ENOMEM; 4829 4830 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN, 4831 htonl(set->field_len[i]))) 4832 return -ENOMEM; 4833 4834 nla_nest_end(skb, field); 4835 } 4836 4837 nla_nest_end(skb, concat); 4838 4839 return 0; 4840 } 4841 4842 static u32 nft_set_userspace_size(const struct nft_set_ops *ops, u32 size) 4843 { 4844 if (ops->usize) 4845 return ops->usize(size); 4846 4847 return size; 4848 } 4849 4850 static noinline_for_stack int 4851 nf_tables_fill_set_info(struct sk_buff *skb, const struct nft_set *set) 4852 { 4853 unsigned int nelems; 4854 char str[40]; 4855 int ret; 4856 4857 ret = snprintf(str, sizeof(str), "%ps", set->ops); 4858 4859 /* Not expected to happen and harmless: NFTA_SET_TYPE is dumped 4860 * to userspace purely for informational/debug purposes. 4861 */ 4862 DEBUG_NET_WARN_ON_ONCE(ret >= sizeof(str)); 4863 4864 if (nla_put_string(skb, NFTA_SET_TYPE, str)) 4865 return -EMSGSIZE; 4866 4867 nelems = nft_set_userspace_size(set->ops, atomic_read(&set->nelems)); 4868 return nla_put_be32(skb, NFTA_SET_COUNT, htonl(nelems)); 4869 } 4870 4871 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 4872 const struct nft_set *set, u16 event, u16 flags) 4873 { 4874 u64 timeout = READ_ONCE(set->timeout); 4875 u32 gc_int = READ_ONCE(set->gc_int); 4876 u32 portid = ctx->portid; 4877 struct nlmsghdr *nlh; 4878 struct nlattr *nest; 4879 u32 seq = ctx->seq; 4880 int i; 4881 4882 nlh = nfnl_msg_put(skb, portid, seq, 4883 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 4884 flags, ctx->family, NFNETLINK_V0, 4885 nft_base_seq_be16(ctx->net)); 4886 if (!nlh) 4887 goto nla_put_failure; 4888 4889 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 4890 goto nla_put_failure; 4891 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 4892 goto nla_put_failure; 4893 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), 4894 NFTA_SET_PAD)) 4895 goto nla_put_failure; 4896 4897 if (event == NFT_MSG_DELSET || 4898 event == NFT_MSG_DESTROYSET) { 4899 nlmsg_end(skb, nlh); 4900 return 0; 4901 } 4902 4903 if (set->flags != 0) 4904 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 4905 goto nla_put_failure; 4906 4907 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 4908 goto nla_put_failure; 4909 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 4910 goto nla_put_failure; 4911 if (set->flags & NFT_SET_MAP) { 4912 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 4913 goto nla_put_failure; 4914 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 4915 goto nla_put_failure; 4916 } 4917 if (set->flags & NFT_SET_OBJECT && 4918 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype))) 4919 goto nla_put_failure; 4920 4921 if (timeout && 4922 nla_put_be64(skb, NFTA_SET_TIMEOUT, 4923 nf_jiffies64_to_msecs(timeout), 4924 NFTA_SET_PAD)) 4925 goto nla_put_failure; 4926 if (gc_int && 4927 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(gc_int))) 4928 goto nla_put_failure; 4929 4930 if (set->policy != NFT_SET_POL_PERFORMANCE) { 4931 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 4932 goto nla_put_failure; 4933 } 4934 4935 if (set->udata && 4936 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) 4937 goto nla_put_failure; 4938 4939 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC); 4940 if (!nest) 4941 goto nla_put_failure; 4942 if (set->size && 4943 nla_put_be32(skb, NFTA_SET_DESC_SIZE, 4944 htonl(nft_set_userspace_size(set->ops, set->size)))) 4945 goto nla_put_failure; 4946 4947 if (set->field_count > 1 && 4948 nf_tables_fill_set_concat(skb, set)) 4949 goto nla_put_failure; 4950 4951 nla_nest_end(skb, nest); 4952 4953 if (nf_tables_fill_set_info(skb, set)) 4954 goto nla_put_failure; 4955 4956 if (set->num_exprs == 1) { 4957 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR); 4958 if (nf_tables_fill_expr_info(skb, set->exprs[0], false) < 0) 4959 goto nla_put_failure; 4960 4961 nla_nest_end(skb, nest); 4962 } else if (set->num_exprs > 1) { 4963 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPRESSIONS); 4964 if (nest == NULL) 4965 goto nla_put_failure; 4966 4967 for (i = 0; i < set->num_exprs; i++) { 4968 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 4969 set->exprs[i], false) < 0) 4970 goto nla_put_failure; 4971 } 4972 nla_nest_end(skb, nest); 4973 } 4974 4975 nlmsg_end(skb, nlh); 4976 return 0; 4977 4978 nla_put_failure: 4979 nlmsg_trim(skb, nlh); 4980 return -1; 4981 } 4982 4983 static void nf_tables_set_notify(const struct nft_ctx *ctx, 4984 const struct nft_set *set, int event, 4985 gfp_t gfp_flags) 4986 { 4987 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4988 u32 portid = ctx->portid; 4989 struct sk_buff *skb; 4990 u16 flags = 0; 4991 int err; 4992 4993 if (!ctx->report && 4994 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 4995 return; 4996 4997 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 4998 if (skb == NULL) 4999 goto err; 5000 5001 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 5002 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 5003 5004 err = nf_tables_fill_set(skb, ctx, set, event, flags); 5005 if (err < 0) { 5006 kfree_skb(skb); 5007 goto err; 5008 } 5009 5010 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 5011 return; 5012 err: 5013 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 5014 } 5015 5016 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 5017 { 5018 const struct nft_set *set; 5019 unsigned int idx, s_idx = cb->args[0]; 5020 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 5021 struct net *net = sock_net(skb->sk); 5022 struct nft_ctx *ctx = cb->data, ctx_set; 5023 struct nftables_pernet *nft_net; 5024 5025 if (cb->args[1]) 5026 return skb->len; 5027 5028 rcu_read_lock(); 5029 nft_net = nft_pernet(net); 5030 cb->seq = nft_base_seq(net); 5031 5032 list_for_each_entry_rcu(table, &nft_net->tables, list) { 5033 if (ctx->family != NFPROTO_UNSPEC && 5034 ctx->family != table->family) 5035 continue; 5036 5037 if (ctx->table && ctx->table != table) 5038 continue; 5039 5040 if (cur_table) { 5041 if (cur_table != table) 5042 continue; 5043 5044 cur_table = NULL; 5045 } 5046 idx = 0; 5047 list_for_each_entry_rcu(set, &table->sets, list) { 5048 if (idx < s_idx) 5049 goto cont; 5050 if (!nft_is_active(net, set)) 5051 goto cont; 5052 5053 ctx_set = *ctx; 5054 ctx_set.table = table; 5055 ctx_set.family = table->family; 5056 5057 if (nf_tables_fill_set(skb, &ctx_set, set, 5058 NFT_MSG_NEWSET, 5059 NLM_F_MULTI) < 0) { 5060 cb->args[0] = idx; 5061 cb->args[2] = (unsigned long) table; 5062 goto done; 5063 } 5064 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 5065 cont: 5066 idx++; 5067 } 5068 if (s_idx) 5069 s_idx = 0; 5070 } 5071 cb->args[1] = 1; 5072 done: 5073 rcu_read_unlock(); 5074 return skb->len; 5075 } 5076 5077 static int nf_tables_dump_sets_start(struct netlink_callback *cb) 5078 { 5079 struct nft_ctx *ctx_dump = NULL; 5080 5081 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC); 5082 if (ctx_dump == NULL) 5083 return -ENOMEM; 5084 5085 cb->data = ctx_dump; 5086 return 0; 5087 } 5088 5089 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 5090 { 5091 kfree(cb->data); 5092 return 0; 5093 } 5094 5095 /* called with rcu_read_lock held */ 5096 static int nf_tables_getset(struct sk_buff *skb, const struct nfnl_info *info, 5097 const struct nlattr * const nla[]) 5098 { 5099 struct netlink_ext_ack *extack = info->extack; 5100 u8 genmask = nft_genmask_cur(info->net); 5101 u8 family = info->nfmsg->nfgen_family; 5102 struct nft_table *table = NULL; 5103 struct net *net = info->net; 5104 const struct nft_set *set; 5105 struct sk_buff *skb2; 5106 struct nft_ctx ctx; 5107 int err; 5108 5109 if (nla[NFTA_SET_TABLE]) { 5110 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 5111 genmask, 0); 5112 if (IS_ERR(table)) { 5113 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5114 return PTR_ERR(table); 5115 } 5116 } 5117 5118 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5119 5120 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 5121 struct netlink_dump_control c = { 5122 .start = nf_tables_dump_sets_start, 5123 .dump = nf_tables_dump_sets, 5124 .done = nf_tables_dump_sets_done, 5125 .data = &ctx, 5126 .module = THIS_MODULE, 5127 }; 5128 5129 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 5130 } 5131 5132 /* Only accept unspec with dump */ 5133 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 5134 return -EAFNOSUPPORT; 5135 if (!nla[NFTA_SET_TABLE]) 5136 return -EINVAL; 5137 5138 set = nft_set_lookup(net, table, nla[NFTA_SET_NAME], genmask); 5139 if (IS_ERR(set)) { 5140 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5141 return PTR_ERR(set); 5142 } 5143 5144 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 5145 if (skb2 == NULL) 5146 return -ENOMEM; 5147 5148 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 5149 if (err < 0) 5150 goto err_fill_set_info; 5151 5152 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 5153 5154 err_fill_set_info: 5155 kfree_skb(skb2); 5156 return err; 5157 } 5158 5159 static int nft_set_desc_concat_parse(const struct nlattr *attr, 5160 struct nft_set_desc *desc) 5161 { 5162 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1]; 5163 u32 len; 5164 int err; 5165 5166 if (desc->field_count >= ARRAY_SIZE(desc->field_len)) 5167 return -E2BIG; 5168 5169 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, 5170 nft_concat_policy, NULL); 5171 if (err < 0) 5172 return err; 5173 5174 if (!tb[NFTA_SET_FIELD_LEN]) 5175 return -EINVAL; 5176 5177 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); 5178 if (!len || len > U8_MAX) 5179 return -EINVAL; 5180 5181 desc->field_len[desc->field_count++] = len; 5182 5183 return 0; 5184 } 5185 5186 static int nft_set_desc_concat(struct nft_set_desc *desc, 5187 const struct nlattr *nla) 5188 { 5189 u32 len = 0, num_regs; 5190 struct nlattr *attr; 5191 int rem, err, i; 5192 5193 nla_for_each_nested(attr, nla, rem) { 5194 if (nla_type(attr) != NFTA_LIST_ELEM) 5195 return -EINVAL; 5196 5197 err = nft_set_desc_concat_parse(attr, desc); 5198 if (err < 0) 5199 return err; 5200 } 5201 5202 for (i = 0; i < desc->field_count; i++) 5203 len += round_up(desc->field_len[i], sizeof(u32)); 5204 5205 if (len != desc->klen) 5206 return -EINVAL; 5207 5208 num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); 5209 if (num_regs > NFT_REG32_COUNT) 5210 return -E2BIG; 5211 5212 return 0; 5213 } 5214 5215 static int nf_tables_set_desc_parse(struct nft_set_desc *desc, 5216 const struct nlattr *nla) 5217 { 5218 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 5219 int err; 5220 5221 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla, 5222 nft_set_desc_policy, NULL); 5223 if (err < 0) 5224 return err; 5225 5226 if (da[NFTA_SET_DESC_SIZE] != NULL) 5227 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 5228 if (da[NFTA_SET_DESC_CONCAT]) 5229 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]); 5230 5231 return err; 5232 } 5233 5234 static int nft_set_expr_alloc(struct nft_ctx *ctx, struct nft_set *set, 5235 const struct nlattr * const *nla, 5236 struct nft_expr **exprs, int *num_exprs, 5237 u32 flags) 5238 { 5239 struct nft_expr *expr; 5240 int err, i; 5241 5242 if (nla[NFTA_SET_EXPR]) { 5243 expr = nft_set_elem_expr_alloc(ctx, set, nla[NFTA_SET_EXPR]); 5244 if (IS_ERR(expr)) { 5245 err = PTR_ERR(expr); 5246 goto err_set_expr_alloc; 5247 } 5248 exprs[0] = expr; 5249 (*num_exprs)++; 5250 } else if (nla[NFTA_SET_EXPRESSIONS]) { 5251 struct nlattr *tmp; 5252 int left; 5253 5254 if (!(flags & NFT_SET_EXPR)) { 5255 err = -EINVAL; 5256 goto err_set_expr_alloc; 5257 } 5258 i = 0; 5259 nla_for_each_nested(tmp, nla[NFTA_SET_EXPRESSIONS], left) { 5260 if (i == NFT_SET_EXPR_MAX) { 5261 err = -E2BIG; 5262 goto err_set_expr_alloc; 5263 } 5264 if (nla_type(tmp) != NFTA_LIST_ELEM) { 5265 err = -EINVAL; 5266 goto err_set_expr_alloc; 5267 } 5268 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 5269 if (IS_ERR(expr)) { 5270 err = PTR_ERR(expr); 5271 goto err_set_expr_alloc; 5272 } 5273 exprs[i++] = expr; 5274 (*num_exprs)++; 5275 } 5276 } 5277 5278 return 0; 5279 5280 err_set_expr_alloc: 5281 for (i = 0; i < *num_exprs; i++) 5282 nft_expr_destroy(ctx, exprs[i]); 5283 5284 return err; 5285 } 5286 5287 static bool nft_set_is_same(const struct nft_set *set, 5288 const struct nft_set_desc *desc, 5289 struct nft_expr *exprs[], u32 num_exprs, u32 flags) 5290 { 5291 int i; 5292 5293 if (set->ktype != desc->ktype || 5294 set->dtype != desc->dtype || 5295 set->flags != flags || 5296 set->klen != desc->klen || 5297 set->dlen != desc->dlen || 5298 set->field_count != desc->field_count || 5299 set->num_exprs != num_exprs) 5300 return false; 5301 5302 for (i = 0; i < desc->field_count; i++) { 5303 if (set->field_len[i] != desc->field_len[i]) 5304 return false; 5305 } 5306 5307 for (i = 0; i < num_exprs; i++) { 5308 if (set->exprs[i]->ops != exprs[i]->ops) 5309 return false; 5310 } 5311 5312 return true; 5313 } 5314 5315 static u32 nft_set_kernel_size(const struct nft_set_ops *ops, 5316 const struct nft_set_desc *desc) 5317 { 5318 if (ops->ksize) 5319 return ops->ksize(desc->size); 5320 5321 return desc->size; 5322 } 5323 5324 static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 5325 const struct nlattr * const nla[]) 5326 { 5327 struct netlink_ext_ack *extack = info->extack; 5328 u8 genmask = nft_genmask_next(info->net); 5329 u8 family = info->nfmsg->nfgen_family; 5330 const struct nft_set_ops *ops; 5331 struct net *net = info->net; 5332 struct nft_set_desc desc; 5333 struct nft_table *table; 5334 unsigned char *udata; 5335 struct nft_set *set; 5336 struct nft_ctx ctx; 5337 size_t alloc_size; 5338 int num_exprs = 0; 5339 char *name; 5340 int err, i; 5341 u16 udlen; 5342 u32 flags; 5343 u64 size; 5344 5345 if (nla[NFTA_SET_TABLE] == NULL || 5346 nla[NFTA_SET_NAME] == NULL || 5347 nla[NFTA_SET_KEY_LEN] == NULL || 5348 nla[NFTA_SET_ID] == NULL) 5349 return -EINVAL; 5350 5351 memset(&desc, 0, sizeof(desc)); 5352 5353 desc.ktype = NFT_DATA_VALUE; 5354 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 5355 desc.ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 5356 if ((desc.ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 5357 return -EINVAL; 5358 } 5359 5360 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 5361 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 5362 return -EINVAL; 5363 5364 flags = 0; 5365 if (nla[NFTA_SET_FLAGS] != NULL) { 5366 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 5367 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 5368 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 5369 NFT_SET_MAP | NFT_SET_EVAL | 5370 NFT_SET_OBJECT | NFT_SET_CONCAT | NFT_SET_EXPR)) 5371 return -EOPNOTSUPP; 5372 /* Only one of these operations is supported */ 5373 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) == 5374 (NFT_SET_MAP | NFT_SET_OBJECT)) 5375 return -EOPNOTSUPP; 5376 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == 5377 (NFT_SET_EVAL | NFT_SET_OBJECT)) 5378 return -EOPNOTSUPP; 5379 if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == 5380 (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) 5381 return -EOPNOTSUPP; 5382 if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) == 5383 (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) 5384 return -EOPNOTSUPP; 5385 } 5386 5387 desc.dtype = 0; 5388 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 5389 if (!(flags & NFT_SET_MAP)) 5390 return -EINVAL; 5391 5392 desc.dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 5393 if ((desc.dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 5394 desc.dtype != NFT_DATA_VERDICT) 5395 return -EINVAL; 5396 5397 if (desc.dtype != NFT_DATA_VERDICT) { 5398 if (nla[NFTA_SET_DATA_LEN] == NULL) 5399 return -EINVAL; 5400 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 5401 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 5402 return -EINVAL; 5403 } else 5404 desc.dlen = sizeof(struct nft_verdict); 5405 } else if (flags & NFT_SET_MAP) 5406 return -EINVAL; 5407 5408 if (nla[NFTA_SET_OBJ_TYPE] != NULL) { 5409 if (!(flags & NFT_SET_OBJECT)) 5410 return -EINVAL; 5411 5412 desc.objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE])); 5413 if (desc.objtype == NFT_OBJECT_UNSPEC || 5414 desc.objtype > NFT_OBJECT_MAX) 5415 return -EOPNOTSUPP; 5416 } else if (flags & NFT_SET_OBJECT) 5417 return -EINVAL; 5418 else 5419 desc.objtype = NFT_OBJECT_UNSPEC; 5420 5421 desc.timeout = 0; 5422 if (nla[NFTA_SET_TIMEOUT] != NULL) { 5423 if (!(flags & NFT_SET_TIMEOUT)) 5424 return -EINVAL; 5425 5426 if (flags & NFT_SET_ANONYMOUS) 5427 return -EOPNOTSUPP; 5428 5429 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &desc.timeout); 5430 if (err) 5431 return err; 5432 } 5433 desc.gc_int = 0; 5434 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 5435 if (!(flags & NFT_SET_TIMEOUT)) 5436 return -EINVAL; 5437 5438 if (flags & NFT_SET_ANONYMOUS) 5439 return -EOPNOTSUPP; 5440 5441 desc.gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 5442 } 5443 5444 desc.policy = NFT_SET_POL_PERFORMANCE; 5445 if (nla[NFTA_SET_POLICY] != NULL) { 5446 desc.policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 5447 switch (desc.policy) { 5448 case NFT_SET_POL_PERFORMANCE: 5449 case NFT_SET_POL_MEMORY: 5450 break; 5451 default: 5452 return -EOPNOTSUPP; 5453 } 5454 } 5455 5456 if (nla[NFTA_SET_DESC] != NULL) { 5457 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); 5458 if (err < 0) 5459 return err; 5460 5461 if (desc.field_count > 1) { 5462 if (!(flags & NFT_SET_CONCAT)) 5463 return -EINVAL; 5464 } else if (flags & NFT_SET_CONCAT) { 5465 return -EINVAL; 5466 } 5467 } else if (flags & NFT_SET_CONCAT) { 5468 return -EINVAL; 5469 } 5470 5471 if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS]) 5472 desc.expr = true; 5473 5474 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask, 5475 NETLINK_CB(skb).portid); 5476 if (IS_ERR(table)) { 5477 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5478 return PTR_ERR(table); 5479 } 5480 5481 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5482 5483 set = nft_set_lookup(net, table, nla[NFTA_SET_NAME], genmask); 5484 if (IS_ERR(set)) { 5485 if (PTR_ERR(set) != -ENOENT) { 5486 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5487 return PTR_ERR(set); 5488 } 5489 } else { 5490 struct nft_expr *exprs[NFT_SET_EXPR_MAX] = {}; 5491 5492 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 5493 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5494 return -EEXIST; 5495 } 5496 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 5497 return -EOPNOTSUPP; 5498 5499 if (nft_set_is_anonymous(set)) 5500 return -EOPNOTSUPP; 5501 5502 err = nft_set_expr_alloc(&ctx, set, nla, exprs, &num_exprs, flags); 5503 if (err < 0) 5504 return err; 5505 5506 if (desc.size) 5507 desc.size = nft_set_kernel_size(set->ops, &desc); 5508 5509 err = 0; 5510 if (!nft_set_is_same(set, &desc, exprs, num_exprs, flags)) { 5511 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5512 err = -EEXIST; 5513 } 5514 5515 for (i = 0; i < num_exprs; i++) 5516 nft_expr_destroy(&ctx, exprs[i]); 5517 5518 if (err < 0) 5519 return err; 5520 5521 return __nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set, &desc); 5522 } 5523 5524 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE)) 5525 return -ENOENT; 5526 5527 ops = nft_select_set_ops(&ctx, flags, &desc); 5528 if (IS_ERR(ops)) 5529 return PTR_ERR(ops); 5530 5531 if (desc.size) 5532 desc.size = nft_set_kernel_size(ops, &desc); 5533 5534 udlen = 0; 5535 if (nla[NFTA_SET_USERDATA]) 5536 udlen = nla_len(nla[NFTA_SET_USERDATA]); 5537 5538 size = 0; 5539 if (ops->privsize != NULL) 5540 size = ops->privsize(nla, &desc); 5541 alloc_size = sizeof(*set) + size + udlen; 5542 if (alloc_size < size || alloc_size > INT_MAX) 5543 return -ENOMEM; 5544 5545 if (!nft_use_inc(&table->use)) 5546 return -EMFILE; 5547 5548 set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT); 5549 if (!set) { 5550 err = -ENOMEM; 5551 goto err_alloc; 5552 } 5553 5554 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT); 5555 if (!name) { 5556 err = -ENOMEM; 5557 goto err_set_name; 5558 } 5559 5560 err = nf_tables_set_alloc_name(&ctx, set, name); 5561 kfree(name); 5562 if (err < 0) 5563 goto err_set_name; 5564 5565 udata = NULL; 5566 if (udlen) { 5567 udata = set->data + size; 5568 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen); 5569 } 5570 5571 INIT_LIST_HEAD(&set->bindings); 5572 INIT_LIST_HEAD(&set->catchall_list); 5573 refcount_set(&set->refs, 1); 5574 set->table = table; 5575 write_pnet(&set->net, net); 5576 set->ops = ops; 5577 set->ktype = desc.ktype; 5578 set->klen = desc.klen; 5579 set->dtype = desc.dtype; 5580 set->objtype = desc.objtype; 5581 set->dlen = desc.dlen; 5582 set->flags = flags; 5583 set->size = desc.size; 5584 set->policy = desc.policy; 5585 set->udlen = udlen; 5586 set->udata = udata; 5587 set->timeout = desc.timeout; 5588 set->gc_int = desc.gc_int; 5589 5590 set->field_count = desc.field_count; 5591 for (i = 0; i < desc.field_count; i++) 5592 set->field_len[i] = desc.field_len[i]; 5593 5594 err = ops->init(set, &desc, nla); 5595 if (err < 0) 5596 goto err_set_init; 5597 5598 err = nft_set_expr_alloc(&ctx, set, nla, set->exprs, &num_exprs, flags); 5599 if (err < 0) 5600 goto err_set_destroy; 5601 5602 set->num_exprs = num_exprs; 5603 set->handle = nf_tables_alloc_handle(table); 5604 INIT_LIST_HEAD(&set->pending_update); 5605 5606 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 5607 if (err < 0) 5608 goto err_set_expr_alloc; 5609 5610 list_add_tail_rcu(&set->list, &table->sets); 5611 5612 return 0; 5613 5614 err_set_expr_alloc: 5615 for (i = 0; i < set->num_exprs; i++) 5616 nft_expr_destroy(&ctx, set->exprs[i]); 5617 err_set_destroy: 5618 ops->destroy(&ctx, set); 5619 err_set_init: 5620 kfree(set->name); 5621 err_set_name: 5622 kvfree(set); 5623 err_alloc: 5624 nft_use_dec_restore(&table->use); 5625 5626 return err; 5627 } 5628 5629 static void nft_set_catchall_destroy(const struct nft_ctx *ctx, 5630 struct nft_set *set) 5631 { 5632 struct nft_set_elem_catchall *next, *catchall; 5633 5634 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 5635 list_del_rcu(&catchall->list); 5636 nf_tables_set_elem_destroy(ctx, set, catchall->elem); 5637 kfree_rcu(catchall, rcu); 5638 } 5639 } 5640 5641 static void nft_set_put(struct nft_set *set) 5642 { 5643 if (refcount_dec_and_test(&set->refs)) { 5644 kfree(set->name); 5645 kvfree(set); 5646 } 5647 } 5648 5649 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 5650 { 5651 int i; 5652 5653 if (WARN_ON(set->use > 0)) 5654 return; 5655 5656 for (i = 0; i < set->num_exprs; i++) 5657 nft_expr_destroy(ctx, set->exprs[i]); 5658 5659 set->ops->destroy(ctx, set); 5660 nft_set_catchall_destroy(ctx, set); 5661 nft_set_put(set); 5662 } 5663 5664 static int nf_tables_delset(struct sk_buff *skb, const struct nfnl_info *info, 5665 const struct nlattr * const nla[]) 5666 { 5667 struct netlink_ext_ack *extack = info->extack; 5668 u8 genmask = nft_genmask_next(info->net); 5669 u8 family = info->nfmsg->nfgen_family; 5670 struct net *net = info->net; 5671 const struct nlattr *attr; 5672 struct nft_table *table; 5673 struct nft_set *set; 5674 struct nft_ctx ctx; 5675 5676 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 5677 return -EAFNOSUPPORT; 5678 5679 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 5680 genmask, NETLINK_CB(skb).portid); 5681 if (IS_ERR(table)) { 5682 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5683 return PTR_ERR(table); 5684 } 5685 5686 if (nla[NFTA_SET_HANDLE]) { 5687 attr = nla[NFTA_SET_HANDLE]; 5688 set = nft_set_lookup_byhandle(table, attr, genmask); 5689 } else { 5690 attr = nla[NFTA_SET_NAME]; 5691 set = nft_set_lookup(net, table, attr, genmask); 5692 } 5693 5694 if (IS_ERR(set)) { 5695 if (PTR_ERR(set) == -ENOENT && 5696 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSET) 5697 return 0; 5698 5699 NL_SET_BAD_ATTR(extack, attr); 5700 return PTR_ERR(set); 5701 } 5702 if (set->use || 5703 (info->nlh->nlmsg_flags & NLM_F_NONREC && 5704 atomic_read(&set->nelems) > 0)) { 5705 NL_SET_BAD_ATTR(extack, attr); 5706 return -EBUSY; 5707 } 5708 5709 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5710 5711 return nft_delset(&ctx, set); 5712 } 5713 5714 static int nft_validate_register_store(const struct nft_ctx *ctx, 5715 enum nft_registers reg, 5716 const struct nft_data *data, 5717 enum nft_data_types type, 5718 unsigned int len); 5719 5720 static int nft_setelem_data_validate(const struct nft_ctx *ctx, 5721 struct nft_set *set, 5722 struct nft_elem_priv *elem_priv) 5723 { 5724 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 5725 enum nft_registers dreg; 5726 5727 dreg = nft_type_to_reg(set->dtype); 5728 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 5729 set->dtype == NFT_DATA_VERDICT ? 5730 NFT_DATA_VERDICT : NFT_DATA_VALUE, 5731 set->dlen); 5732 } 5733 5734 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 5735 struct nft_set *set, 5736 const struct nft_set_iter *iter, 5737 struct nft_elem_priv *elem_priv) 5738 { 5739 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 5740 5741 if (!nft_set_elem_active(ext, iter->genmask)) 5742 return 0; 5743 5744 return nft_setelem_data_validate(ctx, set, elem_priv); 5745 } 5746 5747 static int nft_set_catchall_bind_check(const struct nft_ctx *ctx, 5748 struct nft_set *set) 5749 { 5750 u8 genmask = nft_genmask_next(ctx->net); 5751 struct nft_set_elem_catchall *catchall; 5752 struct nft_set_ext *ext; 5753 int ret = 0; 5754 5755 list_for_each_entry_rcu(catchall, &set->catchall_list, list, 5756 lockdep_commit_lock_is_held(ctx->net)) { 5757 ext = nft_set_elem_ext(set, catchall->elem); 5758 if (!nft_set_elem_active(ext, genmask)) 5759 continue; 5760 5761 ret = nft_setelem_data_validate(ctx, set, catchall->elem); 5762 if (ret < 0) 5763 break; 5764 } 5765 5766 return ret; 5767 } 5768 5769 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 5770 struct nft_set_binding *binding) 5771 { 5772 struct nft_set_binding *i; 5773 struct nft_set_iter iter = { 5774 .genmask = nft_genmask_next(ctx->net), 5775 .type = NFT_ITER_UPDATE, 5776 .fn = nf_tables_bind_check_setelem, 5777 }; 5778 5779 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5780 return -EBUSY; 5781 5782 if (binding->flags & NFT_SET_MAP) { 5783 /* If the set is already bound to the same chain all 5784 * jumps are already validated for that chain. 