1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/module.h> 9 #include <linux/init.h> 10 #include <linux/list.h> 11 #include <linux/skbuff.h> 12 #include <linux/netlink.h> 13 #include <linux/vmalloc.h> 14 #include <linux/rhashtable.h> 15 #include <linux/audit.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter_ipv4.h> 18 #include <linux/netfilter/nfnetlink.h> 19 #include <linux/netfilter/nf_tables.h> 20 #include <net/netfilter/nf_flow_table.h> 21 #include <net/netfilter/nf_tables_core.h> 22 #include <net/netfilter/nf_tables.h> 23 #include <net/netfilter/nf_tables_offload.h> 24 #include <net/net_namespace.h> 25 #include <net/sock.h> 26 27 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) 28 #define NFT_SET_MAX_ANONLEN 16 29 30 /* limit compaction to avoid huge kmalloc/krealloc sizes. */ 31 #define NFT_MAX_SET_NELEMS ((2048 - sizeof(struct nft_trans_elem)) / sizeof(struct nft_trans_one_elem)) 32 33 unsigned int nf_tables_net_id __read_mostly; 34 35 static LIST_HEAD(nf_tables_expressions); 36 static LIST_HEAD(nf_tables_objects); 37 static LIST_HEAD(nf_tables_flowtables); 38 static LIST_HEAD(nf_tables_gc_list); 39 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock); 40 static DEFINE_SPINLOCK(nf_tables_gc_list_lock); 41 42 enum { 43 NFT_VALIDATE_SKIP = 0, 44 NFT_VALIDATE_NEED, 45 NFT_VALIDATE_DO, 46 }; 47 48 static struct rhltable nft_objname_ht; 49 50 static u32 nft_chain_hash(const void *data, u32 len, u32 seed); 51 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed); 52 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *); 53 54 static u32 nft_objname_hash(const void *data, u32 len, u32 seed); 55 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed); 56 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *); 57 58 static const struct rhashtable_params nft_chain_ht_params = { 59 .head_offset = offsetof(struct nft_chain, rhlhead), 60 .key_offset = offsetof(struct nft_chain, name), 61 .hashfn = nft_chain_hash, 62 .obj_hashfn = nft_chain_hash_obj, 63 .obj_cmpfn = nft_chain_hash_cmp, 64 .automatic_shrinking = true, 65 }; 66 67 static const struct rhashtable_params nft_objname_ht_params = { 68 .head_offset = offsetof(struct nft_object, rhlhead), 69 .key_offset = offsetof(struct nft_object, key), 70 .hashfn = nft_objname_hash, 71 .obj_hashfn = nft_objname_hash_obj, 72 .obj_cmpfn = nft_objname_hash_cmp, 73 .automatic_shrinking = true, 74 }; 75 76 struct nft_audit_data { 77 struct nft_table *table; 78 int entries; 79 int op; 80 struct list_head list; 81 }; 82 83 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types 84 [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, 85 [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, 86 [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, 87 [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, 88 [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, 89 [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, 90 [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, 91 [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, 92 [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, 93 [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, 94 [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, 95 [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, 96 [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, 97 [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, 98 [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, 99 [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, 100 [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, 101 [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, 102 [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, 103 [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, 104 [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, 105 [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, 106 [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, 107 [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, 108 [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, 109 [NFT_MSG_GETSETELEM_RESET] = AUDIT_NFT_OP_SETELEM_RESET, 110 }; 111 112 static void nft_validate_state_update(struct nft_table *table, u8 new_validate_state) 113 { 114 switch (table->validate_state) { 115 case NFT_VALIDATE_SKIP: 116 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO); 117 break; 118 case NFT_VALIDATE_NEED: 119 break; 120 case NFT_VALIDATE_DO: 121 if (new_validate_state == NFT_VALIDATE_NEED) 122 return; 123 } 124 125 table->validate_state = new_validate_state; 126 } 127 128 static bool nft_chain_vstate_valid(const struct nft_ctx *ctx, 129 const struct nft_chain *chain) 130 { 131 const struct nft_base_chain *base_chain; 132 enum nft_chain_types type; 133 u8 hooknum; 134 135 if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain))) 136 return false; 137 138 base_chain = nft_base_chain(ctx->chain); 139 hooknum = base_chain->ops.hooknum; 140 type = base_chain->type->type; 141 142 /* chain is already validated for this call depth */ 143 if (chain->vstate.depth >= ctx->level && 144 chain->vstate.hook_mask[type] & BIT(hooknum)) 145 return true; 146 147 return false; 148 } 149 150 static void nf_tables_trans_destroy_work(struct work_struct *w); 151 152 static void nft_trans_gc_work(struct work_struct *work); 153 static DECLARE_WORK(trans_gc_work, nft_trans_gc_work); 154 155 static void nft_ctx_init(struct nft_ctx *ctx, 156 struct net *net, 157 const struct sk_buff *skb, 158 const struct nlmsghdr *nlh, 159 u8 family, 160 struct nft_table *table, 161 struct nft_chain *chain, 162 const struct nlattr * const *nla) 163 { 164 ctx->net = net; 165 ctx->family = family; 166 ctx->level = 0; 167 ctx->table = table; 168 ctx->chain = chain; 169 ctx->nla = nla; 170 ctx->portid = NETLINK_CB(skb).portid; 171 ctx->report = nlmsg_report(nlh); 172 ctx->flags = nlh->nlmsg_flags; 173 ctx->seq = nlh->nlmsg_seq; 174 175 bitmap_zero(ctx->reg_inited, NFT_REG32_NUM); 176 } 177 178 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx, 179 int msg_type, u32 size) 180 { 181 struct nft_trans *trans; 182 183 trans = kzalloc(size, GFP_KERNEL); 184 if (trans == NULL) 185 return NULL; 186 187 INIT_LIST_HEAD(&trans->list); 188 trans->msg_type = msg_type; 189 190 trans->net = ctx->net; 191 trans->table = ctx->table; 192 trans->seq = ctx->seq; 193 trans->flags = ctx->flags; 194 trans->report = ctx->report; 195 196 return trans; 197 } 198 199 static struct nft_trans_binding *nft_trans_get_binding(struct nft_trans *trans) 200 { 201 switch (trans->msg_type) { 202 case NFT_MSG_NEWCHAIN: 203 case NFT_MSG_NEWSET: 204 return container_of(trans, struct nft_trans_binding, nft_trans); 205 } 206 207 return NULL; 208 } 209 210 static void nft_trans_list_del(struct nft_trans *trans) 211 { 212 struct nft_trans_binding *trans_binding; 213 214 list_del(&trans->list); 215 216 trans_binding = nft_trans_get_binding(trans); 217 if (trans_binding) 218 list_del(&trans_binding->binding_list); 219 } 220 221 static void nft_trans_destroy(struct nft_trans *trans) 222 { 223 nft_trans_list_del(trans); 224 kfree(trans); 225 } 226 227 static void __nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set, 228 bool bind) 229 { 230 struct nftables_pernet *nft_net; 231 struct net *net = ctx->net; 232 struct nft_trans *trans; 233 234 if (!nft_set_is_anonymous(set)) 235 return; 236 237 nft_net = nft_pernet(net); 238 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 239 switch (trans->msg_type) { 240 case NFT_MSG_NEWSET: 241 if (nft_trans_set(trans) == set) 242 nft_trans_set_bound(trans) = bind; 243 break; 244 case NFT_MSG_NEWSETELEM: 245 if (nft_trans_elem_set(trans) == set) 246 nft_trans_elem_set_bound(trans) = bind; 247 break; 248 } 249 } 250 } 251 252 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) 253 { 254 return __nft_set_trans_bind(ctx, set, true); 255 } 256 257 static void nft_set_trans_unbind(const struct nft_ctx *ctx, struct nft_set *set) 258 { 259 return __nft_set_trans_bind(ctx, set, false); 260 } 261 262 static void __nft_chain_trans_bind(const struct nft_ctx *ctx, 263 struct nft_chain *chain, bool bind) 264 { 265 struct nftables_pernet *nft_net; 266 struct net *net = ctx->net; 267 struct nft_trans *trans; 268 269 if (!nft_chain_binding(chain)) 270 return; 271 272 nft_net = nft_pernet(net); 273 list_for_each_entry_reverse(trans, &nft_net->commit_list, list) { 274 switch (trans->msg_type) { 275 case NFT_MSG_NEWCHAIN: 276 if (nft_trans_chain(trans) == chain) 277 nft_trans_chain_bound(trans) = bind; 278 break; 279 case NFT_MSG_NEWRULE: 280 if (nft_trans_rule_chain(trans) == chain) 281 nft_trans_rule_bound(trans) = bind; 282 break; 283 } 284 } 285 } 286 287 static void nft_chain_trans_bind(const struct nft_ctx *ctx, 288 struct nft_chain *chain) 289 { 290 __nft_chain_trans_bind(ctx, chain, true); 291 } 292 293 int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain) 294 { 295 if (!nft_chain_binding(chain)) 296 return 0; 297 298 if (nft_chain_binding(ctx->chain)) 299 return -EOPNOTSUPP; 300 301 if (chain->bound) 302 return -EBUSY; 303 304 if (!nft_use_inc(&chain->use)) 305 return -EMFILE; 306 307 chain->bound = true; 308 nft_chain_trans_bind(ctx, chain); 309 310 return 0; 311 } 312 313 void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain) 314 { 315 __nft_chain_trans_bind(ctx, chain, false); 316 } 317 318 static int nft_netdev_register_hooks(struct net *net, 319 struct list_head *hook_list) 320 { 321 struct nf_hook_ops *ops; 322 struct nft_hook *hook; 323 int err, j; 324 325 j = 0; 326 list_for_each_entry(hook, hook_list, list) { 327 list_for_each_entry(ops, &hook->ops_list, list) { 328 err = nf_register_net_hook(net, ops); 329 if (err < 0) 330 goto err_register; 331 332 j++; 333 } 334 } 335 return 0; 336 337 err_register: 338 list_for_each_entry(hook, hook_list, list) { 339 list_for_each_entry(ops, &hook->ops_list, list) { 340 if (j-- <= 0) 341 break; 342 343 nf_unregister_net_hook(net, ops); 344 } 345 } 346 return err; 347 } 348 349 static void nft_netdev_hook_free_ops(struct nft_hook *hook) 350 { 351 struct nf_hook_ops *ops, *next; 352 353 list_for_each_entry_safe(ops, next, &hook->ops_list, list) { 354 list_del(&ops->list); 355 kfree(ops); 356 } 357 } 358 359 static void nft_netdev_hook_free(struct nft_hook *hook) 360 { 361 nft_netdev_hook_free_ops(hook); 362 kfree(hook); 363 } 364 365 static void __nft_netdev_hook_free_rcu(struct rcu_head *rcu) 366 { 367 struct nft_hook *hook = container_of(rcu, struct nft_hook, rcu); 368 369 nft_netdev_hook_free(hook); 370 } 371 372 static void nft_netdev_hook_free_rcu(struct nft_hook *hook) 373 { 374 call_rcu(&hook->rcu, __nft_netdev_hook_free_rcu); 375 } 376 377 static void nft_netdev_unregister_hooks(struct net *net, 378 struct list_head *hook_list, 379 bool release_netdev) 380 { 381 struct nft_hook *hook, *next; 382 struct nf_hook_ops *ops; 383 384 list_for_each_entry_safe(hook, next, hook_list, list) { 385 list_for_each_entry(ops, &hook->ops_list, list) 386 nf_unregister_net_hook(net, ops); 387 if (release_netdev) { 388 list_del(&hook->list); 389 nft_netdev_hook_free_rcu(hook); 390 } 391 } 392 } 393 394 static int nf_tables_register_hook(struct net *net, 395 const struct nft_table *table, 396 struct nft_chain *chain) 397 { 398 struct nft_base_chain *basechain; 399 const struct nf_hook_ops *ops; 400 401 if (table->flags & NFT_TABLE_F_DORMANT || 402 !nft_is_base_chain(chain)) 403 return 0; 404 405 basechain = nft_base_chain(chain); 406 ops = &basechain->ops; 407 408 if (basechain->type->ops_register) 409 return basechain->type->ops_register(net, ops); 410 411 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 412 return nft_netdev_register_hooks(net, &basechain->hook_list); 413 414 return nf_register_net_hook(net, &basechain->ops); 415 } 416 417 static void __nf_tables_unregister_hook(struct net *net, 418 const struct nft_table *table, 419 struct nft_chain *chain, 420 bool release_netdev) 421 { 422 struct nft_base_chain *basechain; 423 const struct nf_hook_ops *ops; 424 425 if (table->flags & NFT_TABLE_F_DORMANT || 426 !nft_is_base_chain(chain)) 427 return; 428 basechain = nft_base_chain(chain); 429 ops = &basechain->ops; 430 431 if (basechain->type->ops_unregister) 432 return basechain->type->ops_unregister(net, ops); 433 434 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 435 nft_netdev_unregister_hooks(net, &basechain->hook_list, 436 release_netdev); 437 else 438 nf_unregister_net_hook(net, &basechain->ops); 439 } 440 441 static void nf_tables_unregister_hook(struct net *net, 442 const struct nft_table *table, 443 struct nft_chain *chain) 444 { 445 return __nf_tables_unregister_hook(net, table, chain, false); 446 } 447 448 static bool nft_trans_collapse_set_elem_allowed(const struct nft_trans_elem *a, const struct nft_trans_elem *b) 449 { 450 /* NB: the ->bound equality check is defensive, at this time we only merge 451 * a new nft_trans_elem transaction request with the transaction tail 452 * element, but a->bound != b->bound would imply a NEWRULE transaction 453 * is queued in-between. 454 * 455 * The set check is mandatory, the NFT_MAX_SET_NELEMS check prevents 456 * huge krealloc() requests. 457 */ 458 return a->set == b->set && a->bound == b->bound && a->nelems < NFT_MAX_SET_NELEMS; 459 } 460 461 static bool nft_trans_collapse_set_elem(struct nftables_pernet *nft_net, 462 struct nft_trans_elem *tail, 463 struct nft_trans_elem *trans) 464 { 465 unsigned int nelems, old_nelems = tail->nelems; 466 struct nft_trans_elem *new_trans; 467 468 if (!nft_trans_collapse_set_elem_allowed(tail, trans)) 469 return false; 470 471 /* "cannot happen", at this time userspace element add 472 * requests always allocate a new transaction element. 473 * 474 * This serves as a reminder to adjust the list_add_tail 475 * logic below in case this ever changes. 476 */ 477 if (WARN_ON_ONCE(trans->nelems != 1)) 478 return false; 479 480 if (check_add_overflow(old_nelems, trans->nelems, &nelems)) 481 return false; 482 483 /* krealloc might free tail which invalidates list pointers */ 484 list_del_init(&tail->nft_trans.list); 485 486 new_trans = krealloc(tail, struct_size(tail, elems, nelems), 487 GFP_KERNEL); 488 if (!new_trans) { 489 list_add_tail(&tail->nft_trans.list, 490 &nft_net->commit_list); 491 return false; 492 } 493 494 /* 495 * new_trans->nft_trans.list contains garbage, but 496 * list_add_tail() doesn't care. 497 */ 498 new_trans->nelems = nelems; 499 new_trans->elems[old_nelems] = trans->elems[0]; 500 list_add_tail(&new_trans->nft_trans.list, &nft_net->commit_list); 501 502 return true; 503 } 504 505 static bool nft_trans_try_collapse(struct nftables_pernet *nft_net, 506 struct nft_trans *trans) 507 { 508 struct nft_trans *tail; 509 510 if (list_empty(&nft_net->commit_list)) 511 return false; 512 513 tail = list_last_entry(&nft_net->commit_list, struct nft_trans, list); 514 515 if (tail->msg_type != trans->msg_type) 516 return false; 517 518 switch (trans->msg_type) { 519 case NFT_MSG_NEWSETELEM: 520 case NFT_MSG_DELSETELEM: 521 return nft_trans_collapse_set_elem(nft_net, 522 nft_trans_container_elem(tail), 523 nft_trans_container_elem(trans)); 524 } 525 526 return false; 527 } 528 529 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans) 530 { 531 struct nftables_pernet *nft_net = nft_pernet(net); 532 struct nft_trans_binding *binding; 533 struct nft_trans_set *trans_set; 534 535 list_add_tail(&trans->list, &nft_net->commit_list); 536 537 binding = nft_trans_get_binding(trans); 538 if (!binding) 539 return; 540 541 switch (trans->msg_type) { 542 case NFT_MSG_NEWSET: 543 trans_set = nft_trans_container_set(trans); 544 545 if (!nft_trans_set_update(trans) && 546 nft_set_is_anonymous(nft_trans_set(trans))) 547 list_add_tail(&binding->binding_list, &nft_net->binding_list); 548 549 list_add_tail(&trans_set->list_trans_newset, &nft_net->commit_set_list); 550 break; 551 case NFT_MSG_NEWCHAIN: 552 if (!nft_trans_chain_update(trans) && 553 nft_chain_binding(nft_trans_chain(trans))) 554 list_add_tail(&binding->binding_list, &nft_net->binding_list); 555 break; 556 } 557 } 558 559 static void nft_trans_commit_list_add_elem(struct net *net, struct nft_trans *trans) 560 { 561 struct nftables_pernet *nft_net = nft_pernet(net); 562 563 WARN_ON_ONCE(trans->msg_type != NFT_MSG_NEWSETELEM && 564 trans->msg_type != NFT_MSG_DELSETELEM); 565 566 if (nft_trans_try_collapse(nft_net, trans)) { 567 kfree(trans); 568 return; 569 } 570 571 nft_trans_commit_list_add_tail(net, trans); 572 } 573 574 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type) 575 { 576 struct nft_trans *trans; 577 578 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table)); 579 if (trans == NULL) 580 return -ENOMEM; 581 582 if (msg_type == NFT_MSG_NEWTABLE) 583 nft_activate_next(ctx->net, ctx->table); 584 585 nft_trans_commit_list_add_tail(ctx->net, trans); 586 return 0; 587 } 588 589 static int nft_deltable(struct nft_ctx *ctx) 590 { 591 int err; 592 593 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE); 594 if (err < 0) 595 return err; 596 597 nft_deactivate_next(ctx->net, ctx->table); 598 return err; 599 } 600 601 static struct nft_trans * 602 nft_trans_alloc_chain(const struct nft_ctx *ctx, int msg_type) 603 { 604 struct nft_trans_chain *trans_chain; 605 struct nft_trans *trans; 606 607 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain)); 608 if (!trans) 609 return NULL; 610 611 trans_chain = nft_trans_container_chain(trans); 612 INIT_LIST_HEAD(&trans_chain->nft_trans_binding.binding_list); 613 trans_chain->chain = ctx->chain; 614 615 return trans; 616 } 617 618 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 619 { 620 struct nft_trans *trans; 621 622 trans = nft_trans_alloc_chain(ctx, msg_type); 623 if (trans == NULL) 624 return ERR_PTR(-ENOMEM); 625 626 if (msg_type == NFT_MSG_NEWCHAIN) { 627 nft_activate_next(ctx->net, ctx->chain); 628 629 if (ctx->nla[NFTA_CHAIN_ID]) { 630 nft_trans_chain_id(trans) = 631 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID])); 632 } 633 } 634 nft_trans_commit_list_add_tail(ctx->net, trans); 635 636 return trans; 637 } 638 639 static int nft_delchain(struct nft_ctx *ctx) 640 { 641 struct nft_trans *trans; 642 643 trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN); 644 if (IS_ERR(trans)) 645 return PTR_ERR(trans); 646 647 nft_use_dec(&ctx->table->use); 648 nft_deactivate_next(ctx->net, ctx->chain); 649 650 return 0; 651 } 652 653 void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule) 654 { 655 struct nft_expr *expr; 656 657 expr = nft_expr_first(rule); 658 while (nft_expr_more(rule, expr)) { 659 if (expr->ops->activate) 660 expr->ops->activate(ctx, expr); 661 662 expr = nft_expr_next(expr); 663 } 664 } 665 666 void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule, 667 enum nft_trans_phase phase) 668 { 669 struct nft_expr *expr; 670 671 expr = nft_expr_first(rule); 672 while (nft_expr_more(rule, expr)) { 673 if (expr->ops->deactivate) 674 expr->ops->deactivate(ctx, expr, phase); 675 676 expr = nft_expr_next(expr); 677 } 678 } 679 680 static int 681 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) 682 { 683 /* You cannot delete the same rule twice */ 684 if (nft_is_active_next(ctx->net, rule)) { 685 nft_deactivate_next(ctx->net, rule); 686 nft_use_dec(&ctx->chain->use); 687 return 0; 688 } 689 return -ENOENT; 690 } 691 692 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type, 693 struct nft_rule *rule) 694 { 695 struct nft_trans *trans; 696 697 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule)); 698 if (trans == NULL) 699 return NULL; 700 701 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) { 702 nft_trans_rule_id(trans) = 703 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID])); 704 } 705 nft_trans_rule(trans) = rule; 706 nft_trans_rule_chain(trans) = ctx->chain; 707 nft_trans_commit_list_add_tail(ctx->net, trans); 708 709 return trans; 710 } 711 712 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) 713 { 714 struct nft_flow_rule *flow; 715 struct nft_trans *trans; 716 int err; 717 718 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule); 719 if (trans == NULL) 720 return -ENOMEM; 721 722 if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) { 723 flow = nft_flow_rule_create(ctx->net, rule); 724 if (IS_ERR(flow)) { 725 nft_trans_destroy(trans); 726 return PTR_ERR(flow); 727 } 728 729 nft_trans_flow_rule(trans) = flow; 730 } 731 732 err = nf_tables_delrule_deactivate(ctx, rule); 733 if (err < 0) { 734 nft_trans_destroy(trans); 735 return err; 736 } 737 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE); 738 739 return 0; 740 } 741 742 static int nft_delrule_by_chain(struct nft_ctx *ctx) 743 { 744 struct nft_rule *rule; 745 int err; 746 747 list_for_each_entry(rule, &ctx->chain->rules, list) { 748 if (!nft_is_active_next(ctx->net, rule)) 749 continue; 750 751 err = nft_delrule(ctx, rule); 752 if (err < 0) 753 return err; 754 } 755 return 0; 756 } 757 758 static int __nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 759 struct nft_set *set, 760 const struct nft_set_desc *desc) 761 { 762 struct nft_trans_set *trans_set; 763 struct nft_trans *trans; 764 765 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set)); 766 if (trans == NULL) 767 return -ENOMEM; 768 769 trans_set = nft_trans_container_set(trans); 770 INIT_LIST_HEAD(&trans_set->nft_trans_binding.binding_list); 771 INIT_LIST_HEAD(&trans_set->list_trans_newset); 772 773 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] && !desc) { 774 nft_trans_set_id(trans) = 775 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID])); 776 nft_activate_next(ctx->net, set); 777 } 778 nft_trans_set(trans) = set; 779 if (desc) { 780 nft_trans_set_update(trans) = true; 781 nft_trans_set_gc_int(trans) = desc->gc_int; 782 nft_trans_set_timeout(trans) = desc->timeout; 783 nft_trans_set_size(trans) = desc->size; 784 } 785 nft_trans_commit_list_add_tail(ctx->net, trans); 786 787 return 0; 788 } 789 790 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type, 791 struct nft_set *set) 792 { 793 return __nft_trans_set_add(ctx, msg_type, set, NULL); 794 } 795 796 static int nft_mapelem_deactivate(const struct nft_ctx *ctx, 797 struct nft_set *set, 798 const struct nft_set_iter *iter, 799 struct nft_elem_priv *elem_priv) 800 { 801 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 802 803 if (!nft_set_elem_active(ext, iter->genmask)) 804 return 0; 805 806 nft_set_elem_change_active(ctx->net, set, ext); 807 nft_setelem_data_deactivate(ctx->net, set, elem_priv); 808 809 return 0; 810 } 811 812 struct nft_set_elem_catchall { 813 struct list_head list; 814 struct rcu_head rcu; 815 struct nft_elem_priv *elem; 816 }; 817 818 static void nft_map_catchall_deactivate(const struct nft_ctx *ctx, 819 struct nft_set *set) 820 { 821 u8 genmask = nft_genmask_next(ctx->net); 822 struct nft_set_elem_catchall *catchall; 823 struct nft_set_ext *ext; 824 825 list_for_each_entry(catchall, &set->catchall_list, list) { 826 ext = nft_set_elem_ext(set, catchall->elem); 827 if (!nft_set_elem_active(ext, genmask)) 828 continue; 829 830 nft_set_elem_change_active(ctx->net, set, ext); 831 nft_setelem_data_deactivate(ctx->net, set, catchall->elem); 832 break; 833 } 834 } 835 836 static void nft_map_deactivate(const struct nft_ctx *ctx, struct nft_set *set) 837 { 838 struct nft_set_iter iter = { 839 .genmask = nft_genmask_next(ctx->net), 840 .type = NFT_ITER_UPDATE, 841 .fn = nft_mapelem_deactivate, 842 }; 843 844 set->ops->walk(ctx, set, &iter); 845 WARN_ON_ONCE(iter.err); 846 847 nft_map_catchall_deactivate(ctx, set); 848 } 849 850 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set) 851 { 852 int err; 853 854 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set); 855 if (err < 0) 856 return err; 857 858 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 859 nft_map_deactivate(ctx, set); 860 861 nft_deactivate_next(ctx->net, set); 862 nft_use_dec(&ctx->table->use); 863 864 return err; 865 } 866 867 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type, 868 struct nft_object *obj) 869 { 870 struct nft_trans *trans; 871 872 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj)); 873 if (trans == NULL) 874 return -ENOMEM; 875 876 if (msg_type == NFT_MSG_NEWOBJ) 877 nft_activate_next(ctx->net, obj); 878 879 nft_trans_obj(trans) = obj; 880 nft_trans_commit_list_add_tail(ctx->net, trans); 881 882 return 0; 883 } 884 885 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj) 886 { 887 int err; 888 889 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj); 890 if (err < 0) 891 return err; 892 893 nft_deactivate_next(ctx->net, obj); 894 nft_use_dec(&ctx->table->use); 895 896 return err; 897 } 898 899 static struct nft_trans * 900 nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type, 901 struct nft_flowtable *flowtable) 902 { 903 struct nft_trans *trans; 904 905 trans = nft_trans_alloc(ctx, msg_type, 906 sizeof(struct nft_trans_flowtable)); 907 if (trans == NULL) 908 return ERR_PTR(-ENOMEM); 909 910 if (msg_type == NFT_MSG_NEWFLOWTABLE) 911 nft_activate_next(ctx->net, flowtable); 912 913 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 914 nft_trans_flowtable(trans) = flowtable; 915 nft_trans_commit_list_add_tail(ctx->net, trans); 916 917 return trans; 918 } 919 920 static int nft_delflowtable(struct nft_ctx *ctx, 921 struct nft_flowtable *flowtable) 922 { 923 struct nft_trans *trans; 924 925 trans = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable); 926 if (IS_ERR(trans)) 927 return PTR_ERR(trans); 928 929 nft_deactivate_next(ctx->net, flowtable); 930 nft_use_dec(&ctx->table->use); 931 932 return 0; 933 } 934 935 static void __nft_reg_track_clobber(struct nft_regs_track *track, u8 dreg) 936 { 937 int i; 938 939 for (i = track->regs[dreg].num_reg; i > 0; i--) 940 __nft_reg_track_cancel(track, dreg - i); 941 } 942 943 static void __nft_reg_track_update(struct nft_regs_track *track, 944 const struct nft_expr *expr, 945 u8 dreg, u8 num_reg) 946 { 947 track->regs[dreg].selector = expr; 948 track->regs[dreg].bitwise = NULL; 949 track->regs[dreg].num_reg = num_reg; 950 } 951 952 void nft_reg_track_update(struct nft_regs_track *track, 953 const struct nft_expr *expr, u8 dreg, u8 len) 954 { 955 unsigned int regcount; 956 int i; 957 958 __nft_reg_track_clobber(track, dreg); 959 960 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 961 for (i = 0; i < regcount; i++, dreg++) 962 __nft_reg_track_update(track, expr, dreg, i); 963 } 964 EXPORT_SYMBOL_GPL(nft_reg_track_update); 965 966 void nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg, u8 len) 967 { 968 unsigned int regcount; 969 int i; 970 971 __nft_reg_track_clobber(track, dreg); 972 973 regcount = DIV_ROUND_UP(len, NFT_REG32_SIZE); 974 for (i = 0; i < regcount; i++, dreg++) 975 __nft_reg_track_cancel(track, dreg); 976 } 977 EXPORT_SYMBOL_GPL(nft_reg_track_cancel); 978 979 void __nft_reg_track_cancel(struct nft_regs_track *track, u8 dreg) 980 { 981 track->regs[dreg].selector = NULL; 982 track->regs[dreg].bitwise = NULL; 983 track->regs[dreg].num_reg = 0; 984 } 985 EXPORT_SYMBOL_GPL(__nft_reg_track_cancel); 986 987 /* 988 * Tables 989 */ 990 991 static struct nft_table *nft_table_lookup(const struct net *net, 992 const struct nlattr *nla, 993 u8 family, u8 genmask, u32 nlpid) 994 { 995 struct nftables_pernet *nft_net; 996 struct nft_table *table; 997 998 if (nla == NULL) 999 return ERR_PTR(-EINVAL); 1000 1001 nft_net = nft_pernet(net); 1002 list_for_each_entry_rcu(table, &nft_net->tables, list, 1003 lockdep_is_held(&nft_net->commit_mutex)) { 1004 if (!nla_strcmp(nla, table->name) && 1005 table->family == family && 1006 nft_active_genmask(table, genmask)) { 1007 if (nft_table_has_owner(table) && 1008 nlpid && table->nlpid != nlpid) 1009 return ERR_PTR(-EPERM); 1010 1011 return table; 1012 } 1013 } 1014 1015 return ERR_PTR(-ENOENT); 1016 } 1017 1018 static struct nft_table *nft_table_lookup_byhandle(const struct net *net, 1019 const struct nlattr *nla, 1020 int family, u8 genmask, u32 nlpid) 1021 { 1022 struct nftables_pernet *nft_net; 1023 struct nft_table *table; 1024 1025 nft_net = nft_pernet(net); 1026 list_for_each_entry(table, &nft_net->tables, list) { 1027 if (be64_to_cpu(nla_get_be64(nla)) == table->handle && 1028 table->family == family && 1029 nft_active_genmask(table, genmask)) { 1030 if (nft_table_has_owner(table) && 1031 nlpid && table->nlpid != nlpid) 1032 return ERR_PTR(-EPERM); 1033 1034 return table; 1035 } 1036 } 1037 1038 return ERR_PTR(-ENOENT); 1039 } 1040 1041 static inline u64 nf_tables_alloc_handle(struct nft_table *table) 1042 { 1043 return ++table->hgenerator; 1044 } 1045 1046 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX]; 1047 1048 static const struct nft_chain_type * 1049 __nft_chain_type_get(u8 family, enum nft_chain_types type) 1050 { 1051 if (family >= NFPROTO_NUMPROTO || 1052 type >= NFT_CHAIN_T_MAX) 1053 return NULL; 1054 1055 return chain_type[family][type]; 1056 } 1057 1058 static const struct nft_chain_type * 1059 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family) 1060 { 1061 const struct nft_chain_type *type; 1062 int i; 1063 1064 for (i = 0; i < NFT_CHAIN_T_MAX; i++) { 1065 type = __nft_chain_type_get(family, i); 1066 if (!type) 1067 continue; 1068 if (!nla_strcmp(nla, type->name)) 1069 return type; 1070 } 1071 return NULL; 1072 } 1073 1074 struct nft_module_request { 1075 struct list_head list; 1076 char module[MODULE_NAME_LEN]; 1077 bool done; 1078 }; 1079 1080 #ifdef CONFIG_MODULES 1081 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, 1082 ...) 1083 { 1084 char module_name[MODULE_NAME_LEN]; 1085 struct nftables_pernet *nft_net; 1086 struct nft_module_request *req; 1087 va_list args; 1088 int ret; 1089 1090 va_start(args, fmt); 1091 ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); 1092 va_end(args); 1093 if (ret >= MODULE_NAME_LEN) 1094 return 0; 1095 1096 nft_net = nft_pernet(net); 1097 list_for_each_entry(req, &nft_net->module_list, list) { 1098 if (!strcmp(req->module, module_name)) { 1099 if (req->done) 1100 return 0; 1101 1102 /* A request to load this module already exists. */ 1103 return -EAGAIN; 1104 } 1105 } 1106 1107 req = kmalloc(sizeof(*req), GFP_KERNEL); 1108 if (!req) 1109 return -ENOMEM; 1110 1111 req->done = false; 1112 strscpy(req->module, module_name, MODULE_NAME_LEN); 1113 list_add_tail(&req->list, &nft_net->module_list); 1114 1115 return -EAGAIN; 1116 } 1117 EXPORT_SYMBOL_GPL(nft_request_module); 1118 #endif 1119 1120 static void lockdep_nfnl_nft_mutex_not_held(void) 1121 { 1122 #ifdef CONFIG_PROVE_LOCKING 1123 if (debug_locks) 1124 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES)); 1125 #endif 1126 } 1127 1128 static const struct nft_chain_type * 1129 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, 1130 u8 family, bool autoload) 1131 { 1132 const struct nft_chain_type *type; 1133 1134 type = __nf_tables_chain_type_lookup(nla, family); 1135 if (type != NULL) 1136 return type; 1137 1138 lockdep_nfnl_nft_mutex_not_held(); 1139 #ifdef CONFIG_MODULES 1140 if (autoload) { 1141 if (nft_request_module(net, "nft-chain-%u-%.*s", family, 1142 nla_len(nla), 1143 (const char *)nla_data(nla)) == -EAGAIN) 1144 return ERR_PTR(-EAGAIN); 1145 } 1146 #endif 1147 return ERR_PTR(-ENOENT); 1148 } 1149 1150 static unsigned int nft_base_seq(const struct net *net) 1151 { 1152 return READ_ONCE(net->nft.base_seq); 1153 } 1154 1155 static __be16 nft_base_seq_be16(const struct net *net) 1156 { 1157 return htons(nft_base_seq(net) & 0xffff); 1158 } 1159 1160 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 1161 [NFTA_TABLE_NAME] = { .type = NLA_STRING, 1162 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1163 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 }, 1164 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 }, 1165 [NFTA_TABLE_USERDATA] = { .type = NLA_BINARY, 1166 .len = NFT_USERDATA_MAXLEN } 1167 }; 1168 1169 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 1170 u32 portid, u32 seq, int event, u32 flags, 1171 int family, const struct nft_table *table) 1172 { 1173 struct nlmsghdr *nlh; 1174 1175 nlh = nfnl_msg_put(skb, portid, seq, 1176 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 1177 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 1178 if (!nlh) 1179 goto nla_put_failure; 1180 1181 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || 1182 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || 1183 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle), 1184 NFTA_TABLE_PAD)) 1185 goto nla_put_failure; 1186 1187 if (event == NFT_MSG_DELTABLE || 1188 event == NFT_MSG_DESTROYTABLE) { 1189 nlmsg_end(skb, nlh); 1190 return 0; 1191 } 1192 1193 if (nla_put_be32(skb, NFTA_TABLE_FLAGS, 1194 htonl(table->flags & NFT_TABLE_F_MASK))) 1195 goto nla_put_failure; 1196 1197 if (nft_table_has_owner(table) && 1198 nla_put_be32(skb, NFTA_TABLE_OWNER, htonl(table->nlpid))) 1199 goto nla_put_failure; 1200 1201 if (table->udata) { 1202 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata)) 1203 goto nla_put_failure; 1204 } 1205 1206 nlmsg_end(skb, nlh); 1207 return 0; 1208 1209 nla_put_failure: 1210 nlmsg_trim(skb, nlh); 1211 return -1; 1212 } 1213 1214 struct nftnl_skb_parms { 1215 bool report; 1216 }; 1217 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb)) 1218 1219 static void nft_notify_enqueue(struct sk_buff *skb, bool report, 1220 struct list_head *notify_list) 1221 { 1222 NFT_CB(skb).report = report; 1223 list_add_tail(&skb->list, notify_list); 1224 } 1225 1226 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) 1227 { 1228 struct nftables_pernet *nft_net; 1229 struct sk_buff *skb; 1230 u16 flags = 0; 1231 int err; 1232 1233 if (!ctx->report && 1234 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 1235 return; 1236 1237 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 1238 if (skb == NULL) 1239 goto err; 1240 1241 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 1242 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 1243 1244 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, 1245 event, flags, ctx->family, ctx->table); 1246 if (err < 0) { 1247 kfree_skb(skb); 1248 goto err; 1249 } 1250 1251 nft_net = nft_pernet(ctx->net); 1252 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 1253 return; 1254 err: 1255 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 1256 } 1257 1258 static int nf_tables_dump_tables(struct sk_buff *skb, 1259 struct netlink_callback *cb) 1260 { 1261 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1262 struct nftables_pernet *nft_net; 1263 const struct nft_table *table; 1264 unsigned int idx = 0, s_idx = cb->args[0]; 1265 struct net *net = sock_net(skb->sk); 1266 int family = nfmsg->nfgen_family; 1267 1268 rcu_read_lock(); 1269 nft_net = nft_pernet(net); 1270 cb->seq = nft_base_seq(net); 1271 1272 list_for_each_entry_rcu(table, &nft_net->tables, list) { 1273 if (family != NFPROTO_UNSPEC && family != table->family) 1274 continue; 1275 1276 if (idx < s_idx) 1277 goto cont; 1278 if (idx > s_idx) 1279 memset(&cb->args[1], 0, 1280 sizeof(cb->args) - sizeof(cb->args[0])); 1281 if (!nft_is_active(net, table)) 1282 continue; 1283 if (nf_tables_fill_table_info(skb, net, 1284 NETLINK_CB(cb->skb).portid, 1285 cb->nlh->nlmsg_seq, 1286 NFT_MSG_NEWTABLE, NLM_F_MULTI, 1287 table->family, table) < 0) 1288 goto done; 1289 1290 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 1291 cont: 1292 idx++; 1293 } 1294 done: 1295 rcu_read_unlock(); 1296 cb->args[0] = idx; 1297 return skb->len; 1298 } 1299 1300 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb, 1301 const struct nlmsghdr *nlh, 1302 struct netlink_dump_control *c) 1303 { 1304 int err; 1305 1306 if (!try_module_get(THIS_MODULE)) 1307 return -EINVAL; 1308 1309 rcu_read_unlock(); 1310 err = netlink_dump_start(nlsk, skb, nlh, c); 1311 rcu_read_lock(); 1312 module_put(THIS_MODULE); 1313 1314 return err; 1315 } 1316 1317 /* called with rcu_read_lock held */ 1318 static int nf_tables_gettable(struct sk_buff *skb, const struct nfnl_info *info, 1319 const struct nlattr * const nla[]) 1320 { 1321 struct netlink_ext_ack *extack = info->extack; 1322 u8 genmask = nft_genmask_cur(info->net); 1323 u8 family = info->nfmsg->nfgen_family; 1324 const struct nft_table *table; 1325 struct net *net = info->net; 1326 struct sk_buff *skb2; 1327 int err; 1328 1329 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1330 struct netlink_dump_control c = { 1331 .dump = nf_tables_dump_tables, 1332 .module = THIS_MODULE, 1333 }; 1334 1335 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 1336 } 1337 1338 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask, 0); 1339 if (IS_ERR(table)) { 1340 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]); 1341 return PTR_ERR(table); 1342 } 1343 1344 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 1345 if (!skb2) 1346 return -ENOMEM; 1347 1348 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid, 1349 info->nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 1350 0, family, table); 1351 if (err < 0) 1352 goto err_fill_table_info; 1353 1354 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 1355 1356 err_fill_table_info: 1357 kfree_skb(skb2); 1358 return err; 1359 } 1360 1361 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt) 1362 { 1363 struct nft_chain *chain; 1364 u32 i = 0; 1365 1366 list_for_each_entry(chain, &table->chains, list) { 1367 if (!nft_is_active_next(net, chain)) 1368 continue; 1369 if (!nft_is_base_chain(chain)) 1370 continue; 1371 1372 if (cnt && i++ == cnt) 1373 break; 1374 1375 nf_tables_unregister_hook(net, table, chain); 1376 } 1377 } 1378 1379 static int nf_tables_table_enable(struct net *net, struct nft_table *table) 1380 { 1381 struct nft_chain *chain; 1382 int err, i = 0; 1383 1384 list_for_each_entry(chain, &table->chains, list) { 1385 if (!nft_is_active_next(net, chain)) 1386 continue; 1387 if (!nft_is_base_chain(chain)) 1388 continue; 1389 1390 err = nf_tables_register_hook(net, table, chain); 1391 if (err < 0) 1392 goto err_register_hooks; 1393 1394 i++; 1395 } 1396 return 0; 1397 1398 err_register_hooks: 1399 if (i) 1400 nft_table_disable(net, table, i); 1401 return err; 1402 } 1403 1404 static void nf_tables_table_disable(struct net *net, struct nft_table *table) 1405 { 1406 table->flags &= ~NFT_TABLE_F_DORMANT; 1407 nft_table_disable(net, table, 0); 1408 table->flags |= NFT_TABLE_F_DORMANT; 1409 } 1410 1411 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1) 1412 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0) 1413 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1) 1414 #define __NFT_TABLE_F_WAS_ORPHAN (__NFT_TABLE_F_INTERNAL << 2) 1415 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ 1416 __NFT_TABLE_F_WAS_AWAKEN | \ 1417 __NFT_TABLE_F_WAS_ORPHAN) 1418 1419 static bool nft_table_pending_update(const struct nft_ctx *ctx) 1420 { 1421 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1422 struct nft_trans *trans; 1423 1424 if (ctx->table->flags & __NFT_TABLE_F_UPDATE) 1425 return true; 1426 1427 list_for_each_entry(trans, &nft_net->commit_list, list) { 1428 if (trans->table == ctx->table && 1429 ((trans->msg_type == NFT_MSG_NEWCHAIN && 1430 nft_trans_chain_update(trans)) || 1431 (trans->msg_type == NFT_MSG_DELCHAIN && 1432 nft_is_base_chain(nft_trans_chain(trans))))) 1433 return true; 1434 } 1435 1436 return false; 1437 } 1438 1439 static int nf_tables_updtable(struct nft_ctx *ctx) 1440 { 1441 struct nft_trans *trans; 1442 u32 flags; 1443 int ret; 1444 1445 if (!ctx->nla[NFTA_TABLE_FLAGS]) 1446 return 0; 1447 1448 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS])); 1449 if (flags & ~NFT_TABLE_F_MASK) 1450 return -EOPNOTSUPP; 1451 1452 if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) 1453 return 0; 1454 1455 if ((nft_table_has_owner(ctx->table) && 1456 !(flags & NFT_TABLE_F_OWNER)) || 1457 (flags & NFT_TABLE_F_OWNER && 1458 !nft_table_is_orphan(ctx->table))) 1459 return -EOPNOTSUPP; 1460 1461 if ((flags ^ ctx->table->flags) & NFT_TABLE_F_PERSIST) 1462 return -EOPNOTSUPP; 1463 1464 /* No dormant off/on/off/on games in single transaction */ 1465 if (nft_table_pending_update(ctx)) 1466 return -EINVAL; 1467 1468 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, 1469 sizeof(struct nft_trans_table)); 1470 if (trans == NULL) 1471 return -ENOMEM; 1472 1473 if ((flags & NFT_TABLE_F_DORMANT) && 1474 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) { 1475 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1476 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) 1477 ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN; 1478 } else if (!(flags & NFT_TABLE_F_DORMANT) && 1479 ctx->table->flags & NFT_TABLE_F_DORMANT) { 1480 ctx->table->flags &= ~NFT_TABLE_F_DORMANT; 1481 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) { 1482 ret = nf_tables_table_enable(ctx->net, ctx->table); 1483 if (ret < 0) 1484 goto err_register_hooks; 1485 1486 ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT; 1487 } 1488 } 1489 1490 if ((flags & NFT_TABLE_F_OWNER) && 1491 !nft_table_has_owner(ctx->table)) { 1492 ctx->table->nlpid = ctx->portid; 1493 ctx->table->flags |= NFT_TABLE_F_OWNER | 1494 __NFT_TABLE_F_WAS_ORPHAN; 1495 } 1496 1497 nft_trans_table_update(trans) = true; 1498 nft_trans_commit_list_add_tail(ctx->net, trans); 1499 1500 return 0; 1501 1502 err_register_hooks: 1503 ctx->table->flags |= NFT_TABLE_F_DORMANT; 1504 nft_trans_destroy(trans); 1505 return ret; 1506 } 1507 1508 static u32 nft_chain_hash(const void *data, u32 len, u32 seed) 1509 { 1510 const char *name = data; 1511 1512 return jhash(name, strlen(name), seed); 1513 } 1514 1515 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed) 1516 { 1517 const struct nft_chain *chain = data; 1518 1519 return nft_chain_hash(chain->name, 0, seed); 1520 } 1521 1522 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg, 1523 const void *ptr) 1524 { 1525 const struct nft_chain *chain = ptr; 1526 const char *name = arg->key; 1527 1528 return strcmp(chain->name, name); 1529 } 1530 1531 static u32 nft_objname_hash(const void *data, u32 len, u32 seed) 1532 { 1533 const struct nft_object_hash_key *k = data; 1534 1535 seed ^= hash_ptr(k->table, 32); 1536 1537 return jhash(k->name, strlen(k->name), seed); 1538 } 1539 1540 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed) 1541 { 1542 const struct nft_object *obj = data; 1543 1544 return nft_objname_hash(&obj->key, 0, seed); 1545 } 1546 1547 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg, 1548 const void *ptr) 1549 { 1550 const struct nft_object_hash_key *k = arg->key; 1551 const struct nft_object *obj = ptr; 1552 1553 if (obj->key.table != k->table) 1554 return -1; 1555 1556 return strcmp(obj->key.name, k->name); 1557 } 1558 1559 static bool nft_supported_family(u8 family) 1560 { 1561 return false 1562 #ifdef CONFIG_NF_TABLES_INET 1563 || family == NFPROTO_INET 1564 #endif 1565 #ifdef CONFIG_NF_TABLES_IPV4 1566 || family == NFPROTO_IPV4 1567 #endif 1568 #ifdef CONFIG_NF_TABLES_ARP 1569 || family == NFPROTO_ARP 1570 #endif 1571 #ifdef CONFIG_NF_TABLES_NETDEV 1572 || family == NFPROTO_NETDEV 1573 #endif 1574 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE) 1575 || family == NFPROTO_BRIDGE 1576 #endif 1577 #ifdef CONFIG_NF_TABLES_IPV6 1578 || family == NFPROTO_IPV6 1579 #endif 1580 ; 1581 } 1582 1583 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, 1584 const struct nlattr * const nla[]) 1585 { 1586 struct nftables_pernet *nft_net = nft_pernet(info->net); 1587 struct netlink_ext_ack *extack = info->extack; 1588 u8 genmask = nft_genmask_next(info->net); 1589 u8 family = info->nfmsg->nfgen_family; 1590 struct net *net = info->net; 1591 const struct nlattr *attr; 1592 struct nft_table *table; 1593 struct nft_ctx ctx; 1594 u32 flags = 0; 1595 int err; 1596 1597 if (!nft_supported_family(family)) 1598 return -EOPNOTSUPP; 1599 1600 lockdep_assert_held(&nft_net->commit_mutex); 1601 attr = nla[NFTA_TABLE_NAME]; 1602 table = nft_table_lookup(net, attr, family, genmask, 1603 NETLINK_CB(skb).portid); 1604 if (IS_ERR(table)) { 1605 if (PTR_ERR(table) != -ENOENT) 1606 return PTR_ERR(table); 1607 } else { 1608 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 1609 NL_SET_BAD_ATTR(extack, attr); 1610 return -EEXIST; 1611 } 1612 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 1613 return -EOPNOTSUPP; 1614 1615 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1616 1617 return nf_tables_updtable(&ctx); 1618 } 1619 1620 if (nla[NFTA_TABLE_FLAGS]) { 1621 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS])); 1622 if (flags & ~NFT_TABLE_F_MASK) 1623 return -EOPNOTSUPP; 1624 } 1625 1626 err = -ENOMEM; 1627 table = kzalloc(sizeof(*table), GFP_KERNEL_ACCOUNT); 1628 if (table == NULL) 1629 goto err_kzalloc; 1630 1631 table->validate_state = nft_net->validate_state; 1632 table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); 1633 if (table->name == NULL) 1634 goto err_strdup; 1635 1636 if (nla[NFTA_TABLE_USERDATA]) { 1637 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL_ACCOUNT); 1638 if (table->udata == NULL) 1639 goto err_table_udata; 1640 1641 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]); 1642 } 1643 1644 err = rhltable_init(&table->chains_ht, &nft_chain_ht_params); 1645 if (err) 1646 goto err_chain_ht; 1647 1648 INIT_LIST_HEAD(&table->chains); 1649 INIT_LIST_HEAD(&table->sets); 1650 INIT_LIST_HEAD(&table->objects); 1651 INIT_LIST_HEAD(&table->flowtables); 1652 table->family = family; 1653 table->flags = flags; 1654 table->handle = ++nft_net->table_handle; 1655 if (table->flags & NFT_TABLE_F_OWNER) 1656 table->nlpid = NETLINK_CB(skb).portid; 1657 1658 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 1659 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE); 1660 if (err < 0) 1661 goto err_trans; 1662 1663 list_add_tail_rcu(&table->list, &nft_net->tables); 1664 return 0; 1665 err_trans: 1666 rhltable_destroy(&table->chains_ht); 1667 err_chain_ht: 1668 kfree(table->udata); 1669 err_table_udata: 1670 kfree(table->name); 1671 err_strdup: 1672 kfree(table); 1673 err_kzalloc: 1674 return err; 1675 } 1676 1677 static int nft_flush_table(struct nft_ctx *ctx) 1678 { 1679 struct nft_flowtable *flowtable, *nft; 1680 struct nft_chain *chain, *nc; 1681 struct nft_object *obj, *ne; 1682 struct nft_set *set, *ns; 1683 int err; 1684 1685 list_for_each_entry(chain, &ctx->table->chains, list) { 1686 if (!nft_is_active_next(ctx->net, chain)) 1687 continue; 1688 1689 if (nft_chain_binding(chain)) 1690 continue; 1691 1692 ctx->chain = chain; 1693 1694 err = nft_delrule_by_chain(ctx); 1695 if (err < 0) 1696 goto out; 1697 } 1698 1699 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) { 1700 if (!nft_is_active_next(ctx->net, set)) 1701 continue; 1702 1703 if (nft_set_is_anonymous(set)) 1704 continue; 1705 1706 err = nft_delset(ctx, set); 1707 if (err < 0) 1708 goto out; 1709 } 1710 1711 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) { 1712 if (!nft_is_active_next(ctx->net, flowtable)) 1713 continue; 1714 1715 err = nft_delflowtable(ctx, flowtable); 1716 if (err < 0) 1717 goto out; 1718 } 1719 1720 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) { 1721 if (!nft_is_active_next(ctx->net, obj)) 1722 continue; 1723 1724 err = nft_delobj(ctx, obj); 1725 if (err < 0) 1726 goto out; 1727 } 1728 1729 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) { 1730 if (!nft_is_active_next(ctx->net, chain)) 1731 continue; 1732 1733 if (nft_chain_binding(chain)) 1734 continue; 1735 1736 ctx->chain = chain; 1737 1738 err = nft_delchain(ctx); 1739 if (err < 0) 1740 goto out; 1741 } 1742 1743 err = nft_deltable(ctx); 1744 out: 1745 return err; 1746 } 1747 1748 static int nft_flush(struct nft_ctx *ctx, int family) 1749 { 1750 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 1751 const struct nlattr * const *nla = ctx->nla; 1752 struct nft_table *table, *nt; 1753 int err = 0; 1754 1755 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 1756 if (family != AF_UNSPEC && table->family != family) 1757 continue; 1758 1759 ctx->family = table->family; 1760 1761 if (!nft_is_active_next(ctx->net, table)) 1762 continue; 1763 1764 if (nft_table_has_owner(table) && table->nlpid != ctx->portid) 1765 continue; 1766 1767 if (nla[NFTA_TABLE_NAME] && 1768 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0) 1769 continue; 1770 1771 ctx->table = table; 1772 1773 err = nft_flush_table(ctx); 1774 if (err < 0) 1775 goto out; 1776 } 1777 out: 1778 return err; 1779 } 1780 1781 static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info, 1782 const struct nlattr * const nla[]) 1783 { 1784 struct netlink_ext_ack *extack = info->extack; 1785 u8 genmask = nft_genmask_next(info->net); 1786 u8 family = info->nfmsg->nfgen_family; 1787 struct net *net = info->net; 1788 const struct nlattr *attr; 1789 struct nft_table *table; 1790 struct nft_ctx ctx; 1791 1792 nft_ctx_init(&ctx, net, skb, info->nlh, 0, NULL, NULL, nla); 1793 if (family == AF_UNSPEC || 1794 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE])) 1795 return nft_flush(&ctx, family); 1796 1797 if (nla[NFTA_TABLE_HANDLE]) { 1798 attr = nla[NFTA_TABLE_HANDLE]; 1799 table = nft_table_lookup_byhandle(net, attr, family, genmask, 1800 NETLINK_CB(skb).portid); 1801 } else { 1802 attr = nla[NFTA_TABLE_NAME]; 1803 table = nft_table_lookup(net, attr, family, genmask, 1804 NETLINK_CB(skb).portid); 1805 } 1806 1807 if (IS_ERR(table)) { 1808 if (PTR_ERR(table) == -ENOENT && 1809 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYTABLE) 1810 return 0; 1811 1812 NL_SET_BAD_ATTR(extack, attr); 1813 return PTR_ERR(table); 1814 } 1815 1816 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 1817 table->use > 0) 1818 return -EBUSY; 1819 1820 ctx.family = family; 1821 ctx.table = table; 1822 1823 return nft_flush_table(&ctx); 1824 } 1825 1826 static void nf_tables_table_destroy(struct nft_table *table) 1827 { 1828 if (WARN_ON(table->use > 0)) 1829 return; 1830 1831 rhltable_destroy(&table->chains_ht); 1832 kfree(table->name); 1833 kfree(table->udata); 1834 kfree(table); 1835 } 1836 1837 void nft_register_chain_type(const struct nft_chain_type *ctype) 1838 { 1839 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1840 if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) { 1841 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1842 return; 1843 } 1844 chain_type[ctype->family][ctype->type] = ctype; 1845 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1846 } 1847 EXPORT_SYMBOL_GPL(nft_register_chain_type); 1848 1849 void nft_unregister_chain_type(const struct nft_chain_type *ctype) 1850 { 1851 nfnl_lock(NFNL_SUBSYS_NFTABLES); 1852 chain_type[ctype->family][ctype->type] = NULL; 1853 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 1854 } 1855 EXPORT_SYMBOL_GPL(nft_unregister_chain_type); 1856 1857 /* 1858 * Chains 1859 */ 1860 1861 static struct nft_chain * 1862 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask) 1863 { 1864 struct nft_chain *chain; 1865 1866 list_for_each_entry(chain, &table->chains, list) { 1867 if (chain->handle == handle && 1868 nft_active_genmask(chain, genmask)) 1869 return chain; 1870 } 1871 1872 return ERR_PTR(-ENOENT); 1873 } 1874 1875 static bool lockdep_commit_lock_is_held(const struct net *net) 1876 { 1877 #ifdef CONFIG_PROVE_LOCKING 1878 struct nftables_pernet *nft_net = nft_pernet(net); 1879 1880 return lockdep_is_held(&nft_net->commit_mutex); 1881 #else 1882 return true; 1883 #endif 1884 } 1885 1886 static struct nft_chain *nft_chain_lookup(struct net *net, 1887 struct nft_table *table, 1888 const struct nlattr *nla, u8 genmask) 1889 { 1890 char search[NFT_CHAIN_MAXNAMELEN + 1]; 1891 struct rhlist_head *tmp, *list; 1892 struct nft_chain *chain; 1893 1894 if (nla == NULL) 1895 return ERR_PTR(-EINVAL); 1896 1897 nla_strscpy(search, nla, sizeof(search)); 1898 1899 WARN_ON(!rcu_read_lock_held() && 1900 !lockdep_commit_lock_is_held(net)); 1901 1902 chain = ERR_PTR(-ENOENT); 1903 rcu_read_lock(); 1904 list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params); 1905 if (!list) 1906 goto out_unlock; 1907 1908 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 1909 if (nft_active_genmask(chain, genmask)) 1910 goto out_unlock; 1911 } 1912 chain = ERR_PTR(-ENOENT); 1913 out_unlock: 1914 rcu_read_unlock(); 1915 return chain; 1916 } 1917 1918 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 1919 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING, 1920 .len = NFT_TABLE_MAXNAMELEN - 1 }, 1921 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 }, 1922 [NFTA_CHAIN_NAME] = { .type = NLA_STRING, 1923 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 1924 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, 1925 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, 1926 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING, 1927 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 1928 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, 1929 [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 }, 1930 [NFTA_CHAIN_ID] = { .type = NLA_U32 }, 1931 [NFTA_CHAIN_USERDATA] = { .type = NLA_BINARY, 1932 .len = NFT_USERDATA_MAXLEN }, 1933 }; 1934 1935 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = { 1936 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 }, 1937 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 }, 1938 [NFTA_HOOK_DEV] = { .type = NLA_STRING, 1939 .len = IFNAMSIZ - 1 }, 1940 }; 1941 1942 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) 1943 { 1944 struct nft_stats *cpu_stats, total; 1945 struct nlattr *nest; 1946 unsigned int seq; 1947 u64 pkts, bytes; 1948 int cpu; 1949 1950 if (!stats) 1951 return 0; 1952 1953 memset(&total, 0, sizeof(total)); 1954 for_each_possible_cpu(cpu) { 1955 cpu_stats = per_cpu_ptr(stats, cpu); 1956 do { 1957 seq = u64_stats_fetch_begin(&cpu_stats->syncp); 1958 pkts = cpu_stats->pkts; 1959 bytes = cpu_stats->bytes; 1960 } while (u64_stats_fetch_retry(&cpu_stats->syncp, seq)); 1961 total.pkts += pkts; 1962 total.bytes += bytes; 1963 } 1964 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS); 1965 if (nest == NULL) 1966 goto nla_put_failure; 1967 1968 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts), 1969 NFTA_COUNTER_PAD) || 1970 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 1971 NFTA_COUNTER_PAD)) 1972 goto nla_put_failure; 1973 1974 nla_nest_end(skb, nest); 1975 return 0; 1976 1977 nla_put_failure: 1978 return -ENOSPC; 1979 } 1980 1981 static bool hook_is_prefix(struct nft_hook *hook) 1982 { 1983 return strlen(hook->ifname) >= hook->ifnamelen; 1984 } 1985 1986 static int nft_nla_put_hook_dev(struct sk_buff *skb, struct nft_hook *hook) 1987 { 1988 int attr = hook_is_prefix(hook) ? NFTA_DEVICE_PREFIX : NFTA_DEVICE_NAME; 1989 1990 return nla_put_string(skb, attr, hook->ifname); 1991 } 1992 1993 static int nft_dump_basechain_hook(struct sk_buff *skb, 1994 const struct net *net, int family, 1995 const struct nft_base_chain *basechain, 1996 const struct list_head *hook_list) 1997 { 1998 const struct nf_hook_ops *ops = &basechain->ops; 1999 struct nft_hook *hook, *first = NULL; 2000 struct nlattr *nest, *nest_devs; 2001 int n = 0; 2002 2003 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK); 2004 if (nest == NULL) 2005 goto nla_put_failure; 2006 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum))) 2007 goto nla_put_failure; 2008 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority))) 2009 goto nla_put_failure; 2010 2011 if (nft_base_chain_netdev(family, ops->hooknum)) { 2012 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS); 2013 if (!nest_devs) 2014 goto nla_put_failure; 2015 2016 if (!hook_list) 2017 hook_list = &basechain->hook_list; 2018 2019 list_for_each_entry_rcu(hook, hook_list, list, 2020 lockdep_commit_lock_is_held(net)) { 2021 if (!first) 2022 first = hook; 2023 2024 if (nft_nla_put_hook_dev(skb, hook)) 2025 goto nla_put_failure; 2026 n++; 2027 } 2028 nla_nest_end(skb, nest_devs); 2029 2030 if (n == 1 && 2031 !hook_is_prefix(first) && 2032 nla_put_string(skb, NFTA_HOOK_DEV, first->ifname)) 2033 goto nla_put_failure; 2034 } 2035 nla_nest_end(skb, nest); 2036 2037 return 0; 2038 nla_put_failure: 2039 return -1; 2040 } 2041 2042 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 2043 u32 portid, u32 seq, int event, u32 flags, 2044 int family, const struct nft_table *table, 2045 const struct nft_chain *chain, 2046 const struct list_head *hook_list) 2047 { 2048 struct nlmsghdr *nlh; 2049 2050 nlh = nfnl_msg_put(skb, portid, seq, 2051 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 2052 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 2053 if (!nlh) 2054 goto nla_put_failure; 2055 2056 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name) || 2057 nla_put_string(skb, NFTA_CHAIN_NAME, chain->name) || 2058 nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), 2059 NFTA_CHAIN_PAD)) 2060 goto nla_put_failure; 2061 2062 if (!hook_list && 2063 (event == NFT_MSG_DELCHAIN || 2064 event == NFT_MSG_DESTROYCHAIN)) { 2065 nlmsg_end(skb, nlh); 2066 return 0; 2067 } 2068 2069 if (nft_is_base_chain(chain)) { 2070 const struct nft_base_chain *basechain = nft_base_chain(chain); 2071 struct nft_stats __percpu *stats; 2072 2073 if (nft_dump_basechain_hook(skb, net, family, basechain, hook_list)) 2074 goto nla_put_failure; 2075 2076 if (nla_put_be32(skb, NFTA_CHAIN_POLICY, 2077 htonl(basechain->policy))) 2078 goto nla_put_failure; 2079 2080 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name)) 2081 goto nla_put_failure; 2082 2083 stats = rcu_dereference_check(basechain->stats, 2084 lockdep_commit_lock_is_held(net)); 2085 if (nft_dump_stats(skb, stats)) 2086 goto nla_put_failure; 2087 } 2088 2089 if (chain->flags && 2090 nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags))) 2091 goto nla_put_failure; 2092 2093 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use))) 2094 goto nla_put_failure; 2095 2096 if (chain->udata && 2097 nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata)) 2098 goto nla_put_failure; 2099 2100 nlmsg_end(skb, nlh); 2101 return 0; 2102 2103 nla_put_failure: 2104 nlmsg_trim(skb, nlh); 2105 return -1; 2106 } 2107 2108 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event, 2109 const struct list_head *hook_list) 2110 { 2111 struct nftables_pernet *nft_net; 2112 struct sk_buff *skb; 2113 u16 flags = 0; 2114 int err; 2115 2116 if (!ctx->report && 2117 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 2118 return; 2119 2120 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 2121 if (skb == NULL) 2122 goto err; 2123 2124 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 2125 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 2126 2127 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, 2128 event, flags, ctx->family, ctx->table, 2129 ctx->chain, hook_list); 2130 if (err < 0) { 2131 kfree_skb(skb); 2132 goto err; 2133 } 2134 2135 nft_net = nft_pernet(ctx->net); 2136 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 2137 return; 2138 err: 2139 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 2140 } 2141 2142 static int nf_tables_dump_chains(struct sk_buff *skb, 2143 struct netlink_callback *cb) 2144 { 2145 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 2146 unsigned int idx = 0, s_idx = cb->args[0]; 2147 struct net *net = sock_net(skb->sk); 2148 int family = nfmsg->nfgen_family; 2149 struct nftables_pernet *nft_net; 2150 const struct nft_table *table; 2151 const struct nft_chain *chain; 2152 2153 rcu_read_lock(); 2154 nft_net = nft_pernet(net); 2155 cb->seq = nft_base_seq(net); 2156 2157 list_for_each_entry_rcu(table, &nft_net->tables, list) { 2158 if (family != NFPROTO_UNSPEC && family != table->family) 2159 continue; 2160 2161 list_for_each_entry_rcu(chain, &table->chains, list) { 2162 if (idx < s_idx) 2163 goto cont; 2164 if (idx > s_idx) 2165 memset(&cb->args[1], 0, 2166 sizeof(cb->args) - sizeof(cb->args[0])); 2167 if (!nft_is_active(net, chain)) 2168 continue; 2169 if (nf_tables_fill_chain_info(skb, net, 2170 NETLINK_CB(cb->skb).portid, 2171 cb->nlh->nlmsg_seq, 2172 NFT_MSG_NEWCHAIN, 2173 NLM_F_MULTI, 2174 table->family, table, 2175 chain, NULL) < 0) 2176 goto done; 2177 2178 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 2179 cont: 2180 idx++; 2181 } 2182 } 2183 done: 2184 rcu_read_unlock(); 2185 cb->args[0] = idx; 2186 return skb->len; 2187 } 2188 2189 /* called with rcu_read_lock held */ 2190 static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info, 2191 const struct nlattr * const nla[]) 2192 { 2193 struct netlink_ext_ack *extack = info->extack; 2194 u8 genmask = nft_genmask_cur(info->net); 2195 u8 family = info->nfmsg->nfgen_family; 2196 const struct nft_chain *chain; 2197 struct net *net = info->net; 2198 struct nft_table *table; 2199 struct sk_buff *skb2; 2200 int err; 2201 2202 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 2203 struct netlink_dump_control c = { 2204 .dump = nf_tables_dump_chains, 2205 .module = THIS_MODULE, 2206 }; 2207 2208 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 2209 } 2210 2211 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 0); 2212 if (IS_ERR(table)) { 2213 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 2214 return PTR_ERR(table); 2215 } 2216 2217 chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask); 2218 if (IS_ERR(chain)) { 2219 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2220 return PTR_ERR(chain); 2221 } 2222 2223 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 2224 if (!skb2) 2225 return -ENOMEM; 2226 2227 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid, 2228 info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 2229 0, family, table, chain, NULL); 2230 if (err < 0) 2231 goto err_fill_chain_info; 2232 2233 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 2234 2235 err_fill_chain_info: 2236 kfree_skb(skb2); 2237 return err; 2238 } 2239 2240 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 2241 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 2242 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 2243 }; 2244 2245 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr) 2246 { 2247 struct nlattr *tb[NFTA_COUNTER_MAX+1]; 2248 struct nft_stats __percpu *newstats; 2249 struct nft_stats *stats; 2250 int err; 2251 2252 err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr, 2253 nft_counter_policy, NULL); 2254 if (err < 0) 2255 return ERR_PTR_PCPU(err); 2256 2257 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS]) 2258 return ERR_PTR_PCPU(-EINVAL); 2259 2260 newstats = netdev_alloc_pcpu_stats(struct nft_stats); 2261 if (newstats == NULL) 2262 return ERR_PTR_PCPU(-ENOMEM); 2263 2264 /* Restore old counters on this cpu, no problem. Per-cpu statistics 2265 * are not exposed to userspace. 2266 */ 2267 preempt_disable(); 2268 stats = this_cpu_ptr(newstats); 2269 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 2270 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 2271 preempt_enable(); 2272 2273 return newstats; 2274 } 2275 2276 static void nft_chain_stats_replace(struct nft_trans_chain *trans) 2277 { 2278 const struct nft_trans *t = &trans->nft_trans_binding.nft_trans; 2279 struct nft_base_chain *chain = nft_base_chain(trans->chain); 2280 2281 if (!trans->stats) 2282 return; 2283 2284 trans->stats = 2285 rcu_replace_pointer(chain->stats, trans->stats, 2286 lockdep_commit_lock_is_held(t->net)); 2287 2288 if (!trans->stats) 2289 static_branch_inc(&nft_counters_enabled); 2290 } 2291 2292 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) 2293 { 2294 struct nft_rule_blob *g0 = rcu_dereference_raw(chain->blob_gen_0); 2295 struct nft_rule_blob *g1 = rcu_dereference_raw(chain->blob_gen_1); 2296 2297 if (g0 != g1) 2298 kvfree(g1); 2299 kvfree(g0); 2300 2301 /* should be NULL either via abort or via successful commit */ 2302 WARN_ON_ONCE(chain->blob_next); 2303 kvfree(chain->blob_next); 2304 } 2305 2306 void nf_tables_chain_destroy(struct nft_chain *chain) 2307 { 2308 const struct nft_table *table = chain->table; 2309 struct nft_hook *hook, *next; 2310 2311 if (WARN_ON(chain->use > 0)) 2312 return; 2313 2314 /* no concurrent access possible anymore */ 2315 nf_tables_chain_free_chain_rules(chain); 2316 2317 if (nft_is_base_chain(chain)) { 2318 struct nft_base_chain *basechain = nft_base_chain(chain); 2319 2320 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { 2321 list_for_each_entry_safe(hook, next, 2322 &basechain->hook_list, list) { 2323 list_del_rcu(&hook->list); 2324 nft_netdev_hook_free_rcu(hook); 2325 } 2326 } 2327 module_put(basechain->type->owner); 2328 if (rcu_access_pointer(basechain->stats)) { 2329 static_branch_dec(&nft_counters_enabled); 2330 free_percpu(rcu_dereference_raw(basechain->stats)); 2331 } 2332 kfree(chain->name); 2333 kfree(chain->udata); 2334 kfree(basechain); 2335 } else { 2336 kfree(chain->name); 2337 kfree(chain->udata); 2338 kfree(chain); 2339 } 2340 } 2341 2342 static struct nft_hook *nft_netdev_hook_alloc(struct net *net, 2343 const struct nlattr *attr, 2344 bool prefix) 2345 { 2346 struct nf_hook_ops *ops; 2347 struct net_device *dev; 2348 struct nft_hook *hook; 2349 int err; 2350 2351 hook = kzalloc(sizeof(struct nft_hook), GFP_KERNEL_ACCOUNT); 2352 if (!hook) 2353 return ERR_PTR(-ENOMEM); 2354 2355 INIT_LIST_HEAD(&hook->ops_list); 2356 2357 err = nla_strscpy(hook->ifname, attr, IFNAMSIZ); 2358 if (err < 0) 2359 goto err_hook_free; 2360 2361 /* include the terminating NUL-char when comparing non-prefixes */ 2362 hook->ifnamelen = strlen(hook->ifname) + !prefix; 2363 2364 /* nf_tables_netdev_event() is called under rtnl_mutex, this is 2365 * indirectly serializing all the other holders of the commit_mutex with 2366 * the rtnl_mutex. 2367 */ 2368 for_each_netdev(net, dev) { 2369 if (strncmp(dev->name, hook->ifname, hook->ifnamelen)) 2370 continue; 2371 2372 ops = kzalloc(sizeof(struct nf_hook_ops), GFP_KERNEL_ACCOUNT); 2373 if (!ops) { 2374 err = -ENOMEM; 2375 goto err_hook_free; 2376 } 2377 ops->dev = dev; 2378 list_add_tail(&ops->list, &hook->ops_list); 2379 } 2380 return hook; 2381 2382 err_hook_free: 2383 nft_netdev_hook_free(hook); 2384 return ERR_PTR(err); 2385 } 2386 2387 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, 2388 const struct nft_hook *this) 2389 { 2390 struct nft_hook *hook; 2391 2392 list_for_each_entry(hook, hook_list, list) { 2393 if (!strncmp(hook->ifname, this->ifname, 2394 min(hook->ifnamelen, this->ifnamelen))) 2395 return hook; 2396 } 2397 2398 return NULL; 2399 } 2400 2401 static int nf_tables_parse_netdev_hooks(struct net *net, 2402 const struct nlattr *attr, 2403 struct list_head *hook_list, 2404 struct netlink_ext_ack *extack) 2405 { 2406 struct nft_hook *hook, *next; 2407 const struct nlattr *tmp; 2408 int rem, n = 0, err; 2409 bool prefix; 2410 2411 nla_for_each_nested(tmp, attr, rem) { 2412 switch (nla_type(tmp)) { 2413 case NFTA_DEVICE_NAME: 2414 prefix = false; 2415 break; 2416 case NFTA_DEVICE_PREFIX: 2417 prefix = true; 2418 break; 2419 default: 2420 err = -EINVAL; 2421 goto err_hook; 2422 } 2423 2424 hook = nft_netdev_hook_alloc(net, tmp, prefix); 2425 if (IS_ERR(hook)) { 2426 NL_SET_BAD_ATTR(extack, tmp); 2427 err = PTR_ERR(hook); 2428 goto err_hook; 2429 } 2430 if (nft_hook_list_find(hook_list, hook)) { 2431 NL_SET_BAD_ATTR(extack, tmp); 2432 nft_netdev_hook_free(hook); 2433 err = -EEXIST; 2434 goto err_hook; 2435 } 2436 list_add_tail(&hook->list, hook_list); 2437 n++; 2438 2439 if (n == NFT_NETDEVICE_MAX) { 2440 err = -EFBIG; 2441 goto err_hook; 2442 } 2443 } 2444 2445 return 0; 2446 2447 err_hook: 2448 list_for_each_entry_safe(hook, next, hook_list, list) { 2449 list_del(&hook->list); 2450 nft_netdev_hook_free(hook); 2451 } 2452 return err; 2453 } 2454 2455 struct nft_chain_hook { 2456 u32 num; 2457 s32 priority; 2458 const struct nft_chain_type *type; 2459 struct list_head list; 2460 }; 2461 2462 static int nft_chain_parse_netdev(struct net *net, struct nlattr *tb[], 2463 struct list_head *hook_list, 2464 struct netlink_ext_ack *extack, u32 flags) 2465 { 2466 struct nft_hook *hook; 2467 int err; 2468 2469 if (tb[NFTA_HOOK_DEV]) { 2470 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV], false); 2471 if (IS_ERR(hook)) { 2472 NL_SET_BAD_ATTR(extack, tb[NFTA_HOOK_DEV]); 2473 return PTR_ERR(hook); 2474 } 2475 2476 list_add_tail(&hook->list, hook_list); 2477 } else if (tb[NFTA_HOOK_DEVS]) { 2478 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS], 2479 hook_list, extack); 2480 if (err < 0) 2481 return err; 2482 2483 } 2484 2485 if (flags & NFT_CHAIN_HW_OFFLOAD && 2486 list_empty(hook_list)) 2487 return -EINVAL; 2488 2489 return 0; 2490 } 2491 2492 static int nft_chain_parse_hook(struct net *net, 2493 struct nft_base_chain *basechain, 2494 const struct nlattr * const nla[], 2495 struct nft_chain_hook *hook, u8 family, 2496 u32 flags, struct netlink_ext_ack *extack) 2497 { 2498 struct nftables_pernet *nft_net = nft_pernet(net); 2499 struct nlattr *ha[NFTA_HOOK_MAX + 1]; 2500 const struct nft_chain_type *type; 2501 int err; 2502 2503 lockdep_assert_held(&nft_net->commit_mutex); 2504 lockdep_nfnl_nft_mutex_not_held(); 2505 2506 err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX, 2507 nla[NFTA_CHAIN_HOOK], 2508 nft_hook_policy, NULL); 2509 if (err < 0) 2510 return err; 2511 2512 if (!basechain) { 2513 if (!ha[NFTA_HOOK_HOOKNUM] || 2514 !ha[NFTA_HOOK_PRIORITY]) { 2515 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2516 return -ENOENT; 2517 } 2518 2519 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2520 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2521 2522 type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT); 2523 if (!type) 2524 return -EOPNOTSUPP; 2525 2526 if (nla[NFTA_CHAIN_TYPE]) { 2527 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE], 2528 family, true); 2529 if (IS_ERR(type)) { 2530 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2531 return PTR_ERR(type); 2532 } 2533 } 2534 if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num))) 2535 return -EOPNOTSUPP; 2536 2537 if (type->type == NFT_CHAIN_T_NAT && 2538 hook->priority <= NF_IP_PRI_CONNTRACK) 2539 return -EOPNOTSUPP; 2540 } else { 2541 if (ha[NFTA_HOOK_HOOKNUM]) { 2542 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM])); 2543 if (hook->num != basechain->ops.hooknum) 2544 return -EOPNOTSUPP; 2545 } 2546 if (ha[NFTA_HOOK_PRIORITY]) { 2547 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY])); 2548 if (hook->priority != basechain->ops.priority) 2549 return -EOPNOTSUPP; 2550 } 2551 2552 if (nla[NFTA_CHAIN_TYPE]) { 2553 type = __nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE], 2554 family); 2555 if (!type) { 2556 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2557 return -ENOENT; 2558 } 2559 } else { 2560 type = basechain->type; 2561 } 2562 } 2563 2564 if (!try_module_get(type->owner)) { 2565 if (nla[NFTA_CHAIN_TYPE]) 2566 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]); 2567 return -ENOENT; 2568 } 2569 2570 hook->type = type; 2571 2572 INIT_LIST_HEAD(&hook->list); 2573 if (nft_base_chain_netdev(family, hook->num)) { 2574 err = nft_chain_parse_netdev(net, ha, &hook->list, extack, flags); 2575 if (err < 0) { 2576 module_put(type->owner); 2577 return err; 2578 } 2579 } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) { 2580 module_put(type->owner); 2581 return -EOPNOTSUPP; 2582 } 2583 2584 return 0; 2585 } 2586 2587 static void nft_chain_release_hook(struct nft_chain_hook *hook) 2588 { 2589 struct nft_hook *h, *next; 2590 2591 list_for_each_entry_safe(h, next, &hook->list, list) { 2592 list_del(&h->list); 2593 nft_netdev_hook_free(h); 2594 } 2595 module_put(hook->type->owner); 2596 } 2597 2598 static void nft_last_rule(const struct nft_chain *chain, const void *ptr) 2599 { 2600 struct nft_rule_dp_last *lrule; 2601 2602 BUILD_BUG_ON(offsetof(struct nft_rule_dp_last, end) != 0); 2603 2604 lrule = (struct nft_rule_dp_last *)ptr; 2605 lrule->end.is_last = 1; 2606 lrule->chain = chain; 2607 /* blob size does not include the trailer rule */ 2608 } 2609 2610 static struct nft_rule_blob *nf_tables_chain_alloc_rules(const struct nft_chain *chain, 2611 unsigned int size) 2612 { 2613 struct nft_rule_blob *blob; 2614 2615 if (size > INT_MAX) 2616 return NULL; 2617 2618 size += sizeof(struct nft_rule_blob) + sizeof(struct nft_rule_dp_last); 2619 2620 blob = kvmalloc(size, GFP_KERNEL_ACCOUNT); 2621 if (!blob) 2622 return NULL; 2623 2624 blob->size = 0; 2625 nft_last_rule(chain, blob->data); 2626 2627 return blob; 2628 } 2629 2630 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family, 2631 const struct nft_chain_hook *hook, 2632 struct nft_chain *chain) 2633 { 2634 ops->pf = family; 2635 ops->hooknum = hook->num; 2636 ops->priority = hook->priority; 2637 ops->priv = chain; 2638 ops->hook = hook->type->hooks[ops->hooknum]; 2639 ops->hook_ops_type = NF_HOOK_OP_NF_TABLES; 2640 } 2641 2642 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, 2643 struct nft_chain_hook *hook, u32 flags) 2644 { 2645 struct nft_chain *chain; 2646 struct nf_hook_ops *ops; 2647 struct nft_hook *h; 2648 2649 basechain->type = hook->type; 2650 INIT_LIST_HEAD(&basechain->hook_list); 2651 chain = &basechain->chain; 2652 2653 if (nft_base_chain_netdev(family, hook->num)) { 2654 list_splice_init(&hook->list, &basechain->hook_list); 2655 list_for_each_entry(h, &basechain->hook_list, list) { 2656 list_for_each_entry(ops, &h->ops_list, list) 2657 nft_basechain_hook_init(ops, family, hook, chain); 2658 } 2659 } 2660 nft_basechain_hook_init(&basechain->ops, family, hook, chain); 2661 2662 chain->flags |= NFT_CHAIN_BASE | flags; 2663 basechain->policy = NF_ACCEPT; 2664 if (chain->flags & NFT_CHAIN_HW_OFFLOAD && 2665 !nft_chain_offload_support(basechain)) { 2666 list_splice_init(&basechain->hook_list, &hook->list); 2667 return -EOPNOTSUPP; 2668 } 2669 2670 flow_block_init(&basechain->flow_block); 2671 2672 return 0; 2673 } 2674 2675 int nft_chain_add(struct nft_table *table, struct nft_chain *chain) 2676 { 2677 int err; 2678 2679 err = rhltable_insert_key(&table->chains_ht, chain->name, 2680 &chain->rhlhead, nft_chain_ht_params); 2681 if (err) 2682 return err; 2683 2684 list_add_tail_rcu(&chain->list, &table->chains); 2685 2686 return 0; 2687 } 2688 2689 static u64 chain_id; 2690 2691 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 policy, 2692 u32 flags, struct netlink_ext_ack *extack) 2693 { 2694 const struct nlattr * const *nla = ctx->nla; 2695 struct nft_table *table = ctx->table; 2696 struct nft_base_chain *basechain; 2697 struct net *net = ctx->net; 2698 char name[NFT_NAME_MAXLEN]; 2699 struct nft_rule_blob *blob; 2700 struct nft_trans *trans; 2701 struct nft_chain *chain; 2702 int err; 2703 2704 if (nla[NFTA_CHAIN_HOOK]) { 2705 struct nft_stats __percpu *stats = NULL; 2706 struct nft_chain_hook hook = {}; 2707 2708 if (table->flags & __NFT_TABLE_F_UPDATE) 2709 return -EINVAL; 2710 2711 if (flags & NFT_CHAIN_BINDING) 2712 return -EOPNOTSUPP; 2713 2714 err = nft_chain_parse_hook(net, NULL, nla, &hook, family, flags, 2715 extack); 2716 if (err < 0) 2717 return err; 2718 2719 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL_ACCOUNT); 2720 if (basechain == NULL) { 2721 nft_chain_release_hook(&hook); 2722 return -ENOMEM; 2723 } 2724 chain = &basechain->chain; 2725 2726 if (nla[NFTA_CHAIN_COUNTERS]) { 2727 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2728 if (IS_ERR_PCPU(stats)) { 2729 nft_chain_release_hook(&hook); 2730 kfree(basechain); 2731 return PTR_ERR_PCPU(stats); 2732 } 2733 rcu_assign_pointer(basechain->stats, stats); 2734 } 2735 2736 err = nft_basechain_init(basechain, family, &hook, flags); 2737 if (err < 0) { 2738 nft_chain_release_hook(&hook); 2739 kfree(basechain); 2740 free_percpu(stats); 2741 return err; 2742 } 2743 if (stats) 2744 static_branch_inc(&nft_counters_enabled); 2745 } else { 2746 if (flags & NFT_CHAIN_BASE) 2747 return -EINVAL; 2748 if (flags & NFT_CHAIN_HW_OFFLOAD) 2749 return -EOPNOTSUPP; 2750 2751 chain = kzalloc(sizeof(*chain), GFP_KERNEL_ACCOUNT); 2752 if (chain == NULL) 2753 return -ENOMEM; 2754 2755 chain->flags = flags; 2756 } 2757 ctx->chain = chain; 2758 2759 INIT_LIST_HEAD(&chain->rules); 2760 chain->handle = nf_tables_alloc_handle(table); 2761 chain->table = table; 2762 2763 if (nla[NFTA_CHAIN_NAME]) { 2764 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2765 } else { 2766 if (!(flags & NFT_CHAIN_BINDING)) { 2767 err = -EINVAL; 2768 goto err_destroy_chain; 2769 } 2770 2771 snprintf(name, sizeof(name), "__chain%llu", ++chain_id); 2772 chain->name = kstrdup(name, GFP_KERNEL_ACCOUNT); 2773 } 2774 2775 if (!chain->name) { 2776 err = -ENOMEM; 2777 goto err_destroy_chain; 2778 } 2779 2780 if (nla[NFTA_CHAIN_USERDATA]) { 2781 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL_ACCOUNT); 2782 if (chain->udata == NULL) { 2783 err = -ENOMEM; 2784 goto err_destroy_chain; 2785 } 2786 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]); 2787 } 2788 2789 blob = nf_tables_chain_alloc_rules(chain, 0); 2790 if (!blob) { 2791 err = -ENOMEM; 2792 goto err_destroy_chain; 2793 } 2794 2795 RCU_INIT_POINTER(chain->blob_gen_0, blob); 2796 RCU_INIT_POINTER(chain->blob_gen_1, blob); 2797 2798 if (!nft_use_inc(&table->use)) { 2799 err = -EMFILE; 2800 goto err_destroy_chain; 2801 } 2802 2803 trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN); 2804 if (IS_ERR(trans)) { 2805 err = PTR_ERR(trans); 2806 goto err_trans; 2807 } 2808 2809 nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET; 2810 if (nft_is_base_chain(chain)) 2811 nft_trans_chain_policy(trans) = policy; 2812 2813 err = nft_chain_add(table, chain); 2814 if (err < 0) 2815 goto err_chain_add; 2816 2817 /* This must be LAST to ensure no packets are walking over this chain. */ 2818 err = nf_tables_register_hook(net, table, chain); 2819 if (err < 0) 2820 goto err_register_hook; 2821 2822 return 0; 2823 2824 err_register_hook: 2825 nft_chain_del(chain); 2826 err_chain_add: 2827 nft_trans_destroy(trans); 2828 err_trans: 2829 nft_use_dec_restore(&table->use); 2830 err_destroy_chain: 2831 nf_tables_chain_destroy(chain); 2832 2833 return err; 2834 } 2835 2836 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 2837 u32 flags, const struct nlattr *attr, 2838 struct netlink_ext_ack *extack) 2839 { 2840 const struct nlattr * const *nla = ctx->nla; 2841 struct nft_base_chain *basechain = NULL; 2842 struct nft_table *table = ctx->table; 2843 struct nft_chain *chain = ctx->chain; 2844 struct nft_chain_hook hook = {}; 2845 struct nft_stats __percpu *stats = NULL; 2846 struct nftables_pernet *nft_net; 2847 struct nft_hook *h, *next; 2848 struct nf_hook_ops *ops; 2849 struct nft_trans *trans; 2850 bool unregister = false; 2851 int err; 2852 2853 if (chain->flags ^ flags) 2854 return -EOPNOTSUPP; 2855 2856 INIT_LIST_HEAD(&hook.list); 2857 2858 if (nla[NFTA_CHAIN_HOOK]) { 2859 if (!nft_is_base_chain(chain)) { 2860 NL_SET_BAD_ATTR(extack, attr); 2861 return -EEXIST; 2862 } 2863 2864 basechain = nft_base_chain(chain); 2865 err = nft_chain_parse_hook(ctx->net, basechain, nla, &hook, 2866 ctx->family, flags, extack); 2867 if (err < 0) 2868 return err; 2869 2870 if (basechain->type != hook.type) { 2871 nft_chain_release_hook(&hook); 2872 NL_SET_BAD_ATTR(extack, attr); 2873 return -EEXIST; 2874 } 2875 2876 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { 2877 list_for_each_entry_safe(h, next, &hook.list, list) { 2878 list_for_each_entry(ops, &h->ops_list, list) { 2879 ops->pf = basechain->ops.pf; 2880 ops->hooknum = basechain->ops.hooknum; 2881 ops->priority = basechain->ops.priority; 2882 ops->priv = basechain->ops.priv; 2883 ops->hook = basechain->ops.hook; 2884 } 2885 2886 if (nft_hook_list_find(&basechain->hook_list, h)) { 2887 list_del(&h->list); 2888 nft_netdev_hook_free(h); 2889 continue; 2890 } 2891 2892 nft_net = nft_pernet(ctx->net); 2893 list_for_each_entry(trans, &nft_net->commit_list, list) { 2894 if (trans->msg_type != NFT_MSG_NEWCHAIN || 2895 trans->table != ctx->table || 2896 !nft_trans_chain_update(trans)) 2897 continue; 2898 2899 if (nft_hook_list_find(&nft_trans_chain_hooks(trans), h)) { 2900 nft_chain_release_hook(&hook); 2901 return -EEXIST; 2902 } 2903 } 2904 } 2905 } else { 2906 ops = &basechain->ops; 2907 if (ops->hooknum != hook.num || 2908 ops->priority != hook.priority) { 2909 nft_chain_release_hook(&hook); 2910 NL_SET_BAD_ATTR(extack, attr); 2911 return -EEXIST; 2912 } 2913 } 2914 } 2915 2916 if (nla[NFTA_CHAIN_HANDLE] && 2917 nla[NFTA_CHAIN_NAME]) { 2918 struct nft_chain *chain2; 2919 2920 chain2 = nft_chain_lookup(ctx->net, table, 2921 nla[NFTA_CHAIN_NAME], genmask); 2922 if (!IS_ERR(chain2)) { 2923 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2924 err = -EEXIST; 2925 goto err_hooks; 2926 } 2927 } 2928 2929 if (table->flags & __NFT_TABLE_F_UPDATE && 2930 !list_empty(&hook.list)) { 2931 NL_SET_BAD_ATTR(extack, attr); 2932 err = -EOPNOTSUPP; 2933 goto err_hooks; 2934 } 2935 2936 if (!(table->flags & NFT_TABLE_F_DORMANT) && 2937 nft_is_base_chain(chain) && 2938 !list_empty(&hook.list)) { 2939 basechain = nft_base_chain(chain); 2940 ops = &basechain->ops; 2941 2942 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { 2943 err = nft_netdev_register_hooks(ctx->net, &hook.list); 2944 if (err < 0) 2945 goto err_hooks; 2946 2947 unregister = true; 2948 } 2949 } 2950 2951 if (nla[NFTA_CHAIN_COUNTERS]) { 2952 if (!nft_is_base_chain(chain)) { 2953 err = -EOPNOTSUPP; 2954 goto err_hooks; 2955 } 2956 2957 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); 2958 if (IS_ERR_PCPU(stats)) { 2959 err = PTR_ERR_PCPU(stats); 2960 goto err_hooks; 2961 } 2962 } 2963 2964 err = -ENOMEM; 2965 trans = nft_trans_alloc_chain(ctx, NFT_MSG_NEWCHAIN); 2966 if (trans == NULL) 2967 goto err_trans; 2968 2969 nft_trans_chain_stats(trans) = stats; 2970 nft_trans_chain_update(trans) = true; 2971 2972 if (nla[NFTA_CHAIN_POLICY]) 2973 nft_trans_chain_policy(trans) = policy; 2974 else 2975 nft_trans_chain_policy(trans) = -1; 2976 2977 if (nla[NFTA_CHAIN_HANDLE] && 2978 nla[NFTA_CHAIN_NAME]) { 2979 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 2980 struct nft_trans *tmp; 2981 char *name; 2982 2983 err = -ENOMEM; 2984 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL_ACCOUNT); 2985 if (!name) 2986 goto err_trans; 2987 2988 err = -EEXIST; 2989 list_for_each_entry(tmp, &nft_net->commit_list, list) { 2990 if (tmp->msg_type == NFT_MSG_NEWCHAIN && 2991 tmp->table == table && 2992 nft_trans_chain_update(tmp) && 2993 nft_trans_chain_name(tmp) && 2994 strcmp(name, nft_trans_chain_name(tmp)) == 0) { 2995 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]); 2996 kfree(name); 2997 goto err_trans; 2998 } 2999 } 3000 3001 nft_trans_chain_name(trans) = name; 3002 } 3003 3004 nft_trans_basechain(trans) = basechain; 3005 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 3006 list_splice(&hook.list, &nft_trans_chain_hooks(trans)); 3007 if (nla[NFTA_CHAIN_HOOK]) 3008 module_put(hook.type->owner); 3009 3010 nft_trans_commit_list_add_tail(ctx->net, trans); 3011 3012 return 0; 3013 3014 err_trans: 3015 free_percpu(stats); 3016 kfree(trans); 3017 err_hooks: 3018 if (nla[NFTA_CHAIN_HOOK]) { 3019 list_for_each_entry_safe(h, next, &hook.list, list) { 3020 if (unregister) { 3021 list_for_each_entry(ops, &h->ops_list, list) 3022 nf_unregister_net_hook(ctx->net, ops); 3023 } 3024 list_del(&h->list); 3025 nft_netdev_hook_free_rcu(h); 3026 } 3027 module_put(hook.type->owner); 3028 } 3029 3030 return err; 3031 } 3032 3033 static struct nft_chain *nft_chain_lookup_byid(const struct net *net, 3034 const struct nft_table *table, 3035 const struct nlattr *nla, u8 genmask) 3036 { 3037 struct nftables_pernet *nft_net = nft_pernet(net); 3038 u32 id = ntohl(nla_get_be32(nla)); 3039 struct nft_trans *trans; 3040 3041 list_for_each_entry(trans, &nft_net->commit_list, list) { 3042 if (trans->msg_type == NFT_MSG_NEWCHAIN && 3043 nft_trans_chain(trans)->table == table && 3044 id == nft_trans_chain_id(trans) && 3045 nft_active_genmask(nft_trans_chain(trans), genmask)) 3046 return nft_trans_chain(trans); 3047 } 3048 return ERR_PTR(-ENOENT); 3049 } 3050 3051 static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info, 3052 const struct nlattr * const nla[]) 3053 { 3054 struct nftables_pernet *nft_net = nft_pernet(info->net); 3055 struct netlink_ext_ack *extack = info->extack; 3056 u8 genmask = nft_genmask_next(info->net); 3057 u8 family = info->nfmsg->nfgen_family; 3058 struct nft_chain *chain = NULL; 3059 struct net *net = info->net; 3060 const struct nlattr *attr; 3061 struct nft_table *table; 3062 u8 policy = NF_ACCEPT; 3063 struct nft_ctx ctx; 3064 u64 handle = 0; 3065 u32 flags = 0; 3066 3067 lockdep_assert_held(&nft_net->commit_mutex); 3068 3069 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 3070 NETLINK_CB(skb).portid); 3071 if (IS_ERR(table)) { 3072 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 3073 return PTR_ERR(table); 3074 } 3075 3076 chain = NULL; 3077 attr = nla[NFTA_CHAIN_NAME]; 3078 3079 if (nla[NFTA_CHAIN_HANDLE]) { 3080 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE])); 3081 chain = nft_chain_lookup_byhandle(table, handle, genmask); 3082 if (IS_ERR(chain)) { 3083 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]); 3084 return PTR_ERR(chain); 3085 } 3086 attr = nla[NFTA_CHAIN_HANDLE]; 3087 } else if (nla[NFTA_CHAIN_NAME]) { 3088 chain = nft_chain_lookup(net, table, attr, genmask); 3089 if (IS_ERR(chain)) { 3090 if (PTR_ERR(chain) != -ENOENT) { 3091 NL_SET_BAD_ATTR(extack, attr); 3092 return PTR_ERR(chain); 3093 } 3094 chain = NULL; 3095 } 3096 } else if (!nla[NFTA_CHAIN_ID]) { 3097 return -EINVAL; 3098 } 3099 3100 if (nla[NFTA_CHAIN_POLICY]) { 3101 if (chain != NULL && 3102 !nft_is_base_chain(chain)) { 3103 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 3104 return -EOPNOTSUPP; 3105 } 3106 3107 if (chain == NULL && 3108 nla[NFTA_CHAIN_HOOK] == NULL) { 3109 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]); 3110 return -EOPNOTSUPP; 3111 } 3112 3113 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY])); 3114 switch (policy) { 3115 case NF_DROP: 3116 case NF_ACCEPT: 3117 break; 3118 default: 3119 return -EINVAL; 3120 } 3121 } 3122 3123 if (nla[NFTA_CHAIN_FLAGS]) 3124 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS])); 3125 else if (chain) 3126 flags = chain->flags; 3127 3128 if (flags & ~NFT_CHAIN_FLAGS) 3129 return -EOPNOTSUPP; 3130 3131 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3132 3133 if (chain != NULL) { 3134 if (chain->flags & NFT_CHAIN_BINDING) 3135 return -EINVAL; 3136 3137 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 3138 NL_SET_BAD_ATTR(extack, attr); 3139 return -EEXIST; 3140 } 3141 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 3142 return -EOPNOTSUPP; 3143 3144 flags |= chain->flags & NFT_CHAIN_BASE; 3145 return nf_tables_updchain(&ctx, genmask, policy, flags, attr, 3146 extack); 3147 } 3148 3149 return nf_tables_addchain(&ctx, family, policy, flags, extack); 3150 } 3151 3152 static int nft_delchain_hook(struct nft_ctx *ctx, 3153 struct nft_base_chain *basechain, 3154 struct netlink_ext_ack *extack) 3155 { 3156 const struct nft_chain *chain = &basechain->chain; 3157 const struct nlattr * const *nla = ctx->nla; 3158 struct nft_chain_hook chain_hook = {}; 3159 struct nft_hook *this, *hook; 3160 LIST_HEAD(chain_del_list); 3161 struct nft_trans *trans; 3162 int err; 3163 3164 if (ctx->table->flags & __NFT_TABLE_F_UPDATE) 3165 return -EOPNOTSUPP; 3166 3167 err = nft_chain_parse_hook(ctx->net, basechain, nla, &chain_hook, 3168 ctx->family, chain->flags, extack); 3169 if (err < 0) 3170 return err; 3171 3172 list_for_each_entry(this, &chain_hook.list, list) { 3173 hook = nft_hook_list_find(&basechain->hook_list, this); 3174 if (!hook) { 3175 err = -ENOENT; 3176 goto err_chain_del_hook; 3177 } 3178 list_move(&hook->list, &chain_del_list); 3179 } 3180 3181 trans = nft_trans_alloc_chain(ctx, NFT_MSG_DELCHAIN); 3182 if (!trans) { 3183 err = -ENOMEM; 3184 goto err_chain_del_hook; 3185 } 3186 3187 nft_trans_basechain(trans) = basechain; 3188 nft_trans_chain_update(trans) = true; 3189 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans)); 3190 list_splice(&chain_del_list, &nft_trans_chain_hooks(trans)); 3191 nft_chain_release_hook(&chain_hook); 3192 3193 nft_trans_commit_list_add_tail(ctx->net, trans); 3194 3195 return 0; 3196 3197 err_chain_del_hook: 3198 list_splice(&chain_del_list, &basechain->hook_list); 3199 nft_chain_release_hook(&chain_hook); 3200 3201 return err; 3202 } 3203 3204 static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, 3205 const struct nlattr * const nla[]) 3206 { 3207 struct netlink_ext_ack *extack = info->extack; 3208 u8 genmask = nft_genmask_next(info->net); 3209 u8 family = info->nfmsg->nfgen_family; 3210 struct net *net = info->net; 3211 const struct nlattr *attr; 3212 struct nft_table *table; 3213 struct nft_chain *chain; 3214 struct nft_rule *rule; 3215 struct nft_ctx ctx; 3216 u64 handle; 3217 u32 use; 3218 int err; 3219 3220 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 3221 NETLINK_CB(skb).portid); 3222 if (IS_ERR(table)) { 3223 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]); 3224 return PTR_ERR(table); 3225 } 3226 3227 if (nla[NFTA_CHAIN_HANDLE]) { 3228 attr = nla[NFTA_CHAIN_HANDLE]; 3229 handle = be64_to_cpu(nla_get_be64(attr)); 3230 chain = nft_chain_lookup_byhandle(table, handle, genmask); 3231 } else { 3232 attr = nla[NFTA_CHAIN_NAME]; 3233 chain = nft_chain_lookup(net, table, attr, genmask); 3234 } 3235 if (IS_ERR(chain)) { 3236 if (PTR_ERR(chain) == -ENOENT && 3237 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN) 3238 return 0; 3239 3240 NL_SET_BAD_ATTR(extack, attr); 3241 return PTR_ERR(chain); 3242 } 3243 3244 if (nft_chain_binding(chain)) 3245 return -EOPNOTSUPP; 3246 3247 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 3248 3249 if (nla[NFTA_CHAIN_HOOK]) { 3250 if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN || 3251 chain->flags & NFT_CHAIN_HW_OFFLOAD) 3252 return -EOPNOTSUPP; 3253 3254 if (nft_is_base_chain(chain)) { 3255 struct nft_base_chain *basechain = nft_base_chain(chain); 3256 3257 if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) 3258 return nft_delchain_hook(&ctx, basechain, extack); 3259 } 3260 } 3261 3262 if (info->nlh->nlmsg_flags & NLM_F_NONREC && 3263 chain->use > 0) 3264 return -EBUSY; 3265 3266 use = chain->use; 3267 list_for_each_entry(rule, &chain->rules, list) { 3268 if (!nft_is_active_next(net, rule)) 3269 continue; 3270 use--; 3271 3272 err = nft_delrule(&ctx, rule); 3273 if (err < 0) 3274 return err; 3275 } 3276 3277 /* There are rules and elements that are still holding references to us, 3278 * we cannot do a recursive removal in this case. 3279 */ 3280 if (use > 0) { 3281 NL_SET_BAD_ATTR(extack, attr); 3282 return -EBUSY; 3283 } 3284 3285 return nft_delchain(&ctx); 3286 } 3287 3288 /* 3289 * Expressions 3290 */ 3291 3292 /** 3293 * nft_register_expr - register nf_tables expr type 3294 * @type: expr type 3295 * 3296 * Registers the expr type for use with nf_tables. Returns zero on 3297 * success or a negative errno code otherwise. 