5785 */ 5786 list_for_each_entry(i, &set->bindings, list) { 5787 if (i->flags & NFT_SET_MAP && 5788 i->chain == binding->chain) 5789 goto bind; 5790 } 5791 5792 set->ops->walk(ctx, set, &iter); 5793 if (!iter.err) 5794 iter.err = nft_set_catchall_bind_check(ctx, set); 5795 5796 if (iter.err < 0) 5797 return iter.err; 5798 } 5799 bind: 5800 if (!nft_use_inc(&set->use)) 5801 return -EMFILE; 5802 5803 binding->chain = ctx->chain; 5804 list_add_tail_rcu(&binding->list, &set->bindings); 5805 nft_set_trans_bind(ctx, set); 5806 5807 return 0; 5808 } 5809 EXPORT_SYMBOL_GPL(nf_tables_bind_set); 5810 5811 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 5812 struct nft_set_binding *binding, bool event) 5813 { 5814 list_del_rcu(&binding->list); 5815 5816 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { 5817 list_del_rcu(&set->list); 5818 set->dead = 1; 5819 if (event) 5820 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, 5821 GFP_KERNEL); 5822 } 5823 } 5824 5825 static void nft_setelem_data_activate(const struct net *net, 5826 const struct nft_set *set, 5827 struct nft_elem_priv *elem_priv); 5828 5829 static int nft_mapelem_activate(const struct nft_ctx *ctx, 5830 struct nft_set *set, 5831 const struct nft_set_iter *iter, 5832 struct nft_elem_priv *elem_priv) 5833 { 5834 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 5835 5836 /* called from abort path, reverse check to undo changes. */ 5837 if (nft_set_elem_active(ext, iter->genmask)) 5838 return 0; 5839 5840 nft_clear(ctx->net, ext); 5841 nft_setelem_data_activate(ctx->net, set, elem_priv); 5842 5843 return 0; 5844 } 5845 5846 static void nft_map_catchall_activate(const struct nft_ctx *ctx, 5847 struct nft_set *set) 5848 { 5849 u8 genmask = nft_genmask_next(ctx->net); 5850 struct nft_set_elem_catchall *catchall; 5851 struct nft_set_ext *ext; 5852 5853 list_for_each_entry(catchall, &set->catchall_list, list) { 5854 ext = nft_set_elem_ext(set, catchall->elem); 5855 if (!nft_set_elem_active(ext, genmask)) 5856 continue; 5857 5858 nft_clear(ctx->net, ext); 5859 nft_setelem_data_activate(ctx->net, set, catchall->elem); 5860 break; 5861 } 5862 } 5863 5864 static void nft_map_activate(const struct nft_ctx *ctx, struct nft_set *set) 5865 { 5866 struct nft_set_iter iter = { 5867 .genmask = nft_genmask_next(ctx->net), 5868 .type = NFT_ITER_UPDATE, 5869 .fn = nft_mapelem_activate, 5870 }; 5871 5872 set->ops->walk(ctx, set, &iter); 5873 WARN_ON_ONCE(iter.err); 5874 5875 nft_map_catchall_activate(ctx, set); 5876 } 5877 5878 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) 5879 { 5880 if (nft_set_is_anonymous(set)) { 5881 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5882 nft_map_activate(ctx, set); 5883 5884 nft_clear(ctx->net, set); 5885 } 5886 5887 nft_use_inc_restore(&set->use); 5888 } 5889 EXPORT_SYMBOL_GPL(nf_tables_activate_set); 5890 5891 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, 5892 struct nft_set_binding *binding, 5893 enum nft_trans_phase phase) 5894 { 5895 WARN_ON_ONCE(!lockdep_commit_lock_is_held(ctx->net)); 5896 5897 switch (phase) { 5898 case NFT_TRANS_PREPARE_ERROR: 5899 nft_set_trans_unbind(ctx, set); 5900 if (nft_set_is_anonymous(set)) 5901 nft_deactivate_next(ctx->net, set); 5902 else 5903 list_del_rcu(&binding->list); 5904 5905 nft_use_dec(&set->use); 5906 break; 5907 case NFT_TRANS_PREPARE: 5908 if (nft_set_is_anonymous(set)) { 5909 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5910 nft_map_deactivate(ctx, set); 5911 5912 nft_deactivate_next(ctx->net, set); 5913 } 5914 nft_use_dec(&set->use); 5915 return; 5916 case NFT_TRANS_ABORT: 5917 case NFT_TRANS_RELEASE: 5918 if (nft_set_is_anonymous(set) && 5919 set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5920 nft_map_deactivate(ctx, set); 5921 5922 nft_use_dec(&set->use); 5923 fallthrough; 5924 default: 5925 nf_tables_unbind_set(ctx, set, binding, 5926 phase == NFT_TRANS_COMMIT); 5927 } 5928 } 5929 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set); 5930 5931 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set) 5932 { 5933 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5934 nft_set_destroy(ctx, set); 5935 } 5936 EXPORT_SYMBOL_GPL(nf_tables_destroy_set); 5937 5938 const struct nft_set_ext_type nft_set_ext_types[] = { 5939 [NFT_SET_EXT_KEY] = { 5940 .align = __alignof__(u32), 5941 }, 5942 [NFT_SET_EXT_DATA] = { 5943 .align = __alignof__(u32), 5944 }, 5945 [NFT_SET_EXT_EXPRESSIONS] = { 5946 .align = __alignof__(struct nft_set_elem_expr), 5947 }, 5948 [NFT_SET_EXT_OBJREF] = { 5949 .len = sizeof(struct nft_object *), 5950 .align = __alignof__(struct nft_object *), 5951 }, 5952 [NFT_SET_EXT_FLAGS] = { 5953 .len = sizeof(u8), 5954 .align = __alignof__(u8), 5955 }, 5956 [NFT_SET_EXT_TIMEOUT] = { 5957 .len = sizeof(struct nft_timeout), 5958 .align = __alignof__(struct nft_timeout), 5959 }, 5960 [NFT_SET_EXT_USERDATA] = { 5961 .len = sizeof(struct nft_userdata), 5962 .align = __alignof__(struct nft_userdata), 5963 }, 5964 [NFT_SET_EXT_KEY_END] = { 5965 .align = __alignof__(u32), 5966 }, 5967 }; 5968 5969 /* 5970 * Set elements 5971 */ 5972 5973 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 5974 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 5975 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 5976 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 5977 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 5978 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 }, 5979 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 5980 .len = NFT_USERDATA_MAXLEN }, 5981 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, 5982 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING, 5983 .len = NFT_OBJ_MAXNAMELEN - 1 }, 5984 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED }, 5985 [NFTA_SET_ELEM_EXPRESSIONS] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy), 5986 }; 5987 5988 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 5989 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING, 5990 .len = NFT_TABLE_MAXNAMELEN - 1 }, 5991 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING, 5992 .len = NFT_SET_MAXNAMELEN - 1 }, 5993 [NFTA_SET_ELEM_LIST_ELEMENTS] = NLA_POLICY_NESTED_ARRAY(nft_set_elem_policy), 5994 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 5995 }; 5996 5997 static int nft_set_elem_expr_dump(struct sk_buff *skb, 5998 const struct nft_set *set, 5999 const struct nft_set_ext *ext, 6000 bool reset) 6001 { 6002 struct nft_set_elem_expr *elem_expr; 6003 u32 size, num_exprs = 0; 6004 struct nft_expr *expr; 6005 struct nlattr *nest; 6006 6007 elem_expr = nft_set_ext_expr(ext); 6008 nft_setelem_expr_foreach(expr, elem_expr, size) 6009 num_exprs++; 6010 6011 if (num_exprs == 1) { 6012 expr = nft_setelem_expr_at(elem_expr, 0); 6013 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, reset) < 0) 6014 return -1; 6015 6016 return 0; 6017 } else if (num_exprs > 1) { 6018 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_EXPRESSIONS); 6019 if (nest == NULL) 6020 goto nla_put_failure; 6021 6022 nft_setelem_expr_foreach(expr, elem_expr, size) { 6023 expr = nft_setelem_expr_at(elem_expr, size); 6024 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 6025 goto nla_put_failure; 6026 } 6027 nla_nest_end(skb, nest); 6028 } 6029 return 0; 6030 6031 nla_put_failure: 6032 return -1; 6033 } 6034 6035 static int nf_tables_fill_setelem(struct sk_buff *skb, 6036 const struct nft_set *set, 6037 const struct nft_elem_priv *elem_priv, 6038 bool reset) 6039 { 6040 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6041 unsigned char *b = skb_tail_pointer(skb); 6042 struct nlattr *nest; 6043 6044 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 6045 if (nest == NULL) 6046 goto nla_put_failure; 6047 6048 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 6049 nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 6050 NFT_DATA_VALUE, set->klen) < 0) 6051 goto nla_put_failure; 6052 6053 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 6054 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext), 6055 NFT_DATA_VALUE, set->klen) < 0) 6056 goto nla_put_failure; 6057 6058 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6059 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 6060 nft_set_datatype(set), set->dlen) < 0) 6061 goto nla_put_failure; 6062 6063 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && 6064 nft_set_elem_expr_dump(skb, set, ext, reset)) 6065 goto nla_put_failure; 6066 6067 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 6068 nla_put_string(skb, NFTA_SET_ELEM_OBJREF, 6069 (*nft_set_ext_obj(ext))->key.name) < 0) 6070 goto nla_put_failure; 6071 6072 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 6073 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 6074 htonl(*nft_set_ext_flags(ext)))) 6075 goto nla_put_failure; 6076 6077 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) { 6078 u64 timeout = READ_ONCE(nft_set_ext_timeout(ext)->timeout); 6079 u64 set_timeout = READ_ONCE(set->timeout); 6080 __be64 msecs = 0; 6081 6082 if (set_timeout != timeout) { 6083 msecs = nf_jiffies64_to_msecs(timeout); 6084 if (nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, msecs, 6085 NFTA_SET_ELEM_PAD)) 6086 goto nla_put_failure; 6087 } 6088 6089 if (timeout > 0) { 6090 u64 expires, now = get_jiffies_64(); 6091 6092 expires = READ_ONCE(nft_set_ext_timeout(ext)->expiration); 6093 if (time_before64(now, expires)) 6094 expires -= now; 6095 else 6096 expires = 0; 6097 6098 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 6099 nf_jiffies64_to_msecs(expires), 6100 NFTA_SET_ELEM_PAD)) 6101 goto nla_put_failure; 6102 } 6103 } 6104 6105 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 6106 struct nft_userdata *udata; 6107 6108 udata = nft_set_ext_userdata(ext); 6109 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 6110 udata->len + 1, udata->data)) 6111 goto nla_put_failure; 6112 } 6113 6114 nla_nest_end(skb, nest); 6115 return 0; 6116 6117 nla_put_failure: 6118 nlmsg_trim(skb, b); 6119 return -EMSGSIZE; 6120 } 6121 6122 struct nft_set_dump_args { 6123 const struct netlink_callback *cb; 6124 struct nft_set_iter iter; 6125 struct sk_buff *skb; 6126 bool reset; 6127 }; 6128 6129 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 6130 struct nft_set *set, 6131 const struct nft_set_iter *iter, 6132 struct nft_elem_priv *elem_priv) 6133 { 6134 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6135 struct nft_set_dump_args *args; 6136 6137 if (!nft_set_elem_active(ext, iter->genmask)) 6138 return 0; 6139 6140 if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext)) 6141 return 0; 6142 6143 args = container_of(iter, struct nft_set_dump_args, iter); 6144 return nf_tables_fill_setelem(args->skb, set, elem_priv, args->reset); 6145 } 6146 6147 static void audit_log_nft_set_reset(const struct nft_table *table, 6148 unsigned int base_seq, 6149 unsigned int nentries) 6150 { 6151 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq); 6152 6153 audit_log_nfcfg(buf, table->family, nentries, 6154 AUDIT_NFT_OP_SETELEM_RESET, GFP_ATOMIC); 6155 kfree(buf); 6156 } 6157 6158 struct nft_set_dump_ctx { 6159 const struct nft_set *set; 6160 struct nft_ctx ctx; 6161 bool reset; 6162 }; 6163 6164 static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb, 6165 const struct nft_set *set, bool reset, 6166 unsigned int base_seq) 6167 { 6168 struct nft_set_elem_catchall *catchall; 6169 u8 genmask = nft_genmask_cur(net); 6170 struct nft_set_ext *ext; 6171 int ret = 0; 6172 6173 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6174 ext = nft_set_elem_ext(set, catchall->elem); 6175 if (!nft_set_elem_active(ext, genmask) || 6176 nft_set_elem_expired(ext)) 6177 continue; 6178 6179 ret = nf_tables_fill_setelem(skb, set, catchall->elem, reset); 6180 if (reset && !ret) 6181 audit_log_nft_set_reset(set->table, base_seq, 1); 6182 break; 6183 } 6184 6185 return ret; 6186 } 6187 6188 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 6189 { 6190 struct nft_set_dump_ctx *dump_ctx = cb->data; 6191 struct net *net = sock_net(skb->sk); 6192 struct nftables_pernet *nft_net; 6193 struct nft_table *table; 6194 struct nft_set *set; 6195 struct nft_set_dump_args args = { 6196 .cb = cb, 6197 .skb = skb, 6198 .reset = dump_ctx->reset, 6199 .iter = { 6200 .genmask = nft_genmask_cur(net), 6201 .type = NFT_ITER_READ, 6202 .skip = cb->args[0], 6203 .fn = nf_tables_dump_setelem, 6204 }, 6205 }; 6206 bool set_found = false; 6207 struct nlmsghdr *nlh; 6208 struct nlattr *nest; 6209 u32 portid, seq; 6210 int event; 6211 6212 rcu_read_lock(); 6213 nft_net = nft_pernet(net); 6214 cb->seq = nft_base_seq(net); 6215 6216 list_for_each_entry_rcu(table, &nft_net->tables, list) { 6217 if (dump_ctx->ctx.family != NFPROTO_UNSPEC && 6218 dump_ctx->ctx.family != table->family) 6219 continue; 6220 6221 if (table != dump_ctx->ctx.table) 6222 continue; 6223 6224 list_for_each_entry_rcu(set, &table->sets, list) { 6225 if (set == dump_ctx->set) { 6226 set_found = true; 6227 break; 6228 } 6229 } 6230 break; 6231 } 6232 6233 if (!set_found) { 6234 rcu_read_unlock(); 6235 return -ENOENT; 6236 } 6237 6238 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM); 6239 portid = NETLINK_CB(cb->skb).portid; 6240 seq = cb->nlh->nlmsg_seq; 6241 6242 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, 6243 table->family, NFNETLINK_V0, nft_base_seq_be16(net)); 6244 if (!nlh) 6245 goto nla_put_failure; 6246 6247 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) 6248 goto nla_put_failure; 6249 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 6250 goto nla_put_failure; 6251 6252 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 6253 if (nest == NULL) 6254 goto nla_put_failure; 6255 6256 set->ops->walk(&dump_ctx->ctx, set, &args.iter); 6257 6258 if (!args.iter.err && args.iter.count == cb->args[0]) 6259 args.iter.err = nft_set_catchall_dump(net, skb, set, 6260 dump_ctx->reset, cb->seq); 6261 nla_nest_end(skb, nest); 6262 nlmsg_end(skb, nlh); 6263 6264 rcu_read_unlock(); 6265 6266 if (args.iter.err && args.iter.err != -EMSGSIZE) 6267 return args.iter.err; 6268 if (args.iter.count == cb->args[0]) 6269 return 0; 6270 6271 cb->args[0] = args.iter.count; 6272 return skb->len; 6273 6274 nla_put_failure: 6275 rcu_read_unlock(); 6276 return -ENOSPC; 6277 } 6278 6279 static int nf_tables_dumpreset_set(struct sk_buff *skb, 6280 struct netlink_callback *cb) 6281 { 6282 struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); 6283 struct nft_set_dump_ctx *dump_ctx = cb->data; 6284 int ret, skip = cb->args[0]; 6285 6286 mutex_lock(&nft_net->commit_mutex); 6287 6288 ret = nf_tables_dump_set(skb, cb); 6289 6290 if (cb->args[0] > skip) 6291 audit_log_nft_set_reset(dump_ctx->ctx.table, cb->seq, 6292 cb->args[0] - skip); 6293 6294 mutex_unlock(&nft_net->commit_mutex); 6295 6296 return ret; 6297 } 6298 6299 static int nf_tables_dump_set_start(struct netlink_callback *cb) 6300 { 6301 struct nft_set_dump_ctx *dump_ctx = cb->data; 6302 6303 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC); 6304 6305 return cb->data ? 0 : -ENOMEM; 6306 } 6307 6308 static int nf_tables_dump_set_done(struct netlink_callback *cb) 6309 { 6310 kfree(cb->data); 6311 return 0; 6312 } 6313 6314 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 6315 const struct nft_ctx *ctx, u32 seq, 6316 u32 portid, int event, u16 flags, 6317 const struct nft_set *set, 6318 const struct nft_elem_priv *elem_priv, 6319 bool reset) 6320 { 6321 struct nlmsghdr *nlh; 6322 struct nlattr *nest; 6323 int err; 6324 6325 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 6326 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 6327 NFNETLINK_V0, nft_base_seq_be16(ctx->net)); 6328 if (!nlh) 6329 goto nla_put_failure; 6330 6331 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 6332 goto nla_put_failure; 6333 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 6334 goto nla_put_failure; 6335 6336 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 6337 if (nest == NULL) 6338 goto nla_put_failure; 6339 6340 err = nf_tables_fill_setelem(skb, set, elem_priv, reset); 6341 if (err < 0) 6342 goto nla_put_failure; 6343 6344 nla_nest_end(skb, nest); 6345 6346 nlmsg_end(skb, nlh); 6347 return 0; 6348 6349 nla_put_failure: 6350 nlmsg_trim(skb, nlh); 6351 return -1; 6352 } 6353 6354 static int nft_setelem_parse_flags(const struct nft_set *set, 6355 const struct nlattr *attr, u32 *flags) 6356 { 6357 if (attr == NULL) 6358 return 0; 6359 6360 *flags = ntohl(nla_get_be32(attr)); 6361 if (*flags & ~(NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 6362 return -EOPNOTSUPP; 6363 if (!(set->flags & NFT_SET_INTERVAL) && 6364 *flags & NFT_SET_ELEM_INTERVAL_END) 6365 return -EINVAL; 6366 if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == 6367 (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 6368 return -EINVAL; 6369 6370 return 0; 6371 } 6372 6373 static int nft_setelem_parse_key(struct nft_ctx *ctx, const struct nft_set *set, 6374 struct nft_data *key, struct nlattr *attr) 6375 { 6376 struct nft_data_desc desc = { 6377 .type = NFT_DATA_VALUE, 6378 .size = NFT_DATA_VALUE_MAXLEN, 6379 .len = set->klen, 6380 }; 6381 6382 return nft_data_init(ctx, key, &desc, attr); 6383 } 6384 6385 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, 6386 struct nft_data_desc *desc, 6387 struct nft_data *data, 6388 struct nlattr *attr) 6389 { 6390 u32 dtype; 6391 6392 if (set->dtype == NFT_DATA_VERDICT) 6393 dtype = NFT_DATA_VERDICT; 6394 else 6395 dtype = NFT_DATA_VALUE; 6396 6397 desc->type = dtype; 6398 desc->size = NFT_DATA_VALUE_MAXLEN; 6399 desc->len = set->dlen; 6400 desc->flags = NFT_DATA_DESC_SETELEM; 6401 6402 return nft_data_init(ctx, data, desc, attr); 6403 } 6404 6405 static void *nft_setelem_catchall_get(const struct net *net, 6406 const struct nft_set *set) 6407 { 6408 struct nft_set_elem_catchall *catchall; 6409 u8 genmask = nft_genmask_cur(net); 6410 struct nft_set_ext *ext; 6411 void *priv = NULL; 6412 6413 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6414 ext = nft_set_elem_ext(set, catchall->elem); 6415 if (!nft_set_elem_active(ext, genmask) || 6416 nft_set_elem_expired(ext)) 6417 continue; 6418 6419 priv = catchall->elem; 6420 break; 6421 } 6422 6423 return priv; 6424 } 6425 6426 static int nft_setelem_get(struct nft_ctx *ctx, const struct nft_set *set, 6427 struct nft_set_elem *elem, u32 flags) 6428 { 6429 void *priv; 6430 6431 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 6432 priv = set->ops->get(ctx->net, set, elem, flags); 6433 if (IS_ERR(priv)) 6434 return PTR_ERR(priv); 6435 } else { 6436 priv = nft_setelem_catchall_get(ctx->net, set); 6437 if (!priv) 6438 return -ENOENT; 6439 } 6440 elem->priv = priv; 6441 6442 return 0; 6443 } 6444 6445 static int nft_get_set_elem(struct nft_ctx *ctx, const struct nft_set *set, 6446 const struct nlattr *attr, bool reset) 6447 { 6448 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6449 struct nft_set_elem elem; 6450 struct sk_buff *skb; 6451 uint32_t flags = 0; 6452 int err; 6453 6454 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6455 nft_set_elem_policy, NULL); 6456 if (err < 0) 6457 return err; 6458 6459 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6460 if (err < 0) 6461 return err; 6462 6463 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 6464 return -EINVAL; 6465 6466 if (nla[NFTA_SET_ELEM_KEY]) { 6467 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6468 nla[NFTA_SET_ELEM_KEY]); 6469 if (err < 0) 6470 return err; 6471 } 6472 6473 if (nla[NFTA_SET_ELEM_KEY_END]) { 6474 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6475 nla[NFTA_SET_ELEM_KEY_END]); 6476 if (err < 0) 6477 return err; 6478 } 6479 6480 err = nft_setelem_get(ctx, set, &elem, flags); 6481 if (err < 0) 6482 return err; 6483 6484 err = -ENOMEM; 6485 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 6486 if (skb == NULL) 6487 return err; 6488 6489 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, 6490 NFT_MSG_NEWSETELEM, 0, set, elem.priv, 6491 reset); 6492 if (err < 0) 6493 goto err_fill_setelem; 6494 6495 return nfnetlink_unicast(skb, ctx->net, ctx->portid); 6496 6497 err_fill_setelem: 6498 kfree_skb(skb); 6499 return err; 6500 } 6501 6502 static int nft_set_dump_ctx_init(struct nft_set_dump_ctx *dump_ctx, 6503 const struct sk_buff *skb, 6504 const struct nfnl_info *info, 6505 const struct nlattr * const nla[], 6506 bool reset) 6507 { 6508 struct netlink_ext_ack *extack = info->extack; 6509 u8 genmask = nft_genmask_cur(info->net); 6510 u8 family = info->nfmsg->nfgen_family; 6511 struct net *net = info->net; 6512 struct nft_table *table; 6513 struct nft_set *set; 6514 6515 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6516 genmask, 0); 6517 if (IS_ERR(table)) { 6518 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6519 return PTR_ERR(table); 6520 } 6521 6522 set = nft_set_lookup(net, table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 6523 if (IS_ERR(set)) { 6524 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_SET]); 6525 return PTR_ERR(set); 6526 } 6527 6528 nft_ctx_init(&dump_ctx->ctx, net, skb, 6529 info->nlh, family, table, NULL, nla); 6530 dump_ctx->set = set; 6531 dump_ctx->reset = reset; 6532 return 0; 6533 } 6534 6535 /* called with rcu_read_lock held */ 6536 static int nf_tables_getsetelem(struct sk_buff *skb, 6537 const struct nfnl_info *info, 6538 const struct nlattr * const nla[]) 6539 { 6540 struct netlink_ext_ack *extack = info->extack; 6541 struct nft_set_dump_ctx dump_ctx; 6542 struct nlattr *attr; 6543 int rem, err = 0; 6544 6545 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 6546 struct netlink_dump_control c = { 6547 .start = nf_tables_dump_set_start, 6548 .dump = nf_tables_dump_set, 6549 .done = nf_tables_dump_set_done, 6550 .module = THIS_MODULE, 6551 }; 6552 6553 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, false); 6554 if (err) 6555 return err; 6556 6557 c.data = &dump_ctx; 6558 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 6559 } 6560 6561 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6562 return -EINVAL; 6563 6564 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, false); 6565 if (err) 6566 return err; 6567 6568 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6569 err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, false); 6570 if (err < 0) { 6571 NL_SET_BAD_ATTR(extack, attr); 6572 break; 6573 } 6574 } 6575 6576 return err; 6577 } 6578 6579 static int nf_tables_getsetelem_reset(struct sk_buff *skb, 6580 const struct nfnl_info *info, 6581 const struct nlattr * const nla[]) 6582 { 6583 struct nftables_pernet *nft_net = nft_pernet(info->net); 6584 struct netlink_ext_ack *extack = info->extack; 6585 struct nft_set_dump_ctx dump_ctx; 6586 int rem, err = 0, nelems = 0; 6587 struct nlattr *attr; 6588 6589 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 6590 struct netlink_dump_control c = { 6591 .start = nf_tables_dump_set_start, 6592 .dump = nf_tables_dumpreset_set, 6593 .done = nf_tables_dump_set_done, 6594 .module = THIS_MODULE, 6595 }; 6596 6597 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, true); 6598 if (err) 6599 return err; 6600 6601 c.data = &dump_ctx; 6602 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 6603 } 6604 6605 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6606 return -EINVAL; 6607 6608 if (!try_module_get(THIS_MODULE)) 6609 return -EINVAL; 6610 rcu_read_unlock(); 6611 mutex_lock(&nft_net->commit_mutex); 6612 rcu_read_lock(); 6613 6614 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, true); 6615 if (err) 6616 goto out_unlock; 6617 6618 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6619 err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, true); 6620 if (err < 0) { 6621 NL_SET_BAD_ATTR(extack, attr); 6622 break; 6623 } 6624 nelems++; 6625 } 6626 audit_log_nft_set_reset(dump_ctx.ctx.table, nft_base_seq(info->net), nelems); 6627 6628 out_unlock: 6629 rcu_read_unlock(); 6630 mutex_unlock(&nft_net->commit_mutex); 6631 rcu_read_lock(); 6632 module_put(THIS_MODULE); 6633 6634 return err; 6635 } 6636 6637 static void nf_tables_setelem_notify(const struct nft_ctx *ctx, 6638 const struct nft_set *set, 6639 const struct nft_elem_priv *elem_priv, 6640 int event) 6641 { 6642 struct nftables_pernet *nft_net; 6643 struct net *net = ctx->net; 6644 u32 portid = ctx->portid; 6645 struct sk_buff *skb; 6646 u16 flags = 0; 6647 int err; 6648 6649 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 6650 return; 6651 6652 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 6653 if (skb == NULL) 6654 goto err; 6655 6656 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 6657 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 6658 6659 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 6660 set, elem_priv, false); 6661 if (err < 0) { 6662 kfree_skb(skb); 6663 goto err; 6664 } 6665 6666 nft_net = nft_pernet(net); 6667 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 6668 return; 6669 err: 6670 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 6671 } 6672 6673 static struct nft_trans *nft_trans_elem_alloc(const struct nft_ctx *ctx, 6674 int msg_type, 6675 struct nft_set *set) 6676 { 6677 struct nft_trans_elem *te; 6678 struct nft_trans *trans; 6679 6680 trans = nft_trans_alloc(ctx, msg_type, struct_size(te, elems, 1)); 6681 if (trans == NULL) 6682 return NULL; 6683 6684 te = nft_trans_container_elem(trans); 6685 te->nelems = 1; 6686 te->set = set; 6687 6688 return trans; 6689 } 6690 6691 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, 6692 const struct nft_set *set, 6693 const struct nlattr *attr) 6694 { 6695 struct nft_expr *expr; 6696 int err; 6697 6698 expr = nft_expr_init(ctx, attr); 6699 if (IS_ERR(expr)) 6700 return expr; 6701 6702 err = -EOPNOTSUPP; 6703 if (expr->ops->type->flags & NFT_EXPR_GC) { 6704 if (set->flags & NFT_SET_TIMEOUT) 6705 goto err_set_elem_expr; 6706 if (!set->ops->gc_init) 6707 goto err_set_elem_expr; 6708 set->ops->gc_init(set); 6709 } 6710 6711 return expr; 6712 6713 err_set_elem_expr: 6714 nft_expr_destroy(ctx, expr); 6715 return ERR_PTR(err); 6716 } 6717 6718 static int nft_set_ext_check(const struct nft_set_ext_tmpl *tmpl, u8 id, u32 len) 6719 { 6720 len += nft_set_ext_types[id].len; 6721 if (len > tmpl->ext_len[id] || 6722 len > U8_MAX) 6723 return -1; 6724 6725 return 0; 6726 } 6727 6728 static int nft_set_ext_memcpy(const struct nft_set_ext_tmpl *tmpl, u8 id, 6729 void *to, const void *from, u32 len) 6730 { 6731 if (nft_set_ext_check(tmpl, id, len) < 0) 6732 return -1; 6733 6734 memcpy(to, from, len); 6735 6736 return 0; 6737 } 6738 6739 struct nft_elem_priv *nft_set_elem_init(const struct nft_set *set, 6740 const struct nft_set_ext_tmpl *tmpl, 6741 const u32 *key, const u32 *key_end, 6742 const u32 *data, 6743 u64 timeout, u64 expiration, gfp_t gfp) 6744 { 6745 struct nft_set_ext *ext; 6746 void *elem; 6747 6748 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 6749 if (elem == NULL) 6750 return ERR_PTR(-ENOMEM); 6751 6752 ext = nft_set_elem_ext(set, elem); 6753 nft_set_ext_init(ext, tmpl); 6754 6755 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 6756 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY, 6757 nft_set_ext_key(ext), key, set->klen) < 0) 6758 goto err_ext_check; 6759 6760 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 6761 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY_END, 6762 nft_set_ext_key_end(ext), key_end, set->klen) < 0) 6763 goto err_ext_check; 6764 6765 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6766 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_DATA, 6767 nft_set_ext_data(ext), data, set->dlen) < 0) 6768 goto err_ext_check; 6769 6770 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) { 6771 nft_set_ext_timeout(ext)->timeout = timeout; 6772 6773 if (expiration == 0) 6774 expiration = timeout; 6775 6776 nft_set_ext_timeout(ext)->expiration = get_jiffies_64() + expiration; 6777 } 6778 6779 return elem; 6780 6781 err_ext_check: 6782 kfree(elem); 6783 6784 return ERR_PTR(-EINVAL); 6785 } 6786 6787 static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 6788 struct nft_expr *expr) 6789 { 6790 if (expr->ops->destroy_clone) { 6791 expr->ops->destroy_clone(ctx, expr); 6792 module_put(expr->ops->type->owner); 6793 } else { 6794 nf_tables_expr_destroy(ctx, expr); 6795 } 6796 } 6797 6798 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 6799 struct nft_set_elem_expr *elem_expr) 6800 { 6801 struct nft_expr *expr; 6802 u32 size; 6803 6804 nft_setelem_expr_foreach(expr, elem_expr, size) 6805 __nft_set_elem_expr_destroy(ctx, expr); 6806 } 6807 6808 /* Drop references and destroy. Called from gc, dynset and abort path. */ 6809 static void __nft_set_elem_destroy(const struct nft_ctx *ctx, 6810 const struct nft_set *set, 6811 const struct nft_elem_priv *elem_priv, 6812 bool destroy_expr) 6813 { 6814 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6815 6816 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE); 6817 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6818 nft_data_release(nft_set_ext_data(ext), set->dtype); 6819 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 6820 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 6821 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6822 nft_use_dec(&(*nft_set_ext_obj(ext))->use); 6823 6824 kfree(elem_priv); 6825 } 6826 6827 /* Drop references and destroy. Called from gc and dynset. */ 6828 void nft_set_elem_destroy(const struct nft_set *set, 6829 const struct nft_elem_priv *elem_priv, 6830 bool destroy_expr) 6831 { 6832 struct nft_ctx ctx = { 6833 .net = read_pnet(&set->net), 6834 .family = set->table->family, 6835 }; 6836 6837 __nft_set_elem_destroy(&ctx, set, elem_priv, destroy_expr); 6838 } 6839 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 6840 6841 /* Drop references and destroy. Called from abort path. */ 6842 static void nft_trans_set_elem_destroy(const struct nft_ctx *ctx, struct nft_trans_elem *te) 6843 { 6844 int i; 6845 6846 for (i = 0; i < te->nelems; i++) { 6847 /* skip update request, see nft_trans_elems_new_abort() */ 6848 if (!te->elems[i].priv) 6849 continue; 6850 6851 __nft_set_elem_destroy(ctx, te->set, te->elems[i].priv, true); 6852 } 6853 } 6854 6855 /* Destroy element. References have been already dropped in the preparation 6856 * path via nft_setelem_data_deactivate(). 