3298 */ 3299 int nft_register_expr(struct nft_expr_type *type) 3300 { 3301 if (WARN_ON_ONCE(type->maxattr > NFT_EXPR_MAXATTR)) 3302 return -ENOMEM; 3303 3304 nfnl_lock(NFNL_SUBSYS_NFTABLES); 3305 if (type->family == NFPROTO_UNSPEC) 3306 list_add_tail_rcu(&type->list, &nf_tables_expressions); 3307 else 3308 list_add_rcu(&type->list, &nf_tables_expressions); 3309 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 3310 return 0; 3311 } 3312 EXPORT_SYMBOL_GPL(nft_register_expr); 3313 3314 /** 3315 * nft_unregister_expr - unregister nf_tables expr type 3316 * @type: expr type 3317 * 3318 * Unregisters the expr typefor use with nf_tables. 3319 */ 3320 void nft_unregister_expr(struct nft_expr_type *type) 3321 { 3322 nfnl_lock(NFNL_SUBSYS_NFTABLES); 3323 list_del_rcu(&type->list); 3324 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 3325 } 3326 EXPORT_SYMBOL_GPL(nft_unregister_expr); 3327 3328 static const struct nft_expr_type *__nft_expr_type_get(u8 family, 3329 struct nlattr *nla) 3330 { 3331 const struct nft_expr_type *type, *candidate = NULL; 3332 3333 list_for_each_entry_rcu(type, &nf_tables_expressions, list) { 3334 if (!nla_strcmp(nla, type->name)) { 3335 if (!type->family && !candidate) 3336 candidate = type; 3337 else if (type->family == family) 3338 candidate = type; 3339 } 3340 } 3341 return candidate; 3342 } 3343 3344 #ifdef CONFIG_MODULES 3345 static int nft_expr_type_request_module(struct net *net, u8 family, 3346 struct nlattr *nla) 3347 { 3348 if (nft_request_module(net, "nft-expr-%u-%.*s", family, 3349 nla_len(nla), (char *)nla_data(nla)) == -EAGAIN) 3350 return -EAGAIN; 3351 3352 return 0; 3353 } 3354 #endif 3355 3356 static const struct nft_expr_type *nft_expr_type_get(struct net *net, 3357 u8 family, 3358 struct nlattr *nla) 3359 { 3360 const struct nft_expr_type *type; 3361 3362 if (nla == NULL) 3363 return ERR_PTR(-EINVAL); 3364 3365 rcu_read_lock(); 3366 type = __nft_expr_type_get(family, nla); 3367 if (type != NULL && try_module_get(type->owner)) { 3368 rcu_read_unlock(); 3369 return type; 3370 } 3371 rcu_read_unlock(); 3372 3373 lockdep_nfnl_nft_mutex_not_held(); 3374 #ifdef CONFIG_MODULES 3375 if (type == NULL) { 3376 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN) 3377 return ERR_PTR(-EAGAIN); 3378 3379 if (nft_request_module(net, "nft-expr-%.*s", 3380 nla_len(nla), 3381 (char *)nla_data(nla)) == -EAGAIN) 3382 return ERR_PTR(-EAGAIN); 3383 } 3384 #endif 3385 return ERR_PTR(-ENOENT); 3386 } 3387 3388 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { 3389 [NFTA_EXPR_NAME] = { .type = NLA_STRING, 3390 .len = NFT_MODULE_AUTOLOAD_LIMIT }, 3391 [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, 3392 }; 3393 3394 static int nf_tables_fill_expr_info(struct sk_buff *skb, 3395 const struct nft_expr *expr, bool reset) 3396 { 3397 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name)) 3398 goto nla_put_failure; 3399 3400 if (expr->ops->dump) { 3401 struct nlattr *data = nla_nest_start_noflag(skb, 3402 NFTA_EXPR_DATA); 3403 if (data == NULL) 3404 goto nla_put_failure; 3405 if (expr->ops->dump(skb, expr, reset) < 0) 3406 goto nla_put_failure; 3407 nla_nest_end(skb, data); 3408 } 3409 3410 return skb->len; 3411 3412 nla_put_failure: 3413 return -1; 3414 }; 3415 3416 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 3417 const struct nft_expr *expr, bool reset) 3418 { 3419 struct nlattr *nest; 3420 3421 nest = nla_nest_start_noflag(skb, attr); 3422 if (!nest) 3423 goto nla_put_failure; 3424 if (nf_tables_fill_expr_info(skb, expr, reset) < 0) 3425 goto nla_put_failure; 3426 nla_nest_end(skb, nest); 3427 return 0; 3428 3429 nla_put_failure: 3430 return -1; 3431 } 3432 3433 struct nft_expr_info { 3434 const struct nft_expr_ops *ops; 3435 const struct nlattr *attr; 3436 struct nlattr *tb[NFT_EXPR_MAXATTR + 1]; 3437 }; 3438 3439 static int nf_tables_expr_parse(const struct nft_ctx *ctx, 3440 const struct nlattr *nla, 3441 struct nft_expr_info *info) 3442 { 3443 const struct nft_expr_type *type; 3444 const struct nft_expr_ops *ops; 3445 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3446 int err; 3447 3448 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3449 nft_expr_policy, NULL); 3450 if (err < 0) 3451 return err; 3452 3453 type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]); 3454 if (IS_ERR(type)) 3455 return PTR_ERR(type); 3456 3457 if (tb[NFTA_EXPR_DATA]) { 3458 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3459 tb[NFTA_EXPR_DATA], 3460 type->policy, NULL); 3461 if (err < 0) 3462 goto err1; 3463 } else 3464 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1)); 3465 3466 if (type->select_ops != NULL) { 3467 ops = type->select_ops(ctx, 3468 (const struct nlattr * const *)info->tb); 3469 if (IS_ERR(ops)) { 3470 err = PTR_ERR(ops); 3471 #ifdef CONFIG_MODULES 3472 if (err == -EAGAIN) 3473 if (nft_expr_type_request_module(ctx->net, 3474 ctx->family, 3475 tb[NFTA_EXPR_NAME]) != -EAGAIN) 3476 err = -ENOENT; 3477 #endif 3478 goto err1; 3479 } 3480 } else 3481 ops = type->ops; 3482 3483 info->attr = nla; 3484 info->ops = ops; 3485 3486 return 0; 3487 3488 err1: 3489 module_put(type->owner); 3490 return err; 3491 } 3492 3493 int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, 3494 struct nft_expr_info *info) 3495 { 3496 struct nlattr *tb[NFTA_EXPR_MAX + 1]; 3497 const struct nft_expr_type *type; 3498 int err; 3499 3500 err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla, 3501 nft_expr_policy, NULL); 3502 if (err < 0) 3503 return err; 3504 3505 if (!tb[NFTA_EXPR_DATA] || !tb[NFTA_EXPR_NAME]) 3506 return -EINVAL; 3507 3508 rcu_read_lock(); 3509 3510 type = __nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]); 3511 if (!type) { 3512 err = -ENOENT; 3513 goto out_unlock; 3514 } 3515 3516 if (!type->inner_ops) { 3517 err = -EOPNOTSUPP; 3518 goto out_unlock; 3519 } 3520 3521 err = nla_parse_nested_deprecated(info->tb, type->maxattr, 3522 tb[NFTA_EXPR_DATA], 3523 type->policy, NULL); 3524 if (err < 0) 3525 goto out_unlock; 3526 3527 info->attr = nla; 3528 info->ops = type->inner_ops; 3529 3530 /* No module reference will be taken on type->owner. 3531 * Presence of type->inner_ops implies that the expression 3532 * is builtin, so it cannot go away. 3533 */ 3534 rcu_read_unlock(); 3535 return 0; 3536 3537 out_unlock: 3538 rcu_read_unlock(); 3539 return err; 3540 } 3541 3542 static int nf_tables_newexpr(const struct nft_ctx *ctx, 3543 const struct nft_expr_info *expr_info, 3544 struct nft_expr *expr) 3545 { 3546 const struct nft_expr_ops *ops = expr_info->ops; 3547 int err; 3548 3549 expr->ops = ops; 3550 if (ops->init) { 3551 err = ops->init(ctx, expr, (const struct nlattr **)expr_info->tb); 3552 if (err < 0) 3553 goto err1; 3554 } 3555 3556 return 0; 3557 err1: 3558 expr->ops = NULL; 3559 return err; 3560 } 3561 3562 static void nf_tables_expr_destroy(const struct nft_ctx *ctx, 3563 struct nft_expr *expr) 3564 { 3565 const struct nft_expr_type *type = expr->ops->type; 3566 3567 if (expr->ops->destroy) 3568 expr->ops->destroy(ctx, expr); 3569 module_put(type->owner); 3570 } 3571 3572 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx, 3573 const struct nlattr *nla) 3574 { 3575 struct nft_expr_info expr_info; 3576 struct nft_expr *expr; 3577 struct module *owner; 3578 int err; 3579 3580 err = nf_tables_expr_parse(ctx, nla, &expr_info); 3581 if (err < 0) 3582 goto err_expr_parse; 3583 3584 err = -EOPNOTSUPP; 3585 if (!(expr_info.ops->type->flags & NFT_EXPR_STATEFUL)) 3586 goto err_expr_stateful; 3587 3588 err = -ENOMEM; 3589 expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT); 3590 if (expr == NULL) 3591 goto err_expr_stateful; 3592 3593 err = nf_tables_newexpr(ctx, &expr_info, expr); 3594 if (err < 0) 3595 goto err_expr_new; 3596 3597 return expr; 3598 err_expr_new: 3599 kfree(expr); 3600 err_expr_stateful: 3601 owner = expr_info.ops->type->owner; 3602 if (expr_info.ops->type->release_ops) 3603 expr_info.ops->type->release_ops(expr_info.ops); 3604 3605 module_put(owner); 3606 err_expr_parse: 3607 return ERR_PTR(err); 3608 } 3609 3610 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src, gfp_t gfp) 3611 { 3612 int err; 3613 3614 if (WARN_ON_ONCE(!src->ops->clone)) 3615 return -EINVAL; 3616 3617 dst->ops = src->ops; 3618 err = src->ops->clone(dst, src, gfp); 3619 if (err < 0) 3620 return err; 3621 3622 __module_get(src->ops->type->owner); 3623 3624 return 0; 3625 } 3626 3627 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr) 3628 { 3629 nf_tables_expr_destroy(ctx, expr); 3630 kfree(expr); 3631 } 3632 3633 /* 3634 * Rules 3635 */ 3636 3637 static struct nft_rule *__nft_rule_lookup(const struct net *net, 3638 const struct nft_chain *chain, 3639 u64 handle) 3640 { 3641 struct nft_rule *rule; 3642 3643 // FIXME: this sucks 3644 list_for_each_entry_rcu(rule, &chain->rules, list, 3645 lockdep_commit_lock_is_held(net)) { 3646 if (handle == rule->handle) 3647 return rule; 3648 } 3649 3650 return ERR_PTR(-ENOENT); 3651 } 3652 3653 static struct nft_rule *nft_rule_lookup(const struct net *net, 3654 const struct nft_chain *chain, 3655 const struct nlattr *nla) 3656 { 3657 if (nla == NULL) 3658 return ERR_PTR(-EINVAL); 3659 3660 return __nft_rule_lookup(net, chain, be64_to_cpu(nla_get_be64(nla))); 3661 } 3662 3663 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 3664 [NFTA_RULE_TABLE] = { .type = NLA_STRING, 3665 .len = NFT_TABLE_MAXNAMELEN - 1 }, 3666 [NFTA_RULE_CHAIN] = { .type = NLA_STRING, 3667 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 3668 [NFTA_RULE_HANDLE] = { .type = NLA_U64 }, 3669 [NFTA_RULE_EXPRESSIONS] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy), 3670 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED }, 3671 [NFTA_RULE_POSITION] = { .type = NLA_U64 }, 3672 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, 3673 .len = NFT_USERDATA_MAXLEN }, 3674 [NFTA_RULE_ID] = { .type = NLA_U32 }, 3675 [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 }, 3676 [NFTA_RULE_CHAIN_ID] = { .type = NLA_U32 }, 3677 }; 3678 3679 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, 3680 u32 portid, u32 seq, int event, 3681 u32 flags, int family, 3682 const struct nft_table *table, 3683 const struct nft_chain *chain, 3684 const struct nft_rule *rule, u64 handle, 3685 bool reset) 3686 { 3687 struct nlmsghdr *nlh; 3688 const struct nft_expr *expr, *next; 3689 struct nlattr *list; 3690 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 3691 3692 nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, 3693 nft_base_seq_be16(net)); 3694 if (!nlh) 3695 goto nla_put_failure; 3696 3697 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) 3698 goto nla_put_failure; 3699 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) 3700 goto nla_put_failure; 3701 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle), 3702 NFTA_RULE_PAD)) 3703 goto nla_put_failure; 3704 3705 if (event != NFT_MSG_DELRULE && handle) { 3706 if (nla_put_be64(skb, NFTA_RULE_POSITION, cpu_to_be64(handle), 3707 NFTA_RULE_PAD)) 3708 goto nla_put_failure; 3709 } 3710 3711 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) 3712 nft_flow_rule_stats(chain, rule); 3713 3714 list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS); 3715 if (list == NULL) 3716 goto nla_put_failure; 3717 nft_rule_for_each_expr(expr, next, rule) { 3718 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 3719 goto nla_put_failure; 3720 } 3721 nla_nest_end(skb, list); 3722 3723 if (rule->udata) { 3724 struct nft_userdata *udata = nft_userdata(rule); 3725 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1, 3726 udata->data) < 0) 3727 goto nla_put_failure; 3728 } 3729 3730 nlmsg_end(skb, nlh); 3731 return 0; 3732 3733 nla_put_failure: 3734 nlmsg_trim(skb, nlh); 3735 return -1; 3736 } 3737 3738 static void nf_tables_rule_notify(const struct nft_ctx *ctx, 3739 const struct nft_rule *rule, int event) 3740 { 3741 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 3742 const struct nft_rule *prule; 3743 struct sk_buff *skb; 3744 u64 handle = 0; 3745 u16 flags = 0; 3746 int err; 3747 3748 if (!ctx->report && 3749 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 3750 return; 3751 3752 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 3753 if (skb == NULL) 3754 goto err; 3755 3756 if (event == NFT_MSG_NEWRULE && 3757 !list_is_first(&rule->list, &ctx->chain->rules) && 3758 !list_is_last(&rule->list, &ctx->chain->rules)) { 3759 prule = list_prev_entry(rule, list); 3760 handle = prule->handle; 3761 } 3762 if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) 3763 flags |= NLM_F_APPEND; 3764 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 3765 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 3766 3767 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, 3768 event, flags, ctx->family, ctx->table, 3769 ctx->chain, rule, handle, false); 3770 if (err < 0) { 3771 kfree_skb(skb); 3772 goto err; 3773 } 3774 3775 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 3776 return; 3777 err: 3778 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 3779 } 3780 3781 static void audit_log_rule_reset(const struct nft_table *table, 3782 unsigned int base_seq, 3783 unsigned int nentries) 3784 { 3785 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", 3786 table->name, base_seq); 3787 3788 audit_log_nfcfg(buf, table->family, nentries, 3789 AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC); 3790 kfree(buf); 3791 } 3792 3793 struct nft_rule_dump_ctx { 3794 unsigned int s_idx; 3795 char *table; 3796 char *chain; 3797 bool reset; 3798 }; 3799 3800 static int __nf_tables_dump_rules(struct sk_buff *skb, 3801 unsigned int *idx, 3802 struct netlink_callback *cb, 3803 const struct nft_table *table, 3804 const struct nft_chain *chain) 3805 { 3806 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3807 struct net *net = sock_net(skb->sk); 3808 const struct nft_rule *rule, *prule; 3809 unsigned int entries = 0; 3810 int ret = 0; 3811 u64 handle; 3812 3813 prule = NULL; 3814 list_for_each_entry_rcu(rule, &chain->rules, list) { 3815 if (!nft_is_active(net, rule)) 3816 goto cont_skip; 3817 if (*idx < ctx->s_idx) 3818 goto cont; 3819 if (prule) 3820 handle = prule->handle; 3821 else 3822 handle = 0; 3823 3824 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, 3825 cb->nlh->nlmsg_seq, 3826 NFT_MSG_NEWRULE, 3827 NLM_F_MULTI | NLM_F_APPEND, 3828 table->family, 3829 table, chain, rule, handle, ctx->reset) < 0) { 3830 ret = 1; 3831 break; 3832 } 3833 entries++; 3834 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 3835 cont: 3836 prule = rule; 3837 cont_skip: 3838 (*idx)++; 3839 } 3840 3841 if (ctx->reset && entries) 3842 audit_log_rule_reset(table, cb->seq, entries); 3843 3844 return ret; 3845 } 3846 3847 static int nf_tables_dump_rules(struct sk_buff *skb, 3848 struct netlink_callback *cb) 3849 { 3850 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3851 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3852 struct nft_table *table; 3853 const struct nft_chain *chain; 3854 unsigned int idx = 0; 3855 struct net *net = sock_net(skb->sk); 3856 int family = nfmsg->nfgen_family; 3857 struct nftables_pernet *nft_net; 3858 3859 rcu_read_lock(); 3860 nft_net = nft_pernet(net); 3861 cb->seq = nft_base_seq(net); 3862 3863 list_for_each_entry_rcu(table, &nft_net->tables, list) { 3864 if (family != NFPROTO_UNSPEC && family != table->family) 3865 continue; 3866 3867 if (ctx->table && strcmp(ctx->table, table->name) != 0) 3868 continue; 3869 3870 if (ctx->table && ctx->chain) { 3871 struct rhlist_head *list, *tmp; 3872 3873 list = rhltable_lookup(&table->chains_ht, ctx->chain, 3874 nft_chain_ht_params); 3875 if (!list) 3876 goto done; 3877 3878 rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) { 3879 if (!nft_is_active(net, chain)) 3880 continue; 3881 __nf_tables_dump_rules(skb, &idx, 3882 cb, table, chain); 3883 break; 3884 } 3885 goto done; 3886 } 3887 3888 list_for_each_entry_rcu(chain, &table->chains, list) { 3889 if (__nf_tables_dump_rules(skb, &idx, 3890 cb, table, chain)) 3891 goto done; 3892 } 3893 3894 if (ctx->table) 3895 break; 3896 } 3897 done: 3898 rcu_read_unlock(); 3899 3900 ctx->s_idx = idx; 3901 return skb->len; 3902 } 3903 3904 static int nf_tables_dumpreset_rules(struct sk_buff *skb, 3905 struct netlink_callback *cb) 3906 { 3907 struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); 3908 int ret; 3909 3910 /* Mutex is held is to prevent that two concurrent dump-and-reset calls 3911 * do not underrun counters and quotas. The commit_mutex is used for 3912 * the lack a better lock, this is not transaction path. 3913 */ 3914 mutex_lock(&nft_net->commit_mutex); 3915 ret = nf_tables_dump_rules(skb, cb); 3916 mutex_unlock(&nft_net->commit_mutex); 3917 3918 return ret; 3919 } 3920 3921 static int nf_tables_dump_rules_start(struct netlink_callback *cb) 3922 { 3923 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3924 const struct nlattr * const *nla = cb->data; 3925 3926 BUILD_BUG_ON(sizeof(*ctx) > sizeof(cb->ctx)); 3927 3928 if (nla[NFTA_RULE_TABLE]) { 3929 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE], GFP_ATOMIC); 3930 if (!ctx->table) 3931 return -ENOMEM; 3932 } 3933 if (nla[NFTA_RULE_CHAIN]) { 3934 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN], GFP_ATOMIC); 3935 if (!ctx->chain) { 3936 kfree(ctx->table); 3937 return -ENOMEM; 3938 } 3939 } 3940 return 0; 3941 } 3942 3943 static int nf_tables_dumpreset_rules_start(struct netlink_callback *cb) 3944 { 3945 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3946 3947 ctx->reset = true; 3948 3949 return nf_tables_dump_rules_start(cb); 3950 } 3951 3952 static int nf_tables_dump_rules_done(struct netlink_callback *cb) 3953 { 3954 struct nft_rule_dump_ctx *ctx = (void *)cb->ctx; 3955 3956 kfree(ctx->table); 3957 kfree(ctx->chain); 3958 return 0; 3959 } 3960 3961 /* Caller must hold rcu read lock or transaction mutex */ 3962 static struct sk_buff * 3963 nf_tables_getrule_single(u32 portid, const struct nfnl_info *info, 3964 const struct nlattr * const nla[], bool reset) 3965 { 3966 struct netlink_ext_ack *extack = info->extack; 3967 u8 genmask = nft_genmask_cur(info->net); 3968 u8 family = info->nfmsg->nfgen_family; 3969 const struct nft_chain *chain; 3970 const struct nft_rule *rule; 3971 struct net *net = info->net; 3972 struct nft_table *table; 3973 struct sk_buff *skb2; 3974 int err; 3975 3976 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0); 3977 if (IS_ERR(table)) { 3978 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 3979 return ERR_CAST(table); 3980 } 3981 3982 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask); 3983 if (IS_ERR(chain)) { 3984 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 3985 return ERR_CAST(chain); 3986 } 3987 3988 rule = nft_rule_lookup(net, chain, nla[NFTA_RULE_HANDLE]); 3989 if (IS_ERR(rule)) { 3990 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 3991 return ERR_CAST(rule); 3992 } 3993 3994 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 3995 if (!skb2) 3996 return ERR_PTR(-ENOMEM); 3997 3998 err = nf_tables_fill_rule_info(skb2, net, portid, 3999 info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, 4000 family, table, chain, rule, 0, reset); 4001 if (err < 0) { 4002 kfree_skb(skb2); 4003 return ERR_PTR(err); 4004 } 4005 4006 return skb2; 4007 } 4008 4009 static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, 4010 const struct nlattr * const nla[]) 4011 { 4012 u32 portid = NETLINK_CB(skb).portid; 4013 struct net *net = info->net; 4014 struct sk_buff *skb2; 4015 4016 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 4017 struct netlink_dump_control c = { 4018 .start= nf_tables_dump_rules_start, 4019 .dump = nf_tables_dump_rules, 4020 .done = nf_tables_dump_rules_done, 4021 .module = THIS_MODULE, 4022 .data = (void *)nla, 4023 }; 4024 4025 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4026 } 4027 4028 skb2 = nf_tables_getrule_single(portid, info, nla, false); 4029 if (IS_ERR(skb2)) 4030 return PTR_ERR(skb2); 4031 4032 return nfnetlink_unicast(skb2, net, portid); 4033 } 4034 4035 static int nf_tables_getrule_reset(struct sk_buff *skb, 4036 const struct nfnl_info *info, 4037 const struct nlattr * const nla[]) 4038 { 4039 struct nftables_pernet *nft_net = nft_pernet(info->net); 4040 u32 portid = NETLINK_CB(skb).portid; 4041 struct net *net = info->net; 4042 struct sk_buff *skb2; 4043 char *buf; 4044 4045 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 4046 struct netlink_dump_control c = { 4047 .start= nf_tables_dumpreset_rules_start, 4048 .dump = nf_tables_dumpreset_rules, 4049 .done = nf_tables_dump_rules_done, 4050 .module = THIS_MODULE, 4051 .data = (void *)nla, 4052 }; 4053 4054 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 4055 } 4056 4057 if (!try_module_get(THIS_MODULE)) 4058 return -EINVAL; 4059 rcu_read_unlock(); 4060 mutex_lock(&nft_net->commit_mutex); 4061 skb2 = nf_tables_getrule_single(portid, info, nla, true); 4062 mutex_unlock(&nft_net->commit_mutex); 4063 rcu_read_lock(); 4064 module_put(THIS_MODULE); 4065 4066 if (IS_ERR(skb2)) 4067 return PTR_ERR(skb2); 4068 4069 buf = kasprintf(GFP_ATOMIC, "%.*s:%u", 4070 nla_len(nla[NFTA_RULE_TABLE]), 4071 (char *)nla_data(nla[NFTA_RULE_TABLE]), 4072 nft_base_seq(net)); 4073 audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1, 4074 AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC); 4075 kfree(buf); 4076 4077 return nfnetlink_unicast(skb2, net, portid); 4078 } 4079 4080 void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule) 4081 { 4082 struct nft_expr *expr, *next; 4083 4084 /* 4085 * Careful: some expressions might not be initialized in case this 4086 * is called on error from nf_tables_newrule(). 4087 */ 4088 expr = nft_expr_first(rule); 4089 while (nft_expr_more(rule, expr)) { 4090 next = nft_expr_next(expr); 4091 nf_tables_expr_destroy(ctx, expr); 4092 expr = next; 4093 } 4094 kfree(rule); 4095 } 4096 4097 /* can only be used if rule is no longer visible to dumps */ 4098 static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule) 4099 { 4100 WARN_ON_ONCE(!lockdep_commit_lock_is_held(ctx->net)); 4101 4102 nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE); 4103 nf_tables_rule_destroy(ctx, rule); 4104 } 4105 4106 static void nft_chain_vstate_update(const struct nft_ctx *ctx, struct nft_chain *chain) 4107 { 4108 const struct nft_base_chain *base_chain; 4109 enum nft_chain_types type; 4110 u8 hooknum; 4111 4112 /* ctx->chain must hold the calling base chain. */ 4113 if (WARN_ON_ONCE(!nft_is_base_chain(ctx->chain))) { 4114 memset(&chain->vstate, 0, sizeof(chain->vstate)); 4115 return; 4116 } 4117 4118 base_chain = nft_base_chain(ctx->chain); 4119 hooknum = base_chain->ops.hooknum; 4120 type = base_chain->type->type; 4121 4122 BUILD_BUG_ON(BIT(NF_INET_NUMHOOKS) > U8_MAX); 4123 4124 chain->vstate.hook_mask[type] |= BIT(hooknum); 4125 if (chain->vstate.depth < ctx->level) 4126 chain->vstate.depth = ctx->level; 4127 } 4128 4129 /** nft_chain_validate - loop detection and hook validation 4130 * 4131 * @ctx: context containing call depth and base chain 4132 * @chain: chain to validate 4133 * 4134 * Walk through the rules of the given chain and chase all jumps/gotos 4135 * and set lookups until either the jump limit is hit or all reachable 4136 * chains have been validated. 4137 */ 4138 int nft_chain_validate(const struct nft_ctx *ctx, struct nft_chain *chain) 4139 { 4140 struct nft_expr *expr, *last; 4141 struct nft_rule *rule; 4142 int err; 4143 4144 BUILD_BUG_ON(NFT_JUMP_STACK_SIZE > 255); 4145 if (ctx->level == NFT_JUMP_STACK_SIZE) 4146 return -EMLINK; 4147 4148 if (ctx->level > 0) { 4149 /* jumps to base chains are not allowed. */ 4150 if (nft_is_base_chain(chain)) 4151 return -ELOOP; 4152 4153 if (nft_chain_vstate_valid(ctx, chain)) 4154 return 0; 4155 } 4156 4157 list_for_each_entry(rule, &chain->rules, list) { 4158 if (fatal_signal_pending(current)) 4159 return -EINTR; 4160 4161 if (!nft_is_active_next(ctx->net, rule)) 4162 continue; 4163 4164 nft_rule_for_each_expr(expr, last, rule) { 4165 if (!expr->ops->validate) 4166 continue; 4167 4168 /* This may call nft_chain_validate() recursively, 4169 * callers that do so must increment ctx->level. 4170 */ 4171 err = expr->ops->validate(ctx, expr); 4172 if (err < 0) 4173 return err; 4174 } 4175 4176 cond_resched(); 4177 } 4178 4179 nft_chain_vstate_update(ctx, chain); 4180 return 0; 4181 } 4182 EXPORT_SYMBOL_GPL(nft_chain_validate); 4183 4184 static int nft_table_validate(struct net *net, const struct nft_table *table) 4185 { 4186 struct nft_chain *chain; 4187 struct nft_ctx ctx = { 4188 .net = net, 4189 .family = table->family, 4190 }; 4191 int err = 0; 4192 4193 list_for_each_entry(chain, &table->chains, list) { 4194 if (!nft_is_base_chain(chain)) 4195 continue; 4196 4197 ctx.chain = chain; 4198 err = nft_chain_validate(&ctx, chain); 4199 if (err < 0) 4200 goto err; 4201 } 4202 4203 err: 4204 list_for_each_entry(chain, &table->chains, list) 4205 memset(&chain->vstate, 0, sizeof(chain->vstate)); 4206 4207 return err; 4208 } 4209 4210 int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, 4211 const struct nft_set_iter *iter, 4212 struct nft_elem_priv *elem_priv) 4213 { 4214 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 4215 struct nft_ctx *pctx = (struct nft_ctx *)ctx; 4216 const struct nft_data *data; 4217 int err; 4218 4219 if (!nft_set_elem_active(ext, iter->genmask)) 4220 return 0; 4221 4222 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 4223 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) 4224 return 0; 4225 4226 data = nft_set_ext_data(ext); 4227 switch (data->verdict.code) { 4228 case NFT_JUMP: 4229 case NFT_GOTO: 4230 pctx->level++; 4231 err = nft_chain_validate(ctx, data->verdict.chain); 4232 if (err < 0) 4233 return err; 4234 pctx->level--; 4235 break; 4236 default: 4237 break; 4238 } 4239 4240 return 0; 4241 } 4242 4243 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set) 4244 { 4245 struct nft_set_iter dummy_iter = { 4246 .genmask = nft_genmask_next(ctx->net), 4247 }; 4248 struct nft_set_elem_catchall *catchall; 4249 4250 struct nft_set_ext *ext; 4251 int ret = 0; 4252 4253 list_for_each_entry_rcu(catchall, &set->catchall_list, list, 4254 lockdep_commit_lock_is_held(ctx->net)) { 4255 ext = nft_set_elem_ext(set, catchall->elem); 4256 if (!nft_set_elem_active(ext, dummy_iter.genmask)) 4257 continue; 4258 4259 ret = nft_setelem_validate(ctx, set, &dummy_iter, catchall->elem); 4260 if (ret < 0) 4261 return ret; 4262 } 4263 4264 return ret; 4265 } 4266 4267 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 4268 const struct nft_chain *chain, 4269 const struct nlattr *nla); 4270 4271 #define NFT_RULE_MAXEXPRS 128 4272 4273 static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 4274 const struct nlattr * const nla[]) 4275 { 4276 struct nftables_pernet *nft_net = nft_pernet(info->net); 4277 struct netlink_ext_ack *extack = info->extack; 4278 unsigned int size, i, n, ulen = 0, usize = 0; 4279 u8 genmask = nft_genmask_next(info->net); 4280 struct nft_rule *rule, *old_rule = NULL; 4281 struct nft_expr_info *expr_info = NULL; 4282 u8 family = info->nfmsg->nfgen_family; 4283 struct nft_flow_rule *flow = NULL; 4284 struct net *net = info->net; 4285 struct nft_userdata *udata; 4286 struct nft_table *table; 4287 struct nft_chain *chain; 4288 struct nft_trans *trans; 4289 u64 handle, pos_handle; 4290 struct nft_expr *expr; 4291 struct nft_ctx ctx; 4292 struct nlattr *tmp; 4293 int err, rem; 4294 4295 lockdep_assert_held(&nft_net->commit_mutex); 4296 4297 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 4298 NETLINK_CB(skb).portid); 4299 if (IS_ERR(table)) { 4300 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 4301 return PTR_ERR(table); 4302 } 4303 4304 if (nla[NFTA_RULE_CHAIN]) { 4305 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 4306 genmask); 4307 if (IS_ERR(chain)) { 4308 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 4309 return PTR_ERR(chain); 4310 } 4311 4312 } else if (nla[NFTA_RULE_CHAIN_ID]) { 4313 chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID], 4314 genmask); 4315 if (IS_ERR(chain)) { 4316 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]); 4317 return PTR_ERR(chain); 4318 } 4319 } else { 4320 return -EINVAL; 4321 } 4322 4323 if (nft_chain_is_bound(chain)) 4324 return -EOPNOTSUPP; 4325 4326 if (nla[NFTA_RULE_HANDLE]) { 4327 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); 4328 rule = __nft_rule_lookup(net, chain, handle); 4329 if (IS_ERR(rule)) { 4330 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 4331 return PTR_ERR(rule); 4332 } 4333 4334 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 4335 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 4336 return -EEXIST; 4337 } 4338 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 4339 old_rule = rule; 4340 else 4341 return -EOPNOTSUPP; 4342 } else { 4343 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE) || 4344 info->nlh->nlmsg_flags & NLM_F_REPLACE) 4345 return -EINVAL; 4346 handle = nf_tables_alloc_handle(table); 4347 4348 if (nla[NFTA_RULE_POSITION]) { 4349 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); 4350 old_rule = __nft_rule_lookup(net, chain, pos_handle); 4351 if (IS_ERR(old_rule)) { 4352 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); 4353 return PTR_ERR(old_rule); 4354 } 4355 } else if (nla[NFTA_RULE_POSITION_ID]) { 4356 old_rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID]); 4357 if (IS_ERR(old_rule)) { 4358 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); 4359 return PTR_ERR(old_rule); 4360 } 4361 } 4362 } 4363 4364 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 4365 4366 n = 0; 4367 size = 0; 4368 if (nla[NFTA_RULE_EXPRESSIONS]) { 4369 expr_info = kvmalloc_array(NFT_RULE_MAXEXPRS, 4370 sizeof(struct nft_expr_info), 4371 GFP_KERNEL); 4372 if (!expr_info) 4373 return -ENOMEM; 4374 4375 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) { 4376 err = -EINVAL; 4377 if (nla_type(tmp) != NFTA_LIST_ELEM) 4378 goto err_release_expr; 4379 if (n == NFT_RULE_MAXEXPRS) 4380 goto err_release_expr; 4381 err = nf_tables_expr_parse(&ctx, tmp, &expr_info[n]); 4382 if (err < 0) { 4383 NL_SET_BAD_ATTR(extack, tmp); 4384 goto err_release_expr; 4385 } 4386 size += expr_info[n].ops->size; 4387 n++; 4388 } 4389 } 4390 /* Check for overflow of dlen field */ 4391 err = -EFBIG; 4392 if (size >= 1 << 12) 4393 goto err_release_expr; 4394 4395 if (nla[NFTA_RULE_USERDATA]) { 4396 ulen = nla_len(nla[NFTA_RULE_USERDATA]); 4397 if (ulen > 0) 4398 usize = sizeof(struct nft_userdata) + ulen; 4399 } 4400 4401 err = -ENOMEM; 4402 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL_ACCOUNT); 4403 if (rule == NULL) 4404 goto err_release_expr; 4405 4406 nft_activate_next(net, rule); 4407 4408 rule->handle = handle; 4409 rule->dlen = size; 4410 rule->udata = ulen ? 1 : 0; 4411 4412 if (ulen) { 4413 udata = nft_userdata(rule); 4414 udata->len = ulen - 1; 4415 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen); 4416 } 4417 4418 expr = nft_expr_first(rule); 4419 for (i = 0; i < n; i++) { 4420 err = nf_tables_newexpr(&ctx, &expr_info[i], expr); 4421 if (err < 0) { 4422 NL_SET_BAD_ATTR(extack, expr_info[i].attr); 4423 goto err_release_rule; 4424 } 4425 4426 if (expr_info[i].ops->validate) 4427 nft_validate_state_update(table, NFT_VALIDATE_NEED); 4428 4429 expr_info[i].ops = NULL; 4430 expr = nft_expr_next(expr); 4431 } 4432 4433 if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { 4434 flow = nft_flow_rule_create(net, rule); 4435 if (IS_ERR(flow)) { 4436 err = PTR_ERR(flow); 4437 goto err_release_rule; 4438 } 4439 } 4440 4441 if (!nft_use_inc(&chain->use)) { 4442 err = -EMFILE; 4443 goto err_destroy_flow; 4444 } 4445 4446 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) { 4447 if (nft_chain_binding(chain)) { 4448 err = -EOPNOTSUPP; 4449 goto err_destroy_flow_rule; 4450 } 4451 4452 err = nft_delrule(&ctx, old_rule); 4453 if (err < 0) 4454 goto err_destroy_flow_rule; 4455 4456 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 4457 if (trans == NULL) { 4458 err = -ENOMEM; 4459 goto err_destroy_flow_rule; 4460 } 4461 list_add_tail_rcu(&rule->list, &old_rule->list); 4462 } else { 4463 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); 4464 if (!trans) { 4465 err = -ENOMEM; 4466 goto err_destroy_flow_rule; 4467 } 4468 4469 if (info->nlh->nlmsg_flags & NLM_F_APPEND) { 4470 if (old_rule) 4471 list_add_rcu(&rule->list, &old_rule->list); 4472 else 4473 list_add_tail_rcu(&rule->list, &chain->rules); 4474 } else { 4475 if (old_rule) 4476 list_add_tail_rcu(&rule->list, &old_rule->list); 4477 else 4478 list_add_rcu(&rule->list, &chain->rules); 4479 } 4480 } 4481 kvfree(expr_info); 4482 4483 if (flow) 4484 nft_trans_flow_rule(trans) = flow; 4485 4486 if (table->validate_state == NFT_VALIDATE_DO) 4487 return nft_table_validate(net, table); 4488 4489 return 0; 4490 4491 err_destroy_flow_rule: 4492 nft_use_dec_restore(&chain->use); 4493 err_destroy_flow: 4494 if (flow) 4495 nft_flow_rule_destroy(flow); 4496 err_release_rule: 4497 nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR); 4498 nf_tables_rule_destroy(&ctx, rule); 4499 err_release_expr: 4500 for (i = 0; i < n; i++) { 4501 if (expr_info[i].ops) { 4502 module_put(expr_info[i].ops->type->owner); 4503 if (expr_info[i].ops->type->release_ops) 4504 expr_info[i].ops->type->release_ops(expr_info[i].ops); 4505 } 4506 } 4507 kvfree(expr_info); 4508 4509 return err; 4510 } 4511 4512 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, 4513 const struct nft_chain *chain, 4514 const struct nlattr *nla) 4515 { 4516 struct nftables_pernet *nft_net = nft_pernet(net); 4517 u32 id = ntohl(nla_get_be32(nla)); 4518 struct nft_trans *trans; 4519 4520 list_for_each_entry(trans, &nft_net->commit_list, list) { 4521 if (trans->msg_type == NFT_MSG_NEWRULE && 4522 nft_trans_rule_chain(trans) == chain && 4523 id == nft_trans_rule_id(trans)) 4524 return nft_trans_rule(trans); 4525 } 4526 return ERR_PTR(-ENOENT); 4527 } 4528 4529 static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info, 4530 const struct nlattr * const nla[]) 4531 { 4532 struct netlink_ext_ack *extack = info->extack; 4533 u8 genmask = nft_genmask_next(info->net); 4534 u8 family = info->nfmsg->nfgen_family; 4535 struct nft_chain *chain = NULL; 4536 struct net *net = info->net; 4537 struct nft_table *table; 4538 struct nft_rule *rule; 4539 struct nft_ctx ctx; 4540 int err = 0; 4541 4542 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 4543 NETLINK_CB(skb).portid); 4544 if (IS_ERR(table)) { 4545 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]); 4546 return PTR_ERR(table); 4547 } 4548 4549 if (nla[NFTA_RULE_CHAIN]) { 4550 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], 4551 genmask); 4552 if (IS_ERR(chain)) { 4553 if (PTR_ERR(chain) == -ENOENT && 4554 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 4555 return 0; 4556 4557 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); 4558 return PTR_ERR(chain); 4559 } 4560 if (nft_chain_binding(chain)) 4561 return -EOPNOTSUPP; 4562 } 4563 4564 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); 4565 4566 if (chain) { 4567 if (nla[NFTA_RULE_HANDLE]) { 4568 rule = nft_rule_lookup(info->net, chain, nla[NFTA_RULE_HANDLE]); 4569 if (IS_ERR(rule)) { 4570 if (PTR_ERR(rule) == -ENOENT && 4571 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) 4572 return 0; 4573 4574 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); 4575 return PTR_ERR(rule); 4576 } 4577 4578 err = nft_delrule(&ctx, rule); 4579 } else if (nla[NFTA_RULE_ID]) { 4580 rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); 4581 if (IS_ERR(rule)) { 4582 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); 4583 return PTR_ERR(rule); 4584 } 4585 4586 err = nft_delrule(&ctx, rule); 4587 } else { 4588 err = nft_delrule_by_chain(&ctx); 4589 } 4590 } else { 4591 list_for_each_entry(chain, &table->chains, list) { 4592 if (!nft_is_active_next(net, chain)) 4593 continue; 4594 if (nft_chain_binding(chain)) 4595 continue; 4596 4597 ctx.chain = chain; 4598 err = nft_delrule_by_chain(&ctx); 4599 if (err < 0) 4600 break; 4601 } 4602 } 4603 4604 return err; 4605 } 4606 4607 /* 4608 * Sets 4609 */ 4610 static const struct nft_set_type *nft_set_types[] = { 4611 &nft_set_hash_fast_type, 4612 &nft_set_hash_type, 4613 &nft_set_rhash_type, 4614 &nft_set_bitmap_type, 4615 &nft_set_rbtree_type, 4616 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML) 4617 &nft_set_pipapo_avx2_type, 4618 #endif 4619 &nft_set_pipapo_type, 4620 }; 4621 4622 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \ 4623 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \ 4624 NFT_SET_EVAL) 4625 4626 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags) 4627 { 4628 return (flags & type->features) == (flags & NFT_SET_FEATURES); 4629 } 4630 4631 /* 4632 * Select a set implementation based on the data characteristics and the 4633 * given policy. The total memory use might not be known if no size is 4634 * given, in that case the amount of memory per element is used. 4635 */ 4636 static const struct nft_set_ops * 4637 nft_select_set_ops(const struct nft_ctx *ctx, u32 flags, 4638 const struct nft_set_desc *desc) 4639 { 4640 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 4641 const struct nft_set_ops *ops, *bops; 4642 struct nft_set_estimate est, best; 4643 const struct nft_set_type *type; 4644 int i; 4645 4646 lockdep_assert_held(&nft_net->commit_mutex); 4647 lockdep_nfnl_nft_mutex_not_held(); 4648 4649 bops = NULL; 4650 best.size = ~0; 4651 best.lookup = ~0; 4652 best.space = ~0; 4653 4654 for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) { 4655 type = nft_set_types[i]; 4656 ops = &type->ops; 4657 4658 if (!nft_set_ops_candidate(type, flags)) 4659 continue; 4660 if (!ops->estimate(desc, flags, &est)) 4661 continue; 4662 4663 switch (desc->policy) { 4664 case NFT_SET_POL_PERFORMANCE: 4665 if (est.lookup < best.lookup) 4666 break; 4667 if (est.lookup == best.lookup && 4668 est.space < best.space) 4669 break; 4670 continue; 4671 case NFT_SET_POL_MEMORY: 4672 if (!desc->size) { 4673 if (est.space < best.space) 4674 break; 4675 if (est.space == best.space && 4676 est.lookup < best.lookup) 4677 break; 4678 } else if (est.size < best.size || !bops) { 4679 break; 4680 } 4681 continue; 4682 default: 4683 break; 4684 } 4685 4686 bops = ops; 4687 best = est; 4688 } 4689 4690 if (bops != NULL) 4691 return bops; 4692 4693 return ERR_PTR(-EOPNOTSUPP); 4694 } 4695 4696 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { 4697 [NFTA_SET_TABLE] = { .type = NLA_STRING, 4698 .len = NFT_TABLE_MAXNAMELEN - 1 }, 4699 [NFTA_SET_NAME] = { .type = NLA_STRING, 4700 .len = NFT_SET_MAXNAMELEN - 1 }, 4701 [NFTA_SET_FLAGS] = { .type = NLA_U32 }, 4702 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 }, 4703 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 }, 4704 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 }, 4705 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 }, 4706 [NFTA_SET_POLICY] = { .type = NLA_U32 }, 4707 [NFTA_SET_DESC] = { .type = NLA_NESTED }, 4708 [NFTA_SET_ID] = { .type = NLA_U32 }, 4709 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 }, 4710 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 }, 4711 [NFTA_SET_USERDATA] = { .type = NLA_BINARY, 4712 .len = NFT_USERDATA_MAXLEN }, 4713 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 }, 4714 [NFTA_SET_HANDLE] = { .type = NLA_U64 }, 4715 [NFTA_SET_EXPR] = { .type = NLA_NESTED }, 4716 [NFTA_SET_EXPRESSIONS] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy), 4717 [NFTA_SET_TYPE] = { .type = NLA_REJECT }, 4718 [NFTA_SET_COUNT] = { .type = NLA_REJECT }, 4719 }; 4720 4721 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = { 4722 [NFTA_SET_FIELD_LEN] = { .type = NLA_U32 }, 4723 }; 4724 4725 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = { 4726 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 }, 4727 [NFTA_SET_DESC_CONCAT] = NLA_POLICY_NESTED_ARRAY(nft_concat_policy), 4728 }; 4729 4730 static struct nft_set *nft_set_lookup(const struct net *net, 4731 const struct nft_table *table, 4732 const struct nlattr *nla, u8 genmask) 4733 { 4734 struct nft_set *set; 4735 4736 if (nla == NULL) 4737 return ERR_PTR(-EINVAL); 4738 4739 list_for_each_entry_rcu(set, &table->sets, list, 4740 lockdep_commit_lock_is_held(net)) { 4741 if (!nla_strcmp(nla, set->name) && 4742 nft_active_genmask(set, genmask)) 4743 return set; 4744 } 4745 return ERR_PTR(-ENOENT); 4746 } 4747 4748 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, 4749 const struct nlattr *nla, 4750 u8 genmask) 4751 { 4752 struct nft_set *set; 4753 4754 list_for_each_entry(set, &table->sets, list) { 4755 if (be64_to_cpu(nla_get_be64(nla)) == set->handle && 4756 nft_active_genmask(set, genmask)) 4757 return set; 4758 } 4759 return ERR_PTR(-ENOENT); 4760 } 4761 4762 static struct nft_set *nft_set_lookup_byid(const struct net *net, 4763 const struct nft_table *table, 4764 const struct nlattr *nla, u8 genmask) 4765 { 4766 struct nftables_pernet *nft_net = nft_pernet(net); 4767 u32 id = ntohl(nla_get_be32(nla)); 4768 struct nft_trans_set *trans; 4769 4770 /* its likely the id we need is at the tail, not at start */ 4771 list_for_each_entry_reverse(trans, &nft_net->commit_set_list, list_trans_newset) { 4772 struct nft_set *set = trans->set; 4773 4774 if (id == trans->set_id && 4775 set->table == table && 4776 nft_active_genmask(set, genmask)) 4777 return set; 4778 } 4779 return ERR_PTR(-ENOENT); 4780 } 4781 4782 struct nft_set *nft_set_lookup_global(const struct net *net, 4783 const struct nft_table *table, 4784 const struct nlattr *nla_set_name, 4785 const struct nlattr *nla_set_id, 4786 u8 genmask) 4787 { 4788 struct nft_set *set; 4789 4790 set = nft_set_lookup(net, table, nla_set_name, genmask); 4791 if (IS_ERR(set)) { 4792 if (!nla_set_id) 4793 return set; 4794 4795 set = nft_set_lookup_byid(net, table, nla_set_id, genmask); 4796 } 4797 return set; 4798 } 4799 EXPORT_SYMBOL_GPL(nft_set_lookup_global); 4800 4801 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, 4802 const char *name) 4803 { 4804 const struct nft_set *i; 4805 const char *p; 4806 unsigned long *inuse; 4807 unsigned int n = 0, min = 0; 4808 4809 p = strchr(name, '%'); 4810 if (p != NULL) { 4811 if (p[1] != 'd' || strchr(p + 2, '%')) 4812 return -EINVAL; 4813 4814 if (strnlen(name, NFT_SET_MAX_ANONLEN) >= NFT_SET_MAX_ANONLEN) 4815 return -EINVAL; 4816 4817 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL); 4818 if (inuse == NULL) 4819 return -ENOMEM; 4820 cont: 4821 list_for_each_entry(i, &ctx->table->sets, list) { 4822 int tmp; 4823 4824 if (!nft_is_active_next(ctx->net, i)) 4825 continue; 4826 if (!sscanf(i->name, name, &tmp)) 4827 continue; 4828 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE) 4829 continue; 4830 4831 set_bit(tmp - min, inuse); 4832 } 4833 4834 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE); 4835 if (n >= BITS_PER_BYTE * PAGE_SIZE) { 4836 min += BITS_PER_BYTE * PAGE_SIZE; 4837 memset(inuse, 0, PAGE_SIZE); 4838 goto cont; 4839 } 4840 free_page((unsigned long)inuse); 4841 } 4842 4843 set->name = kasprintf(GFP_KERNEL_ACCOUNT, name, min + n); 4844 if (!set->name) 4845 return -ENOMEM; 4846 4847 list_for_each_entry(i, &ctx->table->sets, list) { 4848 if (!nft_is_active_next(ctx->net, i)) 4849 continue; 4850 if (!strcmp(set->name, i->name)) { 4851 kfree(set->name); 4852 set->name = NULL; 4853 return -ENFILE; 4854 } 4855 } 4856 return 0; 4857 } 4858 4859 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) 4860 { 4861 u64 ms = be64_to_cpu(nla_get_be64(nla)); 4862 u64 max = (u64)(~((u64)0)); 4863 4864 max = div_u64(max, NSEC_PER_MSEC); 4865 if (ms >= max) 4866 return -ERANGE; 4867 4868 ms *= NSEC_PER_MSEC; 4869 *result = nsecs_to_jiffies64(ms) ? : !!ms; 4870 return 0; 4871 } 4872 4873 __be64 nf_jiffies64_to_msecs(u64 input) 4874 { 4875 return cpu_to_be64(jiffies64_to_msecs(input)); 4876 } 4877 4878 static int nf_tables_fill_set_concat(struct sk_buff *skb, 4879 const struct nft_set *set) 4880 { 4881 struct nlattr *concat, *field; 4882 int i; 4883 4884 concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT); 4885 if (!concat) 4886 return -ENOMEM; 4887 4888 for (i = 0; i < set->field_count; i++) { 4889 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 4890 if (!field) 4891 return -ENOMEM; 4892 4893 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN, 4894 htonl(set->field_len[i]))) 4895 return -ENOMEM; 4896 4897 nla_nest_end(skb, field); 4898 } 4899 4900 nla_nest_end(skb, concat); 4901 4902 return 0; 4903 } 4904 4905 static u32 nft_set_userspace_size(const struct nft_set_ops *ops, u32 size) 4906 { 4907 if (ops->usize) 4908 return ops->usize(size); 4909 4910 return size; 4911 } 4912 4913 static noinline_for_stack int 4914 nf_tables_fill_set_info(struct sk_buff *skb, const struct nft_set *set) 4915 { 4916 unsigned int nelems; 4917 char str[40]; 4918 int ret; 4919 4920 ret = snprintf(str, sizeof(str), "%ps", set->ops); 4921 4922 /* Not expected to happen and harmless: NFTA_SET_TYPE is dumped 4923 * to userspace purely for informational/debug purposes. 4924 */ 4925 DEBUG_NET_WARN_ON_ONCE(ret >= sizeof(str)); 4926 4927 if (nla_put_string(skb, NFTA_SET_TYPE, str)) 4928 return -EMSGSIZE; 4929 4930 nelems = nft_set_userspace_size(set->ops, atomic_read(&set->nelems)); 4931 return nla_put_be32(skb, NFTA_SET_COUNT, htonl(nelems)); 4932 } 4933 4934 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 4935 const struct nft_set *set, u16 event, u16 flags) 4936 { 4937 u64 timeout = READ_ONCE(set->timeout); 4938 u32 gc_int = READ_ONCE(set->gc_int); 4939 u32 portid = ctx->portid; 4940 struct nlmsghdr *nlh; 4941 struct nlattr *nest; 4942 u32 seq = ctx->seq; 4943 int i; 4944 4945 nlh = nfnl_msg_put(skb, portid, seq, 4946 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 4947 flags, ctx->family, NFNETLINK_V0, 4948 nft_base_seq_be16(ctx->net)); 4949 if (!nlh) 4950 goto nla_put_failure; 4951 4952 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 4953 goto nla_put_failure; 4954 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 4955 goto nla_put_failure; 4956 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle), 4957 NFTA_SET_PAD)) 4958 goto nla_put_failure; 4959 4960 if (event == NFT_MSG_DELSET || 4961 event == NFT_MSG_DESTROYSET) { 4962 nlmsg_end(skb, nlh); 4963 return 0; 4964 } 4965 4966 if (set->flags != 0) 4967 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags))) 4968 goto nla_put_failure; 4969 4970 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype))) 4971 goto nla_put_failure; 4972 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen))) 4973 goto nla_put_failure; 4974 if (set->flags & NFT_SET_MAP) { 4975 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype))) 4976 goto nla_put_failure; 4977 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen))) 4978 goto nla_put_failure; 4979 } 4980 if (set->flags & NFT_SET_OBJECT && 4981 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype))) 4982 goto nla_put_failure; 4983 4984 if (timeout && 4985 nla_put_be64(skb, NFTA_SET_TIMEOUT, 4986 nf_jiffies64_to_msecs(timeout), 4987 NFTA_SET_PAD)) 4988 goto nla_put_failure; 4989 if (gc_int && 4990 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(gc_int))) 4991 goto nla_put_failure; 4992 4993 if (set->policy != NFT_SET_POL_PERFORMANCE) { 4994 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy))) 4995 goto nla_put_failure; 4996 } 4997 4998 if (set->udata && 4999 nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) 5000 goto nla_put_failure; 5001 5002 nest = nla_nest_start_noflag(skb, NFTA_SET_DESC); 5003 if (!nest) 5004 goto nla_put_failure; 5005 if (set->size && 5006 nla_put_be32(skb, NFTA_SET_DESC_SIZE, 5007 htonl(nft_set_userspace_size(set->ops, set->size)))) 5008 goto nla_put_failure; 5009 5010 if (set->field_count > 1 && 5011 nf_tables_fill_set_concat(skb, set)) 5012 goto nla_put_failure; 5013 5014 nla_nest_end(skb, nest); 5015 5016 if (nf_tables_fill_set_info(skb, set)) 5017 goto nla_put_failure; 5018 5019 if (set->num_exprs == 1) { 5020 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR); 5021 if (nf_tables_fill_expr_info(skb, set->exprs[0], false) < 0) 5022 goto nla_put_failure; 5023 5024 nla_nest_end(skb, nest); 5025 } else if (set->num_exprs > 1) { 5026 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPRESSIONS); 5027 if (nest == NULL) 5028 goto nla_put_failure; 5029 5030 for (i = 0; i < set->num_exprs; i++) { 5031 if (nft_expr_dump(skb, NFTA_LIST_ELEM, 5032 set->exprs[i], false) < 0) 5033 goto nla_put_failure; 5034 } 5035 nla_nest_end(skb, nest); 5036 } 5037 5038 nlmsg_end(skb, nlh); 5039 return 0; 5040 5041 nla_put_failure: 5042 nlmsg_trim(skb, nlh); 5043 return -1; 5044 } 5045 5046 static void nf_tables_set_notify(const struct nft_ctx *ctx, 5047 const struct nft_set *set, int event, 5048 gfp_t gfp_flags) 5049 { 5050 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 5051 u32 portid = ctx->portid; 5052 struct sk_buff *skb; 5053 u16 flags = 0; 5054 int err; 5055 5056 if (!ctx->report && 5057 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 5058 return; 5059 5060 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags); 5061 if (skb == NULL) 5062 goto err; 5063 5064 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 5065 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 5066 5067 err = nf_tables_fill_set(skb, ctx, set, event, flags); 5068 if (err < 0) { 5069 kfree_skb(skb); 5070 goto err; 5071 } 5072 5073 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 5074 return; 5075 err: 5076 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 5077 } 5078 5079 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb) 5080 { 5081 const struct nft_set *set; 5082 unsigned int idx, s_idx = cb->args[0]; 5083 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2]; 5084 struct net *net = sock_net(skb->sk); 5085 struct nft_ctx *ctx = cb->data, ctx_set; 5086 struct nftables_pernet *nft_net; 5087 5088 if (cb->args[1]) 5089 return skb->len; 5090 5091 rcu_read_lock(); 5092 nft_net = nft_pernet(net); 5093 cb->seq = nft_base_seq(net); 5094 5095 list_for_each_entry_rcu(table, &nft_net->tables, list) { 5096 if (ctx->family != NFPROTO_UNSPEC && 5097 ctx->family != table->family) 5098 continue; 5099 5100 if (ctx->table && ctx->table != table) 5101 continue; 5102 5103 if (cur_table) { 5104 if (cur_table != table) 5105 continue; 5106 5107 cur_table = NULL; 5108 } 5109 idx = 0; 5110 list_for_each_entry_rcu(set, &table->sets, list) { 5111 if (idx < s_idx) 5112 goto cont; 5113 if (!nft_is_active(net, set)) 5114 goto cont; 5115 5116 ctx_set = *ctx; 5117 ctx_set.table = table; 5118 ctx_set.family = table->family; 5119 5120 if (nf_tables_fill_set(skb, &ctx_set, set, 5121 NFT_MSG_NEWSET, 5122 NLM_F_MULTI) < 0) { 5123 cb->args[0] = idx; 5124 cb->args[2] = (unsigned long) table; 5125 goto done; 5126 } 5127 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 5128 cont: 5129 idx++; 5130 } 5131 if (s_idx) 5132 s_idx = 0; 5133 } 5134 cb->args[1] = 1; 5135 done: 5136 rcu_read_unlock(); 5137 return skb->len; 5138 } 5139 5140 static int nf_tables_dump_sets_start(struct netlink_callback *cb) 5141 { 5142 struct nft_ctx *ctx_dump = NULL; 5143 5144 ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC); 5145 if (ctx_dump == NULL) 5146 return -ENOMEM; 5147 5148 cb->data = ctx_dump; 5149 return 0; 5150 } 5151 5152 static int nf_tables_dump_sets_done(struct netlink_callback *cb) 5153 { 5154 kfree(cb->data); 5155 return 0; 5156 } 5157 5158 /* called with rcu_read_lock held */ 5159 static int nf_tables_getset(struct sk_buff *skb, const struct nfnl_info *info, 5160 const struct nlattr * const nla[]) 5161 { 5162 struct netlink_ext_ack *extack = info->extack; 5163 u8 genmask = nft_genmask_cur(info->net); 5164 u8 family = info->nfmsg->nfgen_family; 5165 struct nft_table *table = NULL; 5166 struct net *net = info->net; 5167 const struct nft_set *set; 5168 struct sk_buff *skb2; 5169 struct nft_ctx ctx; 5170 int err; 5171 5172 if (nla[NFTA_SET_TABLE]) { 5173 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 5174 genmask, 0); 5175 if (IS_ERR(table)) { 5176 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5177 return PTR_ERR(table); 5178 } 5179 } 5180 5181 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5182 5183 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 5184 struct netlink_dump_control c = { 5185 .start = nf_tables_dump_sets_start, 5186 .dump = nf_tables_dump_sets, 5187 .done = nf_tables_dump_sets_done, 5188 .data = &ctx, 5189 .module = THIS_MODULE, 5190 }; 5191 5192 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 5193 } 5194 5195 /* Only accept unspec with dump */ 5196 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 5197 return -EAFNOSUPPORT; 5198 if (!nla[NFTA_SET_TABLE]) 5199 return -EINVAL; 5200 5201 set = nft_set_lookup(net, table, nla[NFTA_SET_NAME], genmask); 5202 if (IS_ERR(set)) { 5203 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5204 return PTR_ERR(set); 5205 } 5206 5207 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 5208 if (skb2 == NULL) 5209 return -ENOMEM; 5210 5211 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); 5212 if (err < 0) 5213 goto err_fill_set_info; 5214 5215 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 5216 5217 err_fill_set_info: 5218 kfree_skb(skb2); 5219 return err; 5220 } 5221 5222 static int nft_set_desc_concat_parse(const struct nlattr *attr, 5223 struct nft_set_desc *desc) 5224 { 5225 struct nlattr *tb[NFTA_SET_FIELD_MAX + 1]; 5226 u32 len; 5227 int err; 5228 5229 if (desc->field_count >= ARRAY_SIZE(desc->field_len)) 5230 return -E2BIG; 5231 5232 err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr, 5233 nft_concat_policy, NULL); 5234 if (err < 0) 5235 return err; 5236 5237 if (!tb[NFTA_SET_FIELD_LEN]) 5238 return -EINVAL; 5239 5240 len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN])); 5241 if (!len || len > U8_MAX) 5242 return -EINVAL; 5243 5244 desc->field_len[desc->field_count++] = len; 5245 5246 return 0; 5247 } 5248 5249 static int nft_set_desc_concat(struct nft_set_desc *desc, 5250 const struct nlattr *nla) 5251 { 5252 u32 len = 0, num_regs; 5253 struct nlattr *attr; 5254 int rem, err, i; 5255 5256 nla_for_each_nested(attr, nla, rem) { 5257 if (nla_type(attr) != NFTA_LIST_ELEM) 5258 return -EINVAL; 5259 5260 err = nft_set_desc_concat_parse(attr, desc); 5261 if (err < 0) 5262 return err; 5263 } 5264 5265 for (i = 0; i < desc->field_count; i++) 5266 len += round_up(desc->field_len[i], sizeof(u32)); 5267 5268 if (len != desc->klen) 5269 return -EINVAL; 5270 5271 num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); 5272 if (num_regs > NFT_REG32_COUNT) 5273 return -E2BIG; 5274 5275 return 0; 5276 } 5277 5278 static int nf_tables_set_desc_parse(struct nft_set_desc *desc, 5279 const struct nlattr *nla) 5280 { 5281 struct nlattr *da[NFTA_SET_DESC_MAX + 1]; 5282 int err; 5283 5284 err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla, 5285 nft_set_desc_policy, NULL); 5286 if (err < 0) 5287 return err; 5288 5289 if (da[NFTA_SET_DESC_SIZE] != NULL) 5290 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE])); 5291 if (da[NFTA_SET_DESC_CONCAT]) 5292 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]); 5293 5294 return err; 5295 } 5296 5297 static int nft_set_expr_alloc(struct nft_ctx *ctx, struct nft_set *set, 5298 const struct nlattr * const *nla, 5299 struct nft_expr **exprs, int *num_exprs, 5300 u32 flags) 5301 { 5302 struct nft_expr *expr; 5303 int err, i; 5304 5305 if (nla[NFTA_SET_EXPR]) { 5306 expr = nft_set_elem_expr_alloc(ctx, set, nla[NFTA_SET_EXPR]); 5307 if (IS_ERR(expr)) { 5308 err = PTR_ERR(expr); 5309 goto err_set_expr_alloc; 5310 } 5311 exprs[0] = expr; 5312 (*num_exprs)++; 5313 } else if (nla[NFTA_SET_EXPRESSIONS]) { 5314 struct nlattr *tmp; 5315 int left; 5316 5317 if (!(flags & NFT_SET_EXPR)) { 5318 err = -EINVAL; 5319 goto err_set_expr_alloc; 5320 } 5321 i = 0; 5322 nla_for_each_nested(tmp, nla[NFTA_SET_EXPRESSIONS], left) { 5323 if (i == NFT_SET_EXPR_MAX) { 5324 err = -E2BIG; 5325 goto err_set_expr_alloc; 5326 } 5327 if (nla_type(tmp) != NFTA_LIST_ELEM) { 5328 err = -EINVAL; 5329 goto err_set_expr_alloc; 5330 } 5331 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 5332 if (IS_ERR(expr)) { 5333 err = PTR_ERR(expr); 5334 goto err_set_expr_alloc; 5335 } 5336 exprs[i++] = expr; 5337 (*num_exprs)++; 5338 } 5339 } 5340 5341 return 0; 5342 5343 err_set_expr_alloc: 5344 for (i = 0; i < *num_exprs; i++) 5345 nft_expr_destroy(ctx, exprs[i]); 5346 5347 return err; 5348 } 5349 5350 static bool nft_set_is_same(const struct nft_set *set, 5351 const struct nft_set_desc *desc, 5352 struct nft_expr *exprs[], u32 num_exprs, u32 flags) 5353 { 5354 int i; 5355 5356 if (set->ktype != desc->ktype || 5357 set->dtype != desc->dtype || 5358 set->flags != flags || 5359 set->klen != desc->klen || 5360 set->dlen != desc->dlen || 5361 set->field_count != desc->field_count || 5362 set->num_exprs != num_exprs) 5363 return false; 5364 5365 for (i = 0; i < desc->field_count; i++) { 5366 if (set->field_len[i] != desc->field_len[i]) 5367 return false; 5368 } 5369 5370 for (i = 0; i < num_exprs; i++) { 5371 if (set->exprs[i]->ops != exprs[i]->ops) 5372 return false; 5373 } 5374 5375 return true; 5376 } 5377 5378 static u32 nft_set_kernel_size(const struct nft_set_ops *ops, 5379 const struct nft_set_desc *desc) 5380 { 5381 if (ops->ksize) 5382 return ops->ksize(desc->size); 5383 5384 return desc->size; 5385 } 5386 5387 static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info, 5388 const struct nlattr * const nla[]) 5389 { 5390 struct netlink_ext_ack *extack = info->extack; 5391 u8 genmask = nft_genmask_next(info->net); 5392 u8 family = info->nfmsg->nfgen_family; 5393 const struct nft_set_ops *ops; 5394 struct net *net = info->net; 5395 struct nft_set_desc desc; 5396 struct nft_table *table; 5397 unsigned char *udata; 5398 struct nft_set *set; 5399 struct nft_ctx ctx; 5400 size_t alloc_size; 5401 int num_exprs = 0; 5402 char *name; 5403 int err, i; 5404 u16 udlen; 5405 u32 flags; 5406 u64 size; 5407 5408 if (nla[NFTA_SET_TABLE] == NULL || 5409 nla[NFTA_SET_NAME] == NULL || 5410 nla[NFTA_SET_KEY_LEN] == NULL || 5411 nla[NFTA_SET_ID] == NULL) 5412 return -EINVAL; 5413 5414 memset(&desc, 0, sizeof(desc)); 5415 5416 desc.ktype = NFT_DATA_VALUE; 5417 if (nla[NFTA_SET_KEY_TYPE] != NULL) { 5418 desc.ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE])); 5419 if ((desc.ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK) 5420 return -EINVAL; 5421 } 5422 5423 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN])); 5424 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN) 5425 return -EINVAL; 5426 5427 flags = 0; 5428 if (nla[NFTA_SET_FLAGS] != NULL) { 5429 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS])); 5430 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT | 5431 NFT_SET_INTERVAL | NFT_SET_TIMEOUT | 5432 NFT_SET_MAP | NFT_SET_EVAL | 5433 NFT_SET_OBJECT | NFT_SET_CONCAT | NFT_SET_EXPR)) 5434 return -EOPNOTSUPP; 5435 /* Only one of these operations is supported */ 5436 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) == 5437 (NFT_SET_MAP | NFT_SET_OBJECT)) 5438 return -EOPNOTSUPP; 5439 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) == 5440 (NFT_SET_EVAL | NFT_SET_OBJECT)) 5441 return -EOPNOTSUPP; 5442 if ((flags & (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT | NFT_SET_EVAL)) == 5443 (NFT_SET_ANONYMOUS | NFT_SET_TIMEOUT)) 5444 return -EOPNOTSUPP; 5445 if ((flags & (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) == 5446 (NFT_SET_CONSTANT | NFT_SET_TIMEOUT)) 5447 return -EOPNOTSUPP; 5448 } 5449 5450 desc.dtype = 0; 5451 if (nla[NFTA_SET_DATA_TYPE] != NULL) { 5452 if (!(flags & NFT_SET_MAP)) 5453 return -EINVAL; 5454 5455 desc.dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE])); 5456 if ((desc.dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK && 5457 desc.dtype != NFT_DATA_VERDICT) 5458 return -EINVAL; 5459 5460 if (desc.dtype != NFT_DATA_VERDICT) { 5461 if (nla[NFTA_SET_DATA_LEN] == NULL) 5462 return -EINVAL; 5463 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN])); 5464 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN) 5465 return -EINVAL; 5466 } else 5467 desc.dlen = sizeof(struct nft_verdict); 5468 } else if (flags & NFT_SET_MAP) 5469 return -EINVAL; 5470 5471 if (nla[NFTA_SET_OBJ_TYPE] != NULL) { 5472 if (!(flags & NFT_SET_OBJECT)) 5473 return -EINVAL; 5474 5475 desc.objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE])); 5476 if (desc.objtype == NFT_OBJECT_UNSPEC || 5477 desc.objtype > NFT_OBJECT_MAX) 5478 return -EOPNOTSUPP; 5479 } else if (flags & NFT_SET_OBJECT) 5480 return -EINVAL; 5481 else 5482 desc.objtype = NFT_OBJECT_UNSPEC; 5483 5484 desc.timeout = 0; 5485 if (nla[NFTA_SET_TIMEOUT] != NULL) { 5486 if (!(flags & NFT_SET_TIMEOUT)) 5487 return -EINVAL; 5488 5489 if (flags & NFT_SET_ANONYMOUS) 5490 return -EOPNOTSUPP; 5491 5492 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &desc.timeout); 5493 if (err) 5494 return err; 5495 } 5496 desc.gc_int = 0; 5497 if (nla[NFTA_SET_GC_INTERVAL] != NULL) { 5498 if (!(flags & NFT_SET_TIMEOUT)) 5499 return -EINVAL; 5500 5501 if (flags & NFT_SET_ANONYMOUS) 5502 return -EOPNOTSUPP; 5503 5504 desc.gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL])); 5505 } 5506 5507 desc.policy = NFT_SET_POL_PERFORMANCE; 5508 if (nla[NFTA_SET_POLICY] != NULL) { 5509 desc.policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY])); 5510 switch (desc.policy) { 5511 case NFT_SET_POL_PERFORMANCE: 5512 case NFT_SET_POL_MEMORY: 5513 break; 5514 default: 5515 return -EOPNOTSUPP; 5516 } 5517 } 5518 5519 if (nla[NFTA_SET_DESC] != NULL) { 5520 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]); 5521 if (err < 0) 5522 return err; 5523 5524 if (desc.field_count > 1) { 5525 if (!(flags & NFT_SET_CONCAT)) 5526 return -EINVAL; 5527 } else if (flags & NFT_SET_CONCAT) { 5528 return -EINVAL; 5529 } 5530 } else if (flags & NFT_SET_CONCAT) { 5531 return -EINVAL; 5532 } 5533 5534 if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS]) 5535 desc.expr = true; 5536 5537 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask, 5538 NETLINK_CB(skb).portid); 5539 if (IS_ERR(table)) { 5540 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5541 return PTR_ERR(table); 5542 } 5543 5544 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5545 5546 set = nft_set_lookup(net, table, nla[NFTA_SET_NAME], genmask); 5547 if (IS_ERR(set)) { 5548 if (PTR_ERR(set) != -ENOENT) { 5549 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5550 return PTR_ERR(set); 5551 } 5552 } else { 5553 struct nft_expr *exprs[NFT_SET_EXPR_MAX] = {}; 5554 5555 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 5556 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5557 return -EEXIST; 5558 } 5559 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 5560 return -EOPNOTSUPP; 5561 5562 if (nft_set_is_anonymous(set)) 5563 return -EOPNOTSUPP; 5564 5565 err = nft_set_expr_alloc(&ctx, set, nla, exprs, &num_exprs, flags); 5566 if (err < 0) 5567 return err; 5568 5569 if (desc.size) 5570 desc.size = nft_set_kernel_size(set->ops, &desc); 5571 5572 err = 0; 5573 if (!nft_set_is_same(set, &desc, exprs, num_exprs, flags)) { 5574 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]); 5575 err = -EEXIST; 5576 } 5577 5578 for (i = 0; i < num_exprs; i++) 5579 nft_expr_destroy(&ctx, exprs[i]); 5580 5581 if (err < 0) 5582 return err; 5583 5584 return __nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set, &desc); 5585 } 5586 5587 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE)) 5588 return -ENOENT; 5589 5590 ops = nft_select_set_ops(&ctx, flags, &desc); 5591 if (IS_ERR(ops)) 5592 return PTR_ERR(ops); 5593 5594 if (desc.size) 5595 desc.size = nft_set_kernel_size(ops, &desc); 5596 5597 udlen = 0; 5598 if (nla[NFTA_SET_USERDATA]) 5599 udlen = nla_len(nla[NFTA_SET_USERDATA]); 5600 5601 size = 0; 5602 if (ops->privsize != NULL) 5603 size = ops->privsize(nla, &desc); 5604 alloc_size = sizeof(*set) + size + udlen; 5605 if (alloc_size < size || alloc_size > INT_MAX) 5606 return -ENOMEM; 5607 5608 if (!nft_use_inc(&table->use)) 5609 return -EMFILE; 5610 5611 set = kvzalloc(alloc_size, GFP_KERNEL_ACCOUNT); 5612 if (!set) { 5613 err = -ENOMEM; 5614 goto err_alloc; 5615 } 5616 5617 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL_ACCOUNT); 5618 if (!name) { 5619 err = -ENOMEM; 5620 goto err_set_name; 5621 } 5622 5623 err = nf_tables_set_alloc_name(&ctx, set, name); 5624 kfree(name); 5625 if (err < 0) 5626 goto err_set_name; 5627 5628 udata = NULL; 5629 if (udlen) { 5630 udata = set->data + size; 5631 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen); 5632 } 5633 5634 INIT_LIST_HEAD(&set->bindings); 5635 INIT_LIST_HEAD(&set->catchall_list); 5636 refcount_set(&set->refs, 1); 5637 set->table = table; 5638 write_pnet(&set->net, net); 5639 set->ops = ops; 5640 set->ktype = desc.ktype; 5641 set->klen = desc.klen; 5642 set->dtype = desc.dtype; 5643 set->objtype = desc.objtype; 5644 set->dlen = desc.dlen; 5645 set->flags = flags; 5646 set->size = desc.size; 5647 set->policy = desc.policy; 5648 set->udlen = udlen; 5649 set->udata = udata; 5650 set->timeout = desc.timeout; 5651 set->gc_int = desc.gc_int; 5652 5653 set->field_count = desc.field_count; 5654 for (i = 0; i < desc.field_count; i++) 5655 set->field_len[i] = desc.field_len[i]; 5656 5657 err = ops->init(set, &desc, nla); 5658 if (err < 0) 5659 goto err_set_init; 5660 5661 err = nft_set_expr_alloc(&ctx, set, nla, set->exprs, &num_exprs, flags); 5662 if (err < 0) 5663 goto err_set_destroy; 5664 5665 set->num_exprs = num_exprs; 5666 set->handle = nf_tables_alloc_handle(table); 5667 INIT_LIST_HEAD(&set->pending_update); 5668 5669 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); 5670 if (err < 0) 5671 goto err_set_expr_alloc; 5672 5673 list_add_tail_rcu(&set->list, &table->sets); 5674 5675 return 0; 5676 5677 err_set_expr_alloc: 5678 for (i = 0; i < set->num_exprs; i++) 5679 nft_expr_destroy(&ctx, set->exprs[i]); 5680 err_set_destroy: 5681 ops->destroy(&ctx, set); 5682 err_set_init: 5683 kfree(set->name); 5684 err_set_name: 5685 kvfree(set); 5686 err_alloc: 5687 nft_use_dec_restore(&table->use); 5688 5689 return err; 5690 } 5691 5692 static void nft_set_catchall_destroy(const struct nft_ctx *ctx, 5693 struct nft_set *set) 5694 { 5695 struct nft_set_elem_catchall *next, *catchall; 5696 5697 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 5698 list_del_rcu(&catchall->list); 5699 nf_tables_set_elem_destroy(ctx, set, catchall->elem); 5700 kfree_rcu(catchall, rcu); 5701 } 5702 } 5703 5704 static void nft_set_put(struct nft_set *set) 5705 { 5706 if (refcount_dec_and_test(&set->refs)) { 5707 kfree(set->name); 5708 kvfree(set); 5709 } 5710 } 5711 5712 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set) 5713 { 5714 int i; 5715 5716 if (WARN_ON(set->use > 0)) 5717 return; 5718 5719 for (i = 0; i < set->num_exprs; i++) 5720 nft_expr_destroy(ctx, set->exprs[i]); 5721 5722 set->ops->destroy(ctx, set); 5723 nft_set_catchall_destroy(ctx, set); 5724 nft_set_put(set); 5725 } 5726 5727 static int nf_tables_delset(struct sk_buff *skb, const struct nfnl_info *info, 5728 const struct nlattr * const nla[]) 5729 { 5730 struct netlink_ext_ack *extack = info->extack; 5731 u8 genmask = nft_genmask_next(info->net); 5732 u8 family = info->nfmsg->nfgen_family; 5733 struct net *net = info->net; 5734 const struct nlattr *attr; 5735 struct nft_table *table; 5736 struct nft_set *set; 5737 struct nft_ctx ctx; 5738 5739 if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC) 5740 return -EAFNOSUPPORT; 5741 5742 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, 5743 genmask, NETLINK_CB(skb).portid); 5744 if (IS_ERR(table)) { 5745 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]); 5746 return PTR_ERR(table); 5747 } 5748 5749 if (nla[NFTA_SET_HANDLE]) { 5750 attr = nla[NFTA_SET_HANDLE]; 5751 set = nft_set_lookup_byhandle(table, attr, genmask); 5752 } else { 5753 attr = nla[NFTA_SET_NAME]; 5754 set = nft_set_lookup(net, table, attr, genmask); 5755 } 5756 5757 if (IS_ERR(set)) { 5758 if (PTR_ERR(set) == -ENOENT && 5759 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSET) 5760 return 0; 5761 5762 NL_SET_BAD_ATTR(extack, attr); 5763 return PTR_ERR(set); 5764 } 5765 if (set->use || 5766 (info->nlh->nlmsg_flags & NLM_F_NONREC && 5767 atomic_read(&set->nelems) > 0)) { 5768 NL_SET_BAD_ATTR(extack, attr); 5769 return -EBUSY; 5770 } 5771 5772 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 5773 5774 return nft_delset(&ctx, set); 5775 } 5776 5777 static int nft_validate_register_store(const struct nft_ctx *ctx, 5778 enum nft_registers reg, 5779 const struct nft_data *data, 5780 enum nft_data_types type, 5781 unsigned int len); 5782 5783 static int nft_setelem_data_validate(const struct nft_ctx *ctx, 5784 struct nft_set *set, 5785 struct nft_elem_priv *elem_priv) 5786 { 5787 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 5788 enum nft_registers dreg; 5789 5790 dreg = nft_type_to_reg(set->dtype); 5791 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext), 5792 set->dtype == NFT_DATA_VERDICT ? 5793 NFT_DATA_VERDICT : NFT_DATA_VALUE, 5794 set->dlen); 5795 } 5796 5797 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, 5798 struct nft_set *set, 5799 const struct nft_set_iter *iter, 5800 struct nft_elem_priv *elem_priv) 5801 { 5802 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 5803 5804 if (!nft_set_elem_active(ext, iter->genmask)) 5805 return 0; 5806 5807 return nft_setelem_data_validate(ctx, set, elem_priv); 5808 } 5809 5810 static int nft_set_catchall_bind_check(const struct nft_ctx *ctx, 5811 struct nft_set *set) 5812 { 5813 u8 genmask = nft_genmask_next(ctx->net); 5814 struct nft_set_elem_catchall *catchall; 5815 struct nft_set_ext *ext; 5816 int ret = 0; 5817 5818 list_for_each_entry_rcu(catchall, &set->catchall_list, list, 5819 lockdep_commit_lock_is_held(ctx->net)) { 5820 ext = nft_set_elem_ext(set, catchall->elem); 5821 if (!nft_set_elem_active(ext, genmask)) 5822 continue; 5823 5824 ret = nft_setelem_data_validate(ctx, set, catchall->elem); 5825 if (ret < 0) 5826 break; 5827 } 5828 5829 return ret; 5830 } 5831 5832 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 5833 struct nft_set_binding *binding) 5834 { 5835 struct nft_set_binding *i; 5836 struct nft_set_iter iter = { 5837 .genmask = nft_genmask_next(ctx->net), 5838 .type = NFT_ITER_UPDATE, 5839 .fn = nf_tables_bind_check_setelem, 5840 }; 5841 5842 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5843 return -EBUSY; 5844 5845 if (binding->flags & NFT_SET_MAP) { 5846 /* If the set is already bound to the same chain all 5847 * jumps are already validated for that chain. 5848 */ 5849 list_for_each_entry(i, &set->bindings, list) { 5850 if (i->flags & NFT_SET_MAP && 5851 i->chain == binding->chain) 5852 goto bind; 5853 } 5854 5855 set->ops->walk(ctx, set, &iter); 5856 if (!iter.err) 5857 iter.err = nft_set_catchall_bind_check(ctx, set); 5858 5859 if (iter.err < 0) 5860 return iter.err; 5861 } 5862 bind: 5863 if (!nft_use_inc(&set->use)) 5864 return -EMFILE; 5865 5866 binding->chain = ctx->chain; 5867 list_add_tail_rcu(&binding->list, &set->bindings); 5868 nft_set_trans_bind(ctx, set); 5869 5870 return 0; 5871 } 5872 EXPORT_SYMBOL_GPL(nf_tables_bind_set); 5873 5874 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 5875 struct nft_set_binding *binding, bool event) 5876 { 5877 list_del_rcu(&binding->list); 5878 5879 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) { 5880 list_del_rcu(&set->list); 5881 set->dead = 1; 5882 if (event) 5883 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, 5884 GFP_KERNEL); 5885 } 5886 } 5887 5888 static void nft_setelem_data_activate(const struct net *net, 5889 const struct nft_set *set, 5890 struct nft_elem_priv *elem_priv); 5891 5892 static int nft_mapelem_activate(const struct nft_ctx *ctx, 5893 struct nft_set *set, 5894 const struct nft_set_iter *iter, 5895 struct nft_elem_priv *elem_priv) 5896 { 5897 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 5898 5899 /* called from abort path, reverse check to undo changes. */ 5900 if (nft_set_elem_active(ext, iter->genmask)) 5901 return 0; 5902 5903 nft_clear(ctx->net, ext); 5904 nft_setelem_data_activate(ctx->net, set, elem_priv); 5905 5906 return 0; 5907 } 5908 5909 static void nft_map_catchall_activate(const struct nft_ctx *ctx, 5910 struct nft_set *set) 5911 { 5912 u8 genmask = nft_genmask_next(ctx->net); 5913 struct nft_set_elem_catchall *catchall; 5914 struct nft_set_ext *ext; 5915 5916 list_for_each_entry(catchall, &set->catchall_list, list) { 5917 ext = nft_set_elem_ext(set, catchall->elem); 5918 if (nft_set_elem_active(ext, genmask)) 5919 continue; 5920 5921 nft_clear(ctx->net, ext); 5922 nft_setelem_data_activate(ctx->net, set, catchall->elem); 5923 break; 5924 } 5925 } 5926 5927 static void nft_map_activate(const struct nft_ctx *ctx, struct nft_set *set) 5928 { 5929 struct nft_set_iter iter = { 5930 .genmask = nft_genmask_next(ctx->net), 5931 .type = NFT_ITER_UPDATE, 5932 .fn = nft_mapelem_activate, 5933 }; 5934 5935 set->ops->walk(ctx, set, &iter); 5936 WARN_ON_ONCE(iter.err); 5937 5938 nft_map_catchall_activate(ctx, set); 5939 } 5940 5941 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) 5942 { 5943 if (nft_set_is_anonymous(set)) { 5944 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5945 nft_map_activate(ctx, set); 5946 5947 nft_clear(ctx->net, set); 5948 } 5949 5950 nft_use_inc_restore(&set->use); 5951 } 5952 EXPORT_SYMBOL_GPL(nf_tables_activate_set); 5953 5954 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, 5955 struct nft_set_binding *binding, 5956 enum nft_trans_phase phase) 5957 { 5958 WARN_ON_ONCE(!lockdep_commit_lock_is_held(ctx->net)); 5959 5960 switch (phase) { 5961 case NFT_TRANS_PREPARE_ERROR: 5962 nft_set_trans_unbind(ctx, set); 5963 if (nft_set_is_anonymous(set)) 5964 nft_deactivate_next(ctx->net, set); 5965 else 5966 list_del_rcu(&binding->list); 5967 5968 nft_use_dec(&set->use); 5969 break; 5970 case NFT_TRANS_PREPARE: 5971 if (nft_set_is_anonymous(set)) { 5972 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5973 nft_map_deactivate(ctx, set); 5974 5975 nft_deactivate_next(ctx->net, set); 5976 } 5977 nft_use_dec(&set->use); 5978 return; 5979 case NFT_TRANS_ABORT: 5980 case NFT_TRANS_RELEASE: 5981 if (nft_set_is_anonymous(set) && 5982 set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 5983 nft_map_deactivate(ctx, set); 5984 5985 nft_use_dec(&set->use); 5986 fallthrough; 5987 default: 5988 nf_tables_unbind_set(ctx, set, binding, 5989 phase == NFT_TRANS_COMMIT); 5990 } 5991 } 5992 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set); 5993 5994 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set) 5995 { 5996 if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) 5997 nft_set_destroy(ctx, set); 5998 } 5999 EXPORT_SYMBOL_GPL(nf_tables_destroy_set); 6000 6001 const struct nft_set_ext_type nft_set_ext_types[] = { 6002 [NFT_SET_EXT_KEY] = { 6003 .align = __alignof__(u32), 6004 }, 6005 [NFT_SET_EXT_DATA] = { 6006 .align = __alignof__(u32), 6007 }, 6008 [NFT_SET_EXT_EXPRESSIONS] = { 6009 .align = __alignof__(struct nft_set_elem_expr), 6010 }, 6011 [NFT_SET_EXT_OBJREF] = { 6012 .len = sizeof(struct nft_object *), 6013 .align = __alignof__(struct nft_object *), 6014 }, 6015 [NFT_SET_EXT_FLAGS] = { 6016 .len = sizeof(u8), 6017 .align = __alignof__(u8), 6018 }, 6019 [NFT_SET_EXT_TIMEOUT] = { 6020 .len = sizeof(struct nft_timeout), 6021 .align = __alignof__(struct nft_timeout), 6022 }, 6023 [NFT_SET_EXT_USERDATA] = { 6024 .len = sizeof(struct nft_userdata), 6025 .align = __alignof__(struct nft_userdata), 6026 }, 6027 [NFT_SET_EXT_KEY_END] = { 6028 .align = __alignof__(u32), 6029 }, 6030 }; 6031 6032 /* 6033 * Set elements 6034 */ 6035 6036 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 6037 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED }, 6038 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED }, 6039 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 }, 6040 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, 6041 [NFTA_SET_ELEM_EXPIRATION] = { .type = NLA_U64 }, 6042 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, 6043 .len = NFT_USERDATA_MAXLEN }, 6044 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, 6045 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING, 6046 .len = NFT_OBJ_MAXNAMELEN - 1 }, 6047 [NFTA_SET_ELEM_KEY_END] = { .type = NLA_NESTED }, 6048 [NFTA_SET_ELEM_EXPRESSIONS] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy), 6049 }; 6050 6051 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { 6052 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING, 6053 .len = NFT_TABLE_MAXNAMELEN - 1 }, 6054 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING, 6055 .len = NFT_SET_MAXNAMELEN - 1 }, 6056 [NFTA_SET_ELEM_LIST_ELEMENTS] = NLA_POLICY_NESTED_ARRAY(nft_set_elem_policy), 6057 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 }, 6058 }; 6059 6060 static int nft_set_elem_expr_dump(struct sk_buff *skb, 6061 const struct nft_set *set, 6062 const struct nft_set_ext *ext, 6063 bool reset) 6064 { 6065 struct nft_set_elem_expr *elem_expr; 6066 u32 size, num_exprs = 0; 6067 struct nft_expr *expr; 6068 struct nlattr *nest; 6069 6070 elem_expr = nft_set_ext_expr(ext); 6071 nft_setelem_expr_foreach(expr, elem_expr, size) 6072 num_exprs++; 6073 6074 if (num_exprs == 1) { 6075 expr = nft_setelem_expr_at(elem_expr, 0); 6076 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr, reset) < 0) 6077 return -1; 6078 6079 return 0; 6080 } else if (num_exprs > 1) { 6081 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_EXPRESSIONS); 6082 if (nest == NULL) 6083 goto nla_put_failure; 6084 6085 nft_setelem_expr_foreach(expr, elem_expr, size) { 6086 expr = nft_setelem_expr_at(elem_expr, size); 6087 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr, reset) < 0) 6088 goto nla_put_failure; 6089 } 6090 nla_nest_end(skb, nest); 6091 } 6092 return 0; 6093 6094 nla_put_failure: 6095 return -1; 6096 } 6097 6098 static int nf_tables_fill_setelem(struct sk_buff *skb, 6099 const struct nft_set *set, 6100 const struct nft_elem_priv *elem_priv, 6101 bool reset) 6102 { 6103 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6104 unsigned char *b = skb_tail_pointer(skb); 6105 struct nlattr *nest; 6106 6107 nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM); 6108 if (nest == NULL) 6109 goto nla_put_failure; 6110 6111 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 6112 nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext), 6113 NFT_DATA_VALUE, set->klen) < 0) 6114 goto nla_put_failure; 6115 6116 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 6117 nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext), 6118 NFT_DATA_VALUE, set->klen) < 0) 6119 goto nla_put_failure; 6120 6121 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6122 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext), 6123 nft_set_datatype(set), set->dlen) < 0) 6124 goto nla_put_failure; 6125 6126 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) && 6127 nft_set_elem_expr_dump(skb, set, ext, reset)) 6128 goto nla_put_failure; 6129 6130 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 6131 nla_put_string(skb, NFTA_SET_ELEM_OBJREF, 6132 (*nft_set_ext_obj(ext))->key.name) < 0) 6133 goto nla_put_failure; 6134 6135 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 6136 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, 6137 htonl(*nft_set_ext_flags(ext)))) 6138 goto nla_put_failure; 6139 6140 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) { 6141 u64 timeout = READ_ONCE(nft_set_ext_timeout(ext)->timeout); 6142 u64 set_timeout = READ_ONCE(set->timeout); 6143 __be64 msecs = 0; 6144 6145 if (set_timeout != timeout) { 6146 msecs = nf_jiffies64_to_msecs(timeout); 6147 if (nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT, msecs, 6148 NFTA_SET_ELEM_PAD)) 6149 goto nla_put_failure; 6150 } 6151 6152 if (timeout > 0) { 6153 u64 expires, now = get_jiffies_64(); 6154 6155 expires = READ_ONCE(nft_set_ext_timeout(ext)->expiration); 6156 if (time_before64(now, expires)) 6157 expires -= now; 6158 else 6159 expires = 0; 6160 6161 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION, 6162 nf_jiffies64_to_msecs(expires), 6163 NFTA_SET_ELEM_PAD)) 6164 goto nla_put_failure; 6165 } 6166 } 6167 6168 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) { 6169 struct nft_userdata *udata; 6170 6171 udata = nft_set_ext_userdata(ext); 6172 if (nla_put(skb, NFTA_SET_ELEM_USERDATA, 6173 udata->len + 1, udata->data)) 6174 goto nla_put_failure; 6175 } 6176 6177 nla_nest_end(skb, nest); 6178 return 0; 6179 6180 nla_put_failure: 6181 nlmsg_trim(skb, b); 6182 return -EMSGSIZE; 6183 } 6184 6185 struct nft_set_dump_args { 6186 const struct netlink_callback *cb; 6187 struct nft_set_iter iter; 6188 struct sk_buff *skb; 6189 bool reset; 6190 }; 6191 6192 static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 6193 struct nft_set *set, 6194 const struct nft_set_iter *iter, 6195 struct nft_elem_priv *elem_priv) 6196 { 6197 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6198 struct nft_set_dump_args *args; 6199 6200 if (!nft_set_elem_active(ext, iter->genmask)) 6201 return 0; 6202 6203 if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext)) 6204 return 0; 6205 6206 args = container_of(iter, struct nft_set_dump_args, iter); 6207 return nf_tables_fill_setelem(args->skb, set, elem_priv, args->reset); 6208 } 6209 6210 static void audit_log_nft_set_reset(const struct nft_table *table, 6211 unsigned int base_seq, 6212 unsigned int nentries) 6213 { 6214 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq); 6215 6216 audit_log_nfcfg(buf, table->family, nentries, 6217 AUDIT_NFT_OP_SETELEM_RESET, GFP_ATOMIC); 6218 kfree(buf); 6219 } 6220 6221 struct nft_set_dump_ctx { 6222 const struct nft_set *set; 6223 struct nft_ctx ctx; 6224 bool reset; 6225 }; 6226 6227 static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb, 6228 const struct nft_set *set, bool reset, 6229 unsigned int base_seq) 6230 { 6231 struct nft_set_elem_catchall *catchall; 6232 u8 genmask = nft_genmask_cur(net); 6233 struct nft_set_ext *ext; 6234 int ret = 0; 6235 6236 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6237 ext = nft_set_elem_ext(set, catchall->elem); 6238 if (!nft_set_elem_active(ext, genmask) || 6239 nft_set_elem_expired(ext)) 6240 continue; 6241 6242 ret = nf_tables_fill_setelem(skb, set, catchall->elem, reset); 6243 if (reset && !ret) 6244 audit_log_nft_set_reset(set->table, base_seq, 1); 6245 break; 6246 } 6247 6248 return ret; 6249 } 6250 6251 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) 6252 { 6253 struct nft_set_dump_ctx *dump_ctx = cb->data; 6254 struct net *net = sock_net(skb->sk); 6255 struct nftables_pernet *nft_net; 6256 struct nft_table *table; 6257 struct nft_set *set; 6258 struct nft_set_dump_args args = { 6259 .cb = cb, 6260 .skb = skb, 6261 .reset = dump_ctx->reset, 6262 .iter = { 6263 .genmask = nft_genmask_cur(net), 6264 .type = NFT_ITER_READ, 6265 .skip = cb->args[0], 6266 .fn = nf_tables_dump_setelem, 6267 }, 6268 }; 6269 bool set_found = false; 6270 struct nlmsghdr *nlh; 6271 struct nlattr *nest; 6272 u32 portid, seq; 6273 int event; 6274 6275 rcu_read_lock(); 6276 nft_net = nft_pernet(net); 6277 cb->seq = nft_base_seq(net); 6278 6279 list_for_each_entry_rcu(table, &nft_net->tables, list) { 6280 if (dump_ctx->ctx.family != NFPROTO_UNSPEC && 6281 dump_ctx->ctx.family != table->family) 6282 continue; 6283 6284 if (table != dump_ctx->ctx.table) 6285 continue; 6286 6287 list_for_each_entry_rcu(set, &table->sets, list) { 6288 if (set == dump_ctx->set) { 6289 set_found = true; 6290 break; 6291 } 6292 } 6293 break; 6294 } 6295 6296 if (!set_found) { 6297 rcu_read_unlock(); 6298 return -ENOENT; 6299 } 6300 6301 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM); 6302 portid = NETLINK_CB(cb->skb).portid; 6303 seq = cb->nlh->nlmsg_seq; 6304 6305 nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, 6306 table->family, NFNETLINK_V0, nft_base_seq_be16(net)); 6307 if (!nlh) 6308 goto nla_put_failure; 6309 6310 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) 6311 goto nla_put_failure; 6312 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) 6313 goto nla_put_failure; 6314 6315 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 6316 if (nest == NULL) 6317 goto nla_put_failure; 6318 6319 set->ops->walk(&dump_ctx->ctx, set, &args.iter); 6320 6321 if (!args.iter.err && args.iter.count == cb->args[0]) 6322 args.iter.err = nft_set_catchall_dump(net, skb, set, 6323 dump_ctx->reset, cb->seq); 6324 nla_nest_end(skb, nest); 6325 nlmsg_end(skb, nlh); 6326 6327 rcu_read_unlock(); 6328 6329 if (args.iter.err && args.iter.err != -EMSGSIZE) 6330 return args.iter.err; 6331 if (args.iter.count == cb->args[0]) 6332 return 0; 6333 6334 cb->args[0] = args.iter.count; 6335 return skb->len; 6336 6337 nla_put_failure: 6338 rcu_read_unlock(); 6339 return -ENOSPC; 6340 } 6341 6342 static int nf_tables_dumpreset_set(struct sk_buff *skb, 6343 struct netlink_callback *cb) 6344 { 6345 struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); 6346 struct nft_set_dump_ctx *dump_ctx = cb->data; 6347 int ret, skip = cb->args[0]; 6348 6349 mutex_lock(&nft_net->commit_mutex); 6350 6351 ret = nf_tables_dump_set(skb, cb); 6352 6353 if (cb->args[0] > skip) 6354 audit_log_nft_set_reset(dump_ctx->ctx.table, cb->seq, 6355 cb->args[0] - skip); 6356 6357 mutex_unlock(&nft_net->commit_mutex); 6358 6359 return ret; 6360 } 6361 6362 static int nf_tables_dump_set_start(struct netlink_callback *cb) 6363 { 6364 struct nft_set_dump_ctx *dump_ctx = cb->data; 6365 6366 cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC); 6367 6368 return cb->data ? 