6857 */ 6858 void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, 6859 const struct nft_set *set, 6860 const struct nft_elem_priv *elem_priv) 6861 { 6862 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6863 6864 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 6865 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 6866 6867 kfree(elem_priv); 6868 } 6869 6870 static void nft_trans_elems_destroy(const struct nft_ctx *ctx, 6871 const struct nft_trans_elem *te) 6872 { 6873 int i; 6874 6875 for (i = 0; i < te->nelems; i++) 6876 nf_tables_set_elem_destroy(ctx, te->set, te->elems[i].priv); 6877 } 6878 6879 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 6880 struct nft_expr *expr_array[]) 6881 { 6882 struct nft_expr *expr; 6883 int err, i, k; 6884 6885 for (i = 0; i < set->num_exprs; i++) { 6886 expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT); 6887 if (!expr) 6888 goto err_expr; 6889 6890 err = nft_expr_clone(expr, set->exprs[i], GFP_KERNEL_ACCOUNT); 6891 if (err < 0) { 6892 kfree(expr); 6893 goto err_expr; 6894 } 6895 expr_array[i] = expr; 6896 } 6897 6898 return 0; 6899 6900 err_expr: 6901 for (k = i - 1; k >= 0; k--) 6902 nft_expr_destroy(ctx, expr_array[k]); 6903 6904 return -ENOMEM; 6905 } 6906 6907 static int nft_set_elem_expr_setup(struct nft_ctx *ctx, 6908 const struct nft_set_ext_tmpl *tmpl, 6909 const struct nft_set_ext *ext, 6910 struct nft_expr *expr_array[], 6911 u32 num_exprs) 6912 { 6913 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 6914 u32 len = sizeof(struct nft_set_elem_expr); 6915 struct nft_expr *expr; 6916 int i, err; 6917 6918 if (num_exprs == 0) 6919 return 0; 6920 6921 for (i = 0; i < num_exprs; i++) 6922 len += expr_array[i]->ops->size; 6923 6924 if (nft_set_ext_check(tmpl, NFT_SET_EXT_EXPRESSIONS, len) < 0) 6925 return -EINVAL; 6926 6927 for (i = 0; i < num_exprs; i++) { 6928 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 6929 err = nft_expr_clone(expr, expr_array[i], GFP_KERNEL_ACCOUNT); 6930 if (err < 0) 6931 goto err_elem_expr_setup; 6932 6933 elem_expr->size += expr_array[i]->ops->size; 6934 nft_expr_destroy(ctx, expr_array[i]); 6935 expr_array[i] = NULL; 6936 } 6937 6938 return 0; 6939 6940 err_elem_expr_setup: 6941 for (; i < num_exprs; i++) { 6942 nft_expr_destroy(ctx, expr_array[i]); 6943 expr_array[i] = NULL; 6944 } 6945 6946 return -ENOMEM; 6947 } 6948 6949 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, 6950 const struct nft_set *set) 6951 { 6952 struct nft_set_elem_catchall *catchall; 6953 u8 genmask = nft_genmask_cur(net); 6954 struct nft_set_ext *ext; 6955 6956 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6957 ext = nft_set_elem_ext(set, catchall->elem); 6958 if (nft_set_elem_active(ext, genmask) && 6959 !nft_set_elem_expired(ext) && 6960 !nft_set_elem_is_dead(ext)) 6961 return ext; 6962 } 6963 6964 return NULL; 6965 } 6966 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup); 6967 6968 static int nft_setelem_catchall_insert(const struct net *net, 6969 struct nft_set *set, 6970 const struct nft_set_elem *elem, 6971 struct nft_elem_priv **priv) 6972 { 6973 struct nft_set_elem_catchall *catchall; 6974 u8 genmask = nft_genmask_next(net); 6975 struct nft_set_ext *ext; 6976 6977 list_for_each_entry(catchall, &set->catchall_list, list) { 6978 ext = nft_set_elem_ext(set, catchall->elem); 6979 if (nft_set_elem_active(ext, genmask)) { 6980 *priv = catchall->elem; 6981 return -EEXIST; 6982 } 6983 } 6984 6985 catchall = kmalloc(sizeof(*catchall), GFP_KERNEL_ACCOUNT); 6986 if (!catchall) 6987 return -ENOMEM; 6988 6989 catchall->elem = elem->priv; 6990 list_add_tail_rcu(&catchall->list, &set->catchall_list); 6991 6992 return 0; 6993 } 6994 6995 static int nft_setelem_insert(const struct net *net, 6996 struct nft_set *set, 6997 const struct nft_set_elem *elem, 6998 struct nft_elem_priv **elem_priv, 6999 unsigned int flags) 7000 { 7001 int ret; 7002 7003 if (flags & NFT_SET_ELEM_CATCHALL) 7004 ret = nft_setelem_catchall_insert(net, set, elem, elem_priv); 7005 else 7006 ret = set->ops->insert(net, set, elem, elem_priv); 7007 7008 return ret; 7009 } 7010 7011 static bool nft_setelem_is_catchall(const struct nft_set *set, 7012 const struct nft_elem_priv *elem_priv) 7013 { 7014 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7015 7016 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 7017 *nft_set_ext_flags(ext) & NFT_SET_ELEM_CATCHALL) 7018 return true; 7019 7020 return false; 7021 } 7022 7023 static void nft_setelem_activate(struct net *net, struct nft_set *set, 7024 struct nft_elem_priv *elem_priv) 7025 { 7026 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7027 7028 if (nft_setelem_is_catchall(set, elem_priv)) { 7029 nft_clear(net, ext); 7030 } else { 7031 set->ops->activate(net, set, elem_priv); 7032 } 7033 } 7034 7035 static void nft_trans_elem_update(const struct nft_set *set, 7036 const struct nft_trans_one_elem *elem) 7037 { 7038 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 7039 const struct nft_elem_update *update = elem->update; 7040 7041 if (update->flags & NFT_TRANS_UPD_TIMEOUT) 7042 WRITE_ONCE(nft_set_ext_timeout(ext)->timeout, update->timeout); 7043 7044 if (update->flags & NFT_TRANS_UPD_EXPIRATION) 7045 WRITE_ONCE(nft_set_ext_timeout(ext)->expiration, get_jiffies_64() + update->expiration); 7046 } 7047 7048 static void nft_trans_elems_add(const struct nft_ctx *ctx, 7049 struct nft_trans_elem *te) 7050 { 7051 int i; 7052 7053 for (i = 0; i < te->nelems; i++) { 7054 struct nft_trans_one_elem *elem = &te->elems[i]; 7055 7056 if (elem->update) 7057 nft_trans_elem_update(te->set, elem); 7058 else 7059 nft_setelem_activate(ctx->net, te->set, elem->priv); 7060 7061 nf_tables_setelem_notify(ctx, te->set, elem->priv, 7062 NFT_MSG_NEWSETELEM); 7063 kfree(elem->update); 7064 } 7065 } 7066 7067 static int nft_setelem_catchall_deactivate(const struct net *net, 7068 struct nft_set *set, 7069 struct nft_set_elem *elem) 7070 { 7071 struct nft_set_elem_catchall *catchall; 7072 struct nft_set_ext *ext; 7073 7074 list_for_each_entry(catchall, &set->catchall_list, list) { 7075 ext = nft_set_elem_ext(set, catchall->elem); 7076 if (!nft_is_active_next(net, ext)) 7077 continue; 7078 7079 kfree(elem->priv); 7080 elem->priv = catchall->elem; 7081 nft_set_elem_change_active(net, set, ext); 7082 return 0; 7083 } 7084 7085 return -ENOENT; 7086 } 7087 7088 static int __nft_setelem_deactivate(const struct net *net, 7089 struct nft_set *set, 7090 struct nft_set_elem *elem) 7091 { 7092 void *priv; 7093 7094 priv = set->ops->deactivate(net, set, elem); 7095 if (!priv) 7096 return -ENOENT; 7097 7098 kfree(elem->priv); 7099 elem->priv = priv; 7100 set->ndeact++; 7101 7102 return 0; 7103 } 7104 7105 static int nft_setelem_deactivate(const struct net *net, 7106 struct nft_set *set, 7107 struct nft_set_elem *elem, u32 flags) 7108 { 7109 int ret; 7110 7111 if (flags & NFT_SET_ELEM_CATCHALL) 7112 ret = nft_setelem_catchall_deactivate(net, set, elem); 7113 else 7114 ret = __nft_setelem_deactivate(net, set, elem); 7115 7116 return ret; 7117 } 7118 7119 static void nft_setelem_catchall_destroy(struct nft_set_elem_catchall *catchall) 7120 { 7121 list_del_rcu(&catchall->list); 7122 kfree_rcu(catchall, rcu); 7123 } 7124 7125 static void nft_setelem_catchall_remove(const struct net *net, 7126 const struct nft_set *set, 7127 struct nft_elem_priv *elem_priv) 7128 { 7129 struct nft_set_elem_catchall *catchall, *next; 7130 7131 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 7132 if (catchall->elem == elem_priv) { 7133 nft_setelem_catchall_destroy(catchall); 7134 break; 7135 } 7136 } 7137 } 7138 7139 static void nft_setelem_remove(const struct net *net, 7140 const struct nft_set *set, 7141 struct nft_elem_priv *elem_priv) 7142 { 7143 if (nft_setelem_is_catchall(set, elem_priv)) 7144 nft_setelem_catchall_remove(net, set, elem_priv); 7145 else 7146 set->ops->remove(net, set, elem_priv); 7147 } 7148 7149 static void nft_trans_elems_remove(const struct nft_ctx *ctx, 7150 const struct nft_trans_elem *te) 7151 { 7152 int i; 7153 7154 for (i = 0; i < te->nelems; i++) { 7155 WARN_ON_ONCE(te->elems[i].update); 7156 7157 nf_tables_setelem_notify(ctx, te->set, 7158 te->elems[i].priv, 7159 te->nft_trans.msg_type); 7160 7161 nft_setelem_remove(ctx->net, te->set, te->elems[i].priv); 7162 if (!nft_setelem_is_catchall(te->set, te->elems[i].priv)) { 7163 atomic_dec(&te->set->nelems); 7164 te->set->ndeact--; 7165 } 7166 } 7167 } 7168 7169 static bool nft_setelem_valid_key_end(const struct nft_set *set, 7170 struct nlattr **nla, u32 flags) 7171 { 7172 if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) == 7173 (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { 7174 if (flags & NFT_SET_ELEM_INTERVAL_END) 7175 return false; 7176 7177 if (nla[NFTA_SET_ELEM_KEY_END] && 7178 flags & NFT_SET_ELEM_CATCHALL) 7179 return false; 7180 } else { 7181 if (nla[NFTA_SET_ELEM_KEY_END]) 7182 return false; 7183 } 7184 7185 return true; 7186 } 7187 7188 static u32 nft_set_maxsize(const struct nft_set *set) 7189 { 7190 u32 maxsize, delta; 7191 7192 if (!set->size) 7193 return UINT_MAX; 7194 7195 if (set->ops->adjust_maxsize) 7196 delta = set->ops->adjust_maxsize(set); 7197 else 7198 delta = 0; 7199 7200 if (check_add_overflow(set->size, set->ndeact, &maxsize)) 7201 return UINT_MAX; 7202 7203 if (check_add_overflow(maxsize, delta, &maxsize)) 7204 return UINT_MAX; 7205 7206 return maxsize; 7207 } 7208 7209 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 7210 const struct nlattr *attr, u32 nlmsg_flags) 7211 { 7212 struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {}; 7213 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 7214 u8 genmask = nft_genmask_next(ctx->net); 7215 u32 flags = 0, size = 0, num_exprs = 0; 7216 struct nft_set_ext_tmpl tmpl; 7217 struct nft_set_ext *ext, *ext2; 7218 struct nft_set_elem elem; 7219 struct nft_set_binding *binding; 7220 struct nft_elem_priv *elem_priv; 7221 struct nft_object *obj = NULL; 7222 struct nft_userdata *udata; 7223 struct nft_data_desc desc; 7224 enum nft_registers dreg; 7225 struct nft_trans *trans; 7226 u64 expiration; 7227 u64 timeout; 7228 int err, i; 7229 u8 ulen; 7230 7231 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 7232 nft_set_elem_policy, NULL); 7233 if (err < 0) 7234 return err; 7235 7236 nft_set_ext_prepare(&tmpl); 7237 7238 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 7239 if (err < 0) 7240 return err; 7241 7242 if (((flags & NFT_SET_ELEM_CATCHALL) && nla[NFTA_SET_ELEM_KEY]) || 7243 (!(flags & NFT_SET_ELEM_CATCHALL) && !nla[NFTA_SET_ELEM_KEY])) 7244 return -EINVAL; 7245 7246 if (flags != 0) { 7247 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 7248 if (err < 0) 7249 return err; 7250 } 7251 7252 if (set->flags & NFT_SET_MAP) { 7253 if (nla[NFTA_SET_ELEM_DATA] == NULL && 7254 !(flags & NFT_SET_ELEM_INTERVAL_END)) 7255 return -EINVAL; 7256 } else { 7257 if (nla[NFTA_SET_ELEM_DATA] != NULL) 7258 return -EINVAL; 7259 } 7260 7261 if (set->flags & NFT_SET_OBJECT) { 7262 if (!nla[NFTA_SET_ELEM_OBJREF] && 7263 !(flags & NFT_SET_ELEM_INTERVAL_END)) 7264 return -EINVAL; 7265 } else { 7266 if (nla[NFTA_SET_ELEM_OBJREF]) 7267 return -EINVAL; 7268 } 7269 7270 if (!nft_setelem_valid_key_end(set, nla, flags)) 7271 return -EINVAL; 7272 7273 if ((flags & NFT_SET_ELEM_INTERVAL_END) && 7274 (nla[NFTA_SET_ELEM_DATA] || 7275 nla[NFTA_SET_ELEM_OBJREF] || 7276 nla[NFTA_SET_ELEM_TIMEOUT] || 7277 nla[NFTA_SET_ELEM_EXPIRATION] || 7278 nla[NFTA_SET_ELEM_USERDATA] || 7279 nla[NFTA_SET_ELEM_EXPR] || 7280 nla[NFTA_SET_ELEM_KEY_END] || 7281 nla[NFTA_SET_ELEM_EXPRESSIONS])) 7282 return -EINVAL; 7283 7284 timeout = 0; 7285 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 7286 if (!(set->flags & NFT_SET_TIMEOUT)) 7287 return -EINVAL; 7288 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT], 7289 &timeout); 7290 if (err) 7291 return err; 7292 } else if (set->flags & NFT_SET_TIMEOUT && 7293 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 7294 timeout = set->timeout; 7295 } 7296 7297 expiration = 0; 7298 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) { 7299 if (!(set->flags & NFT_SET_TIMEOUT)) 7300 return -EINVAL; 7301 if (timeout == 0) 7302 return -EOPNOTSUPP; 7303 7304 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION], 7305 &expiration); 7306 if (err) 7307 return err; 7308 7309 if (expiration > timeout) 7310 return -ERANGE; 7311 } 7312 7313 if (nla[NFTA_SET_ELEM_EXPR]) { 7314 struct nft_expr *expr; 7315 7316 if (set->num_exprs && set->num_exprs != 1) 7317 return -EOPNOTSUPP; 7318 7319 expr = nft_set_elem_expr_alloc(ctx, set, 7320 nla[NFTA_SET_ELEM_EXPR]); 7321 if (IS_ERR(expr)) 7322 return PTR_ERR(expr); 7323 7324 expr_array[0] = expr; 7325 num_exprs = 1; 7326 7327 if (set->num_exprs && set->exprs[0]->ops != expr->ops) { 7328 err = -EOPNOTSUPP; 7329 goto err_set_elem_expr; 7330 } 7331 } else if (nla[NFTA_SET_ELEM_EXPRESSIONS]) { 7332 struct nft_expr *expr; 7333 struct nlattr *tmp; 7334 int left; 7335 7336 i = 0; 7337 nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) { 7338 if (i == NFT_SET_EXPR_MAX || 7339 (set->num_exprs && set->num_exprs == i)) { 7340 err = -E2BIG; 7341 goto err_set_elem_expr; 7342 } 7343 if (nla_type(tmp) != NFTA_LIST_ELEM) { 7344 err = -EINVAL; 7345 goto err_set_elem_expr; 7346 } 7347 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 7348 if (IS_ERR(expr)) { 7349 err = PTR_ERR(expr); 7350 goto err_set_elem_expr; 7351 } 7352 expr_array[i] = expr; 7353 num_exprs++; 7354 7355 if (set->num_exprs && expr->ops != set->exprs[i]->ops) { 7356 err = -EOPNOTSUPP; 7357 goto err_set_elem_expr; 7358 } 7359 i++; 7360 } 7361 if (set->num_exprs && set->num_exprs != i) { 7362 err = -EOPNOTSUPP; 7363 goto err_set_elem_expr; 7364 } 7365 } else if (set->num_exprs > 0 && 7366 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 7367 err = nft_set_elem_expr_clone(ctx, set, expr_array); 7368 if (err < 0) 7369 goto err_set_elem_expr_clone; 7370 7371 num_exprs = set->num_exprs; 7372 } 7373 7374 if (nla[NFTA_SET_ELEM_KEY]) { 7375 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 7376 nla[NFTA_SET_ELEM_KEY]); 7377 if (err < 0) 7378 goto err_set_elem_expr; 7379 7380 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 7381 if (err < 0) 7382 goto err_parse_key; 7383 } 7384 7385 if (nla[NFTA_SET_ELEM_KEY_END]) { 7386 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 7387 nla[NFTA_SET_ELEM_KEY_END]); 7388 if (err < 0) 7389 goto err_parse_key; 7390 7391 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 7392 if (err < 0) 7393 goto err_parse_key_end; 7394 } 7395 7396 if (set->flags & NFT_SET_TIMEOUT) { 7397 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 7398 if (err < 0) 7399 goto err_parse_key_end; 7400 } 7401 7402 if (num_exprs) { 7403 for (i = 0; i < num_exprs; i++) 7404 size += expr_array[i]->ops->size; 7405 7406 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, 7407 sizeof(struct nft_set_elem_expr) + size); 7408 if (err < 0) 7409 goto err_parse_key_end; 7410 } 7411 7412 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { 7413 obj = nft_obj_lookup(ctx->net, ctx->table, 7414 nla[NFTA_SET_ELEM_OBJREF], 7415 set->objtype, genmask); 7416 if (IS_ERR(obj)) { 7417 err = PTR_ERR(obj); 7418 obj = NULL; 7419 goto err_parse_key_end; 7420 } 7421 7422 if (!nft_use_inc(&obj->use)) { 7423 err = -EMFILE; 7424 obj = NULL; 7425 goto err_parse_key_end; 7426 } 7427 7428 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); 7429 if (err < 0) 7430 goto err_parse_key_end; 7431 } 7432 7433 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 7434 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val, 7435 nla[NFTA_SET_ELEM_DATA]); 7436 if (err < 0) 7437 goto err_parse_key_end; 7438 7439 dreg = nft_type_to_reg(set->dtype); 7440 list_for_each_entry(binding, &set->bindings, list) { 7441 struct nft_ctx bind_ctx = { 7442 .net = ctx->net, 7443 .family = ctx->family, 7444 .table = ctx->table, 7445 .chain = (struct nft_chain *)binding->chain, 7446 }; 7447 7448 if (!(binding->flags & NFT_SET_MAP)) 7449 continue; 7450 7451 err = nft_validate_register_store(&bind_ctx, dreg, 7452 &elem.data.val, 7453 desc.type, desc.len); 7454 if (err < 0) 7455 goto err_parse_data; 7456 7457 if (desc.type == NFT_DATA_VERDICT && 7458 (elem.data.val.verdict.code == NFT_GOTO || 7459 elem.data.val.verdict.code == NFT_JUMP)) 7460 nft_validate_state_update(ctx->table, 7461 NFT_VALIDATE_NEED); 7462 } 7463 7464 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); 7465 if (err < 0) 7466 goto err_parse_data; 7467 } 7468 7469 /* The full maximum length of userdata can exceed the maximum 7470 * offset value (U8_MAX) for following extensions, therefor it 7471 * must be the last extension added. 7472 */ 7473 ulen = 0; 7474 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 7475 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 7476 if (ulen > 0) { 7477 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 7478 ulen); 7479 if (err < 0) 7480 goto err_parse_data; 7481 } 7482 } 7483 7484 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 7485 elem.key_end.val.data, elem.data.val.data, 7486 timeout, expiration, GFP_KERNEL_ACCOUNT); 7487 if (IS_ERR(elem.priv)) { 7488 err = PTR_ERR(elem.priv); 7489 goto err_parse_data; 7490 } 7491 7492 ext = nft_set_elem_ext(set, elem.priv); 7493 if (flags) 7494 *nft_set_ext_flags(ext) = flags; 7495 7496 if (obj) 7497 *nft_set_ext_obj(ext) = obj; 7498 7499 if (ulen > 0) { 7500 if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) { 7501 err = -EINVAL; 7502 goto err_elem_free; 7503 } 7504 udata = nft_set_ext_userdata(ext); 7505 udata->len = ulen - 1; 7506 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 7507 } 7508 err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs); 7509 if (err < 0) 7510 goto err_elem_free; 7511 7512 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 7513 if (trans == NULL) { 7514 err = -ENOMEM; 7515 goto err_elem_free; 7516 } 7517 7518 ext->genmask = nft_genmask_cur(ctx->net); 7519 7520 err = nft_setelem_insert(ctx->net, set, &elem, &elem_priv, flags); 7521 if (err) { 7522 if (err == -EEXIST) { 7523 ext2 = nft_set_elem_ext(set, elem_priv); 7524 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ 7525 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || 7526 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ 7527 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) 7528 goto err_element_clash; 7529 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 7530 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && 7531 memcmp(nft_set_ext_data(ext), 7532 nft_set_ext_data(ext2), set->dlen) != 0) || 7533 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 7534 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) && 7535 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) 7536 goto err_element_clash; 7537 else if (!(nlmsg_flags & NLM_F_EXCL)) { 7538 err = 0; 7539 if (nft_set_ext_exists(ext2, NFT_SET_EXT_TIMEOUT)) { 7540 struct nft_elem_update update = { }; 7541 7542 if (timeout != nft_set_ext_timeout(ext2)->timeout) { 7543 update.timeout = timeout; 7544 if (expiration == 0) 7545 expiration = timeout; 7546 7547 update.flags |= NFT_TRANS_UPD_TIMEOUT; 7548 } 7549 if (expiration) { 7550 update.expiration = expiration; 7551 update.flags |= NFT_TRANS_UPD_EXPIRATION; 7552 } 7553 7554 if (update.flags) { 7555 struct nft_trans_one_elem *ue; 7556 7557 ue = &nft_trans_container_elem(trans)->elems[0]; 7558 7559 ue->update = kmemdup(&update, sizeof(update), GFP_KERNEL); 7560 if (!ue->update) { 7561 err = -ENOMEM; 7562 goto err_element_clash; 7563 } 7564 7565 ue->priv = elem_priv; 7566 nft_trans_commit_list_add_elem(ctx->net, trans); 7567 goto err_elem_free; 7568 } 7569 } 7570 } 7571 } else if (err == -ENOTEMPTY) { 7572 /* ENOTEMPTY reports overlapping between this element 7573 * and an existing one. 7574 */ 7575 err = -EEXIST; 7576 } 7577 goto err_element_clash; 7578 } 7579 7580 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 7581 unsigned int max = nft_set_maxsize(set); 7582 7583 if (!atomic_add_unless(&set->nelems, 1, max)) { 7584 err = -ENFILE; 7585 goto err_set_full; 7586 } 7587 } 7588 7589 nft_trans_container_elem(trans)->elems[0].priv = elem.priv; 7590 nft_trans_commit_list_add_elem(ctx->net, trans); 7591 return 0; 7592 7593 err_set_full: 7594 nft_setelem_remove(ctx->net, set, elem.priv); 7595 err_element_clash: 7596 kfree(trans); 7597 err_elem_free: 7598 nf_tables_set_elem_destroy(ctx, set, elem.priv); 7599 err_parse_data: 7600 if (nla[NFTA_SET_ELEM_DATA] != NULL) 7601 nft_data_release(&elem.data.val, desc.type); 7602 err_parse_key_end: 7603 if (obj) 7604 nft_use_dec_restore(&obj->use); 7605 7606 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 7607 err_parse_key: 7608 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 7609 err_set_elem_expr: 7610 for (i = 0; i < num_exprs && expr_array[i]; i++) 7611 nft_expr_destroy(ctx, expr_array[i]); 7612 err_set_elem_expr_clone: 7613 return err; 7614 } 7615 7616 static int nf_tables_newsetelem(struct sk_buff *skb, 7617 const struct nfnl_info *info, 7618 const struct nlattr * const nla[]) 7619 { 7620 struct netlink_ext_ack *extack = info->extack; 7621 u8 genmask = nft_genmask_next(info->net); 7622 u8 family = info->nfmsg->nfgen_family; 7623 struct net *net = info->net; 7624 const struct nlattr *attr; 7625 struct nft_table *table; 7626 struct nft_set *set; 7627 struct nft_ctx ctx; 7628 int rem, err; 7629 7630 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 7631 return -EINVAL; 7632 7633 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 7634 genmask, NETLINK_CB(skb).portid); 7635 if (IS_ERR(table)) { 7636 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 7637 return PTR_ERR(table); 7638 } 7639 7640 set = nft_set_lookup_global(net, table, nla[NFTA_SET_ELEM_LIST_SET], 7641 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask); 7642 if (IS_ERR(set)) { 7643 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_SET]); 7644 return PTR_ERR(set); 7645 } 7646 7647 if (!list_empty(&set->bindings) && 7648 (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS))) 7649 return -EBUSY; 7650 7651 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7652 7653 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 7654 err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags); 7655 if (err < 0) { 7656 NL_SET_BAD_ATTR(extack, attr); 7657 return err; 7658 } 7659 } 7660 7661 if (table->validate_state == NFT_VALIDATE_DO) 7662 return nft_table_validate(net, table); 7663 7664 return 0; 7665 } 7666 7667 /** 7668 * nft_data_hold - hold a nft_data item 7669 * 7670 * @data: struct nft_data to release 7671 * @type: type of data 7672 * 7673 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded, 7674 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and 7675 * NFT_GOTO verdicts. This function must be called on active data objects 7676 * from the second phase of the commit protocol. 