0 : -ENOMEM; 6369 } 6370 6371 static int nf_tables_dump_set_done(struct netlink_callback *cb) 6372 { 6373 kfree(cb->data); 6374 return 0; 6375 } 6376 6377 static int nf_tables_fill_setelem_info(struct sk_buff *skb, 6378 const struct nft_ctx *ctx, u32 seq, 6379 u32 portid, int event, u16 flags, 6380 const struct nft_set *set, 6381 const struct nft_elem_priv *elem_priv, 6382 bool reset) 6383 { 6384 struct nlmsghdr *nlh; 6385 struct nlattr *nest; 6386 int err; 6387 6388 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); 6389 nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, 6390 NFNETLINK_V0, nft_base_seq_be16(ctx->net)); 6391 if (!nlh) 6392 goto nla_put_failure; 6393 6394 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) 6395 goto nla_put_failure; 6396 if (nla_put_string(skb, NFTA_SET_NAME, set->name)) 6397 goto nla_put_failure; 6398 6399 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS); 6400 if (nest == NULL) 6401 goto nla_put_failure; 6402 6403 err = nf_tables_fill_setelem(skb, set, elem_priv, reset); 6404 if (err < 0) 6405 goto nla_put_failure; 6406 6407 nla_nest_end(skb, nest); 6408 6409 nlmsg_end(skb, nlh); 6410 return 0; 6411 6412 nla_put_failure: 6413 nlmsg_trim(skb, nlh); 6414 return -1; 6415 } 6416 6417 static int nft_setelem_parse_flags(const struct nft_set *set, 6418 const struct nlattr *attr, u32 *flags) 6419 { 6420 if (attr == NULL) 6421 return 0; 6422 6423 *flags = ntohl(nla_get_be32(attr)); 6424 if (*flags & ~(NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 6425 return -EOPNOTSUPP; 6426 if (!(set->flags & NFT_SET_INTERVAL) && 6427 *flags & NFT_SET_ELEM_INTERVAL_END) 6428 return -EINVAL; 6429 if ((*flags & (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) == 6430 (NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL)) 6431 return -EINVAL; 6432 6433 return 0; 6434 } 6435 6436 static int nft_setelem_parse_key(struct nft_ctx *ctx, const struct nft_set *set, 6437 struct nft_data *key, struct nlattr *attr) 6438 { 6439 struct nft_data_desc desc = { 6440 .type = NFT_DATA_VALUE, 6441 .size = NFT_DATA_VALUE_MAXLEN, 6442 .len = set->klen, 6443 }; 6444 6445 return nft_data_init(ctx, key, &desc, attr); 6446 } 6447 6448 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, 6449 struct nft_data_desc *desc, 6450 struct nft_data *data, 6451 struct nlattr *attr) 6452 { 6453 u32 dtype; 6454 6455 if (set->dtype == NFT_DATA_VERDICT) 6456 dtype = NFT_DATA_VERDICT; 6457 else 6458 dtype = NFT_DATA_VALUE; 6459 6460 desc->type = dtype; 6461 desc->size = NFT_DATA_VALUE_MAXLEN; 6462 desc->len = set->dlen; 6463 desc->flags = NFT_DATA_DESC_SETELEM; 6464 6465 return nft_data_init(ctx, data, desc, attr); 6466 } 6467 6468 static void *nft_setelem_catchall_get(const struct net *net, 6469 const struct nft_set *set) 6470 { 6471 struct nft_set_elem_catchall *catchall; 6472 u8 genmask = nft_genmask_cur(net); 6473 struct nft_set_ext *ext; 6474 void *priv = NULL; 6475 6476 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 6477 ext = nft_set_elem_ext(set, catchall->elem); 6478 if (!nft_set_elem_active(ext, genmask) || 6479 nft_set_elem_expired(ext)) 6480 continue; 6481 6482 priv = catchall->elem; 6483 break; 6484 } 6485 6486 return priv; 6487 } 6488 6489 static int nft_setelem_get(struct nft_ctx *ctx, const struct nft_set *set, 6490 struct nft_set_elem *elem, u32 flags) 6491 { 6492 void *priv; 6493 6494 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 6495 priv = set->ops->get(ctx->net, set, elem, flags); 6496 if (IS_ERR(priv)) 6497 return PTR_ERR(priv); 6498 } else { 6499 priv = nft_setelem_catchall_get(ctx->net, set); 6500 if (!priv) 6501 return -ENOENT; 6502 } 6503 elem->priv = priv; 6504 6505 return 0; 6506 } 6507 6508 static int nft_get_set_elem(struct nft_ctx *ctx, const struct nft_set *set, 6509 const struct nlattr *attr, bool reset) 6510 { 6511 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 6512 struct nft_set_elem elem; 6513 struct sk_buff *skb; 6514 uint32_t flags = 0; 6515 int err; 6516 6517 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 6518 nft_set_elem_policy, NULL); 6519 if (err < 0) 6520 return err; 6521 6522 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 6523 if (err < 0) 6524 return err; 6525 6526 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 6527 return -EINVAL; 6528 6529 if (nla[NFTA_SET_ELEM_KEY]) { 6530 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 6531 nla[NFTA_SET_ELEM_KEY]); 6532 if (err < 0) 6533 return err; 6534 } 6535 6536 if (nla[NFTA_SET_ELEM_KEY_END]) { 6537 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 6538 nla[NFTA_SET_ELEM_KEY_END]); 6539 if (err < 0) 6540 return err; 6541 } 6542 6543 err = nft_setelem_get(ctx, set, &elem, flags); 6544 if (err < 0) 6545 return err; 6546 6547 err = -ENOMEM; 6548 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); 6549 if (skb == NULL) 6550 return err; 6551 6552 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, 6553 NFT_MSG_NEWSETELEM, 0, set, elem.priv, 6554 reset); 6555 if (err < 0) 6556 goto err_fill_setelem; 6557 6558 return nfnetlink_unicast(skb, ctx->net, ctx->portid); 6559 6560 err_fill_setelem: 6561 kfree_skb(skb); 6562 return err; 6563 } 6564 6565 static int nft_set_dump_ctx_init(struct nft_set_dump_ctx *dump_ctx, 6566 const struct sk_buff *skb, 6567 const struct nfnl_info *info, 6568 const struct nlattr * const nla[], 6569 bool reset) 6570 { 6571 struct netlink_ext_ack *extack = info->extack; 6572 u8 genmask = nft_genmask_cur(info->net); 6573 u8 family = info->nfmsg->nfgen_family; 6574 struct net *net = info->net; 6575 struct nft_table *table; 6576 struct nft_set *set; 6577 6578 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 6579 genmask, 0); 6580 if (IS_ERR(table)) { 6581 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 6582 return PTR_ERR(table); 6583 } 6584 6585 set = nft_set_lookup(net, table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 6586 if (IS_ERR(set)) { 6587 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_SET]); 6588 return PTR_ERR(set); 6589 } 6590 6591 nft_ctx_init(&dump_ctx->ctx, net, skb, 6592 info->nlh, family, table, NULL, nla); 6593 dump_ctx->set = set; 6594 dump_ctx->reset = reset; 6595 return 0; 6596 } 6597 6598 /* called with rcu_read_lock held */ 6599 static int nf_tables_getsetelem(struct sk_buff *skb, 6600 const struct nfnl_info *info, 6601 const struct nlattr * const nla[]) 6602 { 6603 struct netlink_ext_ack *extack = info->extack; 6604 struct nft_set_dump_ctx dump_ctx; 6605 struct nlattr *attr; 6606 int rem, err = 0; 6607 6608 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 6609 struct netlink_dump_control c = { 6610 .start = nf_tables_dump_set_start, 6611 .dump = nf_tables_dump_set, 6612 .done = nf_tables_dump_set_done, 6613 .module = THIS_MODULE, 6614 }; 6615 6616 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, false); 6617 if (err) 6618 return err; 6619 6620 c.data = &dump_ctx; 6621 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 6622 } 6623 6624 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6625 return -EINVAL; 6626 6627 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, false); 6628 if (err) 6629 return err; 6630 6631 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6632 err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, false); 6633 if (err < 0) { 6634 NL_SET_BAD_ATTR(extack, attr); 6635 break; 6636 } 6637 } 6638 6639 return err; 6640 } 6641 6642 static int nf_tables_getsetelem_reset(struct sk_buff *skb, 6643 const struct nfnl_info *info, 6644 const struct nlattr * const nla[]) 6645 { 6646 struct nftables_pernet *nft_net = nft_pernet(info->net); 6647 struct netlink_ext_ack *extack = info->extack; 6648 struct nft_set_dump_ctx dump_ctx; 6649 int rem, err = 0, nelems = 0; 6650 struct nlattr *attr; 6651 6652 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 6653 struct netlink_dump_control c = { 6654 .start = nf_tables_dump_set_start, 6655 .dump = nf_tables_dumpreset_set, 6656 .done = nf_tables_dump_set_done, 6657 .module = THIS_MODULE, 6658 }; 6659 6660 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, true); 6661 if (err) 6662 return err; 6663 6664 c.data = &dump_ctx; 6665 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 6666 } 6667 6668 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 6669 return -EINVAL; 6670 6671 if (!try_module_get(THIS_MODULE)) 6672 return -EINVAL; 6673 rcu_read_unlock(); 6674 mutex_lock(&nft_net->commit_mutex); 6675 rcu_read_lock(); 6676 6677 err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, true); 6678 if (err) 6679 goto out_unlock; 6680 6681 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 6682 err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, true); 6683 if (err < 0) { 6684 NL_SET_BAD_ATTR(extack, attr); 6685 break; 6686 } 6687 nelems++; 6688 } 6689 audit_log_nft_set_reset(dump_ctx.ctx.table, nft_base_seq(info->net), nelems); 6690 6691 out_unlock: 6692 rcu_read_unlock(); 6693 mutex_unlock(&nft_net->commit_mutex); 6694 rcu_read_lock(); 6695 module_put(THIS_MODULE); 6696 6697 return err; 6698 } 6699 6700 static void nf_tables_setelem_notify(const struct nft_ctx *ctx, 6701 const struct nft_set *set, 6702 const struct nft_elem_priv *elem_priv, 6703 int event) 6704 { 6705 struct nftables_pernet *nft_net; 6706 struct net *net = ctx->net; 6707 u32 portid = ctx->portid; 6708 struct sk_buff *skb; 6709 u16 flags = 0; 6710 int err; 6711 6712 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 6713 return; 6714 6715 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 6716 if (skb == NULL) 6717 goto err; 6718 6719 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 6720 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 6721 6722 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, 6723 set, elem_priv, false); 6724 if (err < 0) { 6725 kfree_skb(skb); 6726 goto err; 6727 } 6728 6729 nft_net = nft_pernet(net); 6730 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 6731 return; 6732 err: 6733 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 6734 } 6735 6736 static struct nft_trans *nft_trans_elem_alloc(const struct nft_ctx *ctx, 6737 int msg_type, 6738 struct nft_set *set) 6739 { 6740 struct nft_trans_elem *te; 6741 struct nft_trans *trans; 6742 6743 trans = nft_trans_alloc(ctx, msg_type, struct_size(te, elems, 1)); 6744 if (trans == NULL) 6745 return NULL; 6746 6747 te = nft_trans_container_elem(trans); 6748 te->nelems = 1; 6749 te->set = set; 6750 6751 return trans; 6752 } 6753 6754 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, 6755 const struct nft_set *set, 6756 const struct nlattr *attr) 6757 { 6758 struct nft_expr *expr; 6759 int err; 6760 6761 expr = nft_expr_init(ctx, attr); 6762 if (IS_ERR(expr)) 6763 return expr; 6764 6765 err = -EOPNOTSUPP; 6766 if (expr->ops->type->flags & NFT_EXPR_GC) { 6767 if (set->flags & NFT_SET_TIMEOUT) 6768 goto err_set_elem_expr; 6769 if (!set->ops->gc_init) 6770 goto err_set_elem_expr; 6771 set->ops->gc_init(set); 6772 } 6773 6774 return expr; 6775 6776 err_set_elem_expr: 6777 nft_expr_destroy(ctx, expr); 6778 return ERR_PTR(err); 6779 } 6780 6781 static int nft_set_ext_check(const struct nft_set_ext_tmpl *tmpl, u8 id, u32 len) 6782 { 6783 len += nft_set_ext_types[id].len; 6784 if (len > tmpl->ext_len[id] || 6785 len > U8_MAX) 6786 return -1; 6787 6788 return 0; 6789 } 6790 6791 static int nft_set_ext_memcpy(const struct nft_set_ext_tmpl *tmpl, u8 id, 6792 void *to, const void *from, u32 len) 6793 { 6794 if (nft_set_ext_check(tmpl, id, len) < 0) 6795 return -1; 6796 6797 memcpy(to, from, len); 6798 6799 return 0; 6800 } 6801 6802 struct nft_elem_priv *nft_set_elem_init(const struct nft_set *set, 6803 const struct nft_set_ext_tmpl *tmpl, 6804 const u32 *key, const u32 *key_end, 6805 const u32 *data, 6806 u64 timeout, u64 expiration, gfp_t gfp) 6807 { 6808 struct nft_set_ext *ext; 6809 void *elem; 6810 6811 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp); 6812 if (elem == NULL) 6813 return ERR_PTR(-ENOMEM); 6814 6815 ext = nft_set_elem_ext(set, elem); 6816 nft_set_ext_init(ext, tmpl); 6817 6818 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) && 6819 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY, 6820 nft_set_ext_key(ext), key, set->klen) < 0) 6821 goto err_ext_check; 6822 6823 if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) && 6824 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_KEY_END, 6825 nft_set_ext_key_end(ext), key_end, set->klen) < 0) 6826 goto err_ext_check; 6827 6828 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 6829 nft_set_ext_memcpy(tmpl, NFT_SET_EXT_DATA, 6830 nft_set_ext_data(ext), data, set->dlen) < 0) 6831 goto err_ext_check; 6832 6833 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT)) { 6834 nft_set_ext_timeout(ext)->timeout = timeout; 6835 6836 if (expiration == 0) 6837 expiration = timeout; 6838 6839 nft_set_ext_timeout(ext)->expiration = get_jiffies_64() + expiration; 6840 } 6841 6842 return elem; 6843 6844 err_ext_check: 6845 kfree(elem); 6846 6847 return ERR_PTR(-EINVAL); 6848 } 6849 6850 static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 6851 struct nft_expr *expr) 6852 { 6853 if (expr->ops->destroy_clone) { 6854 expr->ops->destroy_clone(ctx, expr); 6855 module_put(expr->ops->type->owner); 6856 } else { 6857 nf_tables_expr_destroy(ctx, expr); 6858 } 6859 } 6860 6861 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 6862 struct nft_set_elem_expr *elem_expr) 6863 { 6864 struct nft_expr *expr; 6865 u32 size; 6866 6867 nft_setelem_expr_foreach(expr, elem_expr, size) 6868 __nft_set_elem_expr_destroy(ctx, expr); 6869 } 6870 6871 /* Drop references and destroy. Called from gc, dynset and abort path. */ 6872 static void __nft_set_elem_destroy(const struct nft_ctx *ctx, 6873 const struct nft_set *set, 6874 const struct nft_elem_priv *elem_priv, 6875 bool destroy_expr) 6876 { 6877 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6878 6879 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE); 6880 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 6881 nft_data_release(nft_set_ext_data(ext), set->dtype); 6882 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 6883 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 6884 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 6885 nft_use_dec(&(*nft_set_ext_obj(ext))->use); 6886 6887 kfree(elem_priv); 6888 } 6889 6890 /* Drop references and destroy. Called from gc and dynset. */ 6891 void nft_set_elem_destroy(const struct nft_set *set, 6892 const struct nft_elem_priv *elem_priv, 6893 bool destroy_expr) 6894 { 6895 struct nft_ctx ctx = { 6896 .net = read_pnet(&set->net), 6897 .family = set->table->family, 6898 }; 6899 6900 __nft_set_elem_destroy(&ctx, set, elem_priv, destroy_expr); 6901 } 6902 EXPORT_SYMBOL_GPL(nft_set_elem_destroy); 6903 6904 /* Drop references and destroy. Called from abort path. */ 6905 static void nft_trans_set_elem_destroy(const struct nft_ctx *ctx, struct nft_trans_elem *te) 6906 { 6907 int i; 6908 6909 for (i = 0; i < te->nelems; i++) { 6910 /* skip update request, see nft_trans_elems_new_abort() */ 6911 if (!te->elems[i].priv) 6912 continue; 6913 6914 __nft_set_elem_destroy(ctx, te->set, te->elems[i].priv, true); 6915 } 6916 } 6917 6918 /* Destroy element. References have been already dropped in the preparation 6919 * path via nft_setelem_data_deactivate(). 6920 */ 6921 void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, 6922 const struct nft_set *set, 6923 const struct nft_elem_priv *elem_priv) 6924 { 6925 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 6926 6927 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) 6928 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext)); 6929 6930 kfree(elem_priv); 6931 } 6932 6933 static void nft_trans_elems_destroy(const struct nft_ctx *ctx, 6934 const struct nft_trans_elem *te) 6935 { 6936 int i; 6937 6938 for (i = 0; i < te->nelems; i++) 6939 nf_tables_set_elem_destroy(ctx, te->set, te->elems[i].priv); 6940 } 6941 6942 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 6943 struct nft_expr *expr_array[]) 6944 { 6945 struct nft_expr *expr; 6946 int err, i, k; 6947 6948 for (i = 0; i < set->num_exprs; i++) { 6949 expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT); 6950 if (!expr) 6951 goto err_expr; 6952 6953 err = nft_expr_clone(expr, set->exprs[i], GFP_KERNEL_ACCOUNT); 6954 if (err < 0) { 6955 kfree(expr); 6956 goto err_expr; 6957 } 6958 expr_array[i] = expr; 6959 } 6960 6961 return 0; 6962 6963 err_expr: 6964 for (k = i - 1; k >= 0; k--) 6965 nft_expr_destroy(ctx, expr_array[k]); 6966 6967 return -ENOMEM; 6968 } 6969 6970 static int nft_set_elem_expr_setup(struct nft_ctx *ctx, 6971 const struct nft_set_ext_tmpl *tmpl, 6972 const struct nft_set_ext *ext, 6973 struct nft_expr *expr_array[], 6974 u32 num_exprs) 6975 { 6976 struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); 6977 u32 len = sizeof(struct nft_set_elem_expr); 6978 struct nft_expr *expr; 6979 int i, err; 6980 6981 if (num_exprs == 0) 6982 return 0; 6983 6984 for (i = 0; i < num_exprs; i++) 6985 len += expr_array[i]->ops->size; 6986 6987 if (nft_set_ext_check(tmpl, NFT_SET_EXT_EXPRESSIONS, len) < 0) 6988 return -EINVAL; 6989 6990 for (i = 0; i < num_exprs; i++) { 6991 expr = nft_setelem_expr_at(elem_expr, elem_expr->size); 6992 err = nft_expr_clone(expr, expr_array[i], GFP_KERNEL_ACCOUNT); 6993 if (err < 0) 6994 goto err_elem_expr_setup; 6995 6996 elem_expr->size += expr_array[i]->ops->size; 6997 nft_expr_destroy(ctx, expr_array[i]); 6998 expr_array[i] = NULL; 6999 } 7000 7001 return 0; 7002 7003 err_elem_expr_setup: 7004 for (; i < num_exprs; i++) { 7005 nft_expr_destroy(ctx, expr_array[i]); 7006 expr_array[i] = NULL; 7007 } 7008 7009 return -ENOMEM; 7010 } 7011 7012 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, 7013 const struct nft_set *set) 7014 { 7015 struct nft_set_elem_catchall *catchall; 7016 u8 genmask = nft_genmask_cur(net); 7017 struct nft_set_ext *ext; 7018 7019 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 7020 ext = nft_set_elem_ext(set, catchall->elem); 7021 if (nft_set_elem_active(ext, genmask) && 7022 !nft_set_elem_expired(ext) && 7023 !nft_set_elem_is_dead(ext)) 7024 return ext; 7025 } 7026 7027 return NULL; 7028 } 7029 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup); 7030 7031 static int nft_setelem_catchall_insert(const struct net *net, 7032 struct nft_set *set, 7033 const struct nft_set_elem *elem, 7034 struct nft_elem_priv **priv) 7035 { 7036 struct nft_set_elem_catchall *catchall; 7037 u8 genmask = nft_genmask_next(net); 7038 struct nft_set_ext *ext; 7039 7040 list_for_each_entry(catchall, &set->catchall_list, list) { 7041 ext = nft_set_elem_ext(set, catchall->elem); 7042 if (nft_set_elem_active(ext, genmask)) { 7043 *priv = catchall->elem; 7044 return -EEXIST; 7045 } 7046 } 7047 7048 catchall = kmalloc(sizeof(*catchall), GFP_KERNEL_ACCOUNT); 7049 if (!catchall) 7050 return -ENOMEM; 7051 7052 catchall->elem = elem->priv; 7053 list_add_tail_rcu(&catchall->list, &set->catchall_list); 7054 7055 return 0; 7056 } 7057 7058 static int nft_setelem_insert(const struct net *net, 7059 struct nft_set *set, 7060 const struct nft_set_elem *elem, 7061 struct nft_elem_priv **elem_priv, 7062 unsigned int flags) 7063 { 7064 int ret; 7065 7066 if (flags & NFT_SET_ELEM_CATCHALL) 7067 ret = nft_setelem_catchall_insert(net, set, elem, elem_priv); 7068 else 7069 ret = set->ops->insert(net, set, elem, elem_priv); 7070 7071 return ret; 7072 } 7073 7074 static bool nft_setelem_is_catchall(const struct nft_set *set, 7075 const struct nft_elem_priv *elem_priv) 7076 { 7077 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7078 7079 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && 7080 *nft_set_ext_flags(ext) & NFT_SET_ELEM_CATCHALL) 7081 return true; 7082 7083 return false; 7084 } 7085 7086 static void nft_setelem_activate(struct net *net, struct nft_set *set, 7087 struct nft_elem_priv *elem_priv) 7088 { 7089 struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7090 7091 if (nft_setelem_is_catchall(set, elem_priv)) { 7092 nft_clear(net, ext); 7093 } else { 7094 set->ops->activate(net, set, elem_priv); 7095 } 7096 } 7097 7098 static void nft_trans_elem_update(const struct nft_set *set, 7099 const struct nft_trans_one_elem *elem) 7100 { 7101 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); 7102 const struct nft_elem_update *update = elem->update; 7103 7104 if (update->flags & NFT_TRANS_UPD_TIMEOUT) 7105 WRITE_ONCE(nft_set_ext_timeout(ext)->timeout, update->timeout); 7106 7107 if (update->flags & NFT_TRANS_UPD_EXPIRATION) 7108 WRITE_ONCE(nft_set_ext_timeout(ext)->expiration, get_jiffies_64() + update->expiration); 7109 } 7110 7111 static void nft_trans_elems_add(const struct nft_ctx *ctx, 7112 struct nft_trans_elem *te) 7113 { 7114 int i; 7115 7116 for (i = 0; i < te->nelems; i++) { 7117 struct nft_trans_one_elem *elem = &te->elems[i]; 7118 7119 if (elem->update) 7120 nft_trans_elem_update(te->set, elem); 7121 else 7122 nft_setelem_activate(ctx->net, te->set, elem->priv); 7123 7124 nf_tables_setelem_notify(ctx, te->set, elem->priv, 7125 NFT_MSG_NEWSETELEM); 7126 kfree(elem->update); 7127 } 7128 } 7129 7130 static int nft_setelem_catchall_deactivate(const struct net *net, 7131 struct nft_set *set, 7132 struct nft_set_elem *elem) 7133 { 7134 struct nft_set_elem_catchall *catchall; 7135 struct nft_set_ext *ext; 7136 7137 list_for_each_entry(catchall, &set->catchall_list, list) { 7138 ext = nft_set_elem_ext(set, catchall->elem); 7139 if (!nft_is_active_next(net, ext)) 7140 continue; 7141 7142 kfree(elem->priv); 7143 elem->priv = catchall->elem; 7144 nft_set_elem_change_active(net, set, ext); 7145 return 0; 7146 } 7147 7148 return -ENOENT; 7149 } 7150 7151 static int __nft_setelem_deactivate(const struct net *net, 7152 struct nft_set *set, 7153 struct nft_set_elem *elem) 7154 { 7155 void *priv; 7156 7157 priv = set->ops->deactivate(net, set, elem); 7158 if (!priv) 7159 return -ENOENT; 7160 7161 kfree(elem->priv); 7162 elem->priv = priv; 7163 set->ndeact++; 7164 7165 return 0; 7166 } 7167 7168 static int nft_setelem_deactivate(const struct net *net, 7169 struct nft_set *set, 7170 struct nft_set_elem *elem, u32 flags) 7171 { 7172 int ret; 7173 7174 if (flags & NFT_SET_ELEM_CATCHALL) 7175 ret = nft_setelem_catchall_deactivate(net, set, elem); 7176 else 7177 ret = __nft_setelem_deactivate(net, set, elem); 7178 7179 return ret; 7180 } 7181 7182 static void nft_setelem_catchall_destroy(struct nft_set_elem_catchall *catchall) 7183 { 7184 list_del_rcu(&catchall->list); 7185 kfree_rcu(catchall, rcu); 7186 } 7187 7188 static void nft_setelem_catchall_remove(const struct net *net, 7189 const struct nft_set *set, 7190 struct nft_elem_priv *elem_priv) 7191 { 7192 struct nft_set_elem_catchall *catchall, *next; 7193 7194 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 7195 if (catchall->elem == elem_priv) { 7196 nft_setelem_catchall_destroy(catchall); 7197 break; 7198 } 7199 } 7200 } 7201 7202 static void nft_setelem_remove(const struct net *net, 7203 const struct nft_set *set, 7204 struct nft_elem_priv *elem_priv) 7205 { 7206 if (nft_setelem_is_catchall(set, elem_priv)) 7207 nft_setelem_catchall_remove(net, set, elem_priv); 7208 else 7209 set->ops->remove(net, set, elem_priv); 7210 } 7211 7212 static void nft_trans_elems_remove(const struct nft_ctx *ctx, 7213 const struct nft_trans_elem *te) 7214 { 7215 int i; 7216 7217 for (i = 0; i < te->nelems; i++) { 7218 WARN_ON_ONCE(te->elems[i].update); 7219 7220 nf_tables_setelem_notify(ctx, te->set, 7221 te->elems[i].priv, 7222 te->nft_trans.msg_type); 7223 7224 nft_setelem_remove(ctx->net, te->set, te->elems[i].priv); 7225 if (!nft_setelem_is_catchall(te->set, te->elems[i].priv)) { 7226 atomic_dec(&te->set->nelems); 7227 te->set->ndeact--; 7228 } 7229 } 7230 } 7231 7232 static bool nft_setelem_valid_key_end(const struct nft_set *set, 7233 struct nlattr **nla, u32 flags) 7234 { 7235 if ((set->flags & (NFT_SET_CONCAT | NFT_SET_INTERVAL)) == 7236 (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { 7237 if (flags & NFT_SET_ELEM_INTERVAL_END) 7238 return false; 7239 7240 if (nla[NFTA_SET_ELEM_KEY_END] && 7241 flags & NFT_SET_ELEM_CATCHALL) 7242 return false; 7243 } else { 7244 if (nla[NFTA_SET_ELEM_KEY_END]) 7245 return false; 7246 } 7247 7248 return true; 7249 } 7250 7251 static u32 nft_set_maxsize(const struct nft_set *set) 7252 { 7253 u32 maxsize, delta; 7254 7255 if (!set->size) 7256 return UINT_MAX; 7257 7258 if (set->ops->adjust_maxsize) 7259 delta = set->ops->adjust_maxsize(set); 7260 else 7261 delta = 0; 7262 7263 if (check_add_overflow(set->size, set->ndeact, &maxsize)) 7264 return UINT_MAX; 7265 7266 if (check_add_overflow(maxsize, delta, &maxsize)) 7267 return UINT_MAX; 7268 7269 return maxsize; 7270 } 7271 7272 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 7273 const struct nlattr *attr, u32 nlmsg_flags, 7274 bool last) 7275 { 7276 struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {}; 7277 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 7278 u8 genmask = nft_genmask_next(ctx->net); 7279 u32 flags = 0, size = 0, num_exprs = 0; 7280 struct nft_set_ext_tmpl tmpl; 7281 struct nft_set_ext *ext, *ext2; 7282 struct nft_set_elem elem; 7283 struct nft_set_binding *binding; 7284 struct nft_elem_priv *elem_priv; 7285 struct nft_object *obj = NULL; 7286 struct nft_userdata *udata; 7287 struct nft_data_desc desc; 7288 enum nft_registers dreg; 7289 struct nft_trans *trans; 7290 u64 expiration; 7291 u64 timeout; 7292 int err, i; 7293 u8 ulen; 7294 7295 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 7296 nft_set_elem_policy, NULL); 7297 if (err < 0) 7298 return err; 7299 7300 nft_set_ext_prepare(&tmpl); 7301 7302 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 7303 if (err < 0) 7304 return err; 7305 7306 if (((flags & NFT_SET_ELEM_CATCHALL) && nla[NFTA_SET_ELEM_KEY]) || 7307 (!(flags & NFT_SET_ELEM_CATCHALL) && !nla[NFTA_SET_ELEM_KEY])) 7308 return -EINVAL; 7309 7310 if (flags != 0) { 7311 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 7312 if (err < 0) 7313 return err; 7314 } 7315 7316 if (set->flags & NFT_SET_MAP) { 7317 if (nla[NFTA_SET_ELEM_DATA] == NULL && 7318 !(flags & NFT_SET_ELEM_INTERVAL_END)) 7319 return -EINVAL; 7320 } else { 7321 if (nla[NFTA_SET_ELEM_DATA] != NULL) 7322 return -EINVAL; 7323 } 7324 7325 if (set->flags & NFT_SET_OBJECT) { 7326 if (!nla[NFTA_SET_ELEM_OBJREF] && 7327 !(flags & NFT_SET_ELEM_INTERVAL_END)) 7328 return -EINVAL; 7329 } else { 7330 if (nla[NFTA_SET_ELEM_OBJREF]) 7331 return -EINVAL; 7332 } 7333 7334 if (!nft_setelem_valid_key_end(set, nla, flags)) 7335 return -EINVAL; 7336 7337 if ((flags & NFT_SET_ELEM_INTERVAL_END) && 7338 (nla[NFTA_SET_ELEM_DATA] || 7339 nla[NFTA_SET_ELEM_OBJREF] || 7340 nla[NFTA_SET_ELEM_TIMEOUT] || 7341 nla[NFTA_SET_ELEM_EXPIRATION] || 7342 nla[NFTA_SET_ELEM_USERDATA] || 7343 nla[NFTA_SET_ELEM_EXPR] || 7344 nla[NFTA_SET_ELEM_KEY_END] || 7345 nla[NFTA_SET_ELEM_EXPRESSIONS])) 7346 return -EINVAL; 7347 7348 timeout = 0; 7349 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { 7350 if (!(set->flags & NFT_SET_TIMEOUT)) 7351 return -EINVAL; 7352 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT], 7353 &timeout); 7354 if (err) 7355 return err; 7356 } else if (set->flags & NFT_SET_TIMEOUT && 7357 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 7358 timeout = set->timeout; 7359 } 7360 7361 expiration = 0; 7362 if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) { 7363 if (!(set->flags & NFT_SET_TIMEOUT)) 7364 return -EINVAL; 7365 if (timeout == 0) 7366 return -EOPNOTSUPP; 7367 7368 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION], 7369 &expiration); 7370 if (err) 7371 return err; 7372 7373 if (expiration > timeout) 7374 return -ERANGE; 7375 } 7376 7377 if (nla[NFTA_SET_ELEM_EXPR]) { 7378 struct nft_expr *expr; 7379 7380 if (set->num_exprs && set->num_exprs != 1) 7381 return -EOPNOTSUPP; 7382 7383 expr = nft_set_elem_expr_alloc(ctx, set, 7384 nla[NFTA_SET_ELEM_EXPR]); 7385 if (IS_ERR(expr)) 7386 return PTR_ERR(expr); 7387 7388 expr_array[0] = expr; 7389 num_exprs = 1; 7390 7391 if (set->num_exprs && set->exprs[0]->ops != expr->ops) { 7392 err = -EOPNOTSUPP; 7393 goto err_set_elem_expr; 7394 } 7395 } else if (nla[NFTA_SET_ELEM_EXPRESSIONS]) { 7396 struct nft_expr *expr; 7397 struct nlattr *tmp; 7398 int left; 7399 7400 i = 0; 7401 nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) { 7402 if (i == NFT_SET_EXPR_MAX || 7403 (set->num_exprs && set->num_exprs == i)) { 7404 err = -E2BIG; 7405 goto err_set_elem_expr; 7406 } 7407 if (nla_type(tmp) != NFTA_LIST_ELEM) { 7408 err = -EINVAL; 7409 goto err_set_elem_expr; 7410 } 7411 expr = nft_set_elem_expr_alloc(ctx, set, tmp); 7412 if (IS_ERR(expr)) { 7413 err = PTR_ERR(expr); 7414 goto err_set_elem_expr; 7415 } 7416 expr_array[i] = expr; 7417 num_exprs++; 7418 7419 if (set->num_exprs && expr->ops != set->exprs[i]->ops) { 7420 err = -EOPNOTSUPP; 7421 goto err_set_elem_expr; 7422 } 7423 i++; 7424 } 7425 if (set->num_exprs && set->num_exprs != i) { 7426 err = -EOPNOTSUPP; 7427 goto err_set_elem_expr; 7428 } 7429 } else if (set->num_exprs > 0 && 7430 !(flags & NFT_SET_ELEM_INTERVAL_END)) { 7431 err = nft_set_elem_expr_clone(ctx, set, expr_array); 7432 if (err < 0) 7433 goto err_set_elem_expr_clone; 7434 7435 num_exprs = set->num_exprs; 7436 } 7437 7438 if (nla[NFTA_SET_ELEM_KEY]) { 7439 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 7440 nla[NFTA_SET_ELEM_KEY]); 7441 if (err < 0) 7442 goto err_set_elem_expr; 7443 7444 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 7445 if (err < 0) 7446 goto err_parse_key; 7447 } 7448 7449 if (nla[NFTA_SET_ELEM_KEY_END]) { 7450 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 7451 nla[NFTA_SET_ELEM_KEY_END]); 7452 if (err < 0) 7453 goto err_parse_key; 7454 7455 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 7456 if (err < 0) 7457 goto err_parse_key_end; 7458 } 7459 7460 if (set->flags & NFT_SET_TIMEOUT) { 7461 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT); 7462 if (err < 0) 7463 goto err_parse_key_end; 7464 } 7465 7466 if (num_exprs) { 7467 for (i = 0; i < num_exprs; i++) 7468 size += expr_array[i]->ops->size; 7469 7470 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS, 7471 sizeof(struct nft_set_elem_expr) + size); 7472 if (err < 0) 7473 goto err_parse_key_end; 7474 } 7475 7476 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) { 7477 obj = nft_obj_lookup(ctx->net, ctx->table, 7478 nla[NFTA_SET_ELEM_OBJREF], 7479 set->objtype, genmask); 7480 if (IS_ERR(obj)) { 7481 err = PTR_ERR(obj); 7482 obj = NULL; 7483 goto err_parse_key_end; 7484 } 7485 7486 if (!nft_use_inc(&obj->use)) { 7487 err = -EMFILE; 7488 obj = NULL; 7489 goto err_parse_key_end; 7490 } 7491 7492 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF); 7493 if (err < 0) 7494 goto err_parse_key_end; 7495 } 7496 7497 if (nla[NFTA_SET_ELEM_DATA] != NULL) { 7498 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val, 7499 nla[NFTA_SET_ELEM_DATA]); 7500 if (err < 0) 7501 goto err_parse_key_end; 7502 7503 dreg = nft_type_to_reg(set->dtype); 7504 list_for_each_entry(binding, &set->bindings, list) { 7505 struct nft_ctx bind_ctx = { 7506 .net = ctx->net, 7507 .family = ctx->family, 7508 .table = ctx->table, 7509 .chain = (struct nft_chain *)binding->chain, 7510 }; 7511 7512 if (!(binding->flags & NFT_SET_MAP)) 7513 continue; 7514 7515 err = nft_validate_register_store(&bind_ctx, dreg, 7516 &elem.data.val, 7517 desc.type, desc.len); 7518 if (err < 0) 7519 goto err_parse_data; 7520 7521 if (desc.type == NFT_DATA_VERDICT && 7522 (elem.data.val.verdict.code == NFT_GOTO || 7523 elem.data.val.verdict.code == NFT_JUMP)) 7524 nft_validate_state_update(ctx->table, 7525 NFT_VALIDATE_NEED); 7526 } 7527 7528 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); 7529 if (err < 0) 7530 goto err_parse_data; 7531 } 7532 7533 /* The full maximum length of userdata can exceed the maximum 7534 * offset value (U8_MAX) for following extensions, therefor it 7535 * must be the last extension added. 7536 */ 7537 ulen = 0; 7538 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) { 7539 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]); 7540 if (ulen > 0) { 7541 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA, 7542 ulen); 7543 if (err < 0) 7544 goto err_parse_data; 7545 } 7546 } 7547 7548 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 7549 elem.key_end.val.data, elem.data.val.data, 7550 timeout, expiration, GFP_KERNEL_ACCOUNT); 7551 if (IS_ERR(elem.priv)) { 7552 err = PTR_ERR(elem.priv); 7553 goto err_parse_data; 7554 } 7555 7556 ext = nft_set_elem_ext(set, elem.priv); 7557 if (flags) 7558 *nft_set_ext_flags(ext) = flags; 7559 7560 if (last) 7561 elem.flags = NFT_SET_ELEM_INTERNAL_LAST; 7562 else 7563 elem.flags = 0; 7564 7565 if (obj) 7566 *nft_set_ext_obj(ext) = obj; 7567 7568 if (ulen > 0) { 7569 if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) { 7570 err = -EINVAL; 7571 goto err_elem_free; 7572 } 7573 udata = nft_set_ext_userdata(ext); 7574 udata->len = ulen - 1; 7575 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen); 7576 } 7577 err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs); 7578 if (err < 0) 7579 goto err_elem_free; 7580 7581 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); 7582 if (trans == NULL) { 7583 err = -ENOMEM; 7584 goto err_elem_free; 7585 } 7586 7587 ext->genmask = nft_genmask_cur(ctx->net); 7588 7589 err = nft_setelem_insert(ctx->net, set, &elem, &elem_priv, flags); 7590 if (err) { 7591 if (err == -EEXIST) { 7592 ext2 = nft_set_elem_ext(set, elem_priv); 7593 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ 7594 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || 7595 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ 7596 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) 7597 goto err_element_clash; 7598 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && 7599 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && 7600 memcmp(nft_set_ext_data(ext), 7601 nft_set_ext_data(ext2), set->dlen) != 0) || 7602 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) && 7603 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) && 7604 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2))) 7605 goto err_element_clash; 7606 else if (!(nlmsg_flags & NLM_F_EXCL)) { 7607 err = 0; 7608 if (nft_set_ext_exists(ext2, NFT_SET_EXT_TIMEOUT)) { 7609 struct nft_elem_update update = { }; 7610 7611 if (timeout != nft_set_ext_timeout(ext2)->timeout) { 7612 update.timeout = timeout; 7613 if (expiration == 0) 7614 expiration = timeout; 7615 7616 update.flags |= NFT_TRANS_UPD_TIMEOUT; 7617 } 7618 if (expiration) { 7619 update.expiration = expiration; 7620 update.flags |= NFT_TRANS_UPD_EXPIRATION; 7621 } 7622 7623 if (update.flags) { 7624 struct nft_trans_one_elem *ue; 7625 7626 ue = &nft_trans_container_elem(trans)->elems[0]; 7627 7628 ue->update = kmemdup(&update, sizeof(update), GFP_KERNEL); 7629 if (!ue->update) { 7630 err = -ENOMEM; 7631 goto err_element_clash; 7632 } 7633 7634 ue->priv = elem_priv; 7635 nft_trans_commit_list_add_elem(ctx->net, trans); 7636 goto err_elem_free; 7637 } 7638 } 7639 } 7640 } else if (err == -ENOTEMPTY) { 7641 /* ENOTEMPTY reports overlapping between this element 7642 * and an existing one. 7643 */ 7644 err = -EEXIST; 7645 } else if (err == -ECANCELED) { 7646 /* ECANCELED reports an existing nul-element in 7647 * interval sets. 7648 */ 7649 err = 0; 7650 } 7651 goto err_element_clash; 7652 } 7653 7654 if (!(flags & NFT_SET_ELEM_CATCHALL)) { 7655 unsigned int max = nft_set_maxsize(set); 7656 7657 if (!atomic_add_unless(&set->nelems, 1, max)) { 7658 err = -ENFILE; 7659 goto err_set_full; 7660 } 7661 } 7662 7663 nft_trans_container_elem(trans)->elems[0].priv = elem.priv; 7664 nft_trans_commit_list_add_elem(ctx->net, trans); 7665 return 0; 7666 7667 err_set_full: 7668 nft_setelem_remove(ctx->net, set, elem.priv); 7669 err_element_clash: 7670 kfree(trans); 7671 err_elem_free: 7672 nf_tables_set_elem_destroy(ctx, set, elem.priv); 7673 err_parse_data: 7674 if (nla[NFTA_SET_ELEM_DATA] != NULL) 7675 nft_data_release(&elem.data.val, desc.type); 7676 err_parse_key_end: 7677 if (obj) 7678 nft_use_dec_restore(&obj->use); 7679 7680 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 7681 err_parse_key: 7682 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 7683 err_set_elem_expr: 7684 for (i = 0; i < num_exprs && expr_array[i]; i++) 7685 nft_expr_destroy(ctx, expr_array[i]); 7686 err_set_elem_expr_clone: 7687 return err; 7688 } 7689 7690 static int nf_tables_newsetelem(struct sk_buff *skb, 7691 const struct nfnl_info *info, 7692 const struct nlattr * const nla[]) 7693 { 7694 struct netlink_ext_ack *extack = info->extack; 7695 u8 genmask = nft_genmask_next(info->net); 7696 u8 family = info->nfmsg->nfgen_family; 7697 struct net *net = info->net; 7698 const struct nlattr *attr; 7699 struct nft_table *table; 7700 struct nft_set *set; 7701 struct nft_ctx ctx; 7702 int rem, err; 7703 7704 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) 7705 return -EINVAL; 7706 7707 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 7708 genmask, NETLINK_CB(skb).portid); 7709 if (IS_ERR(table)) { 7710 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 7711 return PTR_ERR(table); 7712 } 7713 7714 set = nft_set_lookup_global(net, table, nla[NFTA_SET_ELEM_LIST_SET], 7715 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask); 7716 if (IS_ERR(set)) { 7717 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_SET]); 7718 return PTR_ERR(set); 7719 } 7720 7721 if (!list_empty(&set->bindings) && 7722 (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS))) 7723 return -EBUSY; 7724 7725 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 7726 7727 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 7728 err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags, 7729 nla_is_last(attr, rem)); 7730 if (err < 0) { 7731 NL_SET_BAD_ATTR(extack, attr); 7732 return err; 7733 } 7734 } 7735 7736 if (table->validate_state == NFT_VALIDATE_DO) 7737 return nft_table_validate(net, table); 7738 7739 return 0; 7740 } 7741 7742 /** 7743 * nft_data_hold - hold a nft_data item 7744 * 7745 * @data: struct nft_data to release 7746 * @type: type of data 7747 * 7748 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded, 7749 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and 7750 * NFT_GOTO verdicts. This function must be called on active data objects 7751 * from the second phase of the commit protocol. 7752 */ 7753 void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 7754 { 7755 struct nft_chain *chain; 7756 7757 if (type == NFT_DATA_VERDICT) { 7758 switch (data->verdict.code) { 7759 case NFT_JUMP: 7760 case NFT_GOTO: 7761 chain = data->verdict.chain; 7762 nft_use_inc_restore(&chain->use); 7763 break; 7764 } 7765 } 7766 } 7767 7768 static int nft_setelem_active_next(const struct net *net, 7769 const struct nft_set *set, 7770 struct nft_elem_priv *elem_priv) 7771 { 7772 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7773 u8 genmask = nft_genmask_next(net); 7774 7775 return nft_set_elem_active(ext, genmask); 7776 } 7777 7778 static void nft_setelem_data_activate(const struct net *net, 7779 const struct nft_set *set, 7780 struct nft_elem_priv *elem_priv) 7781 { 7782 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7783 7784 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 7785 nft_data_hold(nft_set_ext_data(ext), set->dtype); 7786 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 7787 nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use); 7788 } 7789 7790 void nft_setelem_data_deactivate(const struct net *net, 7791 const struct nft_set *set, 7792 struct nft_elem_priv *elem_priv) 7793 { 7794 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7795 7796 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA)) 7797 nft_data_release(nft_set_ext_data(ext), set->dtype); 7798 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF)) 7799 nft_use_dec(&(*nft_set_ext_obj(ext))->use); 7800 } 7801 7802 /* similar to nft_trans_elems_remove, but called from abort path to undo newsetelem. 