7677 */ 7678 void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 7679 { 7680 struct nft_chain *chain; 7681 7682 if (type == NFT_DATA_VERDICT) { 7683 switch (data->verdict.code) { 7684 case NFT_JUMP: 7685 case NFT_GOTO: 7686 chain = data->verdict.chain; 7687 nft_use_inc_restore(&chain->use); 7688 break; 7689 } 7690 } 7691 } 7692 7693 static int nft_setelem_active_next(const struct net *net, 7694 const struct nft_set *set, 7695 struct nft_elem_priv *elem_priv) 7696 { 7697 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7698 u8 genmask = nft_genmask_next(net); 7699 7700 return nft_set_elem_active(ext, genmask); 7701 } 7702 7703 static void nft_setelem_data_activate(const struct net *net, 7704 const struct nft_set *set, 7705 struct nft_elem_priv *elem_priv) 7706 { 7707 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7708 7709 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 7710 nft_data_hold(nft_set_ext_data(ext), set->dtype); 7711 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 7712 nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use); 7713 } 7714 7715 void nft_setelem_data_deactivate(const struct net *net, 7716 const struct nft_set *set, 7717 struct nft_elem_priv *elem_priv) 7718 { 7719 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7720 7721 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 7722 nft_data_release(nft_set_ext_data(ext), set->dtype); 7723 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 7724 nft_use_dec(&(*nft_set_ext_obj(ext))->use); 7725 } 7726 7727 /* similar to nft_trans_elems_remove, but called from abort path to undo newsetelem. 7728 * No notifications and no ndeact changes. 7729 * 7730 * Returns true if set had been added to (i.e., elements need to be removed again). 7731 */ 7732 static bool nft_trans_elems_new_abort(const struct nft_ctx *ctx, 7733 struct nft_trans_elem *te) 7734 { 7735 bool removed = false; 7736 int i; 7737 7738 for (i = 0; i < te->nelems; i++) { 7739 if (te->elems[i].update) { 7740 kfree(te->elems[i].update); 7741 te->elems[i].update = NULL; 7742 /* Update request, so do not release this element */ 7743 te->elems[i].priv = NULL; 7744 continue; 7745 } 7746 7747 if (!te->set->ops->abort || nft_setelem_is_catchall(te->set, te->elems[i].priv)) 7748 nft_setelem_remove(ctx->net, te->set, te->elems[i].priv); 7749 7750 if (!nft_setelem_is_catchall(te->set, te->elems[i].priv)) 7751 atomic_dec(&te->set->nelems); 7752 7753 removed = true; 7754 } 7755 7756 return removed; 7757 } 7758 7759 /* Called from abort path to undo DELSETELEM/DESTROYSETELEM. */ 7760 static void nft_trans_elems_destroy_abort(const struct nft_ctx *ctx, 7761 const struct nft_trans_elem *te) 7762 { 7763 int i; 7764 7765 for (i = 0; i < te->nelems; i++) { 7766 if (!nft_setelem_active_next(ctx->net, te->set, te->elems[i].priv)) { 7767 nft_setelem_data_activate(ctx->net, te->set, te->elems[i].priv); 7768 nft_setelem_activate(ctx->net, te->set, te->elems[i].priv); 7769 } 7770 7771 if (!nft_setelem_is_catchall(te->set, te->elems[i].priv)) 7772 te->set->ndeact--; 7773 } 7774 } 7775 7776 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 7777 const struct nlattr *attr) 7778 { 7779 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 7780 struct nft_set_ext_tmpl tmpl; 7781 struct nft_set_elem elem; 7782 struct nft_set_ext *ext; 7783 struct nft_trans *trans; 7784 u32 flags = 0; 7785 int err; 7786 7787 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 7788 nft_set_elem_policy, NULL); 7789 if (err < 0) 7790 return err; 7791 7792 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 7793 if (err < 0) 7794 return err; 7795 7796 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 7797 return -EINVAL; 7798 7799 if (!nft_setelem_valid_key_end(set, nla, flags)) 7800 return -EINVAL; 7801 7802 nft_set_ext_prepare(&tmpl); 7803 7804 if (flags != 0) { 7805 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 7806 if (err < 0) 7807 return err; 7808 } 7809 7810 if (nla[NFTA_SET_ELEM_KEY]) { 7811 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 7812 nla[NFTA_SET_ELEM_KEY]); 7813 if (err < 0) 7814 return err; 7815 7816 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 7817 if (err < 0) 7818 goto fail_elem; 7819 } 7820 7821 if (nla[NFTA_SET_ELEM_KEY_END]) { 7822 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 7823 nla[NFTA_SET_ELEM_KEY_END]); 7824 if (err < 0) 7825 goto fail_elem; 7826 7827 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 7828 if (err < 0) 7829 goto fail_elem_key_end; 7830 } 7831 7832 err = -ENOMEM; 7833 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 7834 elem.key_end.val.data, NULL, 0, 0, 7835 GFP_KERNEL_ACCOUNT); 7836 if (IS_ERR(elem.priv)) { 7837 err = PTR_ERR(elem.priv); 7838 goto fail_elem_key_end; 7839 } 7840 7841 ext = nft_set_elem_ext(set, elem.priv); 7842 if (flags) 7843 *nft_set_ext_flags(ext) = flags; 7844 7845 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 7846 if (trans == NULL) 7847 goto fail_trans; 7848 7849 err = nft_setelem_deactivate(ctx->net, set, &elem, flags); 7850 if (err < 0) 7851 goto fail_ops; 7852 7853 nft_setelem_data_deactivate(ctx->net, set, elem.priv); 7854 7855 nft_trans_container_elem(trans)->elems[0].priv = elem.priv; 7856 nft_trans_commit_list_add_elem(ctx->net, trans); 7857 return 0; 7858 7859 fail_ops: 7860 kfree(trans); 7861 fail_trans: 7862 kfree(elem.priv); 7863 fail_elem_key_end: 7864 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 7865 fail_elem: 7866 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 7867 return err; 7868 } 7869 7870 static int nft_setelem_flush(const struct nft_ctx *ctx, 7871 struct nft_set *set, 7872 const struct nft_set_iter *iter, 7873 struct nft_elem_priv *elem_priv) 7874 { 7875 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7876 struct nft_trans *trans; 7877 7878 if (!nft_set_elem_active(ext, iter->genmask)) 7879 return 0; 7880 7881 trans = nft_trans_alloc(ctx, NFT_MSG_DELSETELEM, 7882 struct_size_t(struct nft_trans_elem, elems, 1)); 7883 if (!trans) 7884 return -ENOMEM; 7885 7886 set->ops->flush(ctx->net, set, elem_priv); 7887 set->ndeact++; 7888 7889 nft_setelem_data_deactivate(ctx->net, set, elem_priv); 7890 nft_trans_elem_set(trans) = set; 7891 nft_trans_container_elem(trans)->nelems = 1; 7892 nft_trans_container_elem(trans)->elems[0].priv = elem_priv; 7893 nft_trans_commit_list_add_elem(ctx->net, trans); 7894 7895 return 0; 7896 } 7897 7898 static int __nft_set_catchall_flush(const struct nft_ctx *ctx, 7899 struct nft_set *set, 7900 struct nft_elem_priv *elem_priv) 7901 { 7902 struct nft_trans *trans; 7903 7904 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 7905 if (!trans) 7906 return -ENOMEM; 7907 7908 nft_setelem_data_deactivate(ctx->net, set, elem_priv); 7909 nft_trans_container_elem(trans)->elems[0].priv = elem_priv; 7910 nft_trans_commit_list_add_elem(ctx->net, trans); 7911 7912 return 0; 7913 } 7914 7915 static int nft_set_catchall_flush(const struct nft_ctx *ctx, 7916 struct nft_set *set) 7917 { 7918 u8 genmask = nft_genmask_next(ctx->net); 7919 struct nft_set_elem_catchall *catchall; 7920 struct nft_set_ext *ext; 7921 int ret = 0; 7922 7923 list_for_each_entry_rcu(catchall, &set->catchall_list, list, 7924 lockdep_commit_lock_is_held(ctx->net)) { 7925 ext = nft_set_elem_ext(set, catchall->elem); 7926 if (!nft_set_elem_active(ext, genmask)) 7927 continue; 7928 7929 ret = __nft_set_catchall_flush(ctx, set, catchall->elem); 7930 if (ret < 0) 7931 break; 7932 nft_set_elem_change_active(ctx->net, set, ext); 7933 } 7934 7935 return ret; 7936 } 7937 7938 static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) 7939 { 7940 struct nft_set_iter iter = { 7941 .genmask = genmask, 7942 .type = NFT_ITER_UPDATE, 7943 .fn = nft_setelem_flush, 7944 }; 7945 7946 set->ops->walk(ctx, set, &iter); 7947 if (!iter.err) 7948 iter.err = nft_set_catchall_flush(ctx, set); 7949 7950 return iter.err; 7951 } 7952 7953 static int nf_tables_delsetelem(struct sk_buff *skb, 7954 const struct nfnl_info *info, 7955 const struct nlattr * const nla[]) 7956 { 7957 struct netlink_ext_ack *extack = info->extack; 7958 u8 genmask = nft_genmask_next(info->net); 7959 u8 family = info->nfmsg->nfgen_family; 7960 struct net *net = info->net; 7961 const struct nlattr *attr; 7962 struct nft_table *table; 7963 struct nft_set *set; 7964 struct nft_ctx ctx; 7965 int rem, err = 0; 7966 7967 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 7968 genmask, NETLINK_CB(skb).portid); 7969 if (IS_ERR(table)) { 7970 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 7971 return PTR_ERR(table); 7972 } 7973 7974 set = nft_set_lookup(net, table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 7975 if (IS_ERR(set)) { 7976 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_SET]); 7977 return PTR_ERR(set); 7978 } 7979 7980 if (nft_set_is_anonymous(set)) 7981 return -EOPNOTSUPP; 7982 7983 if (!list_empty(&set->bindings) && (set->flags & NFT_SET_CONSTANT)) 7984 return -EBUSY; 7985 7986 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7987 7988 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 7989 return nft_set_flush(&ctx, set, genmask); 7990 7991 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 7992 err = nft_del_setelem(&ctx, set, attr); 7993 if (err == -ENOENT && 7994 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSETELEM) 7995 continue; 7996 7997 if (err < 0) { 7998 NL_SET_BAD_ATTR(extack, attr); 7999 return err; 8000 } 8001 } 8002 8003 return 0; 8004 } 8005 8006 /* 8007 * Stateful objects 8008 */ 8009 8010 /** 8011 * nft_register_obj- register nf_tables stateful object type 8012 * @obj_type: object type 8013 * 8014 * Registers the object type for use with nf_tables. Returns zero on 8015 * success or a negative errno code otherwise. 8016 */ 8017 int nft_register_obj(struct nft_object_type *obj_type) 8018 { 8019 if (obj_type->type == NFT_OBJECT_UNSPEC) 8020 return -EINVAL; 8021 8022 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8023 list_add_rcu(&obj_type->list, &nf_tables_objects); 8024 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8025 return 0; 8026 } 8027 EXPORT_SYMBOL_GPL(nft_register_obj); 8028 8029 /** 8030 * nft_unregister_obj - unregister nf_tables object type 8031 * @obj_type: object type 8032 * 8033 * Unregisters the object type for use with nf_tables. 8034 */ 8035 void nft_unregister_obj(struct nft_object_type *obj_type) 8036 { 8037 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8038 list_del_rcu(&obj_type->list); 8039 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8040 } 8041 EXPORT_SYMBOL_GPL(nft_unregister_obj); 8042 8043 struct nft_object *nft_obj_lookup(const struct net *net, 8044 const struct nft_table *table, 8045 const struct nlattr *nla, u32 objtype, 8046 u8 genmask) 8047 { 8048 struct nft_object_hash_key k = { .table = table }; 8049 char search[NFT_OBJ_MAXNAMELEN]; 8050 struct rhlist_head *tmp, *list; 8051 struct nft_object *obj; 8052 8053 nla_strscpy(search, nla, sizeof(search)); 8054 k.name = search; 8055 8056 WARN_ON_ONCE(!rcu_read_lock_held() && 8057 !lockdep_commit_lock_is_held(net)); 8058 8059 rcu_read_lock(); 8060 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params); 8061 if (!list) 8062 goto out; 8063 8064 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) { 8065 if (objtype == obj->ops->type->type && 8066 nft_active_genmask(obj, genmask)) { 8067 rcu_read_unlock(); 8068 return obj; 8069 } 8070 } 8071 out: 8072 rcu_read_unlock(); 8073 return ERR_PTR(-ENOENT); 8074 } 8075 EXPORT_SYMBOL_GPL(nft_obj_lookup); 8076 8077 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table, 8078 const struct nlattr *nla, 8079 u32 objtype, u8 genmask) 8080 { 8081 struct nft_object *obj; 8082 8083 list_for_each_entry(obj, &table->objects, list) { 8084 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && 8085 objtype == obj->ops->type->type && 8086 nft_active_genmask(obj, genmask)) 8087 return obj; 8088 } 8089 return ERR_PTR(-ENOENT); 8090 } 8091 8092 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 8093 [NFTA_OBJ_TABLE] = { .type = NLA_STRING, 8094 .len = NFT_TABLE_MAXNAMELEN - 1 }, 8095 [NFTA_OBJ_NAME] = { .type = NLA_STRING, 8096 .len = NFT_OBJ_MAXNAMELEN - 1 }, 8097 [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, 8098 [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, 8099 [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, 8100 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY, 8101 .len = NFT_USERDATA_MAXLEN }, 8102 }; 8103 8104 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 8105 const struct nft_object_type *type, 8106 const struct nlattr *attr) 8107 { 8108 struct nlattr **tb; 8109 const struct nft_object_ops *ops; 8110 struct nft_object *obj; 8111 int err = -ENOMEM; 8112 8113 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL); 8114 if (!tb) 8115 goto err1; 8116 8117 if (attr) { 8118 err = nla_parse_nested_deprecated(tb, type->maxattr, attr, 8119 type->policy, NULL); 8120 if (err < 0) 8121 goto err2; 8122 } else { 8123 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); 8124 } 8125 8126 if (type->select_ops) { 8127 ops = type->select_ops(ctx, (const struct nlattr * const *)tb); 8128 if (IS_ERR(ops)) { 8129 err = PTR_ERR(ops); 8130 goto err2; 8131 } 8132 } else { 8133 ops = type->ops; 8134 } 8135 8136 err = -ENOMEM; 8137 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT); 8138 if (!obj) 8139 goto err2; 8140 8141 err = ops->init(ctx, (const struct nlattr * const *)tb, obj); 8142 if (err < 0) 8143 goto err3; 8144 8145 obj->ops = ops; 8146 8147 kfree(tb); 8148 return obj; 8149 err3: 8150 kfree(obj); 8151 err2: 8152 kfree(tb); 8153 err1: 8154 return ERR_PTR(err); 8155 } 8156 8157 static int nft_object_dump(struct sk_buff *skb, unsigned int attr, 8158 struct nft_object *obj, bool reset) 8159 { 8160 struct nlattr *nest; 8161 8162 nest = nla_nest_start_noflag(skb, attr); 8163 if (!nest) 8164 goto nla_put_failure; 8165 if (obj->ops->dump(skb, obj, reset) < 0) 8166 goto nla_put_failure; 8167 nla_nest_end(skb, nest); 8168 return 0; 8169 8170 nla_put_failure: 8171 return -1; 8172 } 8173 8174 static const struct nft_object_type *__nft_obj_type_get(u32 objtype, u8 family) 8175 { 8176 const struct nft_object_type *type; 8177 8178 list_for_each_entry_rcu(type, &nf_tables_objects, list) { 8179 if (type->family != NFPROTO_UNSPEC && 8180 type->family != family) 8181 continue; 8182 8183 if (objtype == type->type) 8184 return type; 8185 } 8186 return NULL; 8187 } 8188 8189 static const struct nft_object_type * 8190 nft_obj_type_get(struct net *net, u32 objtype, u8 family) 8191 { 8192 const struct nft_object_type *type; 8193 8194 rcu_read_lock(); 8195 type = __nft_obj_type_get(objtype, family); 8196 if (type != NULL && try_module_get(type->owner)) { 8197 rcu_read_unlock(); 8198 return type; 8199 } 8200 rcu_read_unlock(); 8201 8202 lockdep_nfnl_nft_mutex_not_held(); 8203 #ifdef CONFIG_MODULES 8204 if (type == NULL) { 8205 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN) 8206 return ERR_PTR(-EAGAIN); 8207 } 8208 #endif 8209 return ERR_PTR(-ENOENT); 8210 } 8211 8212 static int nf_tables_updobj(const struct nft_ctx *ctx, 8213 const struct nft_object_type *type, 8214 const struct nlattr *attr, 8215 struct nft_object *obj) 8216 { 8217 struct nft_object *newobj; 8218 struct nft_trans *trans; 8219 int err = -ENOMEM; 8220 8221 /* caller must have obtained type->owner reference. */ 8222 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, 8223 sizeof(struct nft_trans_obj)); 8224 if (!trans) 8225 goto err_trans; 8226 8227 newobj = nft_obj_init(ctx, type, attr); 8228 if (IS_ERR(newobj)) { 8229 err = PTR_ERR(newobj); 8230 goto err_free_trans; 8231 } 8232 8233 nft_trans_obj(trans) = obj; 8234 nft_trans_obj_update(trans) = true; 8235 nft_trans_obj_newobj(trans) = newobj; 8236 nft_trans_commit_list_add_tail(ctx->net, trans); 8237 8238 return 0; 8239 8240 err_free_trans: 8241 kfree(trans); 8242 err_trans: 8243 module_put(type->owner); 8244 return err; 8245 } 8246 8247 static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, 8248 const struct nlattr * const nla[]) 8249 { 8250 struct netlink_ext_ack *extack = info->extack; 8251 u8 genmask = nft_genmask_next(info->net); 8252 u8 family = info->nfmsg->nfgen_family; 8253 const struct nft_object_type *type; 8254 struct net *net = info->net; 8255 struct nft_table *table; 8256 struct nft_object *obj; 8257 struct nft_ctx ctx; 8258 u32 objtype; 8259 int err; 8260 8261 if (!nla[NFTA_OBJ_TYPE] || 8262 !nla[NFTA_OBJ_NAME] || 8263 !nla[NFTA_OBJ_DATA]) 8264 return -EINVAL; 8265 8266 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 8267 NETLINK_CB(skb).portid); 8268 if (IS_ERR(table)) { 8269 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 8270 return PTR_ERR(table); 8271 } 8272 8273 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8274 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 8275 if (IS_ERR(obj)) { 8276 err = PTR_ERR(obj); 8277 if (err != -ENOENT) { 8278 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 8279 return err; 8280 } 8281 } else { 8282 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 8283 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 8284 return -EEXIST; 8285 } 8286 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 8287 return -EOPNOTSUPP; 8288 8289 if (!obj->ops->update) 8290 return 0; 8291 8292 type = nft_obj_type_get(net, objtype, family); 8293 if (WARN_ON_ONCE(IS_ERR(type))) 8294 return PTR_ERR(type); 8295 8296 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8297 8298 /* type->owner reference is put when transaction object is released. */ 8299 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); 8300 } 8301 8302 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8303 8304 if (!nft_use_inc(&table->use)) 8305 return -EMFILE; 8306 8307 type = nft_obj_type_get(net, objtype, family); 8308 if (IS_ERR(type)) { 8309 err = PTR_ERR(type); 8310 goto err_type; 8311 } 8312 8313 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]); 8314 if (IS_ERR(obj)) { 8315 err = PTR_ERR(obj); 8316 goto err_init; 8317 } 8318 obj->key.table = table; 8319 obj->handle = nf_tables_alloc_handle(table); 8320 8321 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT); 8322 if (!obj->key.name) { 8323 err = -ENOMEM; 8324 goto err_strdup; 8325 } 8326 8327 if (nla[NFTA_OBJ_USERDATA]) { 8328 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL_ACCOUNT); 8329 if (obj->udata == NULL) 8330 goto err_userdata; 8331 8332 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]); 8333 } 8334 8335 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj); 8336 if (err < 0) 8337 goto err_trans; 8338 8339 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead, 8340 nft_objname_ht_params); 8341 if (err < 0) 8342 goto err_obj_ht; 8343 8344 list_add_tail_rcu(&obj->list, &table->objects); 8345 8346 return 0; 8347 err_obj_ht: 8348 /* queued in transaction log */ 8349 INIT_LIST_HEAD(&obj->list); 8350 return err; 8351 err_trans: 8352 kfree(obj->udata); 8353 err_userdata: 8354 kfree(obj->key.name); 8355 err_strdup: 8356 if (obj->ops->destroy) 8357 obj->ops->destroy(&ctx, obj); 8358 kfree(obj); 8359 err_init: 8360 module_put(type->owner); 8361 err_type: 8362 nft_use_dec_restore(&table->use); 8363 8364 return err; 8365 } 8366 8367 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 8368 u32 portid, u32 seq, int event, u32 flags, 8369 int family, const struct nft_table *table, 8370 struct nft_object *obj, bool reset) 8371 { 8372 struct nlmsghdr *nlh; 8373 8374 nlh = nfnl_msg_put(skb, portid, seq, 8375 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 8376 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 8377 if (!nlh) 8378 goto nla_put_failure; 8379 8380 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || 8381 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || 8382 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || 8383 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), 8384 NFTA_OBJ_PAD)) 8385 goto nla_put_failure; 8386 8387 if (event == NFT_MSG_DELOBJ || 8388 event == NFT_MSG_DESTROYOBJ) { 8389 nlmsg_end(skb, nlh); 8390 return 0; 8391 } 8392 8393 if (nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || 8394 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset)) 8395 goto nla_put_failure; 8396 8397 if (obj->udata && 8398 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata)) 8399 goto nla_put_failure; 8400 8401 nlmsg_end(skb, nlh); 8402 return 0; 8403 8404 nla_put_failure: 8405 nlmsg_trim(skb, nlh); 8406 return -1; 8407 } 8408 8409 static void audit_log_obj_reset(const struct nft_table *table, 8410 unsigned int base_seq, unsigned int nentries) 8411 { 8412 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq); 8413 8414 audit_log_nfcfg(buf, table->family, nentries, 8415 AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC); 8416 kfree(buf); 8417 } 8418 8419 struct nft_obj_dump_ctx { 8420 unsigned int s_idx; 8421 char *table; 8422 u32 type; 8423 bool reset; 8424 }; 8425 8426 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) 8427 { 8428 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 8429 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8430 struct net *net = sock_net(skb->sk); 8431 int family = nfmsg->nfgen_family; 8432 struct nftables_pernet *nft_net; 8433 const struct nft_table *table; 8434 unsigned int entries = 0; 8435 struct nft_object *obj; 8436 unsigned int idx = 0; 8437 int rc = 0; 8438 8439 rcu_read_lock(); 8440 nft_net = nft_pernet(net); 8441 cb->seq = nft_base_seq(net); 8442 8443 list_for_each_entry_rcu(table, &nft_net->tables, list) { 8444 if (family != NFPROTO_UNSPEC && family != table->family) 8445 continue; 8446 8447 entries = 0; 8448 list_for_each_entry_rcu(obj, &table->objects, list) { 8449 if (!nft_is_active(net, obj)) 8450 goto cont; 8451 if (idx < ctx->s_idx) 8452 goto cont; 8453 if (ctx->table && strcmp(ctx->table, table->name)) 8454 goto cont; 8455 if (ctx->type != NFT_OBJECT_UNSPEC && 8456 obj->ops->type->type != ctx->type) 8457 goto cont; 8458 8459 rc = nf_tables_fill_obj_info(skb, net, 8460 NETLINK_CB(cb->skb).portid, 8461 cb->nlh->nlmsg_seq, 8462 NFT_MSG_NEWOBJ, 8463 NLM_F_MULTI | NLM_F_APPEND, 8464 table->family, table, 8465 obj, ctx->reset); 8466 if (rc < 0) 8467 break; 8468 8469 entries++; 8470 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 8471 cont: 8472 idx++; 8473 } 8474 if (ctx->reset && entries) 8475 audit_log_obj_reset(table, nft_base_seq(net), entries); 8476 if (rc < 0) 8477 break; 8478 } 8479 rcu_read_unlock(); 8480 8481 ctx->s_idx = idx; 8482 return skb->len; 8483 } 8484 8485 static int nf_tables_dumpreset_obj(struct sk_buff *skb, 8486 struct netlink_callback *cb) 8487 { 8488 struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); 8489 int ret; 8490 8491 mutex_lock(&nft_net->commit_mutex); 8492 ret = nf_tables_dump_obj(skb, cb); 8493 mutex_unlock(&nft_net->commit_mutex); 8494 8495 return ret; 8496 } 8497 8498 static int nf_tables_dump_obj_start(struct netlink_callback *cb) 8499 { 8500 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8501 const struct nlattr * const *nla = cb->data; 8502 8503 BUILD_BUG_ON(sizeof(*ctx) > sizeof(cb->ctx)); 8504 8505 if (nla[NFTA_OBJ_TABLE]) { 8506 ctx->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC); 8507 if (!ctx->table) 8508 return -ENOMEM; 8509 } 8510 8511 if (nla[NFTA_OBJ_TYPE]) 8512 ctx->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8513 8514 return 0; 8515 } 8516 8517 static int nf_tables_dumpreset_obj_start(struct netlink_callback *cb) 8518 { 8519 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8520 8521 ctx->reset = true; 8522 8523 return nf_tables_dump_obj_start(cb); 8524 } 8525 8526 static int nf_tables_dump_obj_done(struct netlink_callback *cb) 8527 { 8528 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8529 8530 kfree(ctx->table); 8531 8532 return 0; 8533 } 8534 8535 /* Caller must hold rcu read lock or transaction mutex */ 8536 static struct sk_buff * 8537 nf_tables_getobj_single(u32 portid, const struct nfnl_info *info, 8538 const struct nlattr * const nla[], bool reset) 8539 { 8540 struct netlink_ext_ack *extack = info->extack; 8541 u8 genmask = nft_genmask_cur(info->net); 8542 u8 family = info->nfmsg->nfgen_family; 8543 const struct nft_table *table; 8544 struct net *net = info->net; 8545 struct nft_object *obj; 8546 struct sk_buff *skb2; 8547 u32 objtype; 8548 int err; 8549 8550 if (!nla[NFTA_OBJ_NAME] || 8551 !nla[NFTA_OBJ_TYPE]) 8552 return ERR_PTR(-EINVAL); 8553 8554 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0); 8555 if (IS_ERR(table)) { 8556 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 8557 return ERR_CAST(table); 8558 } 8559 8560 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8561 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 8562 if (IS_ERR(obj)) { 8563 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 8564 return ERR_CAST(obj); 8565 } 8566 8567 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8568 if (!skb2) 8569 return ERR_PTR(-ENOMEM); 8570 8571 err = nf_tables_fill_obj_info(skb2, net, portid, 8572 info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 8573 family, table, obj, reset); 8574 if (err < 0) { 8575 kfree_skb(skb2); 8576 return ERR_PTR(err); 8577 } 8578 8579 return skb2; 8580 } 8581 8582 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, 8583 const struct nlattr * const nla[]) 8584 { 8585 u32 portid = NETLINK_CB(skb).portid; 8586 struct sk_buff *skb2; 8587 8588 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8589 struct netlink_dump_control c = { 8590 .start = nf_tables_dump_obj_start, 8591 .dump = nf_tables_dump_obj, 8592 .done = nf_tables_dump_obj_done, 8593 .module = THIS_MODULE, 8594 .data = (void *)nla, 8595 }; 8596 8597 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8598 } 8599 8600 skb2 = nf_tables_getobj_single(portid, info, nla, false); 8601 if (IS_ERR(skb2)) 8602 return PTR_ERR(skb2); 8603 8604 return nfnetlink_unicast(skb2, info->net, portid); 8605 } 8606 8607 static int nf_tables_getobj_reset(struct sk_buff *skb, 8608 const struct nfnl_info *info, 8609 const struct nlattr * const nla[]) 8610 { 8611 struct nftables_pernet *nft_net = nft_pernet(info->net); 8612 u32 portid = NETLINK_CB(skb).portid; 8613 struct net *net = info->net; 8614 struct sk_buff *skb2; 8615 char *buf; 8616 8617 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8618 struct netlink_dump_control c = { 8619 .start = nf_tables_dumpreset_obj_start, 8620 .dump = nf_tables_dumpreset_obj, 8621 .done = nf_tables_dump_obj_done, 8622 .module = THIS_MODULE, 8623 .data = (void *)nla, 8624 }; 8625 8626 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8627 } 8628 8629 if (!try_module_get(THIS_MODULE)) 8630 return -EINVAL; 8631 rcu_read_unlock(); 8632 mutex_lock(&nft_net->commit_mutex); 8633 skb2 = nf_tables_getobj_single(portid, info, nla, true); 8634 mutex_unlock(&nft_net->commit_mutex); 8635 rcu_read_lock(); 8636 module_put(THIS_MODULE); 8637 8638 if (IS_ERR(skb2)) 8639 return PTR_ERR(skb2); 8640 8641 buf = kasprintf(GFP_ATOMIC, "%.*s:%u", 8642 nla_len(nla[NFTA_OBJ_TABLE]), 8643 (char *)nla_data(nla[NFTA_OBJ_TABLE]), 8644 nft_base_seq(net)); 8645 audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1, 8646 AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC); 8647 kfree(buf); 8648 8649 return nfnetlink_unicast(skb2, net, portid); 8650 } 8651 8652 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) 8653 { 8654 if (obj->ops->destroy) 8655 obj->ops->destroy(ctx, obj); 8656 8657 module_put(obj->ops->type->owner); 8658 kfree(obj->key.name); 8659 kfree(obj->udata); 8660 kfree(obj); 8661 } 8662 8663 static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info, 8664 const struct nlattr * const nla[]) 8665 { 8666 struct netlink_ext_ack *extack = info->extack; 8667 u8 genmask = nft_genmask_next(info->net); 8668 u8 family = info->nfmsg->nfgen_family; 8669 struct net *net = info->net; 8670 const struct nlattr *attr; 8671 struct nft_table *table; 8672 struct nft_object *obj; 8673 struct nft_ctx ctx; 8674 u32 objtype; 8675 8676 if (!nla[NFTA_OBJ_TYPE] || 8677 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) 8678 return -EINVAL; 8679 8680 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 8681 NETLINK_CB(skb).portid); 8682 if (IS_ERR(table)) { 8683 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 8684 return PTR_ERR(table); 8685 } 8686 8687 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8688 if (nla[NFTA_OBJ_HANDLE]) { 8689 attr = nla[NFTA_OBJ_HANDLE]; 8690 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask); 8691 } else { 8692 attr = nla[NFTA_OBJ_NAME]; 8693 obj = nft_obj_lookup(net, table, attr, objtype, genmask); 8694 } 8695 8696 if (IS_ERR(obj)) { 8697 if (PTR_ERR(obj) == -ENOENT && 8698 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYOBJ) 8699 return 0; 8700 8701 NL_SET_BAD_ATTR(extack, attr); 8702 return PTR_ERR(obj); 8703 } 8704 if (obj->use > 0) { 8705 NL_SET_BAD_ATTR(extack, attr); 8706 return -EBUSY; 8707 } 8708 8709 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8710 8711 return nft_delobj(&ctx, obj); 8712 } 8713 8714 static void 8715 __nft_obj_notify(struct net *net, const struct nft_table *table, 8716 struct nft_object *obj, u32 portid, u32 seq, int event, 8717 u16 flags, int family, int report, gfp_t gfp) 8718 { 8719 struct nftables_pernet *nft_net = nft_pernet(net); 8720 struct sk_buff *skb; 8721 int err; 8722 8723 if (!report && 8724 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 8725 return; 8726 8727 skb = nlmsg_new(NLMSG_GOODSIZE, gfp); 8728 if (skb == NULL) 8729 goto err; 8730 8731 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 8732 flags & (NLM_F_CREATE | NLM_F_EXCL), 8733 family, table, obj, false); 8734 if (err < 0) { 8735 kfree_skb(skb); 8736 goto err; 8737 } 8738 8739 nft_notify_enqueue(skb, report, &nft_net->notify_list); 8740 return; 8741 err: 8742 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 8743 } 8744 8745 void nft_obj_notify(struct net *net, const struct nft_table *table, 8746 struct nft_object *obj, u32 portid, u32 seq, int event, 8747 u16 flags, int family, int report, gfp_t gfp) 8748 { 8749 char *buf = kasprintf(gfp, "%s:%u", 8750 table->name, nft_base_seq(net)); 8751 8752 audit_log_nfcfg(buf, 8753 family, 8754 obj->handle, 8755 event == NFT_MSG_NEWOBJ ? 8756 AUDIT_NFT_OP_OBJ_REGISTER : 8757 AUDIT_NFT_OP_OBJ_UNREGISTER, 8758 gfp); 8759 kfree(buf); 8760 8761 __nft_obj_notify(net, table, obj, portid, seq, event, 8762 flags, family, report, gfp); 8763 } 8764 EXPORT_SYMBOL_GPL(nft_obj_notify); 8765 8766 static void nf_tables_obj_notify(const struct nft_ctx *ctx, 8767 struct nft_object *obj, int event) 8768 { 8769 __nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, 8770 ctx->seq, event, ctx->flags, ctx->family, 8771 ctx->report, GFP_KERNEL); 8772 } 8773 8774 /* 8775 * Flow tables 8776 */ 8777 void nft_register_flowtable_type(struct nf_flowtable_type *type) 8778 { 8779 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8780 list_add_tail_rcu(&type->list, &nf_tables_flowtables); 8781 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8782 } 8783 EXPORT_SYMBOL_GPL(nft_register_flowtable_type); 8784 8785 void nft_unregister_flowtable_type(struct nf_flowtable_type *type) 8786 { 8787 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8788 list_del_rcu(&type->list); 8789 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8790 } 8791 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); 8792 8793 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 8794 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, 8795 .len = NFT_NAME_MAXLEN - 1 }, 8796 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, 8797 .len = NFT_NAME_MAXLEN - 1 }, 8798 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, 8799 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, 8800 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 }, 8801 }; 8802 8803 struct nft_flowtable *nft_flowtable_lookup(const struct net *net, 8804 const struct nft_table *table, 8805 const struct nlattr *nla, u8 genmask) 8806 { 8807 struct nft_flowtable *flowtable; 8808 8809 list_for_each_entry_rcu(flowtable, &table->flowtables, list, 8810 lockdep_commit_lock_is_held(net)) { 8811 if (!nla_strcmp(nla, flowtable->name) && 8812 nft_active_genmask(flowtable, genmask)) 8813 return flowtable; 8814 } 8815 return ERR_PTR(-ENOENT); 8816 } 8817 EXPORT_SYMBOL_GPL(nft_flowtable_lookup); 8818 8819 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, 8820 struct nft_flowtable *flowtable, 8821 enum nft_trans_phase phase) 8822 { 8823 switch (phase) { 8824 case NFT_TRANS_PREPARE_ERROR: 8825 case NFT_TRANS_PREPARE: 8826 case NFT_TRANS_ABORT: 8827 case NFT_TRANS_RELEASE: 8828 nft_use_dec(&flowtable->use); 8829 fallthrough; 8830 default: 8831 return; 8832 } 8833 } 8834 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable); 8835 8836 static struct nft_flowtable * 8837 nft_flowtable_lookup_byhandle(const struct nft_table *table, 8838 const struct nlattr *nla, u8 genmask) 8839 { 8840 struct nft_flowtable *flowtable; 8841 8842 list_for_each_entry(flowtable, &table->flowtables, list) { 8843 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && 8844 nft_active_genmask(flowtable, genmask)) 8845 return flowtable; 8846 } 8847 return ERR_PTR(-ENOENT); 8848 } 8849 8850 struct nft_flowtable_hook { 8851 u32 num; 8852 int priority; 8853 struct list_head list; 8854 }; 8855 8856 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { 8857 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, 8858 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, 8859 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, 8860 }; 8861 8862 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx, 8863 const struct nlattr * const nla[], 8864 struct nft_flowtable_hook *flowtable_hook, 8865 struct nft_flowtable *flowtable, 8866 struct netlink_ext_ack *extack, bool add) 8867 { 8868 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; 8869 struct nf_hook_ops *ops; 8870 struct nft_hook *hook; 8871 int hooknum, priority; 8872 int err; 8873 8874 INIT_LIST_HEAD(&flowtable_hook->list); 8875 8876 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, 8877 nla[NFTA_FLOWTABLE_HOOK], 8878 nft_flowtable_hook_policy, NULL); 8879 if (err < 0) 8880 return err; 8881 8882 if (add) { 8883 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || 8884 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 8885 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8886 return -ENOENT; 8887 } 8888 8889 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 8890 if (hooknum != NF_NETDEV_INGRESS) 8891 return -EOPNOTSUPP; 8892 8893 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 8894 8895 flowtable_hook->priority = priority; 8896 flowtable_hook->num = hooknum; 8897 } else { 8898 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) { 8899 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 8900 if (hooknum != flowtable->hooknum) 8901 return -EOPNOTSUPP; 8902 } 8903 8904 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 8905 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 8906 if (priority != flowtable->data.priority) 8907 return -EOPNOTSUPP; 8908 } 8909 8910 flowtable_hook->priority = flowtable->data.priority; 8911 flowtable_hook->num = flowtable->hooknum; 8912 } 8913 8914 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) { 8915 err = nf_tables_parse_netdev_hooks(ctx->net, 8916 tb[NFTA_FLOWTABLE_HOOK_DEVS], 8917 &flowtable_hook->list, 8918 extack); 8919 if (err < 0) 8920 return err; 8921 } 8922 8923 list_for_each_entry(hook, &flowtable_hook->list, list) { 8924 list_for_each_entry(ops, &hook->ops_list, list) { 8925 ops->pf = NFPROTO_NETDEV; 8926 ops->hooknum = flowtable_hook->num; 8927 ops->priority = flowtable_hook->priority; 8928 ops->priv = &flowtable->data; 8929 ops->hook = flowtable->data.type->hook; 8930 ops->hook_ops_type = NF_HOOK_OP_NFT_FT; 8931 } 8932 } 8933 8934 return err; 8935 } 8936 8937 /* call under rcu_read_lock */ 8938 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) 8939 { 8940 const struct nf_flowtable_type *type; 8941 8942 list_for_each_entry_rcu(type, &nf_tables_flowtables, list) { 8943 if (family == type->family) 8944 return type; 8945 } 8946 return NULL; 8947 } 8948 8949 static const struct nf_flowtable_type * 8950 nft_flowtable_type_get(struct net *net, u8 family) 8951 { 8952 const struct nf_flowtable_type *type; 8953 8954 rcu_read_lock(); 8955 type = __nft_flowtable_type_get(family); 8956 if (type != NULL && try_module_get(type->owner)) { 8957 rcu_read_unlock(); 8958 return type; 8959 } 8960 rcu_read_unlock(); 8961 8962 lockdep_nfnl_nft_mutex_not_held(); 8963 #ifdef CONFIG_MODULES 8964 if (type == NULL) { 8965 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN) 8966 return ERR_PTR(-EAGAIN); 8967 } 8968 #endif 8969 return ERR_PTR(-ENOENT); 8970 } 8971 8972 /* Only called from error and netdev event paths. */ 8973 static void nft_unregister_flowtable_ops(struct net *net, 8974 struct nft_flowtable *flowtable, 8975 struct nf_hook_ops *ops) 8976 { 8977 nf_unregister_net_hook(net, ops); 8978 flowtable->data.type->setup(&flowtable->data, ops->dev, 8979 FLOW_BLOCK_UNBIND); 8980 } 8981 8982 static void __nft_unregister_flowtable_net_hooks(struct net *net, 8983 struct nft_flowtable *flowtable, 8984 struct list_head *hook_list, 8985 bool release_netdev) 8986 { 8987 struct nft_hook *hook, *next; 8988 struct nf_hook_ops *ops; 8989 8990 list_for_each_entry_safe(hook, next, hook_list, list) { 8991 list_for_each_entry(ops, &hook->ops_list, list) 8992 nft_unregister_flowtable_ops(net, flowtable, ops); 8993 if (release_netdev) { 8994 list_del(&hook->list); 8995 nft_netdev_hook_free_rcu(hook); 8996 } 8997 } 8998 } 8999 9000 static void nft_unregister_flowtable_net_hooks(struct net *net, 9001 struct nft_flowtable *flowtable, 9002 struct list_head *hook_list) 9003 { 9004 __nft_unregister_flowtable_net_hooks(net, flowtable, hook_list, false); 9005 } 9006 9007 static int nft_register_flowtable_ops(struct net *net, 9008 struct nft_flowtable *flowtable, 9009 struct nf_hook_ops *ops) 9010 { 9011 int err; 9012 9013 err = flowtable->data.type->setup(&flowtable->data, 9014 ops->dev, FLOW_BLOCK_BIND); 9015 if (err < 0) 9016 return err; 9017 9018 err = nf_register_net_hook(net, ops); 9019 if (!err) 9020 return 0; 9021 9022 flowtable->data.type->setup(&flowtable->data, 9023 ops->dev, FLOW_BLOCK_UNBIND); 9024 return err; 9025 } 9026 9027 static int nft_register_flowtable_net_hooks(struct net *net, 9028 struct nft_table *table, 9029 struct list_head *hook_list, 9030 struct nft_flowtable *flowtable) 9031 { 9032 struct nft_hook *hook, *next; 9033 struct nft_flowtable *ft; 9034 struct nf_hook_ops *ops; 9035 int err, i = 0; 9036 9037 list_for_each_entry(hook, hook_list, list) { 9038 list_for_each_entry(ft, &table->flowtables, list) { 9039 if (!nft_is_active_next(net, ft)) 9040 continue; 9041 9042 if (nft_hook_list_find(&ft->hook_list, hook)) { 9043 err = -EEXIST; 9044 goto err_unregister_net_hooks; 9045 } 9046 } 9047 9048 list_for_each_entry(ops, &hook->ops_list, list) { 9049 err = nft_register_flowtable_ops(net, flowtable, ops); 9050 if (err < 0) 9051 goto err_unregister_net_hooks; 9052 9053 i++; 9054 } 9055 } 9056 9057 return 0; 9058 9059 err_unregister_net_hooks: 9060 list_for_each_entry_safe(hook, next, hook_list, list) { 9061 list_for_each_entry(ops, &hook->ops_list, list) { 9062 if (i-- <= 0) 9063 break; 9064 9065 nft_unregister_flowtable_ops(net, flowtable, ops); 9066 } 9067 list_del_rcu(&hook->list); 9068 nft_netdev_hook_free_rcu(hook); 9069 } 9070 9071 return err; 9072 } 9073 9074 static void nft_hooks_destroy(struct list_head *hook_list) 9075 { 9076 struct nft_hook *hook, *next; 9077 9078 list_for_each_entry_safe(hook, next, hook_list, list) { 9079 list_del_rcu(&hook->list); 9080 nft_netdev_hook_free_rcu(hook); 9081 } 9082 } 9083 9084 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, 9085 struct nft_flowtable *flowtable, 9086 struct netlink_ext_ack *extack) 9087 { 9088 const struct nlattr * const *nla = ctx->nla; 9089 struct nft_flowtable_hook flowtable_hook; 9090 struct nftables_pernet *nft_net; 9091 struct nft_hook *hook, *next; 9092 struct nf_hook_ops *ops; 9093 struct nft_trans *trans; 9094 bool unregister = false; 9095 u32 flags; 9096 int err; 9097 9098 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 9099 extack, false); 9100 if (err < 0) 9101 return err; 9102 9103 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 9104 if (nft_hook_list_find(&flowtable->hook_list, hook)) { 9105 list_del(&hook->list); 9106 nft_netdev_hook_free(hook); 9107 continue; 9108 } 9109 9110 nft_net = nft_pernet(ctx->net); 9111 list_for_each_entry(trans, &nft_net->commit_list, list) { 9112 if (trans->msg_type != NFT_MSG_NEWFLOWTABLE || 9113 trans->table != ctx->table || 9114 !nft_trans_flowtable_update(trans)) 9115 continue; 9116 9117 if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) { 9118 err = -EEXIST; 9119 goto err_flowtable_update_hook; 9120 } 9121 } 9122 } 9123 9124 if (nla[NFTA_FLOWTABLE_FLAGS]) { 9125 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 9126 if (flags & ~NFT_FLOWTABLE_MASK) { 9127 err = -EOPNOTSUPP; 9128 goto err_flowtable_update_hook; 9129 } 9130 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ 9131 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) { 9132 err = -EOPNOTSUPP; 9133 goto err_flowtable_update_hook; 9134 } 9135 } else { 9136 flags = flowtable->data.flags; 9137 } 9138 9139 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, 9140 &flowtable_hook.list, flowtable); 9141 if (err < 0) 9142 goto err_flowtable_update_hook; 9143 9144 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE, 9145 sizeof(struct nft_trans_flowtable)); 9146 if (!trans) { 9147 unregister = true; 9148 err = -ENOMEM; 9149 goto err_flowtable_update_hook; 9150 } 9151 9152 nft_trans_flowtable_flags(trans) = flags; 9153 nft_trans_flowtable(trans) = flowtable; 9154 nft_trans_flowtable_update(trans) = true; 9155 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 9156 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans)); 9157 9158 nft_trans_commit_list_add_tail(ctx->net, trans); 9159 9160 return 0; 9161 9162 err_flowtable_update_hook: 9163 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 9164 if (unregister) { 9165 list_for_each_entry(ops, &hook->ops_list, list) 9166 nft_unregister_flowtable_ops(ctx->net, 9167 flowtable, ops); 9168 } 9169 list_del_rcu(&hook->list); 9170 nft_netdev_hook_free_rcu(hook); 9171 } 9172 9173 return err; 9174 9175 } 9176 9177 static int nf_tables_newflowtable(struct sk_buff *skb, 9178 const struct nfnl_info *info, 9179 const struct nlattr * const nla[]) 9180 { 9181 struct netlink_ext_ack *extack = info->extack; 9182 struct nft_flowtable_hook flowtable_hook; 9183 u8 genmask = nft_genmask_next(info->net); 9184 u8 family = info->nfmsg->nfgen_family; 9185 const struct nf_flowtable_type *type; 9186 struct nft_flowtable *flowtable; 9187 struct net *net = info->net; 9188 struct nft_table *table; 9189 struct nft_trans *trans; 9190 struct nft_ctx ctx; 9191 int err; 9192 9193 if (!nla[NFTA_FLOWTABLE_TABLE] || 9194 !nla[NFTA_FLOWTABLE_NAME] || 9195 !nla[NFTA_FLOWTABLE_HOOK]) 9196 return -EINVAL; 9197 9198 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 9199 genmask, NETLINK_CB(skb).portid); 9200 if (IS_ERR(table)) { 9201 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 9202 return PTR_ERR(table); 9203 } 9204 9205 flowtable = nft_flowtable_lookup(net, table, nla[NFTA_FLOWTABLE_NAME], 9206 genmask); 9207 if (IS_ERR(flowtable)) { 9208 err = PTR_ERR(flowtable); 9209 if (err != -ENOENT) { 9210 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 9211 return err; 9212 } 9213 } else { 9214 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 9215 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 9216 return -EEXIST; 9217 } 9218 9219 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 9220 9221 return nft_flowtable_update(&ctx, info->nlh, flowtable, extack); 9222 } 9223 9224 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 9225 9226 if (!nft_use_inc(&table->use)) 9227 return -EMFILE; 9228 9229 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT); 9230 if (!flowtable) { 9231 err = -ENOMEM; 9232 goto flowtable_alloc; 9233 } 9234 9235 flowtable->table = table; 9236 flowtable->handle = nf_tables_alloc_handle(table); 9237 INIT_LIST_HEAD(&flowtable->hook_list); 9238 9239 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT); 9240 if (!flowtable->name) { 9241 err = -ENOMEM; 9242 goto err1; 9243 } 9244 9245 type = nft_flowtable_type_get(net, family); 9246 if (IS_ERR(type)) { 9247 err = PTR_ERR(type); 9248 goto err2; 9249 } 9250 9251 if (nla[NFTA_FLOWTABLE_FLAGS]) { 9252 flowtable->data.flags = 9253 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 9254 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { 9255 err = -EOPNOTSUPP; 9256 goto err3; 9257 } 9258 } 9259 9260 write_pnet(&flowtable->data.net, net); 9261 flowtable->data.type = type; 9262 err = type->init(&flowtable->data); 9263 if (err < 0) 9264 goto err3; 9265 9266 err = nft_flowtable_parse_hook(&ctx, nla, &flowtable_hook, flowtable, 9267 extack, true); 9268 if (err < 0) 9269 goto err_flowtable_parse_hooks; 9270 9271 list_splice(&flowtable_hook.list, &flowtable->hook_list); 9272 flowtable->data.priority = flowtable_hook.priority; 9273 flowtable->hooknum = flowtable_hook.num; 9274 9275 trans = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); 9276 if (IS_ERR(trans)) { 9277 err = PTR_ERR(trans); 9278 goto err_flowtable_trans; 9279 } 9280 9281 /* This must be LAST to ensure no packets are walking over this flowtable. */ 9282 err = nft_register_flowtable_net_hooks(ctx.net, table, 9283 &flowtable->hook_list, 9284 flowtable); 9285 if (err < 0) 9286 goto err_flowtable_hooks; 9287 9288 list_add_tail_rcu(&flowtable->list, &table->flowtables); 9289 9290 return 0; 9291 9292 err_flowtable_hooks: 9293 nft_trans_destroy(trans); 9294 err_flowtable_trans: 9295 nft_hooks_destroy(&flowtable->hook_list); 9296 err_flowtable_parse_hooks: 9297 flowtable->data.type->free(&flowtable->data); 9298 err3: 9299 module_put(type->owner); 9300 err2: 9301 kfree(flowtable->name); 9302 err1: 9303 kfree(flowtable); 9304 flowtable_alloc: 9305 nft_use_dec_restore(&table->use); 9306 9307 return err; 9308 } 9309 9310 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook) 9311 { 9312 struct nft_hook *this, *next; 9313 9314 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) { 9315 list_del(&this->list); 9316 nft_netdev_hook_free(this); 9317 } 9318 } 9319 9320 static int nft_delflowtable_hook(struct nft_ctx *ctx, 9321 struct nft_flowtable *flowtable, 9322 struct netlink_ext_ack *extack) 9323 { 9324 const struct nlattr * const *nla = ctx->nla; 9325 struct nft_flowtable_hook flowtable_hook; 9326 LIST_HEAD(flowtable_del_list); 9327 struct nft_hook *this, *hook; 9328 struct nft_trans *trans; 9329 int err; 9330 9331 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 9332 extack, false); 9333 if (err < 0) 9334 return err; 9335 9336 list_for_each_entry(this, &flowtable_hook.list, list) { 9337 hook = nft_hook_list_find(&flowtable->hook_list, this); 9338 if (!hook) { 9339 err = -ENOENT; 9340 goto err_flowtable_del_hook; 9341 } 9342 list_move(&hook->list, &flowtable_del_list); 9343 } 9344 9345 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE, 9346 sizeof(struct nft_trans_flowtable)); 9347 if (!trans) { 9348 err = -ENOMEM; 9349 goto err_flowtable_del_hook; 9350 } 9351 9352 nft_trans_flowtable(trans) = flowtable; 9353 nft_trans_flowtable_update(trans) = true; 9354 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 9355 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans)); 9356 nft_flowtable_hook_release(&flowtable_hook); 9357 9358 nft_trans_commit_list_add_tail(ctx->net, trans); 9359 9360 return 0; 9361 9362 err_flowtable_del_hook: 9363 list_splice(&flowtable_del_list, &flowtable->hook_list); 9364 nft_flowtable_hook_release(&flowtable_hook); 9365 9366 return err; 9367 } 9368 9369 static int nf_tables_delflowtable(struct sk_buff *skb, 9370 const struct nfnl_info *info, 9371 const struct nlattr * const nla[]) 9372 { 9373 struct netlink_ext_ack *extack = info->extack; 9374 u8 genmask = nft_genmask_next(info->net); 9375 u8 family = info->nfmsg->nfgen_family; 9376 struct nft_flowtable *flowtable; 9377 struct net *net = info->net; 9378 const struct nlattr *attr; 9379 struct nft_table *table; 9380 struct nft_ctx ctx; 9381 9382 if (!nla[NFTA_FLOWTABLE_TABLE] || 9383 (!nla[NFTA_FLOWTABLE_NAME] && 9384 !nla[NFTA_FLOWTABLE_HANDLE])) 9385 return -EINVAL; 9386 9387 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 9388 genmask, NETLINK_CB(skb).portid); 9389 if (IS_ERR(table)) { 9390 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 9391 return PTR_ERR(table); 9392 } 9393 9394 if (nla[NFTA_FLOWTABLE_HANDLE]) { 9395 attr = nla[NFTA_FLOWTABLE_HANDLE]; 9396 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask); 9397 } else { 9398 attr = nla[NFTA_FLOWTABLE_NAME]; 9399 flowtable = nft_flowtable_lookup(net, table, attr, genmask); 9400 } 9401 9402 if (IS_ERR(flowtable)) { 9403 if (PTR_ERR(flowtable) == -ENOENT && 9404 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYFLOWTABLE) 9405 return 0; 9406 9407 NL_SET_BAD_ATTR(extack, attr); 9408 return PTR_ERR(flowtable); 9409 } 9410 9411 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 9412 9413 if (nla[NFTA_FLOWTABLE_HOOK]) 9414 return nft_delflowtable_hook(&ctx, flowtable, extack); 9415 9416 if (flowtable->use > 0) { 9417 NL_SET_BAD_ATTR(extack, attr); 9418 return -EBUSY; 9419 } 9420 9421 return nft_delflowtable(&ctx, flowtable); 9422 } 9423 9424 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 9425 u32 portid, u32 seq, int event, 9426 u32 flags, int family, 9427 struct nft_flowtable *flowtable, 9428 struct list_head *hook_list) 9429 { 9430 struct nlattr *nest, *nest_devs; 9431 struct nft_hook *hook; 9432 struct nlmsghdr *nlh; 9433 9434 nlh = nfnl_msg_put(skb, portid, seq, 9435 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 9436 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 9437 if (!nlh) 9438 goto nla_put_failure; 9439 9440 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || 9441 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || 9442 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), 9443 NFTA_FLOWTABLE_PAD)) 9444 goto nla_put_failure; 9445 9446 if (!hook_list && 9447 (event == NFT_MSG_DELFLOWTABLE || 9448 event == NFT_MSG_DESTROYFLOWTABLE)) { 9449 nlmsg_end(skb, nlh); 9450 return 0; 9451 } 9452 9453 if (nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || 9454 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) 9455 goto nla_put_failure; 9456 9457 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK); 9458 if (!nest) 9459 goto nla_put_failure; 9460 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || 9461 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority))) 9462 goto nla_put_failure; 9463 9464 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS); 9465 if (!nest_devs) 9466 goto nla_put_failure; 9467 9468 if (!hook_list) 9469 hook_list = &flowtable->hook_list; 9470 9471 list_for_each_entry_rcu(hook, hook_list, list, 9472 lockdep_commit_lock_is_held(net)) { 9473 if (nft_nla_put_hook_dev(skb, hook)) 9474 goto nla_put_failure; 9475 } 9476 nla_nest_end(skb, nest_devs); 9477 nla_nest_end(skb, nest); 9478 9479 nlmsg_end(skb, nlh); 9480 return 0; 9481 9482 nla_put_failure: 9483 nlmsg_trim(skb, nlh); 9484 return -1; 9485 } 9486 9487 struct nft_flowtable_filter { 9488 char *table; 9489 }; 9490 9491 static int nf_tables_dump_flowtable(struct sk_buff *skb, 9492 struct netlink_callback *cb) 9493 { 9494 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 9495 struct nft_flowtable_filter *filter = cb->data; 9496 unsigned int idx = 0, s_idx = cb->args[0]; 9497 struct net *net = sock_net(skb->sk); 9498 int family = nfmsg->nfgen_family; 9499 struct nft_flowtable *flowtable; 9500 struct nftables_pernet *nft_net; 9501 const struct nft_table *table; 9502 9503 rcu_read_lock(); 9504 nft_net = nft_pernet(net); 9505 cb->seq = nft_base_seq(net); 9506 9507 list_for_each_entry_rcu(table, &nft_net->tables, list) { 9508 if (family != NFPROTO_UNSPEC && family != table->family) 9509 continue; 9510 9511 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 9512 if (!nft_is_active(net, flowtable)) 9513 goto cont; 9514 if (idx < s_idx) 9515 goto cont; 9516 if (idx > s_idx) 9517 memset(&cb->args[1], 0, 9518 sizeof(cb->args) - sizeof(cb->args[0])); 9519 if (filter && filter->table && 9520 strcmp(filter->table, table->name)) 9521 goto cont; 9522 9523 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, 9524 cb->nlh->nlmsg_seq, 9525 NFT_MSG_NEWFLOWTABLE, 9526 NLM_F_MULTI | NLM_F_APPEND, 9527 table->family, 9528 flowtable, NULL) < 0) 9529 goto done; 9530 9531 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 9532 cont: 9533 idx++; 9534 } 9535 } 9536 done: 9537 rcu_read_unlock(); 9538 9539 cb->args[0] = idx; 9540 return skb->len; 9541 } 9542 9543 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb) 9544 { 9545 const struct nlattr * const *nla = cb->data; 9546 struct nft_flowtable_filter *filter = NULL; 9547 9548 if (nla[NFTA_FLOWTABLE_TABLE]) { 