7803 * No notifications and no ndeact changes. 7804 * 7805 * Returns true if set had been added to (i.e., elements need to be removed again). 7806 */ 7807 static bool nft_trans_elems_new_abort(const struct nft_ctx *ctx, 7808 struct nft_trans_elem *te) 7809 { 7810 bool removed = false; 7811 int i; 7812 7813 for (i = 0; i < te->nelems; i++) { 7814 if (te->elems[i].update) { 7815 kfree(te->elems[i].update); 7816 te->elems[i].update = NULL; 7817 /* Update request, so do not release this element */ 7818 te->elems[i].priv = NULL; 7819 continue; 7820 } 7821 7822 if (!te->set->ops->abort_skip_removal || 7823 nft_setelem_is_catchall(te->set, te->elems[i].priv)) 7824 nft_setelem_remove(ctx->net, te->set, te->elems[i].priv); 7825 7826 if (!nft_setelem_is_catchall(te->set, te->elems[i].priv)) 7827 atomic_dec(&te->set->nelems); 7828 7829 removed = true; 7830 } 7831 7832 return removed; 7833 } 7834 7835 /* Called from abort path to undo DELSETELEM/DESTROYSETELEM. */ 7836 static void nft_trans_elems_destroy_abort(const struct nft_ctx *ctx, 7837 const struct nft_trans_elem *te) 7838 { 7839 int i; 7840 7841 for (i = 0; i < te->nelems; i++) { 7842 if (!nft_setelem_active_next(ctx->net, te->set, te->elems[i].priv)) { 7843 nft_setelem_data_activate(ctx->net, te->set, te->elems[i].priv); 7844 nft_setelem_activate(ctx->net, te->set, te->elems[i].priv); 7845 } 7846 7847 if (!nft_setelem_is_catchall(te->set, te->elems[i].priv)) 7848 te->set->ndeact--; 7849 } 7850 } 7851 7852 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set, 7853 const struct nlattr *attr, bool last) 7854 { 7855 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; 7856 struct nft_set_ext_tmpl tmpl; 7857 struct nft_set_elem elem; 7858 struct nft_set_ext *ext; 7859 struct nft_trans *trans; 7860 u32 flags = 0; 7861 int err; 7862 7863 err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr, 7864 nft_set_elem_policy, NULL); 7865 if (err < 0) 7866 return err; 7867 7868 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags); 7869 if (err < 0) 7870 return err; 7871 7872 if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL)) 7873 return -EINVAL; 7874 7875 if (!nft_setelem_valid_key_end(set, nla, flags)) 7876 return -EINVAL; 7877 7878 nft_set_ext_prepare(&tmpl); 7879 7880 if (flags != 0) { 7881 err = nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); 7882 if (err < 0) 7883 return err; 7884 } 7885 7886 if (nla[NFTA_SET_ELEM_KEY]) { 7887 err = nft_setelem_parse_key(ctx, set, &elem.key.val, 7888 nla[NFTA_SET_ELEM_KEY]); 7889 if (err < 0) 7890 return err; 7891 7892 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); 7893 if (err < 0) 7894 goto fail_elem; 7895 } 7896 7897 if (nla[NFTA_SET_ELEM_KEY_END]) { 7898 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val, 7899 nla[NFTA_SET_ELEM_KEY_END]); 7900 if (err < 0) 7901 goto fail_elem; 7902 7903 err = nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen); 7904 if (err < 0) 7905 goto fail_elem_key_end; 7906 } 7907 7908 err = -ENOMEM; 7909 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, 7910 elem.key_end.val.data, NULL, 0, 0, 7911 GFP_KERNEL_ACCOUNT); 7912 if (IS_ERR(elem.priv)) { 7913 err = PTR_ERR(elem.priv); 7914 goto fail_elem_key_end; 7915 } 7916 7917 ext = nft_set_elem_ext(set, elem.priv); 7918 if (flags) 7919 *nft_set_ext_flags(ext) = flags; 7920 7921 if (last) 7922 elem.flags = NFT_SET_ELEM_INTERNAL_LAST; 7923 else 7924 elem.flags = 0; 7925 7926 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 7927 if (trans == NULL) 7928 goto fail_trans; 7929 7930 err = nft_setelem_deactivate(ctx->net, set, &elem, flags); 7931 if (err < 0) 7932 goto fail_ops; 7933 7934 nft_setelem_data_deactivate(ctx->net, set, elem.priv); 7935 7936 nft_trans_container_elem(trans)->elems[0].priv = elem.priv; 7937 nft_trans_commit_list_add_elem(ctx->net, trans); 7938 return 0; 7939 7940 fail_ops: 7941 kfree(trans); 7942 fail_trans: 7943 kfree(elem.priv); 7944 fail_elem_key_end: 7945 nft_data_release(&elem.key_end.val, NFT_DATA_VALUE); 7946 fail_elem: 7947 nft_data_release(&elem.key.val, NFT_DATA_VALUE); 7948 return err; 7949 } 7950 7951 static int nft_setelem_flush(const struct nft_ctx *ctx, 7952 struct nft_set *set, 7953 const struct nft_set_iter *iter, 7954 struct nft_elem_priv *elem_priv) 7955 { 7956 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv); 7957 struct nft_trans *trans; 7958 7959 if (!nft_set_elem_active(ext, iter->genmask)) 7960 return 0; 7961 7962 trans = nft_trans_alloc(ctx, NFT_MSG_DELSETELEM, 7963 struct_size_t(struct nft_trans_elem, elems, 1)); 7964 if (!trans) 7965 return -ENOMEM; 7966 7967 set->ops->flush(ctx->net, set, elem_priv); 7968 set->ndeact++; 7969 7970 nft_setelem_data_deactivate(ctx->net, set, elem_priv); 7971 nft_trans_elem_set(trans) = set; 7972 nft_trans_container_elem(trans)->nelems = 1; 7973 nft_trans_container_elem(trans)->elems[0].priv = elem_priv; 7974 nft_trans_commit_list_add_elem(ctx->net, trans); 7975 7976 return 0; 7977 } 7978 7979 static int __nft_set_catchall_flush(const struct nft_ctx *ctx, 7980 struct nft_set *set, 7981 struct nft_elem_priv *elem_priv) 7982 { 7983 struct nft_trans *trans; 7984 7985 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); 7986 if (!trans) 7987 return -ENOMEM; 7988 7989 nft_setelem_data_deactivate(ctx->net, set, elem_priv); 7990 nft_trans_container_elem(trans)->elems[0].priv = elem_priv; 7991 nft_trans_commit_list_add_elem(ctx->net, trans); 7992 7993 return 0; 7994 } 7995 7996 static int nft_set_catchall_flush(const struct nft_ctx *ctx, 7997 struct nft_set *set) 7998 { 7999 u8 genmask = nft_genmask_next(ctx->net); 8000 struct nft_set_elem_catchall *catchall; 8001 struct nft_set_ext *ext; 8002 int ret = 0; 8003 8004 list_for_each_entry_rcu(catchall, &set->catchall_list, list, 8005 lockdep_commit_lock_is_held(ctx->net)) { 8006 ext = nft_set_elem_ext(set, catchall->elem); 8007 if (!nft_set_elem_active(ext, genmask)) 8008 continue; 8009 8010 ret = __nft_set_catchall_flush(ctx, set, catchall->elem); 8011 if (ret < 0) 8012 break; 8013 nft_set_elem_change_active(ctx->net, set, ext); 8014 } 8015 8016 return ret; 8017 } 8018 8019 static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) 8020 { 8021 struct nft_set_iter iter = { 8022 .genmask = genmask, 8023 .type = NFT_ITER_UPDATE, 8024 .fn = nft_setelem_flush, 8025 }; 8026 8027 set->ops->walk(ctx, set, &iter); 8028 if (!iter.err) 8029 iter.err = nft_set_catchall_flush(ctx, set); 8030 8031 return iter.err; 8032 } 8033 8034 static int nf_tables_delsetelem(struct sk_buff *skb, 8035 const struct nfnl_info *info, 8036 const struct nlattr * const nla[]) 8037 { 8038 struct netlink_ext_ack *extack = info->extack; 8039 u8 genmask = nft_genmask_next(info->net); 8040 u8 family = info->nfmsg->nfgen_family; 8041 struct net *net = info->net; 8042 const struct nlattr *attr; 8043 struct nft_table *table; 8044 struct nft_set *set; 8045 struct nft_ctx ctx; 8046 int rem, err = 0; 8047 8048 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family, 8049 genmask, NETLINK_CB(skb).portid); 8050 if (IS_ERR(table)) { 8051 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]); 8052 return PTR_ERR(table); 8053 } 8054 8055 set = nft_set_lookup(net, table, nla[NFTA_SET_ELEM_LIST_SET], genmask); 8056 if (IS_ERR(set)) { 8057 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_SET]); 8058 return PTR_ERR(set); 8059 } 8060 8061 if (nft_set_is_anonymous(set)) 8062 return -EOPNOTSUPP; 8063 8064 if (!list_empty(&set->bindings) && (set->flags & NFT_SET_CONSTANT)) 8065 return -EBUSY; 8066 8067 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8068 8069 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS]) 8070 return nft_set_flush(&ctx, set, genmask); 8071 8072 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { 8073 err = nft_del_setelem(&ctx, set, attr, 8074 nla_is_last(attr, rem)); 8075 if (err == -ENOENT && 8076 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYSETELEM) 8077 continue; 8078 8079 if (err < 0) { 8080 NL_SET_BAD_ATTR(extack, attr); 8081 return err; 8082 } 8083 } 8084 8085 return 0; 8086 } 8087 8088 /* 8089 * Stateful objects 8090 */ 8091 8092 /** 8093 * nft_register_obj- register nf_tables stateful object type 8094 * @obj_type: object type 8095 * 8096 * Registers the object type for use with nf_tables. Returns zero on 8097 * success or a negative errno code otherwise. 8098 */ 8099 int nft_register_obj(struct nft_object_type *obj_type) 8100 { 8101 if (obj_type->type == NFT_OBJECT_UNSPEC) 8102 return -EINVAL; 8103 8104 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8105 list_add_rcu(&obj_type->list, &nf_tables_objects); 8106 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8107 return 0; 8108 } 8109 EXPORT_SYMBOL_GPL(nft_register_obj); 8110 8111 /** 8112 * nft_unregister_obj - unregister nf_tables object type 8113 * @obj_type: object type 8114 * 8115 * Unregisters the object type for use with nf_tables. 8116 */ 8117 void nft_unregister_obj(struct nft_object_type *obj_type) 8118 { 8119 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8120 list_del_rcu(&obj_type->list); 8121 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8122 } 8123 EXPORT_SYMBOL_GPL(nft_unregister_obj); 8124 8125 struct nft_object *nft_obj_lookup(const struct net *net, 8126 const struct nft_table *table, 8127 const struct nlattr *nla, u32 objtype, 8128 u8 genmask) 8129 { 8130 struct nft_object_hash_key k = { .table = table }; 8131 char search[NFT_OBJ_MAXNAMELEN]; 8132 struct rhlist_head *tmp, *list; 8133 struct nft_object *obj; 8134 8135 nla_strscpy(search, nla, sizeof(search)); 8136 k.name = search; 8137 8138 WARN_ON_ONCE(!rcu_read_lock_held() && 8139 !lockdep_commit_lock_is_held(net)); 8140 8141 rcu_read_lock(); 8142 list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params); 8143 if (!list) 8144 goto out; 8145 8146 rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) { 8147 if (objtype == obj->ops->type->type && 8148 nft_active_genmask(obj, genmask)) { 8149 rcu_read_unlock(); 8150 return obj; 8151 } 8152 } 8153 out: 8154 rcu_read_unlock(); 8155 return ERR_PTR(-ENOENT); 8156 } 8157 EXPORT_SYMBOL_GPL(nft_obj_lookup); 8158 8159 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table, 8160 const struct nlattr *nla, 8161 u32 objtype, u8 genmask) 8162 { 8163 struct nft_object *obj; 8164 8165 list_for_each_entry(obj, &table->objects, list) { 8166 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle && 8167 objtype == obj->ops->type->type && 8168 nft_active_genmask(obj, genmask)) 8169 return obj; 8170 } 8171 return ERR_PTR(-ENOENT); 8172 } 8173 8174 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 8175 [NFTA_OBJ_TABLE] = { .type = NLA_STRING, 8176 .len = NFT_TABLE_MAXNAMELEN - 1 }, 8177 [NFTA_OBJ_NAME] = { .type = NLA_STRING, 8178 .len = NFT_OBJ_MAXNAMELEN - 1 }, 8179 [NFTA_OBJ_TYPE] = { .type = NLA_U32 }, 8180 [NFTA_OBJ_DATA] = { .type = NLA_NESTED }, 8181 [NFTA_OBJ_HANDLE] = { .type = NLA_U64}, 8182 [NFTA_OBJ_USERDATA] = { .type = NLA_BINARY, 8183 .len = NFT_USERDATA_MAXLEN }, 8184 }; 8185 8186 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx, 8187 const struct nft_object_type *type, 8188 const struct nlattr *attr) 8189 { 8190 struct nlattr **tb; 8191 const struct nft_object_ops *ops; 8192 struct nft_object *obj; 8193 int err = -ENOMEM; 8194 8195 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL); 8196 if (!tb) 8197 goto err1; 8198 8199 if (attr) { 8200 err = nla_parse_nested_deprecated(tb, type->maxattr, attr, 8201 type->policy, NULL); 8202 if (err < 0) 8203 goto err2; 8204 } else { 8205 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); 8206 } 8207 8208 if (type->select_ops) { 8209 ops = type->select_ops(ctx, (const struct nlattr * const *)tb); 8210 if (IS_ERR(ops)) { 8211 err = PTR_ERR(ops); 8212 goto err2; 8213 } 8214 } else { 8215 ops = type->ops; 8216 } 8217 8218 err = -ENOMEM; 8219 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL_ACCOUNT); 8220 if (!obj) 8221 goto err2; 8222 8223 err = ops->init(ctx, (const struct nlattr * const *)tb, obj); 8224 if (err < 0) 8225 goto err3; 8226 8227 obj->ops = ops; 8228 8229 kfree(tb); 8230 return obj; 8231 err3: 8232 kfree(obj); 8233 err2: 8234 kfree(tb); 8235 err1: 8236 return ERR_PTR(err); 8237 } 8238 8239 static int nft_object_dump(struct sk_buff *skb, unsigned int attr, 8240 struct nft_object *obj, bool reset) 8241 { 8242 struct nlattr *nest; 8243 8244 nest = nla_nest_start_noflag(skb, attr); 8245 if (!nest) 8246 goto nla_put_failure; 8247 if (obj->ops->dump(skb, obj, reset) < 0) 8248 goto nla_put_failure; 8249 nla_nest_end(skb, nest); 8250 return 0; 8251 8252 nla_put_failure: 8253 return -1; 8254 } 8255 8256 static const struct nft_object_type *__nft_obj_type_get(u32 objtype, u8 family) 8257 { 8258 const struct nft_object_type *type; 8259 8260 list_for_each_entry_rcu(type, &nf_tables_objects, list) { 8261 if (type->family != NFPROTO_UNSPEC && 8262 type->family != family) 8263 continue; 8264 8265 if (objtype == type->type) 8266 return type; 8267 } 8268 return NULL; 8269 } 8270 8271 static const struct nft_object_type * 8272 nft_obj_type_get(struct net *net, u32 objtype, u8 family) 8273 { 8274 const struct nft_object_type *type; 8275 8276 rcu_read_lock(); 8277 type = __nft_obj_type_get(objtype, family); 8278 if (type != NULL && try_module_get(type->owner)) { 8279 rcu_read_unlock(); 8280 return type; 8281 } 8282 rcu_read_unlock(); 8283 8284 lockdep_nfnl_nft_mutex_not_held(); 8285 #ifdef CONFIG_MODULES 8286 if (type == NULL) { 8287 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN) 8288 return ERR_PTR(-EAGAIN); 8289 } 8290 #endif 8291 return ERR_PTR(-ENOENT); 8292 } 8293 8294 static int nf_tables_updobj(const struct nft_ctx *ctx, 8295 const struct nft_object_type *type, 8296 const struct nlattr *attr, 8297 struct nft_object *obj) 8298 { 8299 struct nft_object *newobj; 8300 struct nft_trans *trans; 8301 int err = -ENOMEM; 8302 8303 /* caller must have obtained type->owner reference. */ 8304 trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, 8305 sizeof(struct nft_trans_obj)); 8306 if (!trans) 8307 goto err_trans; 8308 8309 newobj = nft_obj_init(ctx, type, attr); 8310 if (IS_ERR(newobj)) { 8311 err = PTR_ERR(newobj); 8312 goto err_free_trans; 8313 } 8314 8315 nft_trans_obj(trans) = obj; 8316 nft_trans_obj_update(trans) = true; 8317 nft_trans_obj_newobj(trans) = newobj; 8318 nft_trans_commit_list_add_tail(ctx->net, trans); 8319 8320 return 0; 8321 8322 err_free_trans: 8323 kfree(trans); 8324 err_trans: 8325 module_put(type->owner); 8326 return err; 8327 } 8328 8329 static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, 8330 const struct nlattr * const nla[]) 8331 { 8332 struct netlink_ext_ack *extack = info->extack; 8333 u8 genmask = nft_genmask_next(info->net); 8334 u8 family = info->nfmsg->nfgen_family; 8335 const struct nft_object_type *type; 8336 struct net *net = info->net; 8337 struct nft_table *table; 8338 struct nft_object *obj; 8339 struct nft_ctx ctx; 8340 u32 objtype; 8341 int err; 8342 8343 if (!nla[NFTA_OBJ_TYPE] || 8344 !nla[NFTA_OBJ_NAME] || 8345 !nla[NFTA_OBJ_DATA]) 8346 return -EINVAL; 8347 8348 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 8349 NETLINK_CB(skb).portid); 8350 if (IS_ERR(table)) { 8351 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 8352 return PTR_ERR(table); 8353 } 8354 8355 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8356 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 8357 if (IS_ERR(obj)) { 8358 err = PTR_ERR(obj); 8359 if (err != -ENOENT) { 8360 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 8361 return err; 8362 } 8363 } else { 8364 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 8365 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 8366 return -EEXIST; 8367 } 8368 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) 8369 return -EOPNOTSUPP; 8370 8371 if (!obj->ops->update) 8372 return 0; 8373 8374 type = nft_obj_type_get(net, objtype, family); 8375 if (WARN_ON_ONCE(IS_ERR(type))) 8376 return PTR_ERR(type); 8377 8378 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8379 8380 /* type->owner reference is put when transaction object is released. */ 8381 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); 8382 } 8383 8384 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8385 8386 if (!nft_use_inc(&table->use)) 8387 return -EMFILE; 8388 8389 type = nft_obj_type_get(net, objtype, family); 8390 if (IS_ERR(type)) { 8391 err = PTR_ERR(type); 8392 goto err_type; 8393 } 8394 8395 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]); 8396 if (IS_ERR(obj)) { 8397 err = PTR_ERR(obj); 8398 goto err_init; 8399 } 8400 obj->key.table = table; 8401 obj->handle = nf_tables_alloc_handle(table); 8402 8403 obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL_ACCOUNT); 8404 if (!obj->key.name) { 8405 err = -ENOMEM; 8406 goto err_strdup; 8407 } 8408 8409 if (nla[NFTA_OBJ_USERDATA]) { 8410 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL_ACCOUNT); 8411 if (obj->udata == NULL) 8412 goto err_userdata; 8413 8414 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]); 8415 } 8416 8417 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj); 8418 if (err < 0) 8419 goto err_trans; 8420 8421 err = rhltable_insert(&nft_objname_ht, &obj->rhlhead, 8422 nft_objname_ht_params); 8423 if (err < 0) 8424 goto err_obj_ht; 8425 8426 list_add_tail_rcu(&obj->list, &table->objects); 8427 8428 return 0; 8429 err_obj_ht: 8430 /* queued in transaction log */ 8431 INIT_LIST_HEAD(&obj->list); 8432 return err; 8433 err_trans: 8434 kfree(obj->udata); 8435 err_userdata: 8436 kfree(obj->key.name); 8437 err_strdup: 8438 if (obj->ops->destroy) 8439 obj->ops->destroy(&ctx, obj); 8440 kfree(obj); 8441 err_init: 8442 module_put(type->owner); 8443 err_type: 8444 nft_use_dec_restore(&table->use); 8445 8446 return err; 8447 } 8448 8449 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 8450 u32 portid, u32 seq, int event, u32 flags, 8451 int family, const struct nft_table *table, 8452 struct nft_object *obj, bool reset) 8453 { 8454 struct nlmsghdr *nlh; 8455 8456 nlh = nfnl_msg_put(skb, portid, seq, 8457 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 8458 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 8459 if (!nlh) 8460 goto nla_put_failure; 8461 8462 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || 8463 nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || 8464 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || 8465 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle), 8466 NFTA_OBJ_PAD)) 8467 goto nla_put_failure; 8468 8469 if (event == NFT_MSG_DELOBJ || 8470 event == NFT_MSG_DESTROYOBJ) { 8471 nlmsg_end(skb, nlh); 8472 return 0; 8473 } 8474 8475 if (nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) || 8476 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset)) 8477 goto nla_put_failure; 8478 8479 if (obj->udata && 8480 nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata)) 8481 goto nla_put_failure; 8482 8483 nlmsg_end(skb, nlh); 8484 return 0; 8485 8486 nla_put_failure: 8487 nlmsg_trim(skb, nlh); 8488 return -1; 8489 } 8490 8491 static void audit_log_obj_reset(const struct nft_table *table, 8492 unsigned int base_seq, unsigned int nentries) 8493 { 8494 char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq); 8495 8496 audit_log_nfcfg(buf, table->family, nentries, 8497 AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC); 8498 kfree(buf); 8499 } 8500 8501 struct nft_obj_dump_ctx { 8502 unsigned int s_idx; 8503 char *table; 8504 u32 type; 8505 bool reset; 8506 }; 8507 8508 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) 8509 { 8510 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 8511 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8512 struct net *net = sock_net(skb->sk); 8513 int family = nfmsg->nfgen_family; 8514 struct nftables_pernet *nft_net; 8515 const struct nft_table *table; 8516 unsigned int entries = 0; 8517 struct nft_object *obj; 8518 unsigned int idx = 0; 8519 int rc = 0; 8520 8521 rcu_read_lock(); 8522 nft_net = nft_pernet(net); 8523 cb->seq = nft_base_seq(net); 8524 8525 list_for_each_entry_rcu(table, &nft_net->tables, list) { 8526 if (family != NFPROTO_UNSPEC && family != table->family) 8527 continue; 8528 8529 entries = 0; 8530 list_for_each_entry_rcu(obj, &table->objects, list) { 8531 if (!nft_is_active(net, obj)) 8532 goto cont; 8533 if (idx < ctx->s_idx) 8534 goto cont; 8535 if (ctx->table && strcmp(ctx->table, table->name)) 8536 goto cont; 8537 if (ctx->type != NFT_OBJECT_UNSPEC && 8538 obj->ops->type->type != ctx->type) 8539 goto cont; 8540 8541 rc = nf_tables_fill_obj_info(skb, net, 8542 NETLINK_CB(cb->skb).portid, 8543 cb->nlh->nlmsg_seq, 8544 NFT_MSG_NEWOBJ, 8545 NLM_F_MULTI | NLM_F_APPEND, 8546 table->family, table, 8547 obj, ctx->reset); 8548 if (rc < 0) 8549 break; 8550 8551 entries++; 8552 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 8553 cont: 8554 idx++; 8555 } 8556 if (ctx->reset && entries) 8557 audit_log_obj_reset(table, nft_base_seq(net), entries); 8558 if (rc < 0) 8559 break; 8560 } 8561 rcu_read_unlock(); 8562 8563 ctx->s_idx = idx; 8564 return skb->len; 8565 } 8566 8567 static int nf_tables_dumpreset_obj(struct sk_buff *skb, 8568 struct netlink_callback *cb) 8569 { 8570 struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); 8571 int ret; 8572 8573 mutex_lock(&nft_net->commit_mutex); 8574 ret = nf_tables_dump_obj(skb, cb); 8575 mutex_unlock(&nft_net->commit_mutex); 8576 8577 return ret; 8578 } 8579 8580 static int nf_tables_dump_obj_start(struct netlink_callback *cb) 8581 { 8582 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8583 const struct nlattr * const *nla = cb->data; 8584 8585 BUILD_BUG_ON(sizeof(*ctx) > sizeof(cb->ctx)); 8586 8587 if (nla[NFTA_OBJ_TABLE]) { 8588 ctx->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC); 8589 if (!ctx->table) 8590 return -ENOMEM; 8591 } 8592 8593 if (nla[NFTA_OBJ_TYPE]) 8594 ctx->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8595 8596 return 0; 8597 } 8598 8599 static int nf_tables_dumpreset_obj_start(struct netlink_callback *cb) 8600 { 8601 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8602 8603 ctx->reset = true; 8604 8605 return nf_tables_dump_obj_start(cb); 8606 } 8607 8608 static int nf_tables_dump_obj_done(struct netlink_callback *cb) 8609 { 8610 struct nft_obj_dump_ctx *ctx = (void *)cb->ctx; 8611 8612 kfree(ctx->table); 8613 8614 return 0; 8615 } 8616 8617 /* Caller must hold rcu read lock or transaction mutex */ 8618 static struct sk_buff * 8619 nf_tables_getobj_single(u32 portid, const struct nfnl_info *info, 8620 const struct nlattr * const nla[], bool reset) 8621 { 8622 struct netlink_ext_ack *extack = info->extack; 8623 u8 genmask = nft_genmask_cur(info->net); 8624 u8 family = info->nfmsg->nfgen_family; 8625 const struct nft_table *table; 8626 struct net *net = info->net; 8627 struct nft_object *obj; 8628 struct sk_buff *skb2; 8629 u32 objtype; 8630 int err; 8631 8632 if (!nla[NFTA_OBJ_NAME] || 8633 !nla[NFTA_OBJ_TYPE]) 8634 return ERR_PTR(-EINVAL); 8635 8636 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0); 8637 if (IS_ERR(table)) { 8638 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 8639 return ERR_CAST(table); 8640 } 8641 8642 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8643 obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask); 8644 if (IS_ERR(obj)) { 8645 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]); 8646 return ERR_CAST(obj); 8647 } 8648 8649 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 8650 if (!skb2) 8651 return ERR_PTR(-ENOMEM); 8652 8653 err = nf_tables_fill_obj_info(skb2, net, portid, 8654 info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, 8655 family, table, obj, reset); 8656 if (err < 0) { 8657 kfree_skb(skb2); 8658 return ERR_PTR(err); 8659 } 8660 8661 return skb2; 8662 } 8663 8664 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, 8665 const struct nlattr * const nla[]) 8666 { 8667 u32 portid = NETLINK_CB(skb).portid; 8668 struct sk_buff *skb2; 8669 8670 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8671 struct netlink_dump_control c = { 8672 .start = nf_tables_dump_obj_start, 8673 .dump = nf_tables_dump_obj, 8674 .done = nf_tables_dump_obj_done, 8675 .module = THIS_MODULE, 8676 .data = (void *)nla, 8677 }; 8678 8679 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8680 } 8681 8682 skb2 = nf_tables_getobj_single(portid, info, nla, false); 8683 if (IS_ERR(skb2)) 8684 return PTR_ERR(skb2); 8685 8686 return nfnetlink_unicast(skb2, info->net, portid); 8687 } 8688 8689 static int nf_tables_getobj_reset(struct sk_buff *skb, 8690 const struct nfnl_info *info, 8691 const struct nlattr * const nla[]) 8692 { 8693 struct nftables_pernet *nft_net = nft_pernet(info->net); 8694 u32 portid = NETLINK_CB(skb).portid; 8695 struct net *net = info->net; 8696 struct sk_buff *skb2; 8697 char *buf; 8698 8699 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 8700 struct netlink_dump_control c = { 8701 .start = nf_tables_dumpreset_obj_start, 8702 .dump = nf_tables_dumpreset_obj, 8703 .done = nf_tables_dump_obj_done, 8704 .module = THIS_MODULE, 8705 .data = (void *)nla, 8706 }; 8707 8708 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 8709 } 8710 8711 if (!try_module_get(THIS_MODULE)) 8712 return -EINVAL; 8713 rcu_read_unlock(); 8714 mutex_lock(&nft_net->commit_mutex); 8715 skb2 = nf_tables_getobj_single(portid, info, nla, true); 8716 mutex_unlock(&nft_net->commit_mutex); 8717 rcu_read_lock(); 8718 module_put(THIS_MODULE); 8719 8720 if (IS_ERR(skb2)) 8721 return PTR_ERR(skb2); 8722 8723 buf = kasprintf(GFP_ATOMIC, "%.*s:%u", 8724 nla_len(nla[NFTA_OBJ_TABLE]), 8725 (char *)nla_data(nla[NFTA_OBJ_TABLE]), 8726 nft_base_seq(net)); 8727 audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1, 8728 AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC); 8729 kfree(buf); 8730 8731 return nfnetlink_unicast(skb2, net, portid); 8732 } 8733 8734 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) 8735 { 8736 if (obj->ops->destroy) 8737 obj->ops->destroy(ctx, obj); 8738 8739 module_put(obj->ops->type->owner); 8740 kfree(obj->key.name); 8741 kfree(obj->udata); 8742 kfree(obj); 8743 } 8744 8745 static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info, 8746 const struct nlattr * const nla[]) 8747 { 8748 struct netlink_ext_ack *extack = info->extack; 8749 u8 genmask = nft_genmask_next(info->net); 8750 u8 family = info->nfmsg->nfgen_family; 8751 struct net *net = info->net; 8752 const struct nlattr *attr; 8753 struct nft_table *table; 8754 struct nft_object *obj; 8755 struct nft_ctx ctx; 8756 u32 objtype; 8757 8758 if (!nla[NFTA_OBJ_TYPE] || 8759 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE])) 8760 return -EINVAL; 8761 8762 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 8763 NETLINK_CB(skb).portid); 8764 if (IS_ERR(table)) { 8765 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]); 8766 return PTR_ERR(table); 8767 } 8768 8769 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE])); 8770 if (nla[NFTA_OBJ_HANDLE]) { 8771 attr = nla[NFTA_OBJ_HANDLE]; 8772 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask); 8773 } else { 8774 attr = nla[NFTA_OBJ_NAME]; 8775 obj = nft_obj_lookup(net, table, attr, objtype, genmask); 8776 } 8777 8778 if (IS_ERR(obj)) { 8779 if (PTR_ERR(obj) == -ENOENT && 8780 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYOBJ) 8781 return 0; 8782 8783 NL_SET_BAD_ATTR(extack, attr); 8784 return PTR_ERR(obj); 8785 } 8786 if (obj->use > 0) { 8787 NL_SET_BAD_ATTR(extack, attr); 8788 return -EBUSY; 8789 } 8790 8791 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 8792 8793 return nft_delobj(&ctx, obj); 8794 } 8795 8796 static void 8797 __nft_obj_notify(struct net *net, const struct nft_table *table, 8798 struct nft_object *obj, u32 portid, u32 seq, int event, 8799 u16 flags, int family, int report, gfp_t gfp) 8800 { 8801 struct nftables_pernet *nft_net = nft_pernet(net); 8802 struct sk_buff *skb; 8803 int err; 8804 8805 if (!report && 8806 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 8807 return; 8808 8809 skb = nlmsg_new(NLMSG_GOODSIZE, gfp); 8810 if (skb == NULL) 8811 goto err; 8812 8813 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 8814 flags & (NLM_F_CREATE | NLM_F_EXCL), 8815 family, table, obj, false); 8816 if (err < 0) { 8817 kfree_skb(skb); 8818 goto err; 8819 } 8820 8821 nft_notify_enqueue(skb, report, &nft_net->notify_list); 8822 return; 8823 err: 8824 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS); 8825 } 8826 8827 void nft_obj_notify(struct net *net, const struct nft_table *table, 8828 struct nft_object *obj, u32 portid, u32 seq, int event, 8829 u16 flags, int family, int report, gfp_t gfp) 8830 { 8831 char *buf = kasprintf(gfp, "%s:%u", 8832 table->name, nft_base_seq(net)); 8833 8834 audit_log_nfcfg(buf, 8835 family, 8836 obj->handle, 8837 event == NFT_MSG_NEWOBJ ? 8838 AUDIT_NFT_OP_OBJ_REGISTER : 8839 AUDIT_NFT_OP_OBJ_UNREGISTER, 8840 gfp); 8841 kfree(buf); 8842 8843 __nft_obj_notify(net, table, obj, portid, seq, event, 8844 flags, family, report, gfp); 8845 } 8846 EXPORT_SYMBOL_GPL(nft_obj_notify); 8847 8848 static void nf_tables_obj_notify(const struct nft_ctx *ctx, 8849 struct nft_object *obj, int event) 8850 { 8851 __nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, 8852 ctx->seq, event, ctx->flags, ctx->family, 8853 ctx->report, GFP_KERNEL); 8854 } 8855 8856 /* 8857 * Flow tables 8858 */ 8859 void nft_register_flowtable_type(struct nf_flowtable_type *type) 8860 { 8861 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8862 list_add_tail_rcu(&type->list, &nf_tables_flowtables); 8863 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8864 } 8865 EXPORT_SYMBOL_GPL(nft_register_flowtable_type); 8866 8867 void nft_unregister_flowtable_type(struct nf_flowtable_type *type) 8868 { 8869 nfnl_lock(NFNL_SUBSYS_NFTABLES); 8870 list_del_rcu(&type->list); 8871 nfnl_unlock(NFNL_SUBSYS_NFTABLES); 8872 } 8873 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type); 8874 8875 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 8876 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING, 8877 .len = NFT_NAME_MAXLEN - 1 }, 8878 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING, 8879 .len = NFT_NAME_MAXLEN - 1 }, 8880 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED }, 8881 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 }, 8882 [NFTA_FLOWTABLE_FLAGS] = { .type = NLA_U32 }, 8883 }; 8884 8885 struct nft_flowtable *nft_flowtable_lookup(const struct net *net, 8886 const struct nft_table *table, 8887 const struct nlattr *nla, u8 genmask) 8888 { 8889 struct nft_flowtable *flowtable; 8890 8891 list_for_each_entry_rcu(flowtable, &table->flowtables, list, 8892 lockdep_commit_lock_is_held(net)) { 8893 if (!nla_strcmp(nla, flowtable->name) && 8894 nft_active_genmask(flowtable, genmask)) 8895 return flowtable; 8896 } 8897 return ERR_PTR(-ENOENT); 8898 } 8899 EXPORT_SYMBOL_GPL(nft_flowtable_lookup); 8900 8901 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, 8902 struct nft_flowtable *flowtable, 8903 enum nft_trans_phase phase) 8904 { 8905 switch (phase) { 8906 case NFT_TRANS_PREPARE_ERROR: 8907 case NFT_TRANS_PREPARE: 8908 case NFT_TRANS_ABORT: 8909 case NFT_TRANS_RELEASE: 8910 nft_use_dec(&flowtable->use); 8911 fallthrough; 8912 default: 8913 return; 8914 } 8915 } 8916 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable); 8917 8918 static struct nft_flowtable * 8919 nft_flowtable_lookup_byhandle(const struct nft_table *table, 8920 const struct nlattr *nla, u8 genmask) 8921 { 8922 struct nft_flowtable *flowtable; 8923 8924 list_for_each_entry(flowtable, &table->flowtables, list) { 8925 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle && 8926 nft_active_genmask(flowtable, genmask)) 8927 return flowtable; 8928 } 8929 return ERR_PTR(-ENOENT); 8930 } 8931 8932 struct nft_flowtable_hook { 8933 u32 num; 8934 int priority; 8935 struct list_head list; 8936 }; 8937 8938 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = { 8939 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 }, 8940 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 }, 8941 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED }, 8942 }; 8943 8944 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx, 8945 const struct nlattr * const nla[], 8946 struct nft_flowtable_hook *flowtable_hook, 8947 struct nft_flowtable *flowtable, 8948 struct netlink_ext_ack *extack, bool add) 8949 { 8950 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1]; 8951 struct nf_hook_ops *ops; 8952 struct nft_hook *hook; 8953 int hooknum, priority; 8954 int err; 8955 8956 INIT_LIST_HEAD(&flowtable_hook->list); 8957 8958 err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, 8959 nla[NFTA_FLOWTABLE_HOOK], 8960 nft_flowtable_hook_policy, NULL); 8961 if (err < 0) 8962 return err; 8963 8964 if (add) { 8965 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] || 8966 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 8967 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 8968 return -ENOENT; 8969 } 8970 8971 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 8972 if (hooknum != NF_NETDEV_INGRESS) 8973 return -EOPNOTSUPP; 8974 8975 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 8976 8977 flowtable_hook->priority = priority; 8978 flowtable_hook->num = hooknum; 8979 } else { 8980 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) { 8981 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM])); 8982 if (hooknum != flowtable->hooknum) 8983 return -EOPNOTSUPP; 8984 } 8985 8986 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) { 8987 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY])); 8988 if (priority != flowtable->data.priority) 8989 return -EOPNOTSUPP; 8990 } 8991 8992 flowtable_hook->priority = flowtable->data.priority; 8993 flowtable_hook->num = flowtable->hooknum; 8994 } 8995 8996 if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) { 8997 err = nf_tables_parse_netdev_hooks(ctx->net, 8998 tb[NFTA_FLOWTABLE_HOOK_DEVS], 8999 &flowtable_hook->list, 9000 extack); 9001 if (err < 0) 9002 return err; 9003 } 9004 9005 list_for_each_entry(hook, &flowtable_hook->list, list) { 9006 list_for_each_entry(ops, &hook->ops_list, list) { 9007 ops->pf = NFPROTO_NETDEV; 9008 ops->hooknum = flowtable_hook->num; 9009 ops->priority = flowtable_hook->priority; 9010 ops->priv = &flowtable->data; 9011 ops->hook = flowtable->data.type->hook; 9012 ops->hook_ops_type = NF_HOOK_OP_NFT_FT; 9013 } 9014 } 9015 9016 return err; 9017 } 9018 9019 /* call under rcu_read_lock */ 9020 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family) 9021 { 9022 const struct nf_flowtable_type *type; 9023 9024 list_for_each_entry_rcu(type, &nf_tables_flowtables, list) { 9025 if (family == type->family) 9026 return type; 9027 } 9028 return NULL; 9029 } 9030 9031 static const struct nf_flowtable_type * 9032 nft_flowtable_type_get(struct net *net, u8 family) 9033 { 9034 const struct nf_flowtable_type *type; 9035 9036 rcu_read_lock(); 9037 type = __nft_flowtable_type_get(family); 9038 if (type != NULL && try_module_get(type->owner)) { 9039 rcu_read_unlock(); 9040 return type; 9041 } 9042 rcu_read_unlock(); 9043 9044 lockdep_nfnl_nft_mutex_not_held(); 9045 #ifdef CONFIG_MODULES 9046 if (type == NULL) { 9047 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN) 9048 return ERR_PTR(-EAGAIN); 9049 } 9050 #endif 9051 return ERR_PTR(-ENOENT); 9052 } 9053 9054 /* Only called from error and netdev event paths. */ 9055 static void nft_unregister_flowtable_ops(struct net *net, 9056 struct nft_flowtable *flowtable, 9057 struct nf_hook_ops *ops) 9058 { 9059 nf_unregister_net_hook(net, ops); 9060 flowtable->data.type->setup(&flowtable->data, ops->dev, 9061 FLOW_BLOCK_UNBIND); 9062 } 9063 9064 static void __nft_unregister_flowtable_net_hooks(struct net *net, 9065 struct nft_flowtable *flowtable, 9066 struct list_head *hook_list, 9067 bool release_netdev) 9068 { 9069 struct nft_hook *hook, *next; 9070 struct nf_hook_ops *ops; 9071 9072 list_for_each_entry_safe(hook, next, hook_list, list) { 9073 list_for_each_entry(ops, &hook->ops_list, list) 9074 nft_unregister_flowtable_ops(net, flowtable, ops); 9075 if (release_netdev) { 9076 list_del(&hook->list); 9077 nft_netdev_hook_free_rcu(hook); 9078 } 9079 } 9080 } 9081 9082 static void nft_unregister_flowtable_net_hooks(struct net *net, 9083 struct nft_flowtable *flowtable, 9084 struct list_head *hook_list) 9085 { 9086 __nft_unregister_flowtable_net_hooks(net, flowtable, hook_list, false); 9087 } 9088 9089 static int nft_register_flowtable_ops(struct net *net, 9090 struct nft_flowtable *flowtable, 9091 struct nf_hook_ops *ops) 9092 { 9093 int err; 9094 9095 err = flowtable->data.type->setup(&flowtable->data, 9096 ops->dev, FLOW_BLOCK_BIND); 9097 if (err < 0) 9098 return err; 9099 9100 err = nf_register_net_hook(net, ops); 9101 if (!err) 9102 return 0; 9103 9104 flowtable->data.type->setup(&flowtable->data, 9105 ops->dev, FLOW_BLOCK_UNBIND); 9106 return err; 9107 } 9108 9109 static int nft_register_flowtable_net_hooks(struct net *net, 9110 struct nft_table *table, 9111 struct list_head *hook_list, 9112 struct nft_flowtable *flowtable) 9113 { 9114 struct nft_hook *hook, *next; 9115 struct nft_flowtable *ft; 9116 struct nf_hook_ops *ops; 9117 int err, i = 0; 9118 9119 list_for_each_entry(hook, hook_list, list) { 9120 list_for_each_entry(ft, &table->flowtables, list) { 9121 if (!nft_is_active_next(net, ft)) 9122 continue; 9123 9124 if (nft_hook_list_find(&ft->hook_list, hook)) { 9125 err = -EEXIST; 9126 goto err_unregister_net_hooks; 9127 } 9128 } 9129 9130 list_for_each_entry(ops, &hook->ops_list, list) { 9131 err = nft_register_flowtable_ops(net, flowtable, ops); 9132 if (err < 0) 9133 goto err_unregister_net_hooks; 9134 9135 i++; 9136 } 9137 } 9138 9139 return 0; 9140 9141 err_unregister_net_hooks: 9142 list_for_each_entry_safe(hook, next, hook_list, list) { 9143 list_for_each_entry(ops, &hook->ops_list, list) { 9144 if (i-- <= 0) 9145 break; 9146 9147 nft_unregister_flowtable_ops(net, flowtable, ops); 9148 } 9149 list_del_rcu(&hook->list); 9150 nft_netdev_hook_free_rcu(hook); 9151 } 9152 9153 return err; 9154 } 9155 9156 static void nft_hooks_destroy(struct list_head *hook_list) 9157 { 9158 struct nft_hook *hook, *next; 9159 9160 list_for_each_entry_safe(hook, next, hook_list, list) { 9161 list_del_rcu(&hook->list); 9162 nft_netdev_hook_free_rcu(hook); 9163 } 9164 } 9165 9166 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, 9167 struct nft_flowtable *flowtable, 9168 struct netlink_ext_ack *extack) 9169 { 9170 const struct nlattr * const *nla = ctx->nla; 9171 struct nft_flowtable_hook flowtable_hook; 9172 struct nftables_pernet *nft_net; 9173 struct nft_hook *hook, *next; 9174 struct nf_hook_ops *ops; 9175 struct nft_trans *trans; 9176 bool unregister = false; 9177 u32 flags; 9178 int err; 9179 9180 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 9181 extack, false); 9182 if (err < 0) 9183 return err; 9184 9185 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 9186 if (nft_hook_list_find(&flowtable->hook_list, hook)) { 9187 list_del(&hook->list); 9188 nft_netdev_hook_free(hook); 9189 continue; 9190 } 9191 9192 nft_net = nft_pernet(ctx->net); 9193 list_for_each_entry(trans, &nft_net->commit_list, list) { 9194 if (trans->msg_type != NFT_MSG_NEWFLOWTABLE || 9195 trans->table != ctx->table || 9196 !nft_trans_flowtable_update(trans)) 9197 continue; 9198 9199 if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) { 9200 err = -EEXIST; 9201 goto err_flowtable_update_hook; 9202 } 9203 } 9204 } 9205 9206 if (nla[NFTA_FLOWTABLE_FLAGS]) { 9207 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 9208 if (flags & ~NFT_FLOWTABLE_MASK) { 9209 err = -EOPNOTSUPP; 9210 goto err_flowtable_update_hook; 9211 } 9212 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^ 9213 (flags & NFT_FLOWTABLE_HW_OFFLOAD)) { 9214 err = -EOPNOTSUPP; 9215 goto err_flowtable_update_hook; 9216 } 9217 } else { 9218 flags = flowtable->data.flags; 9219 } 9220 9221 err = nft_register_flowtable_net_hooks(ctx->net, ctx->table, 9222 &flowtable_hook.list, flowtable); 9223 if (err < 0) 9224 goto err_flowtable_update_hook; 9225 9226 trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE, 9227 sizeof(struct nft_trans_flowtable)); 9228 if (!trans) { 9229 unregister = true; 9230 err = -ENOMEM; 9231 goto err_flowtable_update_hook; 9232 } 9233 9234 nft_trans_flowtable_flags(trans) = flags; 9235 nft_trans_flowtable(trans) = flowtable; 9236 nft_trans_flowtable_update(trans) = true; 9237 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 9238 list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans)); 9239 9240 nft_trans_commit_list_add_tail(ctx->net, trans); 9241 9242 return 0; 9243 9244 err_flowtable_update_hook: 9245 list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { 9246 if (unregister) { 9247 list_for_each_entry(ops, &hook->ops_list, list) 9248 nft_unregister_flowtable_ops(ctx->net, 9249 flowtable, ops); 9250 } 9251 list_del_rcu(&hook->list); 9252 nft_netdev_hook_free_rcu(hook); 9253 } 9254 9255 return err; 9256 9257 } 9258 9259 static int nf_tables_newflowtable(struct sk_buff *skb, 9260 const struct nfnl_info *info, 9261 const struct nlattr * const nla[]) 9262 { 9263 struct netlink_ext_ack *extack = info->extack; 9264 struct nft_flowtable_hook flowtable_hook; 9265 u8 genmask = nft_genmask_next(info->net); 9266 u8 family = info->nfmsg->nfgen_family; 9267 const struct nf_flowtable_type *type; 9268 struct nft_flowtable *flowtable; 9269 struct net *net = info->net; 9270 struct nft_table *table; 9271 struct nft_trans *trans; 9272 struct nft_ctx ctx; 9273 int err; 9274 9275 if (!nla[NFTA_FLOWTABLE_TABLE] || 9276 !nla[NFTA_FLOWTABLE_NAME] || 9277 !nla[NFTA_FLOWTABLE_HOOK]) 9278 return -EINVAL; 9279 9280 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 9281 genmask, NETLINK_CB(skb).portid); 9282 if (IS_ERR(table)) { 9283 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 9284 return PTR_ERR(table); 9285 } 9286 9287 flowtable = nft_flowtable_lookup(net, table, nla[NFTA_FLOWTABLE_NAME], 9288 genmask); 9289 if (IS_ERR(flowtable)) { 9290 err = PTR_ERR(flowtable); 9291 if (err != -ENOENT) { 9292 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 9293 return err; 9294 } 9295 } else { 9296 if (info->nlh->nlmsg_flags & NLM_F_EXCL) { 9297 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 9298 return -EEXIST; 9299 } 9300 9301 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 9302 