9549 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 9550 if (!filter) 9551 return -ENOMEM; 9552 9553 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], 9554 GFP_ATOMIC); 9555 if (!filter->table) { 9556 kfree(filter); 9557 return -ENOMEM; 9558 } 9559 } 9560 9561 cb->data = filter; 9562 return 0; 9563 } 9564 9565 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) 9566 { 9567 struct nft_flowtable_filter *filter = cb->data; 9568 9569 if (!filter) 9570 return 0; 9571 9572 kfree(filter->table); 9573 kfree(filter); 9574 9575 return 0; 9576 } 9577 9578 /* called with rcu_read_lock held */ 9579 static int nf_tables_getflowtable(struct sk_buff *skb, 9580 const struct nfnl_info *info, 9581 const struct nlattr * const nla[]) 9582 { 9583 struct netlink_ext_ack *extack = info->extack; 9584 u8 genmask = nft_genmask_cur(info->net); 9585 u8 family = info->nfmsg->nfgen_family; 9586 struct nft_flowtable *flowtable; 9587 const struct nft_table *table; 9588 struct net *net = info->net; 9589 struct sk_buff *skb2; 9590 int err; 9591 9592 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 9593 struct netlink_dump_control c = { 9594 .start = nf_tables_dump_flowtable_start, 9595 .dump = nf_tables_dump_flowtable, 9596 .done = nf_tables_dump_flowtable_done, 9597 .module = THIS_MODULE, 9598 .data = (void *)nla, 9599 }; 9600 9601 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 9602 } 9603 9604 if (!nla[NFTA_FLOWTABLE_NAME]) 9605 return -EINVAL; 9606 9607 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 9608 genmask, 0); 9609 if (IS_ERR(table)) { 9610 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 9611 return PTR_ERR(table); 9612 } 9613 9614 flowtable = nft_flowtable_lookup(net, table, nla[NFTA_FLOWTABLE_NAME], 9615 genmask); 9616 if (IS_ERR(flowtable)) { 9617 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 9618 return PTR_ERR(flowtable); 9619 } 9620 9621 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 9622 if (!skb2) 9623 return -ENOMEM; 9624 9625 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, 9626 info->nlh->nlmsg_seq, 9627 NFT_MSG_NEWFLOWTABLE, 0, family, 9628 flowtable, NULL); 9629 if (err < 0) 9630 goto err_fill_flowtable_info; 9631 9632 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 9633 9634 err_fill_flowtable_info: 9635 kfree_skb(skb2); 9636 return err; 9637 } 9638 9639 static void nf_tables_flowtable_notify(struct nft_ctx *ctx, 9640 struct nft_flowtable *flowtable, 9641 struct list_head *hook_list, int event) 9642 { 9643 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 9644 struct sk_buff *skb; 9645 u16 flags = 0; 9646 int err; 9647 9648 if (!ctx->report && 9649 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 9650 return; 9651 9652 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 9653 if (skb == NULL) 9654 goto err; 9655 9656 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 9657 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 9658 9659 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, 9660 ctx->seq, event, flags, 9661 ctx->family, flowtable, hook_list); 9662 if (err < 0) { 9663 kfree_skb(skb); 9664 goto err; 9665 } 9666 9667 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 9668 return; 9669 err: 9670 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 9671 } 9672 9673 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 9674 { 9675 struct nft_hook *hook, *next; 9676 9677 flowtable->data.type->free(&flowtable->data); 9678 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 9679 list_del_rcu(&hook->list); 9680 nft_netdev_hook_free_rcu(hook); 9681 } 9682 kfree(flowtable->name); 9683 module_put(flowtable->data.type->owner); 9684 kfree(flowtable); 9685 } 9686 9687 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 9688 u32 portid, u32 seq) 9689 { 9690 struct nlmsghdr *nlh; 9691 char buf[TASK_COMM_LEN]; 9692 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); 9693 9694 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, 9695 NFNETLINK_V0, nft_base_seq_be16(net)); 9696 if (!nlh) 9697 goto nla_put_failure; 9698 9699 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_base_seq(net))) || 9700 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || 9701 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) 9702 goto nla_put_failure; 9703 9704 nlmsg_end(skb, nlh); 9705 return 0; 9706 9707 nla_put_failure: 9708 nlmsg_trim(skb, nlh); 9709 return -EMSGSIZE; 9710 } 9711 9712 struct nf_hook_ops *nft_hook_find_ops(const struct nft_hook *hook, 9713 const struct net_device *dev) 9714 { 9715 struct nf_hook_ops *ops; 9716 9717 list_for_each_entry(ops, &hook->ops_list, list) { 9718 if (ops->dev == dev) 9719 return ops; 9720 } 9721 return NULL; 9722 } 9723 EXPORT_SYMBOL_GPL(nft_hook_find_ops); 9724 9725 struct nf_hook_ops *nft_hook_find_ops_rcu(const struct nft_hook *hook, 9726 const struct net_device *dev) 9727 { 9728 struct nf_hook_ops *ops; 9729 9730 list_for_each_entry_rcu(ops, &hook->ops_list, list) { 9731 if (ops->dev == dev) 9732 return ops; 9733 } 9734 return NULL; 9735 } 9736 EXPORT_SYMBOL_GPL(nft_hook_find_ops_rcu); 9737 9738 static int nft_flowtable_event(unsigned long event, struct net_device *dev, 9739 struct nft_flowtable *flowtable, bool changename) 9740 { 9741 struct nf_hook_ops *ops; 9742 struct nft_hook *hook; 9743 bool match; 9744 9745 list_for_each_entry(hook, &flowtable->hook_list, list) { 9746 ops = nft_hook_find_ops(hook, dev); 9747 match = !strncmp(hook->ifname, dev->name, hook->ifnamelen); 9748 9749 switch (event) { 9750 case NETDEV_UNREGISTER: 9751 /* NOP if not found or new name still matching */ 9752 if (!ops || (changename && match)) 9753 continue; 9754 9755 /* flow_offload_netdev_event() cleans up entries for us. */ 9756 nft_unregister_flowtable_ops(dev_net(dev), 9757 flowtable, ops); 9758 list_del_rcu(&ops->list); 9759 kfree_rcu(ops, rcu); 9760 break; 9761 case NETDEV_REGISTER: 9762 /* NOP if not matching or already registered */ 9763 if (!match || (changename && ops)) 9764 continue; 9765 9766 ops = kzalloc(sizeof(struct nf_hook_ops), 9767 GFP_KERNEL_ACCOUNT); 9768 if (!ops) 9769 return 1; 9770 9771 ops->pf = NFPROTO_NETDEV; 9772 ops->hooknum = flowtable->hooknum; 9773 ops->priority = flowtable->data.priority; 9774 ops->priv = &flowtable->data; 9775 ops->hook = flowtable->data.type->hook; 9776 ops->hook_ops_type = NF_HOOK_OP_NFT_FT; 9777 ops->dev = dev; 9778 if (nft_register_flowtable_ops(dev_net(dev), 9779 flowtable, ops)) { 9780 kfree(ops); 9781 return 1; 9782 } 9783 list_add_tail_rcu(&ops->list, &hook->ops_list); 9784 break; 9785 } 9786 break; 9787 } 9788 return 0; 9789 } 9790 9791 static int __nf_tables_flowtable_event(unsigned long event, 9792 struct net_device *dev, 9793 bool changename) 9794 { 9795 struct nftables_pernet *nft_net = nft_pernet(dev_net(dev)); 9796 struct nft_flowtable *flowtable; 9797 struct nft_table *table; 9798 9799 list_for_each_entry(table, &nft_net->tables, list) { 9800 list_for_each_entry(flowtable, &table->flowtables, list) { 9801 if (nft_flowtable_event(event, dev, 9802 flowtable, changename)) 9803 return 1; 9804 } 9805 } 9806 return 0; 9807 } 9808 9809 static int nf_tables_flowtable_event(struct notifier_block *this, 9810 unsigned long event, void *ptr) 9811 { 9812 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 9813 struct nftables_pernet *nft_net; 9814 int ret = NOTIFY_DONE; 9815 struct net *net; 9816 9817 if (event != NETDEV_REGISTER && 9818 event != NETDEV_UNREGISTER && 9819 event != NETDEV_CHANGENAME) 9820 return NOTIFY_DONE; 9821 9822 net = dev_net(dev); 9823 nft_net = nft_pernet(net); 9824 mutex_lock(&nft_net->commit_mutex); 9825 9826 if (event == NETDEV_CHANGENAME) { 9827 if (__nf_tables_flowtable_event(NETDEV_REGISTER, dev, true)) { 9828 ret = NOTIFY_BAD; 9829 goto out_unlock; 9830 } 9831 __nf_tables_flowtable_event(NETDEV_UNREGISTER, dev, true); 9832 } else if (__nf_tables_flowtable_event(event, dev, false)) { 9833 ret = NOTIFY_BAD; 9834 } 9835 out_unlock: 9836 mutex_unlock(&nft_net->commit_mutex); 9837 return ret; 9838 } 9839 9840 static struct notifier_block nf_tables_flowtable_notifier = { 9841 .notifier_call = nf_tables_flowtable_event, 9842 }; 9843 9844 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, 9845 int event) 9846 { 9847 struct nlmsghdr *nlh = nlmsg_hdr(skb); 9848 struct sk_buff *skb2; 9849 int err; 9850 9851 if (!nlmsg_report(nlh) && 9852 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 9853 return; 9854 9855 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 9856 if (skb2 == NULL) 9857 goto err; 9858 9859 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 9860 nlh->nlmsg_seq); 9861 if (err < 0) { 9862 kfree_skb(skb2); 9863 goto err; 9864 } 9865 9866 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 9867 nlmsg_report(nlh), GFP_KERNEL); 9868 return; 9869 err: 9870 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 9871 -ENOBUFS); 9872 } 9873 9874 static int nf_tables_getgen(struct sk_buff *skb, const struct nfnl_info *info, 9875 const struct nlattr * const nla[]) 9876 { 9877 struct sk_buff *skb2; 9878 int err; 9879 9880 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 9881 if (skb2 == NULL) 9882 return -ENOMEM; 9883 9884 err = nf_tables_fill_gen_info(skb2, info->net, NETLINK_CB(skb).portid, 9885 info->nlh->nlmsg_seq); 9886 if (err < 0) 9887 goto err_fill_gen_info; 9888 9889 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 9890 9891 err_fill_gen_info: 9892 kfree_skb(skb2); 9893 return err; 9894 } 9895 9896 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 9897 [NFT_MSG_NEWTABLE] = { 9898 .call = nf_tables_newtable, 9899 .type = NFNL_CB_BATCH, 9900 .attr_count = NFTA_TABLE_MAX, 9901 .policy = nft_table_policy, 9902 }, 9903 [NFT_MSG_GETTABLE] = { 9904 .call = nf_tables_gettable, 9905 .type = NFNL_CB_RCU, 9906 .attr_count = NFTA_TABLE_MAX, 9907 .policy = nft_table_policy, 9908 }, 9909 [NFT_MSG_DELTABLE] = { 9910 .call = nf_tables_deltable, 9911 .type = NFNL_CB_BATCH, 9912 .attr_count = NFTA_TABLE_MAX, 9913 .policy = nft_table_policy, 9914 }, 9915 [NFT_MSG_DESTROYTABLE] = { 9916 .call = nf_tables_deltable, 9917 .type = NFNL_CB_BATCH, 9918 .attr_count = NFTA_TABLE_MAX, 9919 .policy = nft_table_policy, 9920 }, 9921 [NFT_MSG_NEWCHAIN] = { 9922 .call = nf_tables_newchain, 9923 .type = NFNL_CB_BATCH, 9924 .attr_count = NFTA_CHAIN_MAX, 9925 .policy = nft_chain_policy, 9926 }, 9927 [NFT_MSG_GETCHAIN] = { 9928 .call = nf_tables_getchain, 9929 .type = NFNL_CB_RCU, 9930 .attr_count = NFTA_CHAIN_MAX, 9931 .policy = nft_chain_policy, 9932 }, 9933 [NFT_MSG_DELCHAIN] = { 9934 .call = nf_tables_delchain, 9935 .type = NFNL_CB_BATCH, 9936 .attr_count = NFTA_CHAIN_MAX, 9937 .policy = nft_chain_policy, 9938 }, 9939 [NFT_MSG_DESTROYCHAIN] = { 9940 .call = nf_tables_delchain, 9941 .type = NFNL_CB_BATCH, 9942 .attr_count = NFTA_CHAIN_MAX, 9943 .policy = nft_chain_policy, 9944 }, 9945 [NFT_MSG_NEWRULE] = { 9946 .call = nf_tables_newrule, 9947 .type = NFNL_CB_BATCH, 9948 .attr_count = NFTA_RULE_MAX, 9949 .policy = nft_rule_policy, 9950 }, 9951 [NFT_MSG_GETRULE] = { 9952 .call = nf_tables_getrule, 9953 .type = NFNL_CB_RCU, 9954 .attr_count = NFTA_RULE_MAX, 9955 .policy = nft_rule_policy, 9956 }, 9957 [NFT_MSG_GETRULE_RESET] = { 9958 .call = nf_tables_getrule_reset, 9959 .type = NFNL_CB_RCU, 9960 .attr_count = NFTA_RULE_MAX, 9961 .policy = nft_rule_policy, 9962 }, 9963 [NFT_MSG_DELRULE] = { 9964 .call = nf_tables_delrule, 9965 .type = NFNL_CB_BATCH, 9966 .attr_count = NFTA_RULE_MAX, 9967 .policy = nft_rule_policy, 9968 }, 9969 [NFT_MSG_DESTROYRULE] = { 9970 .call = nf_tables_delrule, 9971 .type = NFNL_CB_BATCH, 9972 .attr_count = NFTA_RULE_MAX, 9973 .policy = nft_rule_policy, 9974 }, 9975 [NFT_MSG_NEWSET] = { 9976 .call = nf_tables_newset, 9977 .type = NFNL_CB_BATCH, 9978 .attr_count = NFTA_SET_MAX, 9979 .policy = nft_set_policy, 9980 }, 9981 [NFT_MSG_GETSET] = { 9982 .call = nf_tables_getset, 9983 .type = NFNL_CB_RCU, 9984 .attr_count = NFTA_SET_MAX, 9985 .policy = nft_set_policy, 9986 }, 9987 [NFT_MSG_DELSET] = { 9988 .call = nf_tables_delset, 9989 .type = NFNL_CB_BATCH, 9990 .attr_count = NFTA_SET_MAX, 9991 .policy = nft_set_policy, 9992 }, 9993 [NFT_MSG_DESTROYSET] = { 9994 .call = nf_tables_delset, 9995 .type = NFNL_CB_BATCH, 9996 .attr_count = NFTA_SET_MAX, 9997 .policy = nft_set_policy, 9998 }, 9999 [NFT_MSG_NEWSETELEM] = { 10000 .call = nf_tables_newsetelem, 10001 .type = NFNL_CB_BATCH, 10002 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10003 .policy = nft_set_elem_list_policy, 10004 }, 10005 [NFT_MSG_GETSETELEM] = { 10006 .call = nf_tables_getsetelem, 10007 .type = NFNL_CB_RCU, 10008 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10009 .policy = nft_set_elem_list_policy, 10010 }, 10011 [NFT_MSG_GETSETELEM_RESET] = { 10012 .call = nf_tables_getsetelem_reset, 10013 .type = NFNL_CB_RCU, 10014 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10015 .policy = nft_set_elem_list_policy, 10016 }, 10017 [NFT_MSG_DELSETELEM] = { 10018 .call = nf_tables_delsetelem, 10019 .type = NFNL_CB_BATCH, 10020 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10021 .policy = nft_set_elem_list_policy, 10022 }, 10023 [NFT_MSG_DESTROYSETELEM] = { 10024 .call = nf_tables_delsetelem, 10025 .type = NFNL_CB_BATCH, 10026 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10027 .policy = nft_set_elem_list_policy, 10028 }, 10029 [NFT_MSG_GETGEN] = { 10030 .call = nf_tables_getgen, 10031 .type = NFNL_CB_RCU, 10032 }, 10033 [NFT_MSG_NEWOBJ] = { 10034 .call = nf_tables_newobj, 10035 .type = NFNL_CB_BATCH, 10036 .attr_count = NFTA_OBJ_MAX, 10037 .policy = nft_obj_policy, 10038 }, 10039 [NFT_MSG_GETOBJ] = { 10040 .call = nf_tables_getobj, 10041 .type = NFNL_CB_RCU, 10042 .attr_count = NFTA_OBJ_MAX, 10043 .policy = nft_obj_policy, 10044 }, 10045 [NFT_MSG_DELOBJ] = { 10046 .call = nf_tables_delobj, 10047 .type = NFNL_CB_BATCH, 10048 .attr_count = NFTA_OBJ_MAX, 10049 .policy = nft_obj_policy, 10050 }, 10051 [NFT_MSG_DESTROYOBJ] = { 10052 .call = nf_tables_delobj, 10053 .type = NFNL_CB_BATCH, 10054 .attr_count = NFTA_OBJ_MAX, 10055 .policy = nft_obj_policy, 10056 }, 10057 [NFT_MSG_GETOBJ_RESET] = { 10058 .call = nf_tables_getobj_reset, 10059 .type = NFNL_CB_RCU, 10060 .attr_count = NFTA_OBJ_MAX, 10061 .policy = nft_obj_policy, 10062 }, 10063 [NFT_MSG_NEWFLOWTABLE] = { 10064 .call = nf_tables_newflowtable, 10065 .type = NFNL_CB_BATCH, 10066 .attr_count = NFTA_FLOWTABLE_MAX, 10067 .policy = nft_flowtable_policy, 10068 }, 10069 [NFT_MSG_GETFLOWTABLE] = { 10070 .call = nf_tables_getflowtable, 10071 .type = NFNL_CB_RCU, 10072 .attr_count = NFTA_FLOWTABLE_MAX, 10073 .policy = nft_flowtable_policy, 10074 }, 10075 [NFT_MSG_DELFLOWTABLE] = { 10076 .call = nf_tables_delflowtable, 10077 .type = NFNL_CB_BATCH, 10078 .attr_count = NFTA_FLOWTABLE_MAX, 10079 .policy = nft_flowtable_policy, 10080 }, 10081 [NFT_MSG_DESTROYFLOWTABLE] = { 10082 .call = nf_tables_delflowtable, 10083 .type = NFNL_CB_BATCH, 10084 .attr_count = NFTA_FLOWTABLE_MAX, 10085 .policy = nft_flowtable_policy, 10086 }, 10087 }; 10088 10089 static int nf_tables_validate(struct net *net) 10090 { 10091 struct nftables_pernet *nft_net = nft_pernet(net); 10092 struct nft_table *table; 10093 10094 list_for_each_entry(table, &nft_net->tables, list) { 10095 switch (table->validate_state) { 10096 case NFT_VALIDATE_SKIP: 10097 continue; 10098 case NFT_VALIDATE_NEED: 10099 nft_validate_state_update(table, NFT_VALIDATE_DO); 10100 fallthrough; 10101 case NFT_VALIDATE_DO: 10102 if (nft_table_validate(net, table) < 0) 10103 return -EAGAIN; 10104 10105 nft_validate_state_update(table, NFT_VALIDATE_SKIP); 10106 break; 10107 } 10108 } 10109 10110 return 0; 10111 } 10112 10113 /* a drop policy has to be deferred until all rules have been activated, 10114 * otherwise a large ruleset that contains a drop-policy base chain will 10115 * cause all packets to get dropped until the full transaction has been 10116 * processed. 10117 * 10118 * We defer the drop policy until the transaction has been finalized. 10119 */ 10120 static void nft_chain_commit_drop_policy(struct nft_trans_chain *trans) 10121 { 10122 struct nft_base_chain *basechain; 10123 10124 if (trans->policy != NF_DROP) 10125 return; 10126 10127 if (!nft_is_base_chain(trans->chain)) 10128 return; 10129 10130 basechain = nft_base_chain(trans->chain); 10131 basechain->policy = NF_DROP; 10132 } 10133 10134 static void nft_chain_commit_update(struct nft_trans_chain *trans) 10135 { 10136 struct nft_table *table = trans->nft_trans_binding.nft_trans.table; 10137 struct nft_base_chain *basechain; 10138 10139 if (trans->name) { 10140 rhltable_remove(&table->chains_ht, 10141 &trans->chain->rhlhead, 10142 nft_chain_ht_params); 10143 swap(trans->chain->name, trans->name); 10144 rhltable_insert_key(&table->chains_ht, 10145 trans->chain->name, 10146 &trans->chain->rhlhead, 10147 nft_chain_ht_params); 10148 } 10149 10150 if (!nft_is_base_chain(trans->chain)) 10151 return; 10152 10153 nft_chain_stats_replace(trans); 10154 10155 basechain = nft_base_chain(trans->chain); 10156 10157 switch (trans->policy) { 10158 case NF_DROP: 10159 case NF_ACCEPT: 10160 basechain->policy = trans->policy; 10161 break; 10162 } 10163 } 10164 10165 static void nft_obj_commit_update(const struct nft_ctx *ctx, 10166 struct nft_trans *trans) 10167 { 10168 struct nft_object *newobj; 10169 struct nft_object *obj; 10170 10171 obj = nft_trans_obj(trans); 10172 newobj = nft_trans_obj_newobj(trans); 10173 10174 if (WARN_ON_ONCE(!obj->ops->update)) 10175 return; 10176 10177 obj->ops->update(obj, newobj); 10178 nft_obj_destroy(ctx, newobj); 10179 } 10180 10181 static void nft_commit_release(struct nft_trans *trans) 10182 { 10183 struct nft_ctx ctx = { 10184 .net = trans->net, 10185 }; 10186 10187 nft_ctx_update(&ctx, trans); 10188 10189 switch (trans->msg_type) { 10190 case NFT_MSG_DELTABLE: 10191 case NFT_MSG_DESTROYTABLE: 10192 nf_tables_table_destroy(trans->table); 10193 break; 10194 case NFT_MSG_NEWCHAIN: 10195 free_percpu(nft_trans_chain_stats(trans)); 10196 kfree(nft_trans_chain_name(trans)); 10197 break; 10198 case NFT_MSG_DELCHAIN: 10199 case NFT_MSG_DESTROYCHAIN: 10200 if (nft_trans_chain_update(trans)) 10201 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 10202 else 10203 nf_tables_chain_destroy(nft_trans_chain(trans)); 10204 break; 10205 case NFT_MSG_DELRULE: 10206 case NFT_MSG_DESTROYRULE: 10207 nf_tables_rule_destroy(&ctx, nft_trans_rule(trans)); 10208 break; 10209 case NFT_MSG_DELSET: 10210 case NFT_MSG_DESTROYSET: 10211 nft_set_destroy(&ctx, nft_trans_set(trans)); 10212 break; 10213 case NFT_MSG_DELSETELEM: 10214 case NFT_MSG_DESTROYSETELEM: 10215 nft_trans_elems_destroy(&ctx, nft_trans_container_elem(trans)); 10216 break; 10217 case NFT_MSG_DELOBJ: 10218 case NFT_MSG_DESTROYOBJ: 10219 nft_obj_destroy(&ctx, nft_trans_obj(trans)); 10220 break; 10221 case NFT_MSG_DELFLOWTABLE: 10222 case NFT_MSG_DESTROYFLOWTABLE: 10223 if (nft_trans_flowtable_update(trans)) 10224 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 10225 else 10226 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 10227 break; 10228 } 10229 10230 if (trans->put_net) 10231 put_net(trans->net); 10232 10233 kfree(trans); 10234 } 10235 10236 static void nf_tables_trans_destroy_work(struct work_struct *w) 10237 { 10238 struct nftables_pernet *nft_net = container_of(w, struct nftables_pernet, destroy_work); 10239 struct nft_trans *trans, *next; 10240 LIST_HEAD(head); 10241 10242 spin_lock(&nf_tables_destroy_list_lock); 10243 list_splice_init(&nft_net->destroy_list, &head); 10244 spin_unlock(&nf_tables_destroy_list_lock); 10245 10246 if (list_empty(&head)) 10247 return; 10248 10249 synchronize_rcu(); 10250 10251 list_for_each_entry_safe(trans, next, &head, list) { 10252 nft_trans_list_del(trans); 10253 nft_commit_release(trans); 10254 } 10255 } 10256 10257 void nf_tables_trans_destroy_flush_work(struct net *net) 10258 { 10259 struct nftables_pernet *nft_net = nft_pernet(net); 10260 10261 flush_work(&nft_net->destroy_work); 10262 } 10263 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); 10264 10265 static bool nft_expr_reduce(struct nft_regs_track *track, 10266 const struct nft_expr *expr) 10267 { 10268 return false; 10269 } 10270 10271 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain) 10272 { 10273 const struct nft_expr *expr, *last; 10274 struct nft_regs_track track = {}; 10275 unsigned int size, data_size; 10276 void *data, *data_boundary; 10277 struct nft_rule_dp *prule; 10278 struct nft_rule *rule; 10279 10280 /* already handled or inactive chain? */ 10281 if (chain->blob_next || !nft_is_active_next(net, chain)) 10282 return 0; 10283 10284 data_size = 0; 10285 list_for_each_entry(rule, &chain->rules, list) { 10286 if (nft_is_active_next(net, rule)) { 10287 data_size += sizeof(*prule) + rule->dlen; 10288 if (data_size > INT_MAX) 10289 return -ENOMEM; 10290 } 10291 } 10292 10293 chain->blob_next = nf_tables_chain_alloc_rules(chain, data_size); 10294 if (!chain->blob_next) 10295 return -ENOMEM; 10296 10297 data = (void *)chain->blob_next->data; 10298 data_boundary = data + data_size; 10299 size = 0; 10300 10301 list_for_each_entry(rule, &chain->rules, list) { 10302 if (!nft_is_active_next(net, rule)) 10303 continue; 10304 10305 prule = (struct nft_rule_dp *)data; 10306 data += offsetof(struct nft_rule_dp, data); 10307 if (WARN_ON_ONCE(data > data_boundary)) 10308 return -ENOMEM; 10309 10310 size = 0; 10311 track.last = nft_expr_last(rule); 10312 nft_rule_for_each_expr(expr, last, rule) { 10313 track.cur = expr; 10314 10315 if (nft_expr_reduce(&track, expr)) { 10316 expr = track.cur; 10317 continue; 10318 } 10319 10320 if (WARN_ON_ONCE(data + size + expr->ops->size > data_boundary)) 10321 return -ENOMEM; 10322 10323 memcpy(data + size, expr, expr->ops->size); 10324 size += expr->ops->size; 10325 } 10326 if (WARN_ON_ONCE(size >= 1 << 12)) 10327 return -ENOMEM; 10328 10329 prule->handle = rule->handle; 10330 prule->dlen = size; 10331 prule->is_last = 0; 10332 10333 data += size; 10334 size = 0; 10335 chain->blob_next->size += (unsigned long)(data - (void *)prule); 10336 } 10337 10338 if (WARN_ON_ONCE(data > data_boundary)) 10339 return -ENOMEM; 10340 10341 prule = (struct nft_rule_dp *)data; 10342 nft_last_rule(chain, prule); 10343 10344 return 0; 10345 } 10346 10347 static void nf_tables_commit_chain_prepare_cancel(struct net *net) 10348 { 10349 struct nftables_pernet *nft_net = nft_pernet(net); 10350 struct nft_trans *trans, *next; 10351 10352 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 10353 if (trans->msg_type == NFT_MSG_NEWRULE || 10354 trans->msg_type == NFT_MSG_DELRULE) { 10355 struct nft_chain *chain = nft_trans_rule_chain(trans); 10356 10357 kvfree(chain->blob_next); 10358 chain->blob_next = NULL; 10359 } 10360 } 10361 } 10362 10363 static void __nf_tables_commit_chain_free_rules(struct rcu_head *h) 10364 { 10365 struct nft_rule_dp_last *l = container_of(h, struct nft_rule_dp_last, h); 10366 10367 kvfree(l->blob); 10368 } 10369 10370 static void nf_tables_commit_chain_free_rules_old(struct nft_rule_blob *blob) 10371 { 10372 struct nft_rule_dp_last *last; 10373 10374 /* last rule trailer is after end marker */ 10375 last = (void *)blob + sizeof(*blob) + blob->size; 10376 last->blob = blob; 10377 10378 call_rcu(&last->h, __nf_tables_commit_chain_free_rules); 10379 } 10380 10381 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain) 10382 { 10383 struct nft_rule_blob *g0, *g1; 10384 bool next_genbit; 10385 10386 next_genbit = nft_gencursor_next(net); 10387 10388 g0 = rcu_dereference_protected(chain->blob_gen_0, 10389 lockdep_commit_lock_is_held(net)); 10390 g1 = rcu_dereference_protected(chain->blob_gen_1, 10391 lockdep_commit_lock_is_held(net)); 10392 10393 /* No changes to this chain? */ 10394 if (chain->blob_next == NULL) { 10395 /* chain had no change in last or next generation */ 10396 if (g0 == g1) 10397 return; 10398 /* 10399 * chain had no change in this generation; make sure next 10400 * one uses same rules as current generation. 