9303 return nft_flowtable_update(&ctx, info->nlh, flowtable, extack); 9304 } 9305 9306 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 9307 9308 if (!nft_use_inc(&table->use)) 9309 return -EMFILE; 9310 9311 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL_ACCOUNT); 9312 if (!flowtable) { 9313 err = -ENOMEM; 9314 goto flowtable_alloc; 9315 } 9316 9317 flowtable->table = table; 9318 flowtable->handle = nf_tables_alloc_handle(table); 9319 INIT_LIST_HEAD(&flowtable->hook_list); 9320 9321 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL_ACCOUNT); 9322 if (!flowtable->name) { 9323 err = -ENOMEM; 9324 goto err1; 9325 } 9326 9327 type = nft_flowtable_type_get(net, family); 9328 if (IS_ERR(type)) { 9329 err = PTR_ERR(type); 9330 goto err2; 9331 } 9332 9333 if (nla[NFTA_FLOWTABLE_FLAGS]) { 9334 flowtable->data.flags = 9335 ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS])); 9336 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) { 9337 err = -EOPNOTSUPP; 9338 goto err3; 9339 } 9340 } 9341 9342 write_pnet(&flowtable->data.net, net); 9343 flowtable->data.type = type; 9344 err = type->init(&flowtable->data); 9345 if (err < 0) 9346 goto err3; 9347 9348 err = nft_flowtable_parse_hook(&ctx, nla, &flowtable_hook, flowtable, 9349 extack, true); 9350 if (err < 0) 9351 goto err_flowtable_parse_hooks; 9352 9353 list_splice(&flowtable_hook.list, &flowtable->hook_list); 9354 flowtable->data.priority = flowtable_hook.priority; 9355 flowtable->hooknum = flowtable_hook.num; 9356 9357 trans = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable); 9358 if (IS_ERR(trans)) { 9359 err = PTR_ERR(trans); 9360 goto err_flowtable_trans; 9361 } 9362 9363 /* This must be LAST to ensure no packets are walking over this flowtable. */ 9364 err = nft_register_flowtable_net_hooks(ctx.net, table, 9365 &flowtable->hook_list, 9366 flowtable); 9367 if (err < 0) 9368 goto err_flowtable_hooks; 9369 9370 list_add_tail_rcu(&flowtable->list, &table->flowtables); 9371 9372 return 0; 9373 9374 err_flowtable_hooks: 9375 nft_trans_destroy(trans); 9376 err_flowtable_trans: 9377 nft_hooks_destroy(&flowtable->hook_list); 9378 err_flowtable_parse_hooks: 9379 flowtable->data.type->free(&flowtable->data); 9380 err3: 9381 module_put(type->owner); 9382 err2: 9383 kfree(flowtable->name); 9384 err1: 9385 kfree(flowtable); 9386 flowtable_alloc: 9387 nft_use_dec_restore(&table->use); 9388 9389 return err; 9390 } 9391 9392 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook) 9393 { 9394 struct nft_hook *this, *next; 9395 9396 list_for_each_entry_safe(this, next, &flowtable_hook->list, list) { 9397 list_del(&this->list); 9398 nft_netdev_hook_free(this); 9399 } 9400 } 9401 9402 static int nft_delflowtable_hook(struct nft_ctx *ctx, 9403 struct nft_flowtable *flowtable, 9404 struct netlink_ext_ack *extack) 9405 { 9406 const struct nlattr * const *nla = ctx->nla; 9407 struct nft_flowtable_hook flowtable_hook; 9408 LIST_HEAD(flowtable_del_list); 9409 struct nft_hook *this, *hook; 9410 struct nft_trans *trans; 9411 int err; 9412 9413 err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable, 9414 extack, false); 9415 if (err < 0) 9416 return err; 9417 9418 list_for_each_entry(this, &flowtable_hook.list, list) { 9419 hook = nft_hook_list_find(&flowtable->hook_list, this); 9420 if (!hook) { 9421 err = -ENOENT; 9422 goto err_flowtable_del_hook; 9423 } 9424 list_move(&hook->list, &flowtable_del_list); 9425 } 9426 9427 trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE, 9428 sizeof(struct nft_trans_flowtable)); 9429 if (!trans) { 9430 err = -ENOMEM; 9431 goto err_flowtable_del_hook; 9432 } 9433 9434 nft_trans_flowtable(trans) = flowtable; 9435 nft_trans_flowtable_update(trans) = true; 9436 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans)); 9437 list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans)); 9438 nft_flowtable_hook_release(&flowtable_hook); 9439 9440 nft_trans_commit_list_add_tail(ctx->net, trans); 9441 9442 return 0; 9443 9444 err_flowtable_del_hook: 9445 list_splice(&flowtable_del_list, &flowtable->hook_list); 9446 nft_flowtable_hook_release(&flowtable_hook); 9447 9448 return err; 9449 } 9450 9451 static int nf_tables_delflowtable(struct sk_buff *skb, 9452 const struct nfnl_info *info, 9453 const struct nlattr * const nla[]) 9454 { 9455 struct netlink_ext_ack *extack = info->extack; 9456 u8 genmask = nft_genmask_next(info->net); 9457 u8 family = info->nfmsg->nfgen_family; 9458 struct nft_flowtable *flowtable; 9459 struct net *net = info->net; 9460 const struct nlattr *attr; 9461 struct nft_table *table; 9462 struct nft_ctx ctx; 9463 9464 if (!nla[NFTA_FLOWTABLE_TABLE] || 9465 (!nla[NFTA_FLOWTABLE_NAME] && 9466 !nla[NFTA_FLOWTABLE_HANDLE])) 9467 return -EINVAL; 9468 9469 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 9470 genmask, NETLINK_CB(skb).portid); 9471 if (IS_ERR(table)) { 9472 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 9473 return PTR_ERR(table); 9474 } 9475 9476 if (nla[NFTA_FLOWTABLE_HANDLE]) { 9477 attr = nla[NFTA_FLOWTABLE_HANDLE]; 9478 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask); 9479 } else { 9480 attr = nla[NFTA_FLOWTABLE_NAME]; 9481 flowtable = nft_flowtable_lookup(net, table, attr, genmask); 9482 } 9483 9484 if (IS_ERR(flowtable)) { 9485 if (PTR_ERR(flowtable) == -ENOENT && 9486 NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYFLOWTABLE) 9487 return 0; 9488 9489 NL_SET_BAD_ATTR(extack, attr); 9490 return PTR_ERR(flowtable); 9491 } 9492 9493 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); 9494 9495 if (nla[NFTA_FLOWTABLE_HOOK]) 9496 return nft_delflowtable_hook(&ctx, flowtable, extack); 9497 9498 if (flowtable->use > 0) { 9499 NL_SET_BAD_ATTR(extack, attr); 9500 return -EBUSY; 9501 } 9502 9503 return nft_delflowtable(&ctx, flowtable); 9504 } 9505 9506 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 9507 u32 portid, u32 seq, int event, 9508 u32 flags, int family, 9509 struct nft_flowtable *flowtable, 9510 struct list_head *hook_list) 9511 { 9512 struct nlattr *nest, *nest_devs; 9513 struct nft_hook *hook; 9514 struct nlmsghdr *nlh; 9515 9516 nlh = nfnl_msg_put(skb, portid, seq, 9517 nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event), 9518 flags, family, NFNETLINK_V0, nft_base_seq_be16(net)); 9519 if (!nlh) 9520 goto nla_put_failure; 9521 9522 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || 9523 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || 9524 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle), 9525 NFTA_FLOWTABLE_PAD)) 9526 goto nla_put_failure; 9527 9528 if (!hook_list && 9529 (event == NFT_MSG_DELFLOWTABLE || 9530 event == NFT_MSG_DESTROYFLOWTABLE)) { 9531 nlmsg_end(skb, nlh); 9532 return 0; 9533 } 9534 9535 if (nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || 9536 nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags))) 9537 goto nla_put_failure; 9538 9539 nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK); 9540 if (!nest) 9541 goto nla_put_failure; 9542 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) || 9543 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority))) 9544 goto nla_put_failure; 9545 9546 nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS); 9547 if (!nest_devs) 9548 goto nla_put_failure; 9549 9550 if (!hook_list) 9551 hook_list = &flowtable->hook_list; 9552 9553 list_for_each_entry_rcu(hook, hook_list, list, 9554 lockdep_commit_lock_is_held(net)) { 9555 if (nft_nla_put_hook_dev(skb, hook)) 9556 goto nla_put_failure; 9557 } 9558 nla_nest_end(skb, nest_devs); 9559 nla_nest_end(skb, nest); 9560 9561 nlmsg_end(skb, nlh); 9562 return 0; 9563 9564 nla_put_failure: 9565 nlmsg_trim(skb, nlh); 9566 return -1; 9567 } 9568 9569 struct nft_flowtable_filter { 9570 char *table; 9571 }; 9572 9573 static int nf_tables_dump_flowtable(struct sk_buff *skb, 9574 struct netlink_callback *cb) 9575 { 9576 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 9577 struct nft_flowtable_filter *filter = cb->data; 9578 unsigned int idx = 0, s_idx = cb->args[0]; 9579 struct net *net = sock_net(skb->sk); 9580 int family = nfmsg->nfgen_family; 9581 struct nft_flowtable *flowtable; 9582 struct nftables_pernet *nft_net; 9583 const struct nft_table *table; 9584 9585 rcu_read_lock(); 9586 nft_net = nft_pernet(net); 9587 cb->seq = nft_base_seq(net); 9588 9589 list_for_each_entry_rcu(table, &nft_net->tables, list) { 9590 if (family != NFPROTO_UNSPEC && family != table->family) 9591 continue; 9592 9593 list_for_each_entry_rcu(flowtable, &table->flowtables, list) { 9594 if (!nft_is_active(net, flowtable)) 9595 goto cont; 9596 if (idx < s_idx) 9597 goto cont; 9598 if (idx > s_idx) 9599 memset(&cb->args[1], 0, 9600 sizeof(cb->args) - sizeof(cb->args[0])); 9601 if (filter && filter->table && 9602 strcmp(filter->table, table->name)) 9603 goto cont; 9604 9605 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid, 9606 cb->nlh->nlmsg_seq, 9607 NFT_MSG_NEWFLOWTABLE, 9608 NLM_F_MULTI | NLM_F_APPEND, 9609 table->family, 9610 flowtable, NULL) < 0) 9611 goto done; 9612 9613 nl_dump_check_consistent(cb, nlmsg_hdr(skb)); 9614 cont: 9615 idx++; 9616 } 9617 } 9618 done: 9619 rcu_read_unlock(); 9620 9621 cb->args[0] = idx; 9622 return skb->len; 9623 } 9624 9625 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb) 9626 { 9627 const struct nlattr * const *nla = cb->data; 9628 struct nft_flowtable_filter *filter = NULL; 9629 9630 if (nla[NFTA_FLOWTABLE_TABLE]) { 9631 filter = kzalloc(sizeof(*filter), GFP_ATOMIC); 9632 if (!filter) 9633 return -ENOMEM; 9634 9635 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE], 9636 GFP_ATOMIC); 9637 if (!filter->table) { 9638 kfree(filter); 9639 return -ENOMEM; 9640 } 9641 } 9642 9643 cb->data = filter; 9644 return 0; 9645 } 9646 9647 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb) 9648 { 9649 struct nft_flowtable_filter *filter = cb->data; 9650 9651 if (!filter) 9652 return 0; 9653 9654 kfree(filter->table); 9655 kfree(filter); 9656 9657 return 0; 9658 } 9659 9660 /* called with rcu_read_lock held */ 9661 static int nf_tables_getflowtable(struct sk_buff *skb, 9662 const struct nfnl_info *info, 9663 const struct nlattr * const nla[]) 9664 { 9665 struct netlink_ext_ack *extack = info->extack; 9666 u8 genmask = nft_genmask_cur(info->net); 9667 u8 family = info->nfmsg->nfgen_family; 9668 struct nft_flowtable *flowtable; 9669 const struct nft_table *table; 9670 struct net *net = info->net; 9671 struct sk_buff *skb2; 9672 int err; 9673 9674 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 9675 struct netlink_dump_control c = { 9676 .start = nf_tables_dump_flowtable_start, 9677 .dump = nf_tables_dump_flowtable, 9678 .done = nf_tables_dump_flowtable_done, 9679 .module = THIS_MODULE, 9680 .data = (void *)nla, 9681 }; 9682 9683 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); 9684 } 9685 9686 if (!nla[NFTA_FLOWTABLE_NAME]) 9687 return -EINVAL; 9688 9689 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family, 9690 genmask, 0); 9691 if (IS_ERR(table)) { 9692 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]); 9693 return PTR_ERR(table); 9694 } 9695 9696 flowtable = nft_flowtable_lookup(net, table, nla[NFTA_FLOWTABLE_NAME], 9697 genmask); 9698 if (IS_ERR(flowtable)) { 9699 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]); 9700 return PTR_ERR(flowtable); 9701 } 9702 9703 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 9704 if (!skb2) 9705 return -ENOMEM; 9706 9707 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid, 9708 info->nlh->nlmsg_seq, 9709 NFT_MSG_NEWFLOWTABLE, 0, family, 9710 flowtable, NULL); 9711 if (err < 0) 9712 goto err_fill_flowtable_info; 9713 9714 return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); 9715 9716 err_fill_flowtable_info: 9717 kfree_skb(skb2); 9718 return err; 9719 } 9720 9721 static void nf_tables_flowtable_notify(struct nft_ctx *ctx, 9722 struct nft_flowtable *flowtable, 9723 struct list_head *hook_list, int event) 9724 { 9725 struct nftables_pernet *nft_net = nft_pernet(ctx->net); 9726 struct sk_buff *skb; 9727 u16 flags = 0; 9728 int err; 9729 9730 if (!ctx->report && 9731 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) 9732 return; 9733 9734 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 9735 if (skb == NULL) 9736 goto err; 9737 9738 if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) 9739 flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); 9740 9741 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, 9742 ctx->seq, event, flags, 9743 ctx->family, flowtable, hook_list); 9744 if (err < 0) { 9745 kfree_skb(skb); 9746 goto err; 9747 } 9748 9749 nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list); 9750 return; 9751 err: 9752 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS); 9753 } 9754 9755 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 9756 { 9757 struct nft_hook *hook, *next; 9758 9759 flowtable->data.type->free(&flowtable->data); 9760 list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { 9761 list_del_rcu(&hook->list); 9762 nft_netdev_hook_free_rcu(hook); 9763 } 9764 kfree(flowtable->name); 9765 module_put(flowtable->data.type->owner); 9766 kfree(flowtable); 9767 } 9768 9769 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, 9770 u32 portid, u32 seq) 9771 { 9772 struct nlmsghdr *nlh; 9773 char buf[TASK_COMM_LEN]; 9774 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); 9775 9776 nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, 9777 NFNETLINK_V0, nft_base_seq_be16(net)); 9778 if (!nlh) 9779 goto nla_put_failure; 9780 9781 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_base_seq(net))) || 9782 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || 9783 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) 9784 goto nla_put_failure; 9785 9786 nlmsg_end(skb, nlh); 9787 return 0; 9788 9789 nla_put_failure: 9790 nlmsg_trim(skb, nlh); 9791 return -EMSGSIZE; 9792 } 9793 9794 struct nf_hook_ops *nft_hook_find_ops(const struct nft_hook *hook, 9795 const struct net_device *dev) 9796 { 9797 struct nf_hook_ops *ops; 9798 9799 list_for_each_entry(ops, &hook->ops_list, list) { 9800 if (ops->dev == dev) 9801 return ops; 9802 } 9803 return NULL; 9804 } 9805 EXPORT_SYMBOL_GPL(nft_hook_find_ops); 9806 9807 struct nf_hook_ops *nft_hook_find_ops_rcu(const struct nft_hook *hook, 9808 const struct net_device *dev) 9809 { 9810 struct nf_hook_ops *ops; 9811 9812 list_for_each_entry_rcu(ops, &hook->ops_list, list) { 9813 if (ops->dev == dev) 9814 return ops; 9815 } 9816 return NULL; 9817 } 9818 EXPORT_SYMBOL_GPL(nft_hook_find_ops_rcu); 9819 9820 static int nft_flowtable_event(unsigned long event, struct net_device *dev, 9821 struct nft_flowtable *flowtable, bool changename) 9822 { 9823 struct nf_hook_ops *ops; 9824 struct nft_hook *hook; 9825 bool match; 9826 9827 list_for_each_entry(hook, &flowtable->hook_list, list) { 9828 ops = nft_hook_find_ops(hook, dev); 9829 match = !strncmp(hook->ifname, dev->name, hook->ifnamelen); 9830 9831 switch (event) { 9832 case NETDEV_UNREGISTER: 9833 /* NOP if not found or new name still matching */ 9834 if (!ops || (changename && match)) 9835 continue; 9836 9837 /* flow_offload_netdev_event() cleans up entries for us. */ 9838 nft_unregister_flowtable_ops(dev_net(dev), 9839 flowtable, ops); 9840 list_del_rcu(&ops->list); 9841 kfree_rcu(ops, rcu); 9842 break; 9843 case NETDEV_REGISTER: 9844 /* NOP if not matching or already registered */ 9845 if (!match || (changename && ops)) 9846 continue; 9847 9848 ops = kzalloc(sizeof(struct nf_hook_ops), 9849 GFP_KERNEL_ACCOUNT); 9850 if (!ops) 9851 return 1; 9852 9853 ops->pf = NFPROTO_NETDEV; 9854 ops->hooknum = flowtable->hooknum; 9855 ops->priority = flowtable->data.priority; 9856 ops->priv = &flowtable->data; 9857 ops->hook = flowtable->data.type->hook; 9858 ops->hook_ops_type = NF_HOOK_OP_NFT_FT; 9859 ops->dev = dev; 9860 if (nft_register_flowtable_ops(dev_net(dev), 9861 flowtable, ops)) { 9862 kfree(ops); 9863 return 1; 9864 } 9865 list_add_tail_rcu(&ops->list, &hook->ops_list); 9866 break; 9867 } 9868 break; 9869 } 9870 return 0; 9871 } 9872 9873 static int __nf_tables_flowtable_event(unsigned long event, 9874 struct net_device *dev, 9875 bool changename) 9876 { 9877 struct nftables_pernet *nft_net = nft_pernet(dev_net(dev)); 9878 struct nft_flowtable *flowtable; 9879 struct nft_table *table; 9880 9881 list_for_each_entry(table, &nft_net->tables, list) { 9882 list_for_each_entry(flowtable, &table->flowtables, list) { 9883 if (nft_flowtable_event(event, dev, 9884 flowtable, changename)) 9885 return 1; 9886 } 9887 } 9888 return 0; 9889 } 9890 9891 static int nf_tables_flowtable_event(struct notifier_block *this, 9892 unsigned long event, void *ptr) 9893 { 9894 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 9895 struct nftables_pernet *nft_net; 9896 int ret = NOTIFY_DONE; 9897 struct net *net; 9898 9899 if (event != NETDEV_REGISTER && 9900 event != NETDEV_UNREGISTER && 9901 event != NETDEV_CHANGENAME) 9902 return NOTIFY_DONE; 9903 9904 net = dev_net(dev); 9905 nft_net = nft_pernet(net); 9906 mutex_lock(&nft_net->commit_mutex); 9907 9908 if (event == NETDEV_CHANGENAME) { 9909 if (__nf_tables_flowtable_event(NETDEV_REGISTER, dev, true)) { 9910 ret = NOTIFY_BAD; 9911 goto out_unlock; 9912 } 9913 __nf_tables_flowtable_event(NETDEV_UNREGISTER, dev, true); 9914 } else if (__nf_tables_flowtable_event(event, dev, false)) { 9915 ret = NOTIFY_BAD; 9916 } 9917 out_unlock: 9918 mutex_unlock(&nft_net->commit_mutex); 9919 return ret; 9920 } 9921 9922 static struct notifier_block nf_tables_flowtable_notifier = { 9923 .notifier_call = nf_tables_flowtable_event, 9924 }; 9925 9926 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, 9927 int event) 9928 { 9929 struct nlmsghdr *nlh = nlmsg_hdr(skb); 9930 struct sk_buff *skb2; 9931 int err; 9932 9933 if (!nlmsg_report(nlh) && 9934 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) 9935 return; 9936 9937 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); 9938 if (skb2 == NULL) 9939 goto err; 9940 9941 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, 9942 nlh->nlmsg_seq); 9943 if (err < 0) { 9944 kfree_skb(skb2); 9945 goto err; 9946 } 9947 9948 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 9949 nlmsg_report(nlh), GFP_KERNEL); 9950 return; 9951 err: 9952 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES, 9953 -ENOBUFS); 9954 } 9955 9956 static int nf_tables_getgen(struct sk_buff *skb, const struct nfnl_info *info, 9957 const struct nlattr * const nla[]) 9958 { 9959 struct sk_buff *skb2; 9960 int err; 9961 9962 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC); 9963 if (skb2 == NULL) 9964 return -ENOMEM; 9965 9966 err = nf_tables_fill_gen_info(skb2, info->net, NETLINK_CB(skb).portid, 9967 info->nlh->nlmsg_seq); 9968 if (err < 0) 9969 goto err_fill_gen_info; 9970 9971 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 9972 9973 err_fill_gen_info: 9974 kfree_skb(skb2); 9975 return err; 9976 } 9977 9978 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = { 9979 [NFT_MSG_NEWTABLE] = { 9980 .call = nf_tables_newtable, 9981 .type = NFNL_CB_BATCH, 9982 .attr_count = NFTA_TABLE_MAX, 9983 .policy = nft_table_policy, 9984 }, 9985 [NFT_MSG_GETTABLE] = { 9986 .call = nf_tables_gettable, 9987 .type = NFNL_CB_RCU, 9988 .attr_count = NFTA_TABLE_MAX, 9989 .policy = nft_table_policy, 9990 }, 9991 [NFT_MSG_DELTABLE] = { 9992 .call = nf_tables_deltable, 9993 .type = NFNL_CB_BATCH, 9994 .attr_count = NFTA_TABLE_MAX, 9995 .policy = nft_table_policy, 9996 }, 9997 [NFT_MSG_DESTROYTABLE] = { 9998 .call = nf_tables_deltable, 9999 .type = NFNL_CB_BATCH, 10000 .attr_count = NFTA_TABLE_MAX, 10001 .policy = nft_table_policy, 10002 }, 10003 [NFT_MSG_NEWCHAIN] = { 10004 .call = nf_tables_newchain, 10005 .type = NFNL_CB_BATCH, 10006 .attr_count = NFTA_CHAIN_MAX, 10007 .policy = nft_chain_policy, 10008 }, 10009 [NFT_MSG_GETCHAIN] = { 10010 .call = nf_tables_getchain, 10011 .type = NFNL_CB_RCU, 10012 .attr_count = NFTA_CHAIN_MAX, 10013 .policy = nft_chain_policy, 10014 }, 10015 [NFT_MSG_DELCHAIN] = { 10016 .call = nf_tables_delchain, 10017 .type = NFNL_CB_BATCH, 10018 .attr_count = NFTA_CHAIN_MAX, 10019 .policy = nft_chain_policy, 10020 }, 10021 [NFT_MSG_DESTROYCHAIN] = { 10022 .call = nf_tables_delchain, 10023 .type = NFNL_CB_BATCH, 10024 .attr_count = NFTA_CHAIN_MAX, 10025 .policy = nft_chain_policy, 10026 }, 10027 [NFT_MSG_NEWRULE] = { 10028 .call = nf_tables_newrule, 10029 .type = NFNL_CB_BATCH, 10030 .attr_count = NFTA_RULE_MAX, 10031 .policy = nft_rule_policy, 10032 }, 10033 [NFT_MSG_GETRULE] = { 10034 .call = nf_tables_getrule, 10035 .type = NFNL_CB_RCU, 10036 .attr_count = NFTA_RULE_MAX, 10037 .policy = nft_rule_policy, 10038 }, 10039 [NFT_MSG_GETRULE_RESET] = { 10040 .call = nf_tables_getrule_reset, 10041 .type = NFNL_CB_RCU, 10042 .attr_count = NFTA_RULE_MAX, 10043 .policy = nft_rule_policy, 10044 }, 10045 [NFT_MSG_DELRULE] = { 10046 .call = nf_tables_delrule, 10047 .type = NFNL_CB_BATCH, 10048 .attr_count = NFTA_RULE_MAX, 10049 .policy = nft_rule_policy, 10050 }, 10051 [NFT_MSG_DESTROYRULE] = { 10052 .call = nf_tables_delrule, 10053 .type = NFNL_CB_BATCH, 10054 .attr_count = NFTA_RULE_MAX, 10055 .policy = nft_rule_policy, 10056 }, 10057 [NFT_MSG_NEWSET] = { 10058 .call = nf_tables_newset, 10059 .type = NFNL_CB_BATCH, 10060 .attr_count = NFTA_SET_MAX, 10061 .policy = nft_set_policy, 10062 }, 10063 [NFT_MSG_GETSET] = { 10064 .call = nf_tables_getset, 10065 .type = NFNL_CB_RCU, 10066 .attr_count = NFTA_SET_MAX, 10067 .policy = nft_set_policy, 10068 }, 10069 [NFT_MSG_DELSET] = { 10070 .call = nf_tables_delset, 10071 .type = NFNL_CB_BATCH, 10072 .attr_count = NFTA_SET_MAX, 10073 .policy = nft_set_policy, 10074 }, 10075 [NFT_MSG_DESTROYSET] = { 10076 .call = nf_tables_delset, 10077 .type = NFNL_CB_BATCH, 10078 .attr_count = NFTA_SET_MAX, 10079 .policy = nft_set_policy, 10080 }, 10081 [NFT_MSG_NEWSETELEM] = { 10082 .call = nf_tables_newsetelem, 10083 .type = NFNL_CB_BATCH, 10084 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10085 .policy = nft_set_elem_list_policy, 10086 }, 10087 [NFT_MSG_GETSETELEM] = { 10088 .call = nf_tables_getsetelem, 10089 .type = NFNL_CB_RCU, 10090 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10091 .policy = nft_set_elem_list_policy, 10092 }, 10093 [NFT_MSG_GETSETELEM_RESET] = { 10094 .call = nf_tables_getsetelem_reset, 10095 .type = NFNL_CB_RCU, 10096 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10097 .policy = nft_set_elem_list_policy, 10098 }, 10099 [NFT_MSG_DELSETELEM] = { 10100 .call = nf_tables_delsetelem, 10101 .type = NFNL_CB_BATCH, 10102 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10103 .policy = nft_set_elem_list_policy, 10104 }, 10105 [NFT_MSG_DESTROYSETELEM] = { 10106 .call = nf_tables_delsetelem, 10107 .type = NFNL_CB_BATCH, 10108 .attr_count = NFTA_SET_ELEM_LIST_MAX, 10109 .policy = nft_set_elem_list_policy, 10110 }, 10111 [NFT_MSG_GETGEN] = { 10112 .call = nf_tables_getgen, 10113 .type = NFNL_CB_RCU, 10114 }, 10115 [NFT_MSG_NEWOBJ] = { 10116 .call = nf_tables_newobj, 10117 .type = NFNL_CB_BATCH, 10118 .attr_count = NFTA_OBJ_MAX, 10119 .policy = nft_obj_policy, 10120 }, 10121 [NFT_MSG_GETOBJ] = { 10122 .call = nf_tables_getobj, 10123 .type = NFNL_CB_RCU, 10124 .attr_count = NFTA_OBJ_MAX, 10125 .policy = nft_obj_policy, 10126 }, 10127 [NFT_MSG_DELOBJ] = { 10128 .call = nf_tables_delobj, 10129 .type = NFNL_CB_BATCH, 10130 .attr_count = NFTA_OBJ_MAX, 10131 .policy = nft_obj_policy, 10132 }, 10133 [NFT_MSG_DESTROYOBJ] = { 10134 .call = nf_tables_delobj, 10135 .type = NFNL_CB_BATCH, 10136 .attr_count = NFTA_OBJ_MAX, 10137 .policy = nft_obj_policy, 10138 }, 10139 [NFT_MSG_GETOBJ_RESET] = { 10140 .call = nf_tables_getobj_reset, 10141 .type = NFNL_CB_RCU, 10142 .attr_count = NFTA_OBJ_MAX, 10143 .policy = nft_obj_policy, 10144 }, 10145 [NFT_MSG_NEWFLOWTABLE] = { 10146 .call = nf_tables_newflowtable, 10147 .type = NFNL_CB_BATCH, 10148 .attr_count = NFTA_FLOWTABLE_MAX, 10149 .policy = nft_flowtable_policy, 10150 }, 10151 [NFT_MSG_GETFLOWTABLE] = { 10152 .call = nf_tables_getflowtable, 10153 .type = NFNL_CB_RCU, 10154 .attr_count = NFTA_FLOWTABLE_MAX, 10155 .policy = nft_flowtable_policy, 10156 }, 10157 [NFT_MSG_DELFLOWTABLE] = { 10158 .call = nf_tables_delflowtable, 10159 .type = NFNL_CB_BATCH, 10160 .attr_count = NFTA_FLOWTABLE_MAX, 10161 .policy = nft_flowtable_policy, 10162 }, 10163 [NFT_MSG_DESTROYFLOWTABLE] = { 10164 .call = nf_tables_delflowtable, 10165 .type = NFNL_CB_BATCH, 10166 .attr_count = NFTA_FLOWTABLE_MAX, 10167 .policy = nft_flowtable_policy, 10168 }, 10169 }; 10170 10171 static int nf_tables_validate(struct net *net) 10172 { 10173 struct nftables_pernet *nft_net = nft_pernet(net); 10174 struct nft_table *table; 10175 10176 list_for_each_entry(table, &nft_net->tables, list) { 10177 switch (table->validate_state) { 10178 case NFT_VALIDATE_SKIP: 10179 continue; 10180 case NFT_VALIDATE_NEED: 10181 nft_validate_state_update(table, NFT_VALIDATE_DO); 10182 fallthrough; 10183 case NFT_VALIDATE_DO: 10184 if (nft_table_validate(net, table) < 0) 10185 return -EAGAIN; 10186 10187 nft_validate_state_update(table, NFT_VALIDATE_SKIP); 10188 break; 10189 } 10190 } 10191 10192 return 0; 10193 } 10194 10195 /* a drop policy has to be deferred until all rules have been activated, 10196 * otherwise a large ruleset that contains a drop-policy base chain will 10197 * cause all packets to get dropped until the full transaction has been 10198 * processed. 10199 * 10200 * We defer the drop policy until the transaction has been finalized. 10201 */ 10202 static void nft_chain_commit_drop_policy(struct nft_trans_chain *trans) 10203 { 10204 struct nft_base_chain *basechain; 10205 10206 if (trans->policy != NF_DROP) 10207 return; 10208 10209 if (!nft_is_base_chain(trans->chain)) 10210 return; 10211 10212 basechain = nft_base_chain(trans->chain); 10213 basechain->policy = NF_DROP; 10214 } 10215 10216 static void nft_chain_commit_update(struct nft_trans_chain *trans) 10217 { 10218 struct nft_table *table = trans->nft_trans_binding.nft_trans.table; 10219 struct nft_base_chain *basechain; 10220 10221 if (trans->name) { 10222 rhltable_remove(&table->chains_ht, 10223 &trans->chain->rhlhead, 10224 nft_chain_ht_params); 10225 swap(trans->chain->name, trans->name); 10226 rhltable_insert_key(&table->chains_ht, 10227 trans->chain->name, 10228 &trans->chain->rhlhead, 10229 nft_chain_ht_params); 10230 } 10231 10232 if (!nft_is_base_chain(trans->chain)) 10233 return; 10234 10235 nft_chain_stats_replace(trans); 10236 10237 basechain = nft_base_chain(trans->chain); 10238 10239 switch (trans->policy) { 10240 case NF_DROP: 10241 case NF_ACCEPT: 10242 basechain->policy = trans->policy; 10243 break; 10244 } 10245 } 10246 10247 static void nft_obj_commit_update(const struct nft_ctx *ctx, 10248 struct nft_trans *trans) 10249 { 10250 struct nft_object *newobj; 10251 struct nft_object *obj; 10252 10253 obj = nft_trans_obj(trans); 10254 newobj = nft_trans_obj_newobj(trans); 10255 10256 if (WARN_ON_ONCE(!obj->ops->update)) 10257 return; 10258 10259 obj->ops->update(obj, newobj); 10260 nft_obj_destroy(ctx, newobj); 10261 } 10262 10263 static void nft_commit_release(struct nft_trans *trans) 10264 { 10265 struct nft_ctx ctx = { 10266 .net = trans->net, 10267 }; 10268 10269 nft_ctx_update(&ctx, trans); 10270 10271 switch (trans->msg_type) { 10272 case NFT_MSG_DELTABLE: 10273 case NFT_MSG_DESTROYTABLE: 10274 nf_tables_table_destroy(trans->table); 10275 break; 10276 case NFT_MSG_NEWCHAIN: 10277 free_percpu(nft_trans_chain_stats(trans)); 10278 kfree(nft_trans_chain_name(trans)); 10279 break; 10280 case NFT_MSG_DELCHAIN: 10281 case NFT_MSG_DESTROYCHAIN: 10282 if (nft_trans_chain_update(trans)) 10283 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 10284 else 10285 nf_tables_chain_destroy(nft_trans_chain(trans)); 10286 break; 10287 case NFT_MSG_DELRULE: 10288 case NFT_MSG_DESTROYRULE: 10289 nf_tables_rule_destroy(&ctx, nft_trans_rule(trans)); 10290 break; 10291 case NFT_MSG_DELSET: 10292 case NFT_MSG_DESTROYSET: 10293 nft_set_destroy(&ctx, nft_trans_set(trans)); 10294 break; 10295 case NFT_MSG_DELSETELEM: 10296 case NFT_MSG_DESTROYSETELEM: 10297 nft_trans_elems_destroy(&ctx, nft_trans_container_elem(trans)); 10298 break; 10299 case NFT_MSG_DELOBJ: 10300 case NFT_MSG_DESTROYOBJ: 10301 nft_obj_destroy(&ctx, nft_trans_obj(trans)); 10302 break; 10303 case NFT_MSG_DELFLOWTABLE: 10304 case NFT_MSG_DESTROYFLOWTABLE: 10305 if (nft_trans_flowtable_update(trans)) 10306 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 10307 else 10308 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 10309 break; 10310 } 10311 10312 if (trans->put_net) 10313 put_net(trans->net); 10314 10315 kfree(trans); 10316 } 10317 10318 static void nf_tables_trans_destroy_work(struct work_struct *w) 10319 { 10320 struct nftables_pernet *nft_net = container_of(w, struct nftables_pernet, destroy_work); 10321 struct nft_trans *trans, *next; 10322 LIST_HEAD(head); 10323 10324 spin_lock(&nf_tables_destroy_list_lock); 10325 list_splice_init(&nft_net->destroy_list, &head); 10326 spin_unlock(&nf_tables_destroy_list_lock); 10327 10328 if (list_empty(&head)) 10329 return; 10330 10331 synchronize_rcu(); 10332 10333 list_for_each_entry_safe(trans, next, &head, list) { 10334 nft_trans_list_del(trans); 10335 nft_commit_release(trans); 10336 } 10337 } 10338 10339 void nf_tables_trans_destroy_flush_work(struct net *net) 10340 { 10341 struct nftables_pernet *nft_net = nft_pernet(net); 10342 10343 flush_work(&nft_net->destroy_work); 10344 } 10345 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); 10346 10347 static bool nft_expr_reduce(struct nft_regs_track *track, 10348 const struct nft_expr *expr) 10349 { 10350 return false; 10351 } 10352 10353 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain) 10354 { 10355 const struct nft_expr *expr, *last; 10356 struct nft_regs_track track = {}; 10357 unsigned int size, data_size; 10358 void *data, *data_boundary; 10359 struct nft_rule_dp *prule; 10360 struct nft_rule *rule; 10361 10362 /* already handled or inactive chain? */ 10363 if (chain->blob_next || !nft_is_active_next(net, chain)) 10364 return 0; 10365 10366 data_size = 0; 10367 list_for_each_entry(rule, &chain->rules, list) { 10368 if (nft_is_active_next(net, rule)) { 10369 data_size += sizeof(*prule) + rule->dlen; 10370 if (data_size > INT_MAX) 10371 return -ENOMEM; 10372 } 10373 } 10374 10375 chain->blob_next = nf_tables_chain_alloc_rules(chain, data_size); 10376 if (!chain->blob_next) 10377 return -ENOMEM; 10378 10379 data = (void *)chain->blob_next->data; 10380 data_boundary = data + data_size; 10381 size = 0; 10382 10383 list_for_each_entry(rule, &chain->rules, list) { 10384 if (!nft_is_active_next(net, rule)) 10385 continue; 10386 10387 prule = (struct nft_rule_dp *)data; 10388 data += offsetof(struct nft_rule_dp, data); 10389 if (WARN_ON_ONCE(data > data_boundary)) 10390 return -ENOMEM; 10391 10392 size = 0; 10393 track.last = nft_expr_last(rule); 10394 nft_rule_for_each_expr(expr, last, rule) { 10395 track.cur = expr; 10396 10397 if (nft_expr_reduce(&track, expr)) { 10398 expr = track.cur; 10399 continue; 10400 } 10401 10402 if (WARN_ON_ONCE(data + size + expr->ops->size > data_boundary)) 10403 return -ENOMEM; 10404 10405 memcpy(data + size, expr, expr->ops->size); 10406 size += expr->ops->size; 10407 } 10408 if (WARN_ON_ONCE(size >= 1 << 12)) 10409 return -ENOMEM; 10410 10411 prule->handle = rule->handle; 10412 prule->dlen = size; 10413 prule->is_last = 0; 10414 10415 data += size; 10416 size = 0; 10417 chain->blob_next->size += (unsigned long)(data - (void *)prule); 10418 } 10419 10420 if (WARN_ON_ONCE(data > data_boundary)) 10421 return -ENOMEM; 10422 10423 prule = (struct nft_rule_dp *)data; 10424 nft_last_rule(chain, prule); 10425 10426 return 0; 10427 } 10428 10429 static void nf_tables_commit_chain_prepare_cancel(struct net *net) 10430 { 10431 struct nftables_pernet *nft_net = nft_pernet(net); 10432 struct nft_trans *trans, *next; 10433 10434 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 10435 if (trans->msg_type == NFT_MSG_NEWRULE || 10436 trans->msg_type == NFT_MSG_DELRULE) { 10437 struct nft_chain *chain = nft_trans_rule_chain(trans); 10438 10439 kvfree(chain->blob_next); 10440 chain->blob_next = NULL; 10441 } 10442 } 10443 } 10444 10445 static void __nf_tables_commit_chain_free_rules(struct rcu_head *h) 10446 { 10447 struct nft_rule_dp_last *l = container_of(h, struct nft_rule_dp_last, h); 10448 10449 kvfree(l->blob); 10450 } 10451 10452 static void nf_tables_commit_chain_free_rules_old(struct nft_rule_blob *blob) 10453 { 10454 struct nft_rule_dp_last *last; 10455 10456 /* last rule trailer is after end marker */ 10457 last = (void *)blob + sizeof(*blob) + blob->size; 10458 last->blob = blob; 10459 10460 call_rcu(&last->h, __nf_tables_commit_chain_free_rules); 10461 } 10462 10463 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain) 10464 { 10465 struct nft_rule_blob *g0, *g1; 10466 bool next_genbit; 10467 10468 next_genbit = nft_gencursor_next(net); 10469 10470 g0 = rcu_dereference_protected(chain->blob_gen_0, 10471 lockdep_commit_lock_is_held(net)); 10472 g1 = rcu_dereference_protected(chain->blob_gen_1, 10473 lockdep_commit_lock_is_held(net)); 10474 10475 /* No changes to this chain? */ 10476 if (chain->blob_next == NULL) { 10477 /* chain had no change in last or next generation */ 10478 if (g0 == g1) 10479 return; 10480 /* 10481 * chain had no change in this generation; make sure next 10482 * one uses same rules as current generation. 10483 */ 10484 if (next_genbit) { 10485 rcu_assign_pointer(chain->blob_gen_1, g0); 10486 nf_tables_commit_chain_free_rules_old(g1); 10487 } else { 10488 rcu_assign_pointer(chain->blob_gen_0, g1); 10489 nf_tables_commit_chain_free_rules_old(g0); 10490 } 10491 10492 return; 10493 } 10494 10495 if (next_genbit) 10496 rcu_assign_pointer(chain->blob_gen_1, chain->blob_next); 10497 else 10498 rcu_assign_pointer(chain->blob_gen_0, chain->blob_next); 10499 10500 chain->blob_next = NULL; 10501 10502 if (g0 == g1) 10503 return; 10504 10505 if (next_genbit) 10506 nf_tables_commit_chain_free_rules_old(g1); 10507 else 10508 nf_tables_commit_chain_free_rules_old(g0); 10509 } 10510 10511 static void nft_obj_del(struct nft_object *obj) 10512 { 10513 rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params); 10514 list_del_rcu(&obj->list); 10515 } 10516 10517 void nft_chain_del(struct nft_chain *chain) 10518 { 10519 struct nft_table *table = chain->table; 10520 10521 WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead, 10522 nft_chain_ht_params)); 10523 list_del_rcu(&chain->list); 10524 } 10525 10526 static void nft_trans_gc_setelem_remove(struct nft_ctx *ctx, 10527 struct nft_trans_gc *trans) 10528 { 10529 struct nft_elem_priv **priv = trans->priv; 10530 unsigned int i; 10531 10532 for (i = 0; i < trans->count; i++) { 10533 nft_setelem_data_deactivate(ctx->net, trans->set, priv[i]); 10534 nft_setelem_remove(ctx->net, trans->set, priv[i]); 10535 } 10536 } 10537 10538 void nft_trans_gc_destroy(struct nft_trans_gc *trans) 10539 { 10540 nft_set_put(trans->set); 10541 put_net(trans->net); 10542 kfree(trans); 10543 } 10544 10545 static void nft_trans_gc_trans_free(struct rcu_head *rcu) 10546 { 10547 struct nft_elem_priv *elem_priv; 10548 struct nft_trans_gc *trans; 10549 struct nft_ctx ctx = {}; 10550 unsigned int i; 10551 10552 trans = container_of(rcu, struct nft_trans_gc, rcu); 10553 ctx.net = read_pnet(&trans->set->net); 10554 10555 for (i = 0; i < trans->count; i++) { 10556 elem_priv = trans->priv[i]; 10557 if (!nft_setelem_is_catchall(trans->set, elem_priv)) 10558 atomic_dec(&trans->set->nelems); 10559 10560 nf_tables_set_elem_destroy(&ctx, trans->set, elem_priv); 10561 } 10562 10563 nft_trans_gc_destroy(trans); 10564 } 10565 10566 static bool nft_trans_gc_work_done(struct nft_trans_gc *trans) 10567 { 10568 struct nftables_pernet *nft_net; 10569 struct nft_ctx ctx = {}; 10570 10571 nft_net = nft_pernet(trans->net); 10572 10573 mutex_lock(&nft_net->commit_mutex); 10574 10575 /* Check for race with transaction, otherwise this batch refers to 10576 * stale objects that might not be there anymore. Skip transaction if 10577 * set has been destroyed from control plane transaction in case gc 10578 * worker loses race. 10579 */ 10580 if (READ_ONCE(nft_net->gc_seq) != trans->seq || trans->set->dead) { 10581 mutex_unlock(&nft_net->commit_mutex); 10582 return false; 10583 } 10584 10585 ctx.net = trans->net; 10586 ctx.table = trans->set->table; 10587 10588 nft_trans_gc_setelem_remove(&ctx, trans); 10589 mutex_unlock(&nft_net->commit_mutex); 10590 10591 return true; 10592 } 10593 10594 static void nft_trans_gc_work(struct work_struct *work) 10595 { 10596 struct nft_trans_gc *trans, *next; 10597 LIST_HEAD(trans_gc_list); 10598 10599 spin_lock(&nf_tables_gc_list_lock); 10600 list_splice_init(&nf_tables_gc_list, &trans_gc_list); 10601 spin_unlock(&nf_tables_gc_list_lock); 10602 10603 list_for_each_entry_safe(trans, next, &trans_gc_list, list) { 10604 list_del(&trans->list); 10605 if (!nft_trans_gc_work_done(trans)) { 10606 nft_trans_gc_destroy(trans); 10607 continue; 10608 } 10609 call_rcu(&trans->rcu, nft_trans_gc_trans_free); 10610 } 10611 } 10612 10613 struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set, 10614 unsigned int gc_seq, gfp_t gfp) 10615 { 10616 struct net *net = read_pnet(&set->net); 10617 struct nft_trans_gc *trans; 10618 10619 trans = kzalloc(sizeof(*trans), gfp); 10620 if (!trans) 10621 return NULL; 10622 10623 trans->net = maybe_get_net(net); 10624 if (!trans->net) { 10625 kfree(trans); 10626 return NULL; 10627 } 10628 10629 refcount_inc(&set->refs); 10630 trans->set = set; 10631 trans->seq = gc_seq; 10632 10633 return trans; 10634 } 10635 10636 void nft_trans_gc_elem_add(struct nft_trans_gc *trans, void *priv) 10637 { 10638 trans->priv[trans->count++] = priv; 10639 } 10640 10641 static void nft_trans_gc_queue_work(struct nft_trans_gc *trans) 10642 { 10643 spin_lock(&nf_tables_gc_list_lock); 10644 list_add_tail(&trans->list, &nf_tables_gc_list); 10645 spin_unlock(&nf_tables_gc_list_lock); 10646 10647 schedule_work(&trans_gc_work); 10648 } 10649 10650 static int nft_trans_gc_space(struct nft_trans_gc *trans) 10651 { 10652 return NFT_TRANS_GC_BATCHCOUNT - trans->count; 10653 } 10654 10655 struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc, 10656 unsigned int gc_seq, gfp_t gfp) 10657 { 10658 struct nft_set *set; 10659 10660 if (nft_trans_gc_space(gc)) 10661 return gc; 10662 10663 set = gc->set; 10664 nft_trans_gc_queue_work(gc); 10665 10666 return nft_trans_gc_alloc(set, gc_seq, gfp); 10667 } 10668 10669 void nft_trans_gc_queue_async_done(struct nft_trans_gc *trans) 10670 { 10671 if (trans->count == 0) { 10672 nft_trans_gc_destroy(trans); 10673 return; 10674 } 10675 10676 nft_trans_gc_queue_work(trans); 10677 } 10678 10679 struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp) 10680 { 10681 struct nft_set *set; 10682 10683 if (WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc->net))) 10684 return NULL; 10685 10686 if (nft_trans_gc_space(gc)) 10687 return gc; 10688 10689 set = gc->set; 10690 call_rcu(&gc->rcu, nft_trans_gc_trans_free); 10691 10692 return nft_trans_gc_alloc(set, 0, gfp); 10693 } 10694 10695 void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans) 10696 { 10697 WARN_ON_ONCE(!lockdep_commit_lock_is_held(trans->net)); 10698 10699 if (trans->count == 0) { 10700 nft_trans_gc_destroy(trans); 10701 return; 10702 } 10703 10704 call_rcu(&trans->rcu, nft_trans_gc_trans_free); 10705 } 10706 10707 struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc, 10708 unsigned int gc_seq) 10709 { 10710 struct nft_set_elem_catchall *catchall; 10711 const struct nft_set *set = gc->set; 10712 struct nft_set_ext *ext; 10713 10714 list_for_each_entry_rcu(catchall, &set->catchall_list, list) { 10715 ext = nft_set_elem_ext(set, catchall->elem); 10716 10717 if (!nft_set_elem_expired(ext)) 10718 continue; 10719 if (nft_set_elem_is_dead(ext)) 10720 goto dead_elem; 10721 10722 nft_set_elem_dead(ext); 10723 dead_elem: 10724 gc = nft_trans_gc_queue_async(gc, gc_seq, GFP_ATOMIC); 10725 if (!gc) 10726 return NULL; 10727 10728 nft_trans_gc_elem_add(gc, catchall->elem); 10729 } 10730 10731 return gc; 10732 } 10733 10734 struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc) 10735 { 10736 struct nft_set_elem_catchall *catchall, *next; 10737 u64 tstamp = nft_net_tstamp(gc->net); 10738 const struct nft_set *set = gc->set; 10739 struct nft_elem_priv *elem_priv; 10740 struct nft_set_ext *ext; 10741 10742 WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc->net)); 10743 10744 list_for_each_entry_safe(catchall, next, &set->catchall_list, list) { 10745 ext = nft_set_elem_ext(set, catchall->elem); 10746 10747 if (!__nft_set_elem_expired(ext, tstamp)) 10748 continue; 10749 10750 gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); 10751 if (!gc) 10752 return NULL; 10753 10754 elem_priv = catchall->elem; 10755 nft_setelem_data_deactivate(gc->net, gc->set, elem_priv); 10756 nft_setelem_catchall_destroy(catchall); 10757 nft_trans_gc_elem_add(gc, elem_priv); 10758 } 10759 10760 return gc; 10761 } 10762 10763 static void nf_tables_module_autoload_cleanup(struct net *net) 10764 { 10765 struct nftables_pernet *nft_net = nft_pernet(net); 10766 struct nft_module_request *req, *next; 10767 10768 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 10769 list_for_each_entry_safe(req, next, &nft_net->module_list, list) { 10770 WARN_ON_ONCE(!req->done); 10771 list_del(&req->list); 10772 kfree(req); 10773 } 10774 } 10775 10776 static void nf_tables_commit_release(struct net *net) 10777 { 10778 struct nftables_pernet *nft_net = nft_pernet(net); 10779 struct nft_trans *trans; 10780 10781 /* all side effects have to be made visible. 10782 * For example, if a chain named 'foo' has been deleted, a 10783 * new transaction must not find it anymore. 10784 * 10785 * Memory reclaim happens asynchronously from work queue 10786 * to prevent expensive synchronize_rcu() in commit phase. 10787 */ 10788 if (list_empty(&nft_net->commit_list)) { 10789 nf_tables_module_autoload_cleanup(net); 10790 mutex_unlock(&nft_net->commit_mutex); 10791 return; 10792 } 10793 10794 trans = list_last_entry(&nft_net->commit_list, 10795 struct nft_trans, list); 10796 get_net(trans->net); 10797 WARN_ON_ONCE(trans->put_net); 10798 10799 trans->put_net = true; 10800 spin_lock(&nf_tables_destroy_list_lock); 10801 list_splice_tail_init(&nft_net->commit_list, &nft_net->destroy_list); 10802 spin_unlock(&nf_tables_destroy_list_lock); 10803 10804 nf_tables_module_autoload_cleanup(net); 10805 schedule_work(&nft_net->destroy_work); 10806 10807 mutex_unlock(&nft_net->commit_mutex); 10808 } 10809 10810 static void nft_commit_notify(struct net *net, u32 portid) 10811 { 10812 struct nftables_pernet *nft_net = nft_pernet(net); 10813 struct sk_buff *batch_skb = NULL, *nskb, *skb; 10814 unsigned char *data; 10815 int len; 10816 10817 list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) { 10818 if (!batch_skb) { 10819 new_batch: 10820 batch_skb = skb; 10821 len = NLMSG_GOODSIZE - skb->len; 10822 list_del(&skb->list); 10823 continue; 10824 } 10825 len -= skb->len; 10826 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) { 10827 data = skb_put(batch_skb, skb->len); 10828 memcpy(data, skb->data, skb->len); 10829 list_del(&skb->list); 10830 kfree_skb(skb); 10831 continue; 10832 } 10833 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 10834 NFT_CB(batch_skb).report, GFP_KERNEL); 10835 goto new_batch; 10836 } 10837 10838 if (batch_skb) { 10839 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES, 10840 NFT_CB(batch_skb).report, GFP_KERNEL); 10841 } 10842 10843 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 10844 } 10845 10846 static int nf_tables_commit_audit_alloc(struct list_head *adl, 10847 struct nft_table *table) 10848 { 10849 struct nft_audit_data *adp; 10850 10851 list_for_each_entry(adp, adl, list) { 10852 if (adp->table == table) 10853 return 0; 10854 } 10855 adp = kzalloc(sizeof(*adp), GFP_KERNEL); 10856 if (!adp) 10857 return -ENOMEM; 10858 adp->table = table; 10859 list_add(&adp->list, adl); 10860 return 0; 10861 } 10862 10863 static void nf_tables_commit_audit_free(struct list_head *adl) 10864 { 10865 struct nft_audit_data *adp, *adn; 10866 10867 list_for_each_entry_safe(adp, adn, adl, list) { 10868 list_del(&adp->list); 10869 kfree(adp); 10870 } 10871 } 10872 10873 /* nft audit emits the number of elements that get added/removed/updated, 10874 * so NEW/DELSETELEM needs to increment based on the total elem count. 10875 */ 10876 static unsigned int nf_tables_commit_audit_entrycount(const struct nft_trans *trans) 10877 { 10878 switch (trans->msg_type) { 10879 case NFT_MSG_NEWSETELEM: 10880 case NFT_MSG_DELSETELEM: 10881 return nft_trans_container_elem(trans)->nelems; 10882 } 10883 10884 return 1; 10885 } 10886 10887 static void nf_tables_commit_audit_collect(struct list_head *adl, 10888 const struct nft_trans *trans, u32 op) 10889 { 10890 const struct nft_table *table = trans->table; 10891 struct nft_audit_data *adp; 10892 10893 list_for_each_entry(adp, adl, list) { 10894 if (adp->table == table) 10895 goto found; 10896 } 10897 WARN_ONCE(1, "table=%s not expected in commit list", table->name); 10898 return; 10899 found: 10900 adp->entries += nf_tables_commit_audit_entrycount(trans); 10901 if (!adp->op || adp->op > op) 10902 adp->op = op; 10903 } 10904 10905 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22) 10906 10907 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation) 10908 { 10909 struct nft_audit_data *adp, *adn; 10910 char aubuf[AUNFTABLENAMELEN]; 10911 10912 list_for_each_entry_safe(adp, adn, adl, list) { 10913 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name, 10914 generation); 10915 audit_log_nfcfg(aubuf, adp->table->family, adp->entries, 10916 nft2audit_op[adp->op], GFP_KERNEL); 10917 list_del(&adp->list); 10918 kfree(adp); 10919 } 10920 } 10921 10922 static void nft_set_commit_update(struct list_head *set_update_list) 10923 { 10924 struct nft_set *set, *next; 10925 10926 list_for_each_entry_safe(set, next, set_update_list, pending_update) { 10927 list_del_init(&set->pending_update); 10928 10929 if (!set->ops->commit || set->dead) 10930 continue; 10931 10932 set->ops->commit(set); 10933 } 10934 } 10935 10936 static unsigned int nft_gc_seq_begin(struct nftables_pernet *nft_net) 10937 { 10938 unsigned int gc_seq; 10939 10940 /* Bump gc counter, it becomes odd, this is the busy mark. */ 10941 gc_seq = READ_ONCE(nft_net->gc_seq); 10942 WRITE_ONCE(nft_net->gc_seq, ++gc_seq); 10943 10944 return gc_seq; 10945 } 10946 10947 static void nft_gc_seq_end(struct nftables_pernet *nft_net, unsigned int gc_seq) 10948 { 10949 WRITE_ONCE(nft_net->gc_seq, ++gc_seq); 10950 } 10951 10952 static int nf_tables_commit(struct net *net, struct sk_buff *skb) 10953 { 10954 struct nftables_pernet *nft_net = nft_pernet(net); 10955 const struct nlmsghdr *nlh = nlmsg_hdr(skb); 10956 struct nft_trans_binding *trans_binding; 10957 struct nft_trans *trans, *next; 10958 unsigned int base_seq, gc_seq; 10959 LIST_HEAD(set_update_list); 10960 struct nft_trans_elem *te; 10961 struct nft_chain *chain; 10962 struct nft_table *table; 10963 struct nft_ctx ctx; 10964 LIST_HEAD(adl); 10965 int err; 10966 10967 if (list_empty(&nft_net->commit_list)) { 10968 mutex_unlock(&nft_net->commit_mutex); 10969 return 0; 10970 } 10971 10972 nft_ctx_init(&ctx, net, skb, nlh, NFPROTO_UNSPEC, NULL, NULL, NULL); 10973 10974 list_for_each_entry(trans_binding, &nft_net->binding_list, binding_list) { 10975 trans = &trans_binding->nft_trans; 10976 switch (trans->msg_type) { 10977 case NFT_MSG_NEWSET: 10978 if (!nft_trans_set_update(trans) && 10979 nft_set_is_anonymous(nft_trans_set(trans)) && 10980 !nft_trans_set_bound(trans)) { 10981 pr_warn_once("nftables ruleset with unbound set\n"); 10982 return -EINVAL; 10983 } 10984 break; 10985 case NFT_MSG_NEWCHAIN: 10986 if (!nft_trans_chain_update(trans) && 10987 nft_chain_binding(nft_trans_chain(trans)) && 10988 !nft_trans_chain_bound(trans)) { 10989 pr_warn_once("nftables ruleset with unbound chain\n"); 10990 return -EINVAL; 10991 } 10992 break; 10993 default: 10994 WARN_ONCE(1, "Unhandled bind type %d", trans->msg_type); 10995 break; 10996 } 10997 } 10998 10999 /* 0. Validate ruleset, otherwise roll back for error reporting. */ 11000 if (nf_tables_validate(net) < 0) { 11001 nft_net->validate_state = NFT_VALIDATE_DO; 11002 return -EAGAIN; 11003 } 11004 11005 err = nft_flow_rule_offload_commit(net); 11006 if (err < 0) 11007 return err; 11008 11009 /* 1. Allocate space for next generation rules_gen_X[] */ 11010 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 11011 struct nft_table *table = trans->table; 11012 int ret; 11013 11014 ret = nf_tables_commit_audit_alloc(&adl, table); 11015 if (ret) { 11016 nf_tables_commit_chain_prepare_cancel(net); 11017 nf_tables_commit_audit_free(&adl); 11018 return ret; 11019 } 11020 if (trans->msg_type == NFT_MSG_NEWRULE || 11021 trans->msg_type == NFT_MSG_DELRULE) { 11022 chain = nft_trans_rule_chain(trans); 11023 11024 ret = nf_tables_commit_chain_prepare(net, chain); 11025 if (ret < 0) { 11026 nf_tables_commit_chain_prepare_cancel(net); 11027 nf_tables_commit_audit_free(&adl); 11028 return ret; 11029 } 11030 } 11031 } 11032 11033 /* step 2. Make rules_gen_X visible to packet path */ 11034 list_for_each_entry(table, &nft_net->tables, list) { 11035 list_for_each_entry(chain, &table->chains, list) 11036 nf_tables_commit_chain(net, chain); 11037 } 11038 11039 /* 11040 * Bump generation counter, invalidate any dump in progress. 11041 * Cannot fail after this point. 11042 */ 11043 base_seq = nft_base_seq(net); 11044 while (++base_seq == 0) 11045 ; 11046 11047 /* pairs with smp_load_acquire in nft_lookup_eval */ 11048 smp_store_release(&net->nft.base_seq, base_seq); 11049 11050 gc_seq = nft_gc_seq_begin(nft_net); 11051 11052 /* step 3. Start new generation, rules_gen_X now in use. */ 11053 net->nft.gencursor = nft_gencursor_next(net); 11054 11055 list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) { 11056 struct nft_table *table = trans->table; 11057 11058 nft_ctx_update(&ctx, trans); 11059 11060 nf_tables_commit_audit_collect(&adl, trans, trans->msg_type); 11061 switch (trans->msg_type) { 11062 case NFT_MSG_NEWTABLE: 11063 if (nft_trans_table_update(trans)) { 11064 if (!(table->flags & __NFT_TABLE_F_UPDATE)) { 11065 nft_trans_destroy(trans); 11066 break; 11067 } 11068 if (table->flags & NFT_TABLE_F_DORMANT) 11069 nf_tables_table_disable(net, table); 11070 11071 table->flags &= ~__NFT_TABLE_F_UPDATE; 11072 } else { 11073 nft_clear(net, table); 11074 } 11075 nf_tables_table_notify(&ctx, NFT_MSG_NEWTABLE); 11076 nft_trans_destroy(trans); 11077 break; 11078 case NFT_MSG_DELTABLE: 11079 case NFT_MSG_DESTROYTABLE: 11080 list_del_rcu(&table->list); 11081 nf_tables_table_notify(&ctx, trans->msg_type); 11082 break; 11083 case NFT_MSG_NEWCHAIN: 11084 if (nft_trans_chain_update(trans)) { 11085 nft_chain_commit_update(nft_trans_container_chain(trans)); 11086 nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN, 11087 &nft_trans_chain_hooks(trans)); 11088 list_splice(&nft_trans_chain_hooks(trans), 11089 &nft_trans_basechain(trans)->hook_list); 11090 /* trans destroyed after rcu grace period */ 11091 } else { 11092 nft_chain_commit_drop_policy(nft_trans_container_chain(trans)); 11093 nft_clear(net, nft_trans_chain(trans)); 11094 nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN, NULL); 11095 nft_trans_destroy(trans); 11096 } 11097 break; 11098 case NFT_MSG_DELCHAIN: 11099 case NFT_MSG_DESTROYCHAIN: 11100 if (nft_trans_chain_update(trans)) { 11101 nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN, 11102 &nft_trans_chain_hooks(trans)); 11103 if (!(table->flags & NFT_TABLE_F_DORMANT)) { 11104 nft_netdev_unregister_hooks(net, 11105 &nft_trans_chain_hooks(trans), 11106 true); 11107 } 11108 } else { 11109 nft_chain_del(nft_trans_chain(trans)); 11110 nf_tables_chain_notify(&ctx, NFT_MSG_DELCHAIN, 11111 NULL); 11112 nf_tables_unregister_hook(ctx.net, ctx.table, 11113 nft_trans_chain(trans)); 11114 } 11115 break; 11116 case NFT_MSG_NEWRULE: 11117 nft_clear(net, nft_trans_rule(trans)); 11118 nf_tables_rule_notify(&ctx, nft_trans_rule(trans), 11119 NFT_MSG_NEWRULE); 11120 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11121 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11122 11123 nft_trans_destroy(trans); 11124 break; 11125 case NFT_MSG_DELRULE: 11126 case NFT_MSG_DESTROYRULE: 11127 list_del_rcu(&nft_trans_rule(trans)->list); 11128 nf_tables_rule_notify(&ctx, nft_trans_rule(trans), 11129 trans->msg_type); 11130 nft_rule_expr_deactivate(&ctx, nft_trans_rule(trans), 11131 NFT_TRANS_COMMIT); 11132 11133 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11134 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11135 break; 11136 case NFT_MSG_NEWSET: 11137 list_del(&nft_trans_container_set(trans)->list_trans_newset); 11138 if (nft_trans_set_update(trans)) { 11139 struct nft_set *set = nft_trans_set(trans); 11140 11141 WRITE_ONCE(set->timeout, nft_trans_set_timeout(trans)); 11142 WRITE_ONCE(set->gc_int, nft_trans_set_gc_int(trans)); 11143 11144 if (nft_trans_set_size(trans)) 11145 WRITE_ONCE(set->size, nft_trans_set_size(trans)); 11146 } else { 11147 nft_clear(net, nft_trans_set(trans)); 11148 /* This avoids hitting -EBUSY when deleting the table 11149 * from the transaction. 11150 */ 11151 if (nft_set_is_anonymous(nft_trans_set(trans)) && 11152 !list_empty(&nft_trans_set(trans)->bindings)) 11153 nft_use_dec(&table->use); 11154 } 11155 nf_tables_set_notify(&ctx, nft_trans_set(trans), 11156 NFT_MSG_NEWSET, GFP_KERNEL); 11157 nft_trans_destroy(trans); 11158 break; 11159 case NFT_MSG_DELSET: 11160 case NFT_MSG_DESTROYSET: 11161 nft_trans_set(trans)->dead = 1; 11162 list_del_rcu(&nft_trans_set(trans)->list); 11163 nf_tables_set_notify(&ctx, nft_trans_set(trans), 11164 trans->msg_type, GFP_KERNEL); 11165 break; 11166 case NFT_MSG_NEWSETELEM: 11167 te = nft_trans_container_elem(trans); 11168 11169 nft_trans_elems_add(&ctx, te); 11170 11171 if (te->set->ops->commit && 11172 list_empty(&te->set->pending_update)) { 11173 list_add_tail(&te->set->pending_update, 11174 &set_update_list); 11175 } 11176 nft_trans_destroy(trans); 11177 break; 11178 case NFT_MSG_DELSETELEM: 11179 case NFT_MSG_DESTROYSETELEM: 11180 te = nft_trans_container_elem(trans); 11181 11182 nft_trans_elems_remove(&ctx, te); 11183 11184 if (te->set->ops->commit && 11185 list_empty(&te->set->pending_update)) { 11186 list_add_tail(&te->set->pending_update, 11187 &set_update_list); 11188 } 11189 break; 11190 case NFT_MSG_NEWOBJ: 11191 if (nft_trans_obj_update(trans)) { 11192 nft_obj_commit_update(&ctx, trans); 11193 nf_tables_obj_notify(&ctx, 11194 nft_trans_obj(trans), 11195 NFT_MSG_NEWOBJ); 11196 } else { 11197 nft_clear(net, nft_trans_obj(trans)); 11198 nf_tables_obj_notify(&ctx, 11199 nft_trans_obj(trans), 11200 NFT_MSG_NEWOBJ); 11201 nft_trans_destroy(trans); 11202 } 11203 break; 11204 case NFT_MSG_DELOBJ: 11205 case NFT_MSG_DESTROYOBJ: 11206 nft_obj_del(nft_trans_obj(trans)); 11207 nf_tables_obj_notify(&ctx, nft_trans_obj(trans), 11208 trans->msg_type); 11209 break; 11210 case NFT_MSG_NEWFLOWTABLE: 11211 if (nft_trans_flowtable_update(trans)) { 11212 nft_trans_flowtable(trans)->data.flags = 11213 nft_trans_flowtable_flags(trans); 11214 nf_tables_flowtable_notify(&ctx, 11215 nft_trans_flowtable(trans), 11216 &nft_trans_flowtable_hooks(trans), 11217 NFT_MSG_NEWFLOWTABLE); 11218 list_splice(&nft_trans_flowtable_hooks(trans), 11219 &nft_trans_flowtable(trans)->hook_list); 11220 } else { 11221 nft_clear(net, nft_trans_flowtable(trans)); 11222 nf_tables_flowtable_notify(&ctx, 11223 nft_trans_flowtable(trans), 11224 NULL, 11225 NFT_MSG_NEWFLOWTABLE); 11226 } 11227 nft_trans_destroy(trans); 11228 break; 11229 case NFT_MSG_DELFLOWTABLE: 11230 case NFT_MSG_DESTROYFLOWTABLE: 11231 if (nft_trans_flowtable_update(trans)) { 11232 nf_tables_flowtable_notify(&ctx, 11233 nft_trans_flowtable(trans), 11234 &nft_trans_flowtable_hooks(trans), 11235 trans->msg_type); 11236 nft_unregister_flowtable_net_hooks(net, 11237 nft_trans_flowtable(trans), 11238 &nft_trans_flowtable_hooks(trans)); 11239 } else { 11240 list_del_rcu(&nft_trans_flowtable(trans)->list); 11241 nf_tables_flowtable_notify(&ctx, 11242 nft_trans_flowtable(trans), 11243 NULL, 11244 trans->msg_type); 11245 nft_unregister_flowtable_net_hooks(net, 11246 nft_trans_flowtable(trans), 11247 &nft_trans_flowtable(trans)->hook_list); 11248 } 11249 break; 11250 } 11251 } 11252 11253 nft_set_commit_update(&set_update_list); 11254 11255 nft_commit_notify(net, NETLINK_CB(skb).portid); 11256 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); 11257 nf_tables_commit_audit_log(&adl, nft_base_seq(net)); 11258 11259 nft_gc_seq_end(nft_net, gc_seq); 11260 nft_net->validate_state = NFT_VALIDATE_SKIP; 11261 nf_tables_commit_release(net); 11262 11263 return 0; 11264 } 11265 11266 static void nf_tables_module_autoload(struct net *net) 11267 { 11268 struct nftables_pernet *nft_net = nft_pernet(net); 11269 struct nft_module_request *req, *next; 11270 LIST_HEAD(module_list); 11271 11272 list_splice_init(&nft_net->module_list, &module_list); 11273 mutex_unlock(&nft_net->commit_mutex); 11274 list_for_each_entry_safe(req, next, &module_list, list) { 11275 request_module("%s", req->module); 11276 req->done = true; 11277 } 11278 mutex_lock(&nft_net->commit_mutex); 11279 list_splice(&module_list, &nft_net->module_list); 11280 } 11281 11282 static void nf_tables_abort_release(struct nft_trans *trans) 11283 { 11284 struct nft_ctx ctx = { }; 11285 11286 nft_ctx_update(&ctx, trans); 11287 11288 switch (trans->msg_type) { 11289 case NFT_MSG_NEWTABLE: 11290 nf_tables_table_destroy(trans->table); 11291 break; 11292 case NFT_MSG_NEWCHAIN: 11293 if (nft_trans_chain_update(trans)) 11294 nft_hooks_destroy(&nft_trans_chain_hooks(trans)); 11295 else 11296 nf_tables_chain_destroy(nft_trans_chain(trans)); 11297 break; 11298 case NFT_MSG_NEWRULE: 11299 nf_tables_rule_destroy(&ctx, nft_trans_rule(trans)); 11300 break; 11301 case NFT_MSG_NEWSET: 11302 nft_set_destroy(&ctx, nft_trans_set(trans)); 11303 break; 11304 case NFT_MSG_NEWSETELEM: 11305 nft_trans_set_elem_destroy(&ctx, nft_trans_container_elem(trans)); 11306 break; 11307 case NFT_MSG_NEWOBJ: 11308 nft_obj_destroy(&ctx, nft_trans_obj(trans)); 11309 break; 11310 case NFT_MSG_NEWFLOWTABLE: 11311 if (nft_trans_flowtable_update(trans)) 11312 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans)); 11313 else 11314 nf_tables_flowtable_destroy(nft_trans_flowtable(trans)); 11315 break; 11316 } 11317 kfree(trans); 11318 } 11319 11320 static void nft_set_abort_update(struct list_head *set_update_list) 11321 { 11322 struct nft_set *set, *next; 11323 11324 list_for_each_entry_safe(set, next, set_update_list, pending_update) { 11325 list_del_init(&set->pending_update); 11326 11327 if (!set->ops->abort) 11328 continue; 11329 11330 set->ops->abort(set); 11331 } 11332 } 11333 11334 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 11335 { 11336 struct nftables_pernet *nft_net = nft_pernet(net); 11337 struct nft_trans *trans, *next; 11338 LIST_HEAD(set_update_list); 11339 struct nft_trans_elem *te; 11340 struct nft_ctx ctx = { 11341 .net = net, 11342 }; 11343 int err = 0; 11344 11345 if (action == NFNL_ABORT_VALIDATE && 11346 nf_tables_validate(net) < 0) 11347 err = -EAGAIN; 11348 11349 list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, 11350 list) { 11351 struct nft_table *table = trans->table; 11352 11353 nft_ctx_update(&ctx, trans); 11354 11355 switch (trans->msg_type) { 11356 case NFT_MSG_NEWTABLE: 11357 if (nft_trans_table_update(trans)) { 11358 if (!(table->flags & __NFT_TABLE_F_UPDATE)) { 11359 nft_trans_destroy(trans); 11360 break; 11361 } 11362 if (table->flags & __NFT_TABLE_F_WAS_DORMANT) { 11363 nf_tables_table_disable(net, table); 11364 table->flags |= NFT_TABLE_F_DORMANT; 11365 } else if (table->flags & __NFT_TABLE_F_WAS_AWAKEN) { 11366 table->flags &= ~NFT_TABLE_F_DORMANT; 11367 } 11368 if (table->flags & __NFT_TABLE_F_WAS_ORPHAN) { 11369 table->flags &= ~NFT_TABLE_F_OWNER; 11370 table->nlpid = 0; 11371 } 11372 table->flags &= ~__NFT_TABLE_F_UPDATE; 11373 nft_trans_destroy(trans); 11374 } else { 11375 list_del_rcu(&table->list); 11376 } 11377 break; 11378 case NFT_MSG_DELTABLE: 11379 case NFT_MSG_DESTROYTABLE: 11380 nft_clear(trans->net, table); 11381 nft_trans_destroy(trans); 11382 break; 11383 case NFT_MSG_NEWCHAIN: 11384 if (nft_trans_chain_update(trans)) { 11385 if (!(table->flags & NFT_TABLE_F_DORMANT)) { 11386 nft_netdev_unregister_hooks(net, 11387 &nft_trans_chain_hooks(trans), 11388 true); 11389 } 11390 free_percpu(nft_trans_chain_stats(trans)); 11391 kfree(nft_trans_chain_name(trans)); 11392 nft_trans_destroy(trans); 11393 } else { 11394 if (nft_trans_chain_bound(trans)) { 11395 nft_trans_destroy(trans); 11396 break; 11397 } 11398 nft_use_dec_restore(&table->use); 11399 nft_chain_del(nft_trans_chain(trans)); 11400 nf_tables_unregister_hook(trans->net, table, 11401 nft_trans_chain(trans)); 11402 } 11403 break; 11404 case NFT_MSG_DELCHAIN: 11405 case NFT_MSG_DESTROYCHAIN: 11406 if (nft_trans_chain_update(trans)) { 11407 list_splice(&nft_trans_chain_hooks(trans), 11408 &nft_trans_basechain(trans)->hook_list); 11409 } else { 11410 nft_use_inc_restore(&table->use); 11411 nft_clear(trans->net, nft_trans_chain(trans)); 11412 } 11413 nft_trans_destroy(trans); 11414 break; 11415 case NFT_MSG_NEWRULE: 11416 if (nft_trans_rule_bound(trans)) { 11417 nft_trans_destroy(trans); 11418 break; 11419 } 11420 nft_use_dec_restore(&nft_trans_rule_chain(trans)->use); 11421 list_del_rcu(&nft_trans_rule(trans)->list); 11422 nft_rule_expr_deactivate(&ctx, 11423 nft_trans_rule(trans), 11424 NFT_TRANS_ABORT); 11425 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11426 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11427 break; 11428 case NFT_MSG_DELRULE: 11429 case NFT_MSG_DESTROYRULE: 11430 nft_use_inc_restore(&nft_trans_rule_chain(trans)->use); 11431 nft_clear(trans->net, nft_trans_rule(trans)); 11432 nft_rule_expr_activate(&ctx, nft_trans_rule(trans)); 11433 if (nft_trans_rule_chain(trans)->flags & NFT_CHAIN_HW_OFFLOAD) 11434 nft_flow_rule_destroy(nft_trans_flow_rule(trans)); 11435 11436 nft_trans_destroy(trans); 11437 break; 11438 case NFT_MSG_NEWSET: 11439 list_del(&nft_trans_container_set(trans)->list_trans_newset); 11440 if (nft_trans_set_update(trans)) { 11441 nft_trans_destroy(trans); 11442 break; 11443 } 11444 nft_use_dec_restore(&table->use); 11445 if (nft_trans_set_bound(trans)) { 11446 nft_trans_destroy(trans); 11447 break; 11448 } 11449 nft_trans_set(trans)->dead = 1; 11450 list_del_rcu(&nft_trans_set(trans)->list); 11451 break; 11452 case NFT_MSG_DELSET: 11453 case NFT_MSG_DESTROYSET: 11454 nft_use_inc_restore(&table->use); 11455 nft_clear(trans->net, nft_trans_set(trans)); 11456 if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11457 nft_map_activate(&ctx, nft_trans_set(trans)); 11458 11459 nft_trans_destroy(trans); 11460 break; 11461 case NFT_MSG_NEWSETELEM: 11462 if (nft_trans_elem_set_bound(trans)) { 11463 nft_trans_destroy(trans); 11464 break; 11465 } 11466 te = nft_trans_container_elem(trans); 11467 if (!nft_trans_elems_new_abort(&ctx, te)) { 11468 nft_trans_destroy(trans); 11469 break; 11470 } 11471 11472 if (te->set->ops->abort && 11473 list_empty(&te->set->pending_update)) { 11474 list_add_tail(&te->set->pending_update, 11475 &set_update_list); 11476 } 11477 break; 11478 case NFT_MSG_DELSETELEM: 11479 case NFT_MSG_DESTROYSETELEM: 11480 te = nft_trans_container_elem(trans); 11481 11482 nft_trans_elems_destroy_abort(&ctx, te); 11483 11484 if (te->set->ops->abort && 11485 list_empty(&te->set->pending_update)) { 11486 list_add_tail(&te->set->pending_update, 11487 &set_update_list); 11488 } 11489 nft_trans_destroy(trans); 11490 break; 11491 case NFT_MSG_NEWOBJ: 11492 if (nft_trans_obj_update(trans)) { 11493 nft_obj_destroy(&ctx, nft_trans_obj_newobj(trans)); 11494 nft_trans_destroy(trans); 11495 } else { 11496 nft_use_dec_restore(&table->use); 11497 nft_obj_del(nft_trans_obj(trans)); 11498 } 11499 break; 11500 case NFT_MSG_DELOBJ: 11501 case NFT_MSG_DESTROYOBJ: 11502 nft_use_inc_restore(&table->use); 11503 nft_clear(trans->net, nft_trans_obj(trans)); 11504 nft_trans_destroy(trans); 11505 break; 11506 case NFT_MSG_NEWFLOWTABLE: 11507 if (nft_trans_flowtable_update(trans)) { 11508 nft_unregister_flowtable_net_hooks(net, 11509 nft_trans_flowtable(trans), 11510 &nft_trans_flowtable_hooks(trans)); 11511 } else { 11512 nft_use_dec_restore(&table->use); 11513 list_del_rcu(&nft_trans_flowtable(trans)->list); 11514 nft_unregister_flowtable_net_hooks(net, 11515 nft_trans_flowtable(trans), 11516 &nft_trans_flowtable(trans)->hook_list); 11517 } 11518 break; 11519 case NFT_MSG_DELFLOWTABLE: 11520 case NFT_MSG_DESTROYFLOWTABLE: 11521 if (nft_trans_flowtable_update(trans)) { 11522 list_splice(&nft_trans_flowtable_hooks(trans), 11523 &nft_trans_flowtable(trans)->hook_list); 11524 } else { 11525 nft_use_inc_restore(&table->use); 11526 nft_clear(trans->net, nft_trans_flowtable(trans)); 11527 } 11528 nft_trans_destroy(trans); 11529 break; 11530 } 11531 } 11532 11533 WARN_ON_ONCE(!list_empty(&nft_net->commit_set_list)); 11534 11535 nft_set_abort_update(&set_update_list); 11536 11537 synchronize_rcu(); 11538 11539 list_for_each_entry_safe_reverse(trans, next, 11540 &nft_net->commit_list, list) { 11541 nft_trans_list_del(trans); 11542 nf_tables_abort_release(trans); 11543 } 11544 11545 return err; 11546 } 11547 11548 static int nf_tables_abort(struct net *net, struct sk_buff *skb, 11549 enum nfnl_abort_action action) 11550 { 11551 struct nftables_pernet *nft_net = nft_pernet(net); 11552 unsigned int gc_seq; 11553 int ret; 11554 11555 gc_seq = nft_gc_seq_begin(nft_net); 11556 ret = __nf_tables_abort(net, action); 11557 nft_gc_seq_end(nft_net, gc_seq); 11558 11559 if (action == NFNL_ABORT_NONE) { 11560 struct nft_table *table; 11561 11562 list_for_each_entry(table, &nft_net->tables, list) 11563 table->validate_state = NFT_VALIDATE_SKIP; 11564 } 11565 11566 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 11567 11568 /* module autoload needs to happen after GC sequence update because it 11569 * temporarily releases and grabs mutex again. 11570 */ 11571 if (action == NFNL_ABORT_AUTOLOAD) 11572 nf_tables_module_autoload(net); 11573 else 11574 nf_tables_module_autoload_cleanup(net); 11575 11576 mutex_unlock(&nft_net->commit_mutex); 11577 11578 return ret; 11579 } 11580 11581 static bool nf_tables_valid_genid(struct net *net, u32 genid) 11582 { 11583 struct nftables_pernet *nft_net = nft_pernet(net); 11584 bool genid_ok; 11585 11586 mutex_lock(&nft_net->commit_mutex); 11587 nft_net->tstamp = get_jiffies_64(); 11588 11589 genid_ok = genid == 0 || nft_base_seq(net) == genid; 11590 if (!genid_ok) 11591 mutex_unlock(&nft_net->commit_mutex); 11592 11593 /* else, commit mutex has to be released by commit or abort function */ 11594 return genid_ok; 11595 } 11596 11597 static const struct nfnetlink_subsystem nf_tables_subsys = { 11598 .name = "nf_tables", 11599 .subsys_id = NFNL_SUBSYS_NFTABLES, 11600 .cb_count = NFT_MSG_MAX, 11601 .cb = nf_tables_cb, 11602 .commit = nf_tables_commit, 11603 .abort = nf_tables_abort, 11604 .valid_genid = nf_tables_valid_genid, 11605 .owner = THIS_MODULE, 11606 }; 11607 11608 int nft_chain_validate_dependency(const struct nft_chain *chain, 11609 enum nft_chain_types type) 11610 { 11611 const struct nft_base_chain *basechain; 11612 11613 if (nft_is_base_chain(chain)) { 11614 basechain = nft_base_chain(chain); 11615 if (basechain->type->type != type) 11616 return -EOPNOTSUPP; 11617 } 11618 return 0; 11619 } 11620 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency); 11621 11622 int nft_chain_validate_hooks(const struct nft_chain *chain, 11623 unsigned int hook_flags) 11624 { 11625 struct nft_base_chain *basechain; 11626 11627 if (nft_is_base_chain(chain)) { 11628 basechain = nft_base_chain(chain); 11629 11630 if ((1 << basechain->ops.hooknum) & hook_flags) 11631 return 0; 11632 11633 return -EOPNOTSUPP; 11634 } 11635 11636 return 0; 11637 } 11638 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks); 11639 11640 /** 11641 * nft_parse_u32_check - fetch u32 attribute and check for maximum value 11642 * 11643 * @attr: netlink attribute to fetch value from 11644 * @max: maximum value to be stored in dest 11645 * @dest: pointer to the variable 11646 * 11647 * Parse, check and store a given u32 netlink attribute into variable. 11648 * This function returns -ERANGE if the value goes over maximum value. 11649 * Otherwise a 0 is returned and the attribute value is stored in the 11650 * destination variable. 11651 */ 11652 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 11653 { 11654 u32 val; 11655 11656 val = ntohl(nla_get_be32(attr)); 11657 if (val > max) 11658 return -ERANGE; 11659 11660 *dest = val; 11661 return 0; 11662 } 11663 EXPORT_SYMBOL_GPL(nft_parse_u32_check); 11664 11665 static int nft_parse_register(const struct nlattr *attr, u32 *preg) 11666 { 11667 unsigned int reg; 11668 11669 reg = ntohl(nla_get_be32(attr)); 11670 switch (reg) { 11671 case NFT_REG_VERDICT...NFT_REG_4: 11672 *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; 11673 break; 11674 case NFT_REG32_00...NFT_REG32_15: 11675 *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; 11676 break; 11677 default: 11678 return -ERANGE; 11679 } 11680 11681 return 0; 11682 } 11683 11684 /** 11685 * nft_dump_register - dump a register value to a netlink attribute 11686 * 11687 * @skb: socket buffer 11688 * @attr: attribute number 11689 * @reg: register number 11690 * 11691 * Construct a netlink attribute containing the register number. For 11692 * compatibility reasons, register numbers being a multiple of 4 are 11693 * translated to the corresponding 128 bit register numbers. 11694 */ 11695 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg) 11696 { 11697 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0) 11698 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE); 11699 else 11700 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00; 11701 11702 return nla_put_be32(skb, attr, htonl(reg)); 11703 } 11704 EXPORT_SYMBOL_GPL(nft_dump_register); 11705 11706 static int nft_validate_register_load(enum nft_registers reg, unsigned int len) 11707 { 11708 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 11709 return -EINVAL; 11710 if (len == 0) 11711 return -EINVAL; 11712 if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data)) 11713 return -ERANGE; 11714 11715 return 0; 11716 } 11717 11718 int nft_parse_register_load(const struct nft_ctx *ctx, 11719 const struct nlattr *attr, u8 *sreg, u32 len) 11720 { 11721 int err, invalid_reg; 11722 u32 reg, next_register; 11723 11724 err = nft_parse_register(attr, ®); 11725 if (err < 0) 11726 return err; 11727 11728 err = nft_validate_register_load(reg, len); 11729 if (err < 0) 11730 return err; 11731 11732 next_register = DIV_ROUND_UP(len, NFT_REG32_SIZE) + reg; 11733 11734 /* Can't happen: nft_validate_register_load() should have failed */ 11735 if (WARN_ON_ONCE(next_register > NFT_REG32_NUM)) 11736 return -EINVAL; 11737 11738 /* find first register that did not see an earlier store. */ 11739 invalid_reg = find_next_zero_bit(ctx->reg_inited, NFT_REG32_NUM, reg); 11740 11741 /* invalid register within the range that we're loading from? */ 11742 if (invalid_reg < next_register) 11743 return -ENODATA; 11744 11745 *sreg = reg; 11746 return 0; 11747 } 11748 EXPORT_SYMBOL_GPL(nft_parse_register_load); 11749 11750 static void nft_saw_register_store(const struct nft_ctx *__ctx, 11751 int reg, unsigned int len) 11752 { 11753 unsigned int registers = DIV_ROUND_UP(len, NFT_REG32_SIZE); 11754 struct nft_ctx *ctx = (struct nft_ctx *)__ctx; 11755 11756 if (WARN_ON_ONCE(len == 0 || reg < 0)) 11757 return; 11758 11759 bitmap_set(ctx->reg_inited, reg, registers); 11760 } 11761 11762 static int nft_validate_register_store(const struct nft_ctx *ctx, 11763 enum nft_registers reg, 11764 const struct nft_data *data, 11765 enum nft_data_types type, 11766 unsigned int len) 11767 { 11768 switch (reg) { 11769 case NFT_REG_VERDICT: 11770 if (type != NFT_DATA_VERDICT) 11771 return -EINVAL; 11772 break; 11773 default: 11774 if (type != NFT_DATA_VALUE) 11775 return -EINVAL; 11776 11777 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) 11778 return -EINVAL; 11779 if (len == 0) 11780 return -EINVAL; 11781 if (reg * NFT_REG32_SIZE + len > 11782 sizeof_field(struct nft_regs, data)) 11783 return -ERANGE; 11784 11785 break; 11786 } 11787 11788 nft_saw_register_store(ctx, reg, len); 11789 return 0; 11790 } 11791 11792 int nft_parse_register_store(const struct nft_ctx *ctx, 11793 const struct nlattr *attr, u8 *dreg, 11794 const struct nft_data *data, 11795 enum nft_data_types type, unsigned int len) 11796 { 11797 int err; 11798 u32 reg; 11799 11800 err = nft_parse_register(attr, ®); 11801 if (err < 0) 11802 return err; 11803 11804 err = nft_validate_register_store(ctx, reg, data, type, len); 11805 if (err < 0) 11806 return err; 11807 11808 *dreg = reg; 11809 return 0; 11810 } 11811 EXPORT_SYMBOL_GPL(nft_parse_register_store); 11812 11813 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { 11814 [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, 11815 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING, 11816 .len = NFT_CHAIN_MAXNAMELEN - 1 }, 11817 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 }, 11818 }; 11819 11820 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 11821 struct nft_data_desc *desc, const struct nlattr *nla) 11822 { 11823 u8 genmask = nft_genmask_next(ctx->net); 11824 struct nlattr *tb[NFTA_VERDICT_MAX + 1]; 11825 struct nft_chain *chain; 11826 int err; 11827 11828 err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla, 11829 nft_verdict_policy, NULL); 11830 if (err < 0) 11831 return err; 11832 11833 if (!tb[NFTA_VERDICT_CODE]) 11834 return -EINVAL; 11835 11836 /* zero padding hole for memcmp */ 11837 memset(data, 0, sizeof(*data)); 11838 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); 11839 11840 switch (data->verdict.code) { 11841 case NF_ACCEPT: 11842 case NF_DROP: 11843 case NF_QUEUE: 11844 break; 11845 case NFT_CONTINUE: 11846 case NFT_BREAK: 11847 case NFT_RETURN: 11848 break; 11849 case NFT_JUMP: 11850 case NFT_GOTO: 11851 if (tb[NFTA_VERDICT_CHAIN]) { 11852 chain = nft_chain_lookup(ctx->net, ctx->table, 11853 tb[NFTA_VERDICT_CHAIN], 11854 genmask); 11855 } else if (tb[NFTA_VERDICT_CHAIN_ID]) { 11856 chain = nft_chain_lookup_byid(ctx->net, ctx->table, 11857 tb[NFTA_VERDICT_CHAIN_ID], 11858 genmask); 11859 if (IS_ERR(chain)) 11860 return PTR_ERR(chain); 11861 } else { 11862 return -EINVAL; 11863 } 11864 11865 if (IS_ERR(chain)) 11866 return PTR_ERR(chain); 11867 if (nft_is_base_chain(chain)) 11868 return -EOPNOTSUPP; 11869 if (nft_chain_is_bound(chain)) 11870 return -EINVAL; 11871 if (desc->flags & NFT_DATA_DESC_SETELEM && 11872 chain->flags & NFT_CHAIN_BINDING) 11873 return -EINVAL; 11874 if (!nft_use_inc(&chain->use)) 11875 return -EMFILE; 11876 11877 data->verdict.chain = chain; 11878 break; 11879 default: 11880 return -EINVAL; 11881 } 11882 11883 desc->len = sizeof(data->verdict); 11884 11885 return 0; 11886 } 11887 11888 static void nft_verdict_uninit(const struct nft_data *data) 11889 { 11890 struct nft_chain *chain; 11891 11892 switch (data->verdict.code) { 11893 case NFT_JUMP: 11894 case NFT_GOTO: 11895 chain = data->verdict.chain; 11896 nft_use_dec(&chain->use); 11897 break; 11898 } 11899 } 11900 11901 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v) 11902 { 11903 struct nlattr *nest; 11904 11905 nest = nla_nest_start_noflag(skb, type); 11906 if (!nest) 11907 goto nla_put_failure; 11908 11909 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code))) 11910 goto nla_put_failure; 11911 11912 switch (v->code) { 11913 case NFT_JUMP: 11914 case NFT_GOTO: 11915 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, 11916 v->chain->name)) 11917 goto nla_put_failure; 11918 } 11919 nla_nest_end(skb, nest); 11920 return 0; 11921 11922 nla_put_failure: 11923 return -1; 11924 } 11925 11926 static int nft_value_init(const struct nft_ctx *ctx, 11927 struct nft_data *data, struct nft_data_desc *desc, 11928 const struct nlattr *nla) 11929 { 11930 unsigned int len; 11931 11932 len = nla_len(nla); 11933 if (len == 0) 11934 return -EINVAL; 11935 if (len > desc->size) 11936 return -EOVERFLOW; 11937 if (desc->len) { 11938 if (len != desc->len) 11939 return -EINVAL; 11940 } else { 11941 desc->len = len; 11942 } 11943 11944 nla_memcpy(data->data, nla, len); 11945 11946 return 0; 11947 } 11948 11949 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data, 11950 unsigned int len) 11951 { 11952 return nla_put(skb, NFTA_DATA_VALUE, len, data->data); 11953 } 11954 11955 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = { 11956 [NFTA_DATA_VALUE] = { .type = NLA_BINARY }, 11957 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED }, 11958 }; 11959 11960 /** 11961 * nft_data_init - parse nf_tables data netlink attributes 11962 * 11963 * @ctx: context of the expression using the data 11964 * @data: destination struct nft_data 11965 * @desc: data description 11966 * @nla: netlink attribute containing data 11967 * 11968 * Parse the netlink data attributes and initialize a struct nft_data. 11969 * The type and length of data are returned in the data description. 11970 * 11971 * The caller can indicate that it only wants to accept data of type 11972 * NFT_DATA_VALUE by passing NULL for the ctx argument. 11973 */ 11974 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, 11975 struct nft_data_desc *desc, const struct nlattr *nla) 11976 { 11977 struct nlattr *tb[NFTA_DATA_MAX + 1]; 11978 int err; 11979 11980 if (WARN_ON_ONCE(!desc->size)) 11981 return -EINVAL; 11982 11983 err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla, 11984 nft_data_policy, NULL); 11985 if (err < 0) 11986 return err; 11987 11988 if (tb[NFTA_DATA_VALUE]) { 11989 if (desc->type != NFT_DATA_VALUE) 11990 return -EINVAL; 11991 11992 err = nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]); 11993 } else if (tb[NFTA_DATA_VERDICT] && ctx != NULL) { 11994 if (desc->type != NFT_DATA_VERDICT) 11995 return -EINVAL; 11996 11997 err = nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]); 11998 } else { 11999 err = -EINVAL; 12000 } 12001 12002 return err; 12003 } 12004 EXPORT_SYMBOL_GPL(nft_data_init); 12005 12006 /** 12007 * nft_data_release - release a nft_data item 12008 * 12009 * @data: struct nft_data to release 12010 * @type: type of data 12011 * 12012 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded, 12013 * all others need to be released by calling this function. 12014 */ 12015 void nft_data_release(const struct nft_data *data, enum nft_data_types type) 12016 { 12017 if (type < NFT_DATA_VERDICT) 12018 return; 12019 switch (type) { 12020 case NFT_DATA_VERDICT: 12021 return nft_verdict_uninit(data); 12022 default: 12023 WARN_ON(1); 12024 } 12025 } 12026 EXPORT_SYMBOL_GPL(nft_data_release); 12027 12028 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 12029 enum nft_data_types type, unsigned int len) 12030 { 12031 struct nlattr *nest; 12032 int err; 12033 12034 nest = nla_nest_start_noflag(skb, attr); 12035 if (nest == NULL) 12036 return -1; 12037 12038 switch (type) { 12039 case NFT_DATA_VALUE: 12040 err = nft_value_dump(skb, data, len); 12041 break; 12042 case NFT_DATA_VERDICT: 12043 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict); 12044 break; 12045 default: 12046 err = -EINVAL; 12047 WARN_ON(1); 12048 } 12049 12050 nla_nest_end(skb, nest); 12051 return err; 12052 } 12053 EXPORT_SYMBOL_GPL(nft_data_dump); 12054 12055 static void __nft_release_hook(struct net *net, struct nft_table *table) 12056 { 12057 struct nft_flowtable *flowtable; 12058 struct nft_chain *chain; 12059 12060 list_for_each_entry(chain, &table->chains, list) 12061 __nf_tables_unregister_hook(net, table, chain, true); 12062 list_for_each_entry(flowtable, &table->flowtables, list) 12063 __nft_unregister_flowtable_net_hooks(net, flowtable, 12064 &flowtable->hook_list, 12065 true); 12066 } 12067 12068 static void __nft_release_hooks(struct net *net) 12069 { 12070 struct nftables_pernet *nft_net = nft_pernet(net); 12071 struct nft_table *table; 12072 12073 list_for_each_entry(table, &nft_net->tables, list) { 12074 if (nft_table_has_owner(table)) 12075 continue; 12076 12077 __nft_release_hook(net, table); 12078 } 12079 } 12080 12081 static void __nft_release_table(struct net *net, struct nft_table *table) 12082 { 12083 struct nft_flowtable *flowtable, *nf; 12084 struct nft_chain *chain, *nc; 12085 struct nft_object *obj, *ne; 12086 struct nft_rule *rule, *nr; 12087 struct nft_set *set, *ns; 12088 struct nft_ctx ctx = { 12089 .net = net, 12090 .family = NFPROTO_NETDEV, 12091 }; 12092 12093 ctx.family = table->family; 12094 ctx.table = table; 12095 list_for_each_entry(chain, &table->chains, list) { 12096 if (nft_chain_binding(chain)) 12097 continue; 12098 12099 ctx.chain = chain; 12100 list_for_each_entry_safe(rule, nr, &chain->rules, list) { 12101 list_del(&rule->list); 12102 nft_use_dec(&chain->use); 12103 nf_tables_rule_release(&ctx, rule); 12104 } 12105 } 12106 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 12107 list_del(&flowtable->list); 12108 nft_use_dec(&table->use); 12109 nf_tables_flowtable_destroy(flowtable); 12110 } 12111 list_for_each_entry_safe(set, ns, &table->sets, list) { 12112 list_del(&set->list); 12113 nft_use_dec(&table->use); 12114 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 12115 nft_map_deactivate(&ctx, set); 12116 12117 nft_set_destroy(&ctx, set); 12118 } 12119 list_for_each_entry_safe(obj, ne, &table->objects, list) { 12120 nft_obj_del(obj); 12121 nft_use_dec(&table->use); 12122 nft_obj_destroy(&ctx, obj); 12123 } 12124 list_for_each_entry_safe(chain, nc, &table->chains, list) { 12125 nft_chain_del(chain); 12126 nft_use_dec(&table->use); 12127 nf_tables_chain_destroy(chain); 12128 } 12129 nf_tables_table_destroy(table); 12130 } 12131 12132 static void __nft_release_tables(struct net *net) 12133 { 12134 struct nftables_pernet *nft_net = nft_pernet(net); 12135 struct nft_table *table, *nt; 12136 12137 list_for_each_entry_safe(table, nt, &nft_net->tables, list) { 12138 if (nft_table_has_owner(table)) 12139 continue; 12140 12141 list_del(&table->list); 12142 12143 __nft_release_table(net, table); 12144 } 12145 } 12146 12147 static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, 12148 void *ptr) 12149 { 12150 struct nft_table *table, *to_delete[8]; 12151 struct nftables_pernet *nft_net; 12152 struct netlink_notify *n = ptr; 12153 struct net *net = n->net; 12154 unsigned int deleted; 12155 bool restart = false; 12156 unsigned int gc_seq; 12157 12158 if (event != NETLINK_URELEASE || n->protocol != NETLINK_NETFILTER) 12159 return NOTIFY_DONE; 12160 12161 nft_net = nft_pernet(net); 12162 deleted = 0; 12163 mutex_lock(&nft_net->commit_mutex); 12164 12165 gc_seq = nft_gc_seq_begin(nft_net); 12166 12167 nf_tables_trans_destroy_flush_work(net); 12168 again: 12169 list_for_each_entry(table, &nft_net->tables, list) { 12170 if (nft_table_has_owner(table) && 12171 n->portid == table->nlpid) { 12172 if (table->flags & NFT_TABLE_F_PERSIST) { 12173 table->flags &= ~NFT_TABLE_F_OWNER; 12174 continue; 12175 } 12176 __nft_release_hook(net, table); 12177 list_del_rcu(&table->list); 12178 to_delete[deleted++] = table; 12179 if (deleted >= ARRAY_SIZE(to_delete)) 12180 break; 12181 } 12182 } 12183 if (deleted) { 12184 restart = deleted >= ARRAY_SIZE(to_delete); 12185 synchronize_rcu(); 12186 while (deleted) 12187 __nft_release_table(net, to_delete[--deleted]); 12188 12189 if (restart) 12190 goto again; 12191 } 12192 nft_gc_seq_end(nft_net, gc_seq); 12193 12194 mutex_unlock(&nft_net->commit_mutex); 12195 12196 return NOTIFY_DONE; 12197 } 12198 12199 static struct notifier_block nft_nl_notifier = { 12200 .notifier_call = nft_rcv_nl_event, 12201 }; 12202 12203 static int __net_init nf_tables_init_net(struct net *net) 12204 { 12205 struct nftables_pernet *nft_net = nft_pernet(net); 12206 12207 INIT_LIST_HEAD(&nft_net->tables); 12208 INIT_LIST_HEAD(&nft_net->commit_list); 12209 INIT_LIST_HEAD(&nft_net->destroy_list); 12210 INIT_LIST_HEAD(&nft_net->commit_set_list); 12211 INIT_LIST_HEAD(&nft_net->binding_list); 12212 INIT_LIST_HEAD(&nft_net->module_list); 12213 INIT_LIST_HEAD(&nft_net->notify_list); 12214 mutex_init(&nft_net->commit_mutex); 12215 net->nft.base_seq = 1; 12216 nft_net->gc_seq = 0; 12217 nft_net->validate_state = NFT_VALIDATE_SKIP; 12218 INIT_WORK(&nft_net->destroy_work, nf_tables_trans_destroy_work); 12219 12220 return 0; 12221 } 12222 12223 static void __net_exit nf_tables_pre_exit_net(struct net *net) 12224 { 12225 struct nftables_pernet *nft_net = nft_pernet(net); 12226 12227 mutex_lock(&nft_net->commit_mutex); 12228 __nft_release_hooks(net); 12229 mutex_unlock(&nft_net->commit_mutex); 12230 } 12231 12232 static void __net_exit nf_tables_exit_net(struct net *net) 12233 { 12234 struct nftables_pernet *nft_net = nft_pernet(net); 12235 unsigned int gc_seq; 12236 12237 mutex_lock(&nft_net->commit_mutex); 12238 12239 gc_seq = nft_gc_seq_begin(nft_net); 12240 12241 WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); 12242 WARN_ON_ONCE(!list_empty(&nft_net->commit_set_list)); 12243 12244 if (!list_empty(&nft_net->module_list)) 12245 nf_tables_module_autoload_cleanup(net); 12246 12247 cancel_work_sync(&nft_net->destroy_work); 12248 __nft_release_tables(net); 12249 12250 nft_gc_seq_end(nft_net, gc_seq); 12251 12252 mutex_unlock(&nft_net->commit_mutex); 12253 12254 WARN_ON_ONCE(!list_empty(&nft_net->tables)); 12255 WARN_ON_ONCE(!list_empty(&nft_net->module_list)); 12256 WARN_ON_ONCE(!list_empty(&nft_net->notify_list)); 12257 WARN_ON_ONCE(!list_empty(&nft_net->destroy_list)); 12258 } 12259 12260 static void nf_tables_exit_batch(struct list_head *net_exit_list) 12261 { 12262 flush_work(&trans_gc_work); 12263 } 12264 12265 static struct pernet_operations nf_tables_net_ops = { 12266 .init = nf_tables_init_net, 12267 .pre_exit = nf_tables_pre_exit_net, 12268 .exit = nf_tables_exit_net, 12269 .exit_batch = nf_tables_exit_batch, 12270 .id = &nf_tables_net_id, 12271 .size = sizeof(struct nftables_pernet), 12272 }; 12273 12274 static int __init nf_tables_module_init(void) 12275 { 12276 int err; 12277 12278 BUILD_BUG_