10401 */ 10402 if (next_genbit) { 10403 rcu_assign_pointer(chain->blob_gen_1, g0); 10404 nf_tables_commit_chain_free_rules_old(g1); 10405 } else { 10406 rcu_assign_pointer(chain->blob_gen_0, g1); 10407 nf_tables_commit_chain_free_rules_old(g0); 10408 } 10409 10410 return; 10411 } 10412 10413 if (next_genbit) 10414 rcu_assign_pointer(chain->blob_gen_1, chain->blob_next); 10415 else 10416 rcu_assign_pointer(chain->blob_gen_0, chain->blob_next); 10417 10418 chain->blob_next = NULL; 10419 10420 if (g0 == g1) 10421 return; 10422 10423 if (next_genbit) 10424 nf_tables_commit_chain_free_rules_old(g1); 10425 else 10426 nf_tables_commit_chain_free_rules_old(g0); 10427 } 10428 10429 static void nft_obj_del(struct nft_object *obj) 10430 { 10431 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params); 10432 list_del_rcu(&obj->list); 10433 } 10434 10435 void nft_chain_del(struct nft_chain *chain) 10436 { 10437 struct nft_table *table = chain->table; 10438 10439 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead, 10440 nft_chain_ht_params)); 10441 list_del_rcu(&chain->list); 10442 } 10443 10444 static void nft_trans_gc_setelem_remove(struct nft_ctx *ctx, 10445 struct nft_trans_gc *trans) 10446 { 10447 struct nft_elem_priv **priv = trans->priv; 10448 unsigned int i; 10449 10450 for (i = 0; i < trans->count; i++) { 10451 nft_setelem_data_deactivate(ctx->net, trans->set, priv[i]); 10452 nft_setelem_remove(ctx->net, trans->set, priv[i]); 10453 } 10454 } 10455 10456 void nft_trans_gc_destroy(struct nft_trans_gc *trans) 10457 { 10458 nft_set_put(trans->set); 10459 put_net(trans->net); 10460 kfree(trans); 10461 } 10462 10463 static void nft_trans_gc_trans_free(struct rcu_head *rcu) 10464 { 10465 struct nft_elem_priv *elem_priv; 10466 struct nft_trans_gc *trans; 10467 struct nft_ctx ctx = {}; 10468 unsigned int i; 10469 10470 trans = container_of(rcu, struct nft_trans_gc, rcu); 10471 ctx.net = read_pnet(&trans->set->net); 10472 10473 for (i = 0; i < trans->count; i++) { 10474 elem_priv = trans->priv[i]; 10475 if (!nft_setelem_is_catchall(trans->set, elem_priv)) 10476 atomic_dec(&trans->set->nelems); 10477 10478 nf_tables_set_elem_destroy(&ctx, trans->set, elem_priv); 10479 } 10480 10481 nft_trans_gc_destroy(trans); 10482 } 10483 10484 static bool nft_trans_gc_work_done(struct nft_trans_gc *trans) 10485 { 10486 struct nftables_pernet *nft_net; 10487 struct nft_ctx ctx = {}; 10488 10489 nft_net = nft_pernet(trans->net); 10490 10491 mutex_lock(&nft_net->commit_mutex); 10492 10493 /* Check for race with transaction, otherwise this batch refers to 10494 * stale objects that might not be there anymore. Skip transaction if 10495 * set has been destroyed from control plane transaction in case gc 10496 * worker loses race. 10497 */ 10498 if (READ_ONCE(nft_net->gc_seq) != trans->seq || trans->set->dead) { 10499 mutex_unlock(&nft_net->commit_mutex); 10500 return false; 10501 } 10502 10503 ctx.net = trans->net; 10504 ctx.table = trans->set->table; 10505 10506 nft_trans_gc_setelem_remove(&ctx, trans); 10507 mutex_unlock(&nft_net->commit_mutex); 10508 10509 return true; 10510 } 10511 10512 static void nft_trans_gc_work(struct work_struct *work) 10513 { 10514 struct nft_trans_gc *trans, *next; 10515 LIST_HEAD(trans_gc_list); 10516 10517 spin_lock(&nf_tables_gc_list_lock); 10518 list_splice_init(&nf_tables_gc_list, &trans_gc_list); 10519 spin_unlock(&nf_tables_gc_list_lock); 10520 10521 list_for_each_entry_safe(trans, next, &trans_gc_list, list) { 10522 list_del(&trans->list); 10523 if (!nft_trans_gc_work_done(trans)) { 10524 nft_trans_gc_destroy(trans); 10525 continue; 10526 } 10527 call_rcu(&trans->rcu, nft_trans_gc_trans_free); 10528 } 10529 } 10530 10531 struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set, 10532 unsigned int gc_seq, gfp_t gfp) 10533 { 10534 struct net *net = read_pnet(&set->net); 10535 struct nft_trans_gc *trans; 10536 10537 trans = kzalloc(sizeof(*trans), gfp); 10538 if (!trans) 10539 return NULL; 10540 10541 trans->net = maybe_get_net(net); 10542 if (!trans->net) { 10543 kfree(trans); 10544 return NULL; 10545 } 10546 10547 refcount_inc(&set->refs); 10548 trans->set = set; 10549 trans->seq = gc_seq; 10550 10551 return trans; 10552 } 10553 10554 void nft_trans_gc_elem_add(struct nft_trans_gc *trans, void *priv) 10555 { 10556 trans->priv[trans->count++] = priv; 10557 } 10558 10559 static void nft_trans_gc_queue_work(struct nft_trans_gc *trans) 10560 { 10561 spin_lock(&nf_tables_gc_list_lock); 10562 list_add_tail(&trans->list, &nf_tables_gc_list); 10563 spin_unlock(&nf_tables_gc_list_lock); 10564 10565 schedule_work(&trans_gc_work); 10566 } 10567 10568 static int nft_trans_gc_space(struct nft_trans_gc *trans) 10569 { 10570 return NFT_TRANS_GC_BATCHCOUNT - trans->count; 10571 } 10572 10573 struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc, 10574 unsigned int gc_seq, gfp_t gfp) 10575 { 10576 struct nft_set *set; 10577 10578 if (nft_trans_gc_space(gc)) 10579 return gc; 10580 10581 set = gc->set; 10582 nft_trans_gc_queue_work(gc); 10583 10584 return nft_trans_gc_alloc(set, gc_seq, gfp); 10585 } 10586 10587 void nft_trans_gc_queue_async_done(struct nft_trans_gc *trans) 10588 { 10589 if (trans->count == 0) { 10590 nft_trans_gc_destroy(trans); 10591 return; 10592 } 10593 10594 nft_trans_gc_queue_work(trans); 10595 } 10596 10597 struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp) 10598 { 10599 struct nft_set *set; 10600 10601 if (WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc->net))) 10602 return NULL; 10603 10604 if (nft_trans_gc_space(gc)) 10605 return gc; 10606 10607 set = gc->set; 10608 call_rcu(&gc->rcu, nft_trans_gc_trans_free); 10609 10610 return nft_trans_gc_alloc(set, 0, gfp); 10611 } 10612 10613 void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans) 10614 { 10615 WARN_ON_ONCE(!lockdep_commit_lock_is_held(trans->net)); 10616 10617 if (trans->count == 0) { 10618 nft_trans_gc_destroy(trans); 10619 return; 10620 } 10621 10622 call_rcu(&trans->rcu, nft_trans_gc_trans_free); 10623 } 10624 10625 struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc, 10626 unsigned int gc_seq) 10627 { 10628 struct nft_set_elem_catchall *catchall; 10629 const struct nft_set *set = gc->set; 10630 struct nft_set_ext *ext; 10631 10632 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 10633 ext = nft_set_elem_ext(set, catchall->elem); 10634 10635 if (!nft_set_elem_expired(ext)) 10636 continue; 10637 if (nft_set_elem_is_dead(ext)) 10638 goto dead_elem; 10639 10640 nft_set_elem_dead(ext); 10641 dead_elem: 10642 gc = nft_trans_gc_queue_async(gc, gc_seq, GFP_ATOMIC); 10643 if (!gc) 10644 return NULL; 10645 10646 nft_trans_gc_elem_add(gc, catchall->elem); 10647 } 10648 10649 return gc; 10650 } 10651 10652 struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc) 10653 { 10654 struct nft_set_elem_catchall *catchall, *next; 10655 u64 tstamp = nft_net_tstamp(gc->net); 10656 const struct nft_set *set = gc->set; 10657 struct nft_elem_priv *elem_priv; 10658 struct nft_set_ext *ext; 10659 10660 WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc->net)); 10661 10662 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 10663 ext = nft_set_elem_ext(set, catchall->elem); 10664 10665 if (!__nft_set_elem_expired(ext, tstamp)) 10666 continue; 10667 10668 gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); 10669 if (!gc) 10670 return NULL; 10671 10672 elem_priv = catchall->elem; 10673 nft_setelem_data_deactivate(gc->net, gc->set, elem_priv); 10674 nft_setelem_catchall_destroy(catchall); 10675 nft_trans_gc_elem_add(gc, elem_priv); 10676 } 10677 10678 return gc; 10679 } 10680 10681 static void nf_tables_module_autoload_cleanup(struct net *net) 10682 { 10683 struct nftables_pernet *nft_net = nft_pernet(net); 10684 struct nft_module_request *req, *next; 10685 10686 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 10687 list_for_each_entry_safe(req, next, &nft_net->module_list, list) { 10688 WARN_ON_ONCE(!req->done); 10689 list_del(&req->list); 10690 kfree(req); 10691 } 10692 } 10693 10694 static void nf_tables_commit_release(struct net *net) 10695 { 10696 struct nftables_pernet *nft_net = nft_pernet(net); 10697 struct nft_trans *trans; 10698 10699 /* all side effects have to be made visible. 10700 * For example, if a chain named 'foo' has been deleted, a 10701 * new transaction must not find it anymore. 10702 * 10703 * Memory reclaim happens asynchronously from work queue 10704 * to prevent expensive synchronize_rcu() in commit phase. 10705 */ 10706 if (list_empty(&nft_net->commit_list)) { 10707 nf_tables_module_autoload_cleanup(net); 10708 mutex_unlock(&nft_net->commit_mutex); 10709 return; 10710 } 10711 10712 trans = list_last_entry(&nft_net->commit_list, 10713 struct nft_trans, list); 10714 get_net(trans->net); 10715 WARN_ON_ONCE(trans->put_net); 10716 10717 trans->put_net = true; 10718 spin_lock(&nf_tables_destroy_list_lock); 10719 list_splice_tail_init(&nft_net->commit_list, &nft_net->destroy_list); 10720 spin_unlock(&nf_tables_destroy_list_lock); 10721 10722 nf_tables_module_autoload_cleanup(net); 10723 schedule_work(&nft_net->destroy_work); 10724 10725 mutex_unlock(&nft_net->commit_mutex); 10726 } 10727 10728 static void nft_commit_notify(struct net *net, u32 portid) 10729 { 10730 struct nftables_pernet *nft_net = nft_pernet(net); 10731 struct sk_buff *batch_skb = NULL, *nskb, *skb; 10732 unsigned char *data; 10733 int len; 10734 10735 list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) { 10736 if (!batch_skb) { 10737 new_batch: 10738 batch_skb = skb; 10739 len = NLMSG_GOODSIZE - skb->len; 10740 list_del(&skb->list); 10741 continue; 10742 } 10743 len -= skb->len; 10744 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) { 10745 data = skb_put(batch_skb, skb->len); 10746 memcpy(data, skb->data, skb->len); 10747 list_del(&skb->list); 10748 kfree_skb(skb); 10749 continue; 10750 } 10751 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 10752 NFT_CB(batch_skb).report, GFP_KERNEL); 10753 goto new_batch; 10754 } 10755 10756 if (batch_skb) { 10757 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 10758 NFT_CB(batch_skb).report, GFP_KERNEL); 10759 } 10760 10761 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 10762 } 10763 10764 static int nf_tables_commit_audit_alloc(struct list_head *adl, 10765 struct nft_table *table) 10766 { 10767 struct nft_audit_data *adp; 10768 10769 list_for_each_entry(adp, adl, list) { 10770 if (adp->table == table) 10771 return 0; 10772 } 10773 adp = kzalloc(sizeof(*adp), GFP_KERNEL); 10774 if (!adp) 10775 return -ENOMEM; 10776 adp->table = table; 10777 list_add(&adp->list, adl); 10778 return 0; 10779 } 10780 10781 static void nf_tables_commit_audit_free(struct list_head *adl) 10782 { 10783 struct nft_audit_data *adp, *adn; 10784 10785 list_for_each_entry_safe(adp, adn, adl, list) { 10786 list_del(&adp->list); 10787 kfree(adp); 10788 } 10789 } 10790 10791 /* nft audit emits the number of elements that get added/removed/updated, 10792 * so NEW/DELSETELEM needs to increment based on the total elem count. 10793 */ 10794 static unsigned int nf_tables_commit_audit_entrycount(const struct nft_trans *trans) 10795 { 10796 switch (trans->msg_type) { 10797 case NFT_MSG_NEWSETELEM: 10798 case NFT_MSG_DELSETELEM: 10799 return nft_trans_container_elem(trans)->nelems; 10800 } 10801 10802 return 1; 10803 } 10804 10805 static void nf_tables_commit_audit_collect(struct list_head *adl, 10806 const struct nft_trans *trans, u32 op) 10807 { 10808 const struct nft_table *table = trans->table; 10809 struct nft_audit_data *adp; 10810 10811 list_for_each_entry(adp, adl, list) { 10812 if (adp->table == table) 10813 goto found; 10814 } 10815 WARN_ONCE(1, "table=%s not expected in commit list", table->name); 10816 return; 10817 found: 10818 adp->entries += nf_tables_commit_audit_entrycount(trans); 10819 if (!adp->op || adp->op > op) 10820 adp->op = op; 10821 } 10822 10823 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22) 10824 10825 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation) 10826 { 10827 struct nft_audit_data *adp, *adn; 10828 char aubuf[AUNFTABLENAMELEN]; 10829 10830 list_for_each_entry_safe(adp, adn, adl, list) { 10831 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name, 10832 generation); 10833 audit_log_nfcfg(aubuf, adp->table->family, adp->entries, 10834 nft2audit_op[adp->op], GFP_KERNEL); 10835 list_del(&adp->list); 10836 kfree(adp); 10837 } 10838 } 10839 10840 static void nft_set_commit_update(struct list_head *set_update_list) 10841 { 10842 struct nft_set *set, *next; 10843 10844 list_for_each_entry_safe(set, next, set_update_list, pending_update) { 10845 list_del_init(&set->pending_update); 10846 10847 if (!set->ops->commit || set->dead) 10848 continue; 10849 10850 set->ops->commit(set); 10851 } 10852 } 10853 10854 static unsigned int nft_gc_seq_begin(struct nftables_pernet *nft_net) 10855 { 10856 unsigned int gc_seq; 10857 10858 /* Bump gc counter, it becomes odd, this is the busy mark. */ 10859 gc_seq = READ_ONCE(nft_net->gc_seq); 10860 WRITE_ONCE(nft_net->gc_seq, ++gc_seq); 10861 10862 return gc_seq; 10863 } 10864 10865 static void nft_gc_seq_end(struct nftables_pernet *nft_net, unsigned int gc_seq) 10866 { 10867 WRITE_ONCE(nft_net->gc_seq, ++gc_seq); 10868 } 10869 10870 static int nf_tables_commit(struct net *net, struct sk_buff *skb) 10871 { 10872 struct nftables_pernet *nft_net = nft_pernet(net); 10873 const struct nlmsghdr *nlh = nlmsg_hdr(skb); 10874 struct nft_trans_binding *trans_binding; 10875 struct nft_trans *trans, *next; 10876 unsigned int base_seq, gc_seq; 10877 LIST_HEAD(set_update_list); 10878 struct nft_trans_elem *te; 10879 struct nft_chain *chain; 10880 struct nft_table *table; 10881 struct nft_ctx ctx; 10882 LIST_HEAD(adl); 10883 int err; 10884 10885 if (list_empty(&nft_net->commit_list)) { 10886 mutex_unlock(&nft_net->commit_mutex); 10887 return 0; 10888 } 10889 10890 nft_ctx_init(&ctx, net, skb, nlh, NFPROTO_UNSPEC, NULL, NULL, NULL); 10891 10892 list_for_each_entry(trans_binding, &nft_net->binding_list, binding_list) { 10893 trans = &trans_binding->nft_trans; 10894 switch (trans->msg_type) { 10895 case NFT_MSG_NEWSET: 10896 if (!nft_trans_set_update(trans) && 10897 nft_set_is_anonymous(nft_trans_set(trans)) && 10898 !nft_trans_set_bound(trans)) { 10899 pr_warn_once("nftables ruleset with unbound set\n"); 10900 return -EINVAL; 10901 } 10902 break; 10903 case NFT_MSG_NEWCHAIN: 10904 if (!nft_trans_chain_update(trans) && 10905 nft_chain_binding(nft_trans_chain(trans)) && 10906 !nft_trans_chain_bound(trans)) { 10907 pr_warn_once("nftables ruleset with unbound chain\n"); 10908 return -EINVAL; 10909 } 10910 break; 10911 default: 10912 WARN_ONCE(1, "Unhandled bind type %d", trans->msg_type); 10913 break; 10914 } 10915 } 10916 10917 /* 0. Validate ruleset, otherwise roll back for error reporting. */ 10918 if (nf_tables_validate(net) < 0) { 10919 nft_net->validate_state = NFT_VALIDATE_DO; 10920 return -EAGAIN; 10921 } 10922 10923 err = nft_flow_rule_offload_commit(net); 10924 if (err < 0) 10925 return err; 10926 10927 /* 1. Allocate space for next generation rules_gen_X[] */ 10928 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 10929 struct nft_table *table = trans->table; 10930 int ret; 10931 10932 ret = nf_tables_commit_audit_alloc(&adl, table); 10933 if (ret) { 10934 nf_tables_commit_chain_prepare_cancel(net); 10935 nf_tables_commit_audit_free(&adl); 10936 return ret; 10937 } 10938 if (trans->msg_type == NFT_MSG_NEWRULE || 10939 trans->msg_type == NFT_MSG_DELRULE) { 10940 chain = nft_trans_rule_chain(trans); 10941 10942 ret = nf_tables_commit_chain_prepare(net, chain); 10943 if (ret < 0) { 10944 nf_tables_commit_chain_prepare_cancel(net); 10945 nf_tables_commit_audit_free(&adl); 10946 return ret; 10947 } 10948 } 10949 } 10950 10951 /* step 2. Make rules_gen_X visible to packet path */ 10952 list_for_each_entry(table, &nft_net->tables, list) { 10953 list_for_each_entry(chain, &table->chains, list) 10954 nf_tables_commit_chain(net, chain); 10955 } 10956 10957 /* 10958 * Bump generation counter, invalidate any dump in progress. 10959 * Cannot fail after this point. 10960 */ 10961 base_seq = nft_base_seq(net); 10962 while (++base_seq == 0) 10963 ; 10964 10965 /* pairs with smp_load_acquire in nft_lookup_eval */ 10966 smp_store_release(&net->nft.base_seq, base_seq); 10967 10968 gc_seq = nft_gc_seq_begin(nft_net); 10969 10970 /* step 3. Start new generation, rules_gen_X now in use. */ 10971 net->nft.gencursor = nft_gencursor_next(net); 10972 10973 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 10974 struct nft_table *table = trans->table; 10975 10976 nft_ctx_update(&ctx, trans); 10977 10978 nf_tables_commit_audit_collect(&adl, trans, trans->msg_type); 10979 switch (trans->msg_type) { 10980 case NFT_MSG_NEWTABLE: 10981 if (nft_trans_table_update(trans)) { 10982 if (!(table->flags & __NFT_TABLE_F_UPDATE)) { 10983 nft_trans_destroy(trans); 10984 break; 10985 } 10986 if (table->flags & NFT_TABLE_F_DORMANT) 10987 nf_tables_table_disable(net, table); 10988 10989 table->flags &= ~__NFT_TABLE_F_UPDATE; 10990 } else { 10991 nft_clear(net, table); 10992 } 10993 nf_tables_table_notify(&ctx, NFT_MSG_NEWTABLE); 10994 nft_trans_destroy(trans); 10995 break; 10996 case NFT_MSG_DELTABLE: 10997 case NFT_MSG_DESTROYTABLE: 10998 list_del_rcu(&table->list); 10999 nf_tables_table_notify(&ctx, trans->msg_type); 11000 break; 11001 case NFT_MSG_NEWCHAIN: 11002 if (nft_trans_chain_update(trans)) { 11003 nft_chain_commit_update(nft_trans_container_chain(trans)); 11004 nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN, 11005 &nft_trans_chain_hooks(trans)); 11006 list_splice(&nft_trans_chain_hooks(trans), 11007 &nft_trans_basechain(trans)->hook_list); 11008 /* trans destroyed after rcu grace period */ 11009 } else { 11010 nft_chain_commit_drop_policy(nft_trans_container_chain(trans)); 11011 nft_clear(net, nft_trans_chain(trans)); 11012 nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN, NULL); 11013 nft_trans_destroy(trans); 11014 } 11015 break; 11016 case NFT_MSG_DELCHAIN: 11017 case NFT_MSG_DESTROYCHAIN: 11018 if (nft_trans_chain_update(trans)) { 11019 nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN, 11020 &nft_trans_chain_hooks(trans)); 11021 if (!(table->flags & NFT_TABLE_F_DORMANT)) { 11022 nft_netdev_unregister_hooks(net, 11023 &nft_trans_chain_hooks(trans), 11024 true); 11025 } 11026 } else { 11027 nft_chain_del(nft_trans_chain(trans)); 11028 nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN, 11029 NULL); 11030 nf_tables_unregister_hook(ctx.net, ctx.table, 11031 nft_trans_chain(trans)); 11032 } 11033 break; 11034 case NFT_MSG_NEWRULE: 11035 nft_clear(net, nft_trans_rule(trans)); 11036 nf_tables_rule_notify(&ctx, nft_trans_rule(trans), 11037 NFT_MSG_NEWRULE); 11038 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11039 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11040 11041 nft_trans_destroy(trans); 11042 break; 11043 case NFT_MSG_DELRULE: 11044 case NFT_MSG_DESTROYRULE: 11045 list_del_rcu(&nft_trans_rule(trans)->list); 11046 nf_tables_rule_notify(&ctx, nft_trans_rule(trans), 11047 trans->msg_type); 11048 nft_rule_expr_deactivate(&ctx, nft_trans_rule(trans), 11049 NFT_TRANS_COMMIT); 11050 11051 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11052 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11053 break; 11054 case NFT_MSG_NEWSET: 11055 list_del(&nft_trans_container_set(trans)->list_trans_newset); 11056 if (nft_trans_set_update(trans)) { 11057 struct nft_set *set = nft_trans_set(trans); 11058 11059 WRITE_ONCE(set->timeout, nft_trans_set_timeout(trans)); 11060 WRITE_ONCE(set->gc_int, nft_trans_set_gc_int(trans)); 11061 11062 if (nft_trans_set_size(trans)) 11063 WRITE_ONCE(set->size, nft_trans_set_size(trans)); 11064 } else { 11065 nft_clear(net, nft_trans_set(trans)); 11066 /* This avoids hitting -EBUSY when deleting the table 11067 * from the transaction. 11068 */ 11069 if (nft_set_is_anonymous(nft_trans_set(trans)) && 11070 !list_empty(&nft_trans_set(trans)->bindings)) 11071 nft_use_dec(&table->use); 11072 } 11073 nf_tables_set_notify(&ctx, nft_trans_set(trans), 11074 NFT_MSG_NEWSET, GFP_KERNEL); 11075 nft_trans_destroy(trans); 11076 break; 11077 case NFT_MSG_DELSET: 11078 case NFT_MSG_DESTROYSET: 11079 nft_trans_set(trans)->dead = 1; 11080 list_del_rcu(&nft_trans_set(trans)->list); 11081 nf_tables_set_notify(&ctx, nft_trans_set(trans), 11082 trans->msg_type, GFP_KERNEL); 11083 break; 11084 case NFT_MSG_NEWSETELEM: 11085 te = nft_trans_container_elem(trans); 11086 11087 nft_trans_elems_add(&ctx, te); 11088 11089 if (te->set->ops->commit && 11090 list_empty(&te->set->pending_update)) { 11091 list_add_tail(&te->set->pending_update, 11092 &set_update_list); 11093 } 11094 nft_trans_destroy(trans); 11095 break; 11096 case NFT_MSG_DELSETELEM: 11097 case NFT_MSG_DESTROYSETELEM: 11098 te = nft_trans_container_elem(trans); 11099 11100 nft_trans_elems_remove(&ctx, te); 11101 11102 if (te->set->ops->commit && 11103 list_empty(&te->set->pending_update)) { 11104 list_add_tail(&te->set->pending_update, 11105 &set_update_list); 11106 } 11107 break; 11108 case NFT_MSG_NEWOBJ: 11109 if (nft_trans_obj_update(trans)) { 11110 nft_obj_commit_update(&ctx, trans); 11111 nf_tables_obj_notify(&ctx, 11112 nft_trans_obj(trans), 11113 NFT_MSG_NEWOBJ); 11114 } else { 11115 nft_clear(net, nft_trans_obj(trans)); 11116 nf_tables_obj_notify(&ctx, 11117 nft_trans_obj(trans), 11118 NFT_MSG_NEWOBJ); 11119 nft_trans_destroy(trans); 11120 } 11121 break; 11122 case NFT_MSG_DELOBJ: 11123 case NFT_MSG_DESTROYOBJ: 11124 nft_obj_del(nft_trans_obj(trans)); 11125 nf_tables_obj_notify(&ctx, nft_trans_obj(trans), 11126 trans->msg_type); 11127 break; 11128 case NFT_MSG_NEWFLOWTABLE: 11129 if (nft_trans_flowtable_update(trans)) { 11130 nft_trans_flowtable(trans)->data.flags = 11131 nft_trans_flowtable_flags(trans); 11132 nf_tables_flowtable_notify(&ctx, 11133 nft_trans_flowtable(trans), 11134 &nft_trans_flowtable_hooks(trans), 11135 NFT_MSG_NEWFLOWTABLE); 11136 list_splice(&nft_trans_flowtable_hooks(trans), 11137 &nft_trans_flowtable(trans)->hook_list); 11138 } else { 11139 nft_clear(net, nft_trans_flowtable(trans)); 11140 nf_tables_flowtable_notify(&ctx, 11141 nft_trans_flowtable(trans), 11142 NULL, 11143 NFT_MSG_NEWFLOWTABLE); 11144 } 11145 nft_trans_destroy(trans); 11146 break; 11147 case NFT_MSG_DELFLOWTABLE: 11148 case NFT_MSG_DESTROYFLOWTABLE: 11149 if (nft_trans_flowtable_update(trans)) { 11150 nf_tables_flowtable_notify(&ctx, 11151 nft_trans_flowtable(trans), 11152 &nft_trans_flowtable_hooks(trans), 11153 trans->msg_type); 11154 nft_unregister_flowtable_net_hooks(net, 11155 nft_trans_flowtable(trans), 11156 &nft_trans_flowtable_hooks(trans)); 11157 } else { 11158 list_del_rcu(&nft_trans_flowtable(trans)->list); 11159 nf_tables_flowtable_notify(&ctx, 11160 nft_trans_flowtable(trans), 11161 NULL, 11162 trans->msg_type); 11163 nft_unregister_flowtable_net_hooks(net, 11164 nft_trans_flowtable(trans), 11165 &nft_trans_flowtable(trans)->hook_list); 11166 } 11167 break; 11168 } 11169 } 11170 11171 nft_set_commit_update(&set_update_list); 11172 11173 nft_commit_notify(net, NETLINK_CB(skb).portid); 11174 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 11175 nf_tables_commit_audit_log(&adl, nft_base_seq(net)); 11176 11177 nft_gc_seq_end(nft_net, gc_seq); 11178 nft_net->validate_state = NFT_VALIDATE_SKIP; 11179 nf_tables_commit_release(net); 11180 11181 return 0; 11182 } 11183 11184 static void nf_tables_module_autoload(struct net *net) 11185 { 11186 struct nftables_pernet *nft_net = nft_pernet(net); 11187 struct nft_module_request *req, *next; 11188 LIST_HEAD(module_list); 11189 11190 list_splice_init(&nft_net->module_list, &module_list); 11191 mutex_unlock(&nft_net->commit_mutex); 11192 list_for_each_entry_safe(req, next, &module_list, list) { 11193 request_module("%s", req->module); 11194 req->done = true; 11195 } 11196 mutex_lock(&nft_net->commit_mutex); 11197 list_splice(&module_list, &nft_net->module_list); 11198 } 11199 11200 static void nf_tables_abort_release(struct nft_trans *trans) 11201 { 11202 struct nft_ctx ctx = { }; 11203 11204 nft_ctx_update(&ctx, trans); 11205 11206 switch (trans->msg_type) { 11207 case NFT_MSG_NEWTABLE: 11208 nf_tables_table_destroy(trans->table); 11209 break; 11210 case NFT_MSG_NEWCHAIN: 11211 if (nft_trans_chain_update(trans)) 11212 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 11213 else 11214 nf_tables_chain_destroy(nft_trans_chain(trans)); 11215 break; 11216 case NFT_MSG_NEWRULE: 11217 nf_tables_rule_destroy(&ctx, nft_trans_rule(trans)); 11218 break; 11219 case NFT_MSG_NEWSET: 11220 nft_set_destroy(&ctx, nft_trans_set(trans)); 11221 break; 11222 case NFT_MSG_NEWSETELEM: 11223 nft_trans_set_elem_destroy(&ctx, nft_trans_container_elem(trans)); 11224 break; 11225 case NFT_MSG_NEWOBJ: 11226 nft_obj_destroy(&ctx, nft_trans_obj(trans)); 11227 break; 11228 case NFT_MSG_NEWFLOWTABLE: 11229 if (nft_trans_flowtable_update(trans)) 11230 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 11231 else 11232 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 11233 break; 11234 } 11235 kfree(trans); 11236 } 11237 11238 static void nft_set_abort_update(struct list_head *set_update_list) 11239 { 11240 struct nft_set *set, *next; 11241 11242 list_for_each_entry_safe(set, next, set_update_list, pending_update) { 11243 list_del_init(&set->pending_update); 11244 11245 if (!set->ops->abort) 11246 continue; 11247 11248 set->ops->abort(set); 11249 } 11250 } 11251 11252 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 11253 { 11254 struct nftables_pernet *nft_net = nft_pernet(net); 11255 struct nft_trans *trans, *next; 11256 LIST_HEAD(set_update_list); 11257 struct nft_trans_elem *te; 11258 struct nft_ctx ctx = { 11259 .net = net, 11260 }; 11261 int err = 0; 11262 11263 if (action == NFNL_ABORT_VALIDATE && 11264 nf_tables_validate(net) < 0) 11265 err = -EAGAIN; 11266 11267 list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, 11268 list) { 11269 struct nft_table *table = trans->table; 11270 11271 nft_ctx_update(&ctx, trans); 11272 11273 switch (trans->msg_type) { 11274 case NFT_MSG_NEWTABLE: 11275 if (nft_trans_table_update(trans)) { 11276 if (!(table->flags & __NFT_TABLE_F_UPDATE)) { 11277 nft_trans_destroy(trans); 11278 break; 11279 } 11280 if (table->flags & __NFT_TABLE_F_WAS_DORMANT) { 11281 nf_tables_table_disable(net, table); 11282 table->flags |= NFT_TABLE_F_DORMANT; 11283 } else if (table->flags & __NFT_TABLE_F_WAS_AWAKEN) { 11284 table->flags &= ~NFT_TABLE_F_DORMANT; 11285 } 11286 if (table->flags & __NFT_TABLE_F_WAS_ORPHAN) { 11287 table->flags &= ~NFT_TABLE_F_OWNER; 11288 table->nlpid = 0; 11289 } 11290 table->flags &= ~__NFT_TABLE_F_UPDATE; 11291 nft_trans_destroy(trans); 11292 } else { 11293 list_del_rcu(&table->list); 11294 } 11295 break; 11296 case NFT_MSG_DELTABLE: 11297 case NFT_MSG_DESTROYTABLE: 11298 nft_clear(trans->net, table); 11299 nft_trans_destroy(trans); 11300 break; 11301 case NFT_MSG_NEWCHAIN: 11302 if (nft_trans_chain_update(trans)) { 11303 if (!(table->flags & NFT_TABLE_F_DORMANT)) { 11304 nft_netdev_unregister_hooks(net, 11305 &nft_trans_chain_hooks(trans), 11306 true); 11307 } 11308 free_percpu(nft_trans_chain_stats(trans)); 11309 kfree(nft_trans_chain_name(trans)); 11310 nft_trans_destroy(trans); 11311 } else { 11312 if (nft_trans_chain_bound(trans)) { 11313 nft_trans_destroy(trans); 11314 break; 11315 } 11316 nft_use_dec_restore(&table->use); 11317 nft_chain_del(nft_trans_chain(trans)); 11318 nf_tables_unregister_hook(trans->net, table, 11319 nft_trans_chain(trans)); 11320 } 11321 break; 11322 case NFT_MSG_DELCHAIN: 11323 case NFT_MSG_DESTROYCHAIN: 11324 if (nft_trans_chain_update(trans)) { 11325 list_splice(&nft_trans_chain_hooks(trans), 11326 &nft_trans_basechain(trans)->hook_list); 11327 } else { 11328 nft_use_inc_restore(&table->use); 11329 nft_clear(trans->net, nft_trans_chain(trans)); 11330 } 11331 nft_trans_destroy(trans); 11332 break; 11333 case NFT_MSG_NEWRULE: 11334 if (nft_trans_rule_bound(trans)) { 11335 nft_trans_destroy(trans); 11336 break; 11337 } 11338 nft_use_dec_restore(&nft_trans_rule_chain(trans)->use); 11339 list_del_rcu(&nft_trans_rule(trans)->list); 11340 nft_rule_expr_deactivate(&ctx, 11341 nft_trans_rule(trans), 11342 NFT_TRANS_ABORT); 11343 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11344 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11345 break; 11346 case NFT_MSG_DELRULE: 11347 case NFT_MSG_DESTROYRULE: 11348 nft_use_inc_restore(&nft_trans_rule_chain(trans)->use); 11349 nft_clear(trans->net, nft_trans_rule(trans)); 11350 nft_rule_expr_activate(&ctx, nft_trans_rule(trans)); 11351 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11352 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11353 11354 nft_trans_destroy(trans); 11355 break; 11356 case NFT_MSG_NEWSET: 11357 list_del(&nft_trans_container_set(trans)->list_trans_newset); 11358 if (nft_trans_set_update(trans)) { 11359 nft_trans_destroy(trans); 11360 break; 11361 } 11362 nft_use_dec_restore(&table->use); 11363 if (nft_trans_set_bound(trans)) { 11364 nft_trans_destroy(trans); 11365 break; 11366 } 11367 nft_trans_set(trans)->dead = 1; 11368 list_del_rcu(&nft_trans_set(trans)->list); 11369 break; 11370 case NFT_MSG_DELSET: 11371 case NFT_MSG_DESTROYSET: 11372 nft_use_inc_restore(&table->use); 11373 nft_clear(trans->net, nft_trans_set(trans)); 11374 if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11375 nft_map_activate(&ctx, nft_trans_set(trans)); 11376 11377 nft_trans_destroy(trans); 11378 break; 11379 case NFT_MSG_NEWSETELEM: 11380 if (nft_trans_elem_set_bound(trans)) { 11381 nft_trans_destroy(trans); 11382 break; 11383 } 11384 te = nft_trans_container_elem(trans); 11385 if (!nft_trans_elems_new_abort(&ctx, te)) { 11386 nft_trans_destroy(trans); 11387 break; 11388 } 11389 11390 if (te->set->ops->abort && 11391 list_empty(&te->set->pending_update)) { 11392 list_add_tail(&te->set->pending_update, 11393 &set_update_list); 11394 } 11395 break; 11396 case NFT_MSG_DELSETELEM: 11397 case NFT_MSG_DESTROYSETELEM: 11398 te = nft_trans_container_elem(trans); 11399 11400 nft_trans_elems_destroy_abort(&ctx, te); 11401 11402 if (te->set->ops->abort && 11403 list_empty(&te->set->pending_update)) { 11404 list_add_tail(&te->set->pending_update, 11405 &set_update_list); 11406 } 11407 nft_trans_destroy(trans); 11408 break; 11409 case NFT_MSG_NEWOBJ: 11410 if (nft_trans_obj_update(trans)) { 11411 nft_obj_destroy(&ctx, nft_trans_obj_newobj(trans)); 11412 nft_trans_destroy(trans); 11413 } else { 11414 nft_use_dec_restore(&table->use); 11415 nft_obj_del(nft_trans_obj(trans)); 11416 } 11417 break; 11418 case NFT_MSG_DELOBJ: 11419 case NFT_MSG_DESTROYOBJ: 11420 nft_use_inc_restore(&table->use); 11421 nft_clear(trans->net, nft_trans_obj(trans)); 11422 nft_trans_destroy(trans); 11423 break; 11424 case NFT_MSG_NEWFLOWTABLE: 11425 if (nft_trans_flowtable_update(trans)) { 11426 nft_unregister_flowtable_net_hooks(net, 11427 nft_trans_flowtable(trans), 11428 &nft_trans_flowtable_hooks(trans)); 11429 } else { 11430 nft_use_dec_restore(&table->use); 11431 list_del_rcu(&nft_trans_flowtable(trans)->list); 11432 nft_unregister_flowtable_net_hooks(net, 11433 nft_trans_flowtable(trans), 11434 &nft_trans_flowtable(trans)->hook_list); 11435 } 11436 break; 11437 case NFT_MSG_DELFLOWTABLE: 11438 case NFT_MSG_DESTROYFLOWTABLE: 11439 if (nft_trans_flowtable_update(trans)) { 11440 list_splice(&nft_trans_flowtable_hooks(trans), 11441 &nft_trans_flowtable(trans)->hook_list); 11442 } else { 11443 nft_use_inc_restore(&table->use); 11444 nft_clear(trans->net, nft_trans_flowtable(trans)); 11445 } 11446 nft_trans_destroy(trans); 11447 break; 11448 } 11449 } 11450 11451 WARN_ON_ONCE(!list_empty(&nft_net->commit_set_list)); 11452 11453 nft_set_abort_update(&set_update_list); 11454 11455 synchronize_rcu(); 11456 11457 list_for_each_entry_safe_reverse(trans, next, 11458 &nft_net->commit_list, list) { 11459 nft_trans_list_del(trans); 11460 nf_tables_abort_release(trans); 11461 } 11462 11463 return err; 11464 } 11465 11466 static int nf_tables_abort(struct net *net, struct sk_buff *skb, 11467 enum nfnl_abort_action action) 11468 { 11469 struct nftables_pernet *nft_net = nft_pernet(net); 11470 unsigned int gc_seq; 11471 int ret; 11472 11473 gc_seq = nft_gc_seq_begin(nft_net); 11474 ret = __nf_tables_abort(net, action); 11475 nft_gc_seq_end(nft_net, gc_seq); 11476 11477 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 11478 11479 /* module autoload needs to happen after GC sequence update because it 11480 * temporarily releases and grabs mutex again. 11481 */ 11482 if (action == NFNL_ABORT_AUTOLOAD) 11483 nf_tables_module_autoload(net); 11484 else 11485 nf_tables_module_autoload_cleanup(net); 11486 11487 mutex_unlock(&nft_net->commit_mutex); 11488 11489 return ret; 11490 } 11491 11492 static bool nf_tables_valid_genid(struct net *net, u32 genid) 11493 { 11494 struct nftables_pernet *nft_net = nft_pernet(net); 11495 bool genid_ok; 11496 11497 mutex_lock(&nft_net->commit_mutex); 11498 nft_net->tstamp = get_jiffies_64(); 11499 11500 genid_ok = genid == 0 || nft_base_seq(net) == genid; 11501 if (!genid_ok) 11502 mutex_unlock(&nft_net->commit_mutex); 11503 11504 /* else, commit mutex has to be released by commit or abort function */ 11505 return genid_ok; 11506 } 11507 11508 static const struct nfnetlink_subsystem nf_tables_subsys = { 11509 .name = "nf_tables", 11510 .subsys_id = NFNL_SUBSYS_NFTABLES, 11511 .cb_count = NFT_MSG_MAX, 11512 .cb = nf_tables_cb, 11513 .commit = nf_tables_commit, 11514 .abort = nf_tables_abort, 11515 .valid_genid = nf_tables_valid_genid, 11516 .owner = THIS_MODULE, 11517 }; 11518 11519 int nft_chain_validate_dependency(const struct nft_chain *chain, 11520 enum nft_chain_types type) 11521 { 11522 const struct nft_base_chain *basechain; 11523 11524 if (nft_is_base_chain(chain)) { 11525 basechain = nft_base_chain(chain); 11526 if (basechain->type->type != type) 11527 return -EOPNOTSUPP; 11528 } 11529 return 0; 11530 } 11531 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 11532 11533 int nft_chain_validate_hooks(const struct nft_chain *chain, 11534 unsigned int hook_flags) 11535 { 11536 struct nft_base_chain *basechain; 11537 11538 if (nft_is_base_chain(chain)) { 11539 basechain = nft_base_chain(chain); 11540 11541 if ((1 << basechain->ops.hooknum) & hook_flags) 11542 return 0; 11543 11544 return -EOPNOTSUPP; 11545 } 11546 11547 return 0; 11548 } 11549 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 11550 11551 /** 11552 * nft_parse_u32_check - fetch u32 attribute and check for maximum value 11553 * 11554 * @attr: netlink attribute to fetch value from 11555 * @max: maximum value to be stored in dest 11556 * @dest: pointer to the variable 11557 * 11558 * Parse, check and store a given u32 netlink attribute into variable. 11559 * This function returns -ERANGE if the value goes over maximum value. 11560 * Otherwise a 0 is returned and the attribute value is stored in the 11561 * destination variable. 11562 */ 11563 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 11564 { 11565 u32 val; 11566 11567 val = ntohl(nla_get_be32(attr)); 11568 if (val > max) 11569 return -ERANGE; 11570 11571 *dest = val; 11572 return 0; 11573 } 11574 EXPORT_SYMBOL_GPL(nft_parse_u32_check); 11575 11576 static int nft_parse_register(const struct nlattr *attr, u32 *preg) 11577 { 11578 unsigned int reg; 11579 11580 reg = ntohl(nla_get_be32(attr)); 11581 switch (reg) { 11582 case NFT_REG_VERDICT...NFT_REG_4: 11583 *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; 11584 break; 11585 case NFT_REG32_00...NFT_REG32_15: 11586 *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 11587 break; 11588 default: 11589 return -ERANGE; 11590 } 11591 11592 return 0; 11593 } 11594 11595 /** 11596 * nft_dump_register - dump a register value to a netlink attribute 11597 * 11598 * @skb: socket buffer 11599 * @attr: attribute number 11600 * @reg: register number 11601 * 11602 * Construct a netlink attribute containing the register number. For 11603 * compatibility reasons, register numbers being a multiple of 4 are 11604 * translated to the corresponding 128 bit register numbers. 11605 */ 11606 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 11607 { 11608 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 11609 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 11610 else 11611 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 11612 11613 return nla_put_be32(skb, attr, htonl(reg)); 11614 } 11615 EXPORT_SYMBOL_GPL(nft_dump_register); 11616 11617 static int nft_validate_register_load(enum nft_registers reg, unsigned int len) 11618 { 11619 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 11620 return -EINVAL; 11621 if (len == 0) 11622 return -EINVAL; 11623 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data)) 11624 return -ERANGE; 11625 11626 return 0; 11627 } 11628 11629 int nft_parse_register_load(const struct nft_ctx *ctx, 11630 const struct nlattr *attr, u8 *sreg, u32 len) 11631 { 11632 int err, invalid_reg; 11633 u32 reg, next_register; 11634 11635 err = nft_parse_register(attr, ®); 11636 if (err < 0) 11637 return err; 11638 11639 err = nft_validate_register_load(reg, len); 11640 if (err < 0) 11641 return err; 11642 11643 next_register = DIV_ROUND_UP(len, NFT_REG32_SIZE) + reg; 11644 11645 /* Can't happen: nft_validate_register_load() should have failed */ 11646 if (WARN_ON_ONCE(next_register > NFT_REG32_NUM)) 11647 return -EINVAL; 11648 11649 /* find first register that did not see an earlier store. */ 11650 invalid_reg = find_next_zero_bit(ctx->reg_inited, NFT_REG32_NUM, reg); 11651 11652 /* invalid register within the range that we're loading from? */ 11653 if (invalid_reg < next_register) 11654 return -ENODATA; 11655 11656 *sreg = reg; 11657 return 0; 11658 } 11659 EXPORT_SYMBOL_GPL(nft_parse_register_load); 11660 11661 static void nft_saw_register_store(const struct nft_ctx *__ctx, 11662 int reg, unsigned int len) 11663 { 11664 unsigned int registers = DIV_ROUND_UP(len, NFT_REG32_SIZE); 11665 struct nft_ctx *ctx = (struct nft_ctx *)__ctx; 11666 11667 if (WARN_ON_ONCE(len == 0 || reg < 0)) 11668 return; 11669 11670 bitmap_set(ctx->reg_inited, reg, registers); 11671 } 11672 11673 static int nft_validate_register_store(const struct nft_ctx *ctx, 11674 enum nft_registers reg, 11675 const struct nft_data *data, 11676 enum nft_data_types type, 11677 unsigned int len) 11678 { 11679 int err; 11680 11681 switch (reg) { 11682 case NFT_REG_VERDICT: 11683 if (type != NFT_DATA_VERDICT) 11684 return -EINVAL; 11685 11686 if (data != NULL && 11687 (data->verdict.code == NFT_GOTO || 11688 data->verdict.code == NFT_JUMP)) { 11689 err = nft_chain_validate(ctx, data->verdict.chain); 11690 if (err < 0) 11691 return err; 11692 } 11693 11694 break; 11695 default: 11696 if (type != NFT_DATA_VALUE) 11697 return -EINVAL; 11698 11699 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 11700 return -EINVAL; 11701 if (len == 0) 11702 return -EINVAL; 11703 if (reg * NFT_REG32_SIZE + len > 11704 sizeof_field(struct nft_regs, data)) 11705 return -ERANGE; 11706 11707 break; 11708 } 11709 11710 nft_saw_register_store(ctx, reg, len); 11711 return 0; 11712 } 11713 11714 int nft_parse_register_store(const struct nft_ctx *ctx, 11715 const struct nlattr *attr, u8 *dreg, 11716 const struct nft_data *data, 11717 enum nft_data_types type, unsigned int len) 11718 { 11719 int err; 11720 u32 reg; 11721 11722 err = nft_parse_register(attr, ®); 11723 if (err < 0) 11724 return err; 11725 11726 err = nft_validate_register_store(ctx, reg, data, type, len); 11727 if (err < 0) 11728 return err; 11729 11730 *dreg = reg; 11731 return 0; 11732 } 11733 EXPORT_SYMBOL_GPL(nft_parse_register_store); 11734 11735 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 11736 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 11737 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 11738 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 11739 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 }, 11740 }; 11741 11742 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 11743 struct nft_data_desc *desc, const struct nlattr *nla) 11744 { 11745 u8 genmask = nft_genmask_next(ctx->net); 11746 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 11747 struct nft_chain *chain; 11748 int err; 11749 11750 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla, 11751 nft_verdict_policy, NULL); 11752 if (err < 0) 11753 return err; 11754 11755 if (!tb[NFTA_VERDICT_CODE]) 11756 return -EINVAL; 11757 11758 /* zero padding hole for memcmp */ 11759 memset(data, 0, sizeof(*data)); 11760 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 11761 11762 switch (data->verdict.code) { 11763 case NF_ACCEPT: 11764 case NF_DROP: 11765 case NF_QUEUE: 11766 break; 11767 case NFT_CONTINUE: 11768 case NFT_BREAK: 11769 case NFT_RETURN: 11770 break; 11771 case NFT_JUMP: 11772 case NFT_GOTO: 11773 if (tb[NFTA_VERDICT_CHAIN]) { 11774 chain = nft_chain_lookup(ctx->net, ctx->table, 11775 tb[NFTA_VERDICT_CHAIN], 11776 genmask); 11777 } else if (tb[NFTA_VERDICT_CHAIN_ID]) { 11778 chain = nft_chain_lookup_byid(ctx->net, ctx->table, 11779 tb[NFTA_VERDICT_CHAIN_ID], 11780 genmask); 11781 if (IS_ERR(chain)) 11782 return PTR_ERR(chain); 11783 } else { 11784 return -EINVAL; 11785 } 11786 11787 if (IS_ERR(chain)) 11788 return PTR_ERR(chain); 11789 if (nft_is_base_chain(chain)) 11790 return -EOPNOTSUPP; 11791 if (nft_chain_is_bound(chain)) 11792 return -EINVAL; 11793 if (desc->flags & NFT_DATA_DESC_SETELEM && 11794 chain->flags & NFT_CHAIN_BINDING) 11795 return -EINVAL; 11796 if (!nft_use_inc(&chain->use)) 11797 return -EMFILE; 11798 11799 data->verdict.chain = chain; 11800 break; 11801 default: 11802 return -EINVAL; 11803 } 11804 11805 desc->len = sizeof(data->verdict); 11806 11807 return 0; 11808 } 11809 11810 static void nft_verdict_uninit(const struct nft_data *data) 11811 { 11812 struct nft_chain *chain; 11813 11814 switch (data->verdict.code) { 11815 case NFT_JUMP: 11816 case NFT_GOTO: 11817 chain = data->verdict.chain; 11818 nft_use_dec(&chain->use); 11819 break; 11820 } 11821 } 11822 11823 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v) 11824 { 11825 struct nlattr *nest; 11826 11827 nest = nla_nest_start_noflag(skb, type); 11828 if (!nest) 11829 goto nla_put_failure; 11830 11831 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code))) 11832 goto nla_put_failure; 11833 11834 switch (v->code) { 11835 case NFT_JUMP: 11836 case NFT_GOTO: 11837 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 11838 v->chain->name)) 11839 goto nla_put_failure; 11840 } 11841 nla_nest_end(skb, nest); 11842 return 0; 11843 11844 nla_put_failure: 11845 return -1; 11846 } 11847 11848 static int nft_value_init(const struct nft_ctx *ctx, 11849 struct nft_data *data, struct nft_data_desc *desc, 11850 const struct nlattr *nla) 11851 { 11852 unsigned int len; 11853 11854 len = nla_len(nla); 11855 if (len == 0) 11856 return -EINVAL; 11857 if (len > desc->size) 11858 return -EOVERFLOW; 11859 if (desc->len) { 11860 if (len != desc->len) 11861 return -EINVAL; 11862 } else { 11863 desc->len = len; 11864 } 11865 11866 nla_memcpy(data->data, nla, len); 11867 11868 return 0; 11869 } 11870 11871 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 11872 unsigned int len) 11873 { 11874 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 11875 } 11876 11877 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 11878 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 11879 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 11880 }; 11881 11882 /** 11883 * nft_data_init - parse nf_tables data netlink attributes 11884 * 11885 * @ctx: context of the expression using the data 11886 * @data: destination struct nft_data 11887 * @desc: data description 11888 * @nla: netlink attribute containing data 11889 * 11890 * Parse the netlink data attributes and initialize a struct nft_data. 11891 * The type and length of data are returned in the data description. 11892 * 11893 * The caller can indicate that it only wants to accept data of type 11894 * NFT_DATA_VALUE by passing NULL for the ctx argument. 11895 */ 11896 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, 11897 struct nft_data_desc *desc, const struct nlattr *nla) 11898 { 11899 struct nlattr *tb[NFTA_DATA_MAX + 1]; 11900 int err; 11901 11902 if (WARN_ON_ONCE(!desc->size)) 11903 return -EINVAL; 11904 11905 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla, 11906 nft_data_policy, NULL); 11907 if (err < 0) 11908 return err; 11909 11910 if (tb[NFTA_DATA_VALUE]) { 11911 if (desc->type != NFT_DATA_VALUE) 11912 return -EINVAL; 11913 11914 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]); 11915 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) { 11916 if (desc->type != NFT_DATA_VERDICT) 11917 return -EINVAL; 11918 11919 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 11920 } else { 11921 err = -EINVAL; 11922 } 11923 11924 return err; 11925 } 11926 EXPORT_SYMBOL_GPL(nft_data_init); 11927 11928 /** 11929 * nft_data_release - release a nft_data item 11930 * 11931 * @data: struct nft_data to release 11932 * @type: type of data 11933 * 11934 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 11935 * all others need to be released by calling this function. 11936 */ 11937 void nft_data_release(const struct nft_data *data, enum nft_data_types type) 11938 { 11939 if (type < NFT_DATA_VERDICT) 11940 return; 11941 switch (type) { 11942 case NFT_DATA_VERDICT: 11943 return nft_verdict_uninit(data); 11944 default: 11945 WARN_ON(1); 11946 } 11947 } 11948 EXPORT_SYMBOL_GPL(nft_data_release); 11949 11950 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 11951 enum nft_data_types type, unsigned int len) 11952 { 11953 struct nlattr *nest; 11954 int err; 11955 11956 nest = nla_nest_start_noflag(skb, attr); 11957 if (nest == NULL) 11958 return -1; 11959 11960 switch (type) { 11961 case NFT_DATA_VALUE: 11962 err = nft_value_dump(skb, data, len); 11963 break; 11964 case NFT_DATA_VERDICT: 11965 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict); 11966 break; 11967 default: 11968 err = -EINVAL; 11969 WARN_ON(1); 11970 } 11971 11972 nla_nest_end(skb, nest); 11973 return err; 11974 } 11975 EXPORT_SYMBOL_GPL(nft_data_dump); 11976 11977 static void __nft_release_hook(struct net *net, struct nft_table *table) 11978 { 11979 struct nft_flowtable *flowtable; 11980 struct nft_chain *chain; 11981 11982 list_for_each_entry(chain, &table->chains, list) 11983 __nf_tables_unregister_hook(net, table, chain, true); 11984 list_for_each_entry(flowtable, &table->flowtables, list) 11985 __nft_unregister_flowtable_net_hooks(net, flowtable, 11986 &flowtable->hook_list, 11987 true); 11988 } 11989 11990 static void __nft_release_hooks(struct net *net) 11991 { 11992 struct nftables_pernet *nft_net = nft_pernet(net); 11993 struct nft_table *table; 11994 11995 list_for_each_entry(table, &nft_net->tables, list) { 11996 if (nft_table_has_owner(table)) 11997 continue; 11998 11999 __nft_release_hook(net, table); 12000 } 12001 } 12002 12003 static void __nft_release_table(struct net *net, struct nft_table *table) 12004 { 12005 struct nft_flowtable *flowtable, *nf; 12006 struct nft_chain *chain, *nc; 12007 struct nft_object *obj, *ne; 12008 struct nft_rule *rule, *nr; 12009 struct nft_set *set, *ns; 12010 struct nft_ctx ctx = { 12011 .net = net, 12012 .family = NFPROTO_NETDEV, 12013 }; 12014 12015 ctx.family = table->family; 12016 ctx.table = table; 12017 list_for_each_entry(chain, &table->chains, list) { 12018 if (nft_chain_binding(chain)) 12019 continue; 12020 12021 ctx.chain = chain; 12022 list_for_each_entry_safe(rule, nr, &chain->rules, list) { 12023 list_del(&rule->list); 12024 nft_use_dec(&chain->use); 12025 nf_tables_rule_release(&ctx, rule); 12026 } 12027 } 12028 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 12029 list_del(&flowtable->list); 12030 nft_use_dec(&table->use); 12031 nf_tables_flowtable_destroy(flowtable); 12032 } 12033 list_for_each_entry_safe(set, ns, &table->sets, list) { 12034 list_del(&set->list); 12035 nft_use_dec(&table->use); 12036 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 12037 nft_map_deactivate(&ctx, set); 12038 12039 nft_set_destroy(&ctx, set); 12040 } 12041 list_for_each_entry_safe(obj, ne, &table->objects, list) { 12042 nft_obj_del(obj); 12043 nft_use_dec(&table->use); 12044 nft_obj_destroy(&ctx, obj); 12045 } 12046 list_for_each_entry_safe(chain, nc, &table->chains, list) { 12047 nft_chain_del(chain); 12048 nft_use_dec(&table->use); 12049 nf_tables_chain_destroy(chain); 12050 } 12051 nf_tables_table_destroy(table); 12052 } 12053 12054 static void __nft_release_tables(struct net *net) 12055 { 12056 struct nftables_pernet *nft_net = nft_pernet(net); 12057 struct nft_table *table, *nt; 12058 12059 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 12060 if (nft_table_has_owner(table)) 12061 continue; 12062 12063 list_del(&table->list); 12064 12065 __nft_release_table(net, table); 12066 } 12067 } 12068 12069 static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, 12070 void *ptr) 12071 { 12072 struct nft_table *table, *to_delete[8]; 12073 struct nftables_pernet *nft_net; 12074 struct netlink_notify *n = ptr; 12075 struct net *net = n->net; 12076 unsigned int deleted; 12077 bool restart = false; 12078 unsigned int gc_seq; 12079 12080 if (event != NETLINK_URELEASE || n->protocol != NETLINK_NETFILTER) 12081 return NOTIFY_DONE; 12082 12083 nft_net = nft_pernet(net); 12084 deleted = 0; 12085 mutex_lock(&nft_net->commit_mutex); 12086 12087 gc_seq = nft_gc_seq_begin(nft_net); 12088 12089 nf_tables_trans_destroy_flush_work(net); 12090 again: 12091 list_for_each_entry(table, &nft_net->tables, list) { 12092 if (nft_table_has_owner(table) && 12093 n->portid == table->nlpid) { 12094 if (table->flags & NFT_TABLE_F_PERSIST) { 12095 table->flags &= ~NFT_TABLE_F_OWNER; 12096 continue; 12097 } 12098 __nft_release_hook(net, table); 12099 list_del_rcu(&table->list); 12100 to_delete[deleted++] = table; 12101 if (deleted >= ARRAY_SIZE(to_delete)) 12102 break; 12103 } 12104 } 12105 if (deleted) { 12106 restart = deleted >= ARRAY_SIZE(to_delete); 12107 synchronize_rcu(); 12108 while (deleted) 12109 __nft_release_table(net, to_delete[--deleted]); 12110 12111 if (restart) 12112 goto again; 12113 } 12114 nft_gc_seq_end(nft_net, gc_seq); 12115 12116 mutex_unlock(&nft_net->commit_mutex); 12117 12118 return NOTIFY_DONE; 12119 } 12120 12121 static struct notifier_block nft_nl_notifier = { 12122 .notifier_call = nft_rcv_nl_event, 12123 }; 12124 12125 static int __net_init nf_tables_init_net(struct net *net) 12126 { 12127 struct nftables_pernet *nft_net = nft_pernet(net); 12128 12129 INIT_LIST_HEAD(&nft_net->tables); 12130 INIT_LIST_HEAD(&nft_net->commit_list); 12131 INIT_LIST_HEAD(&nft_net->destroy_list); 12132 INIT_LIST_HEAD(&nft_net->commit_set_list); 12133 INIT_LIST_HEAD(&nft_net->binding_list); 12134 INIT_LIST_HEAD(&nft_net->module_list); 12135 INIT_LIST_HEAD(&nft_net->notify_list); 12136 mutex_init(&nft_net->commit_mutex); 12137 net->nft.base_seq = 1; 12138 nft_net->gc_seq = 0; 12139 nft_net->validate_state = NFT_VALIDATE_SKIP; 12140 INIT_WORK(&nft_net->destroy_work, nf_tables_trans_destroy_work); 12141 12142 return 0; 12143 } 12144 12145 static void __net_exit nf_tables_pre_exit_net(struct net *net) 12146 { 12147 struct nftables_pernet *nft_net = nft_pernet(net); 12148 12149 mutex_lock(&nft_net->commit_mutex); 12150 __nft_release_hooks(net); 12151 mutex_unlock(&nft_net->commit_mutex); 12152 } 12153 12154 static void __net_exit nf_tables_exit_net(struct net *net) 12155 { 12156 struct nftables_pernet *nft_net = nft_pernet(net); 12157 unsigned int gc_seq; 12158 12159 mutex_lock(&nft_net->commit_mutex); 12160 12161 gc_seq = nft_gc_seq_begin(nft_net); 12162 12163 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 12164 WARN_ON_ONCE(!list_empty(&nft_net->commit_set_list)); 12165 12166 if (!list_empty(&nft_net->module_list)) 12167 nf_tables_module_autoload_cleanup(net); 12168 12169 cancel_work_sync(&nft_net->destroy_work); 12170 __nft_release_tables(net); 12171 12172 nft_gc_seq_end(nft_net, gc_seq); 12173 12174 mutex_unlock(&nft_net->commit_mutex); 12175 12176 WARN_ON_ONCE(!list_empty(&nft_net->tables)); 12177 WARN_ON_ONCE(!list_empty(&nft_net->module_list)); 12178 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 12179 WARN_ON_ONCE(!list_empty(&nft_net->destroy_list)); 12180 } 12181 12182 static void nf_tables_exit_batch(struct list_head *net_exit_list) 12183 { 12184 flush_work(&trans_gc_work); 12185 } 12186 12187 static struct pernet_operations nf_tables_net_ops = { 12188 .init = nf_tables_init_net, 12189 .pre_exit = nf_tables_pre_exit_net, 12190 .exit = nf_tables_exit_net, 12191 .exit_batch = nf_tables_exit_batch, 12192 .id = &nf_tables_net_id, 12193 .size = sizeof(struct nftables_pernet), 12194 }; 12195 12196 static int __init nf_tables_module_init(void) 12197 { 12198 int err; 12199 12200 BUILD_BUG_ON(offsetof(struct nft_trans_table, nft_trans) != 0); 12201 BUILD_BUG_ON(offsetof(struct nft_trans_chain, nft_trans_binding.nft_trans) != 0); 12202 BUILD_BUG_ON(offsetof(struct nft_trans_rule, nft_trans) != 0); 12203 BUILD_BUG_ON(offsetof(struct nft_trans_set, nft_trans_binding.nft_trans) != 0); 12204 BUILD_BUG_ON(offsetof(struct nft_trans_elem, nft_trans) != 0); 12205 BUILD_BUG_ON(offsetof(struct nft_trans_obj, nft_trans) != 0); 12206 BUILD_BUG_ON(offsetof(struct nft_trans_flowtable, nft_trans) != 0); 12207 12208 err = register_pernet_subsys(&nf_tables_net_ops); 12209 if (err < 0) 12210 return err; 12211 12212 err = nft_chain_filter_init(); 12213 if (err < 0) 12214 goto err_chain_filter; 12215 12216 err = nf_tables_core_module_init(); 12217 if (err < 0) 12218 goto err_core_module; 12219 12220 err = register_netdevice_notifier(&nf_tables_flowtable_notifier); 12221 if (err < 0) 12222 goto err_netdev_notifier; 12223 12224 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params); 12225 if (err < 0) 12226 goto err_rht_objname; 12227 12228 err = nft_offload_init(); 12229 if (err < 0) 12230 goto err_offload; 12231 12232 err = netlink_register_notifier(&nft_nl_notifier); 12233 if (err < 0) 12234 goto err_netlink_notifier; 12235 12236 /* must be last */ 12237 err = nfnetlink_subsys_register(&nf_tables_subsys); 12238 if (err < 0) 12239 goto err_nfnl_subsys; 12240 12241 nft_chain_route_init(); 12242 12243 return err; 12244 12245 err_nfnl_subsys: 12246 netlink_unregister_notifier(&nft_nl_notifier); 12247 err_netlink_notifier: 12248 nft_offload_exit(); 12249 err_offload: 12250 rhltable_destroy(&nft_objname_ht); 12251 err_rht_objname: 12252 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 12253 err_netdev_notifier: 12254 nf_tables_core_module_exit(); 12255 err_core_module: 12256 nft_chain_filter_fini(); 12257 err_chain_filter: 12258 unregister_pernet_subsys(&nf_tables_net_ops); 12259 return err; 12260 } 12261 12262 static void __exit nf_tables_module_exit(void) 12263 { 12264 nfnetlink_subsys_unregister(&nf_tables_subsys); 12265 netlink_unregister_notifier(&nft_nl_notifier); 12266 nft_offload_exit(); 12267 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 12268 nft_chain_filter_fini(); 12269 nft_chain_route_fini(); 12270 unregister_pernet_subsys(&nf_tables_net_ops); 12271 cancel_work_sync(&trans_gc_work); 12272 rcu_barrier(); 12273 rhltable_destroy(&nft_objname_ht); 12274 nf_tables_core_module_exit(); 12275 } 12276 12277 module_init(nf_tables_module_init); 12278 module_exit(nf_tables_module_exit); 12279 12280 MODULE_LICENSE("GPL"); 12281 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 12282 MODULE_DESCRIPTION("Framework for packet filtering and classification"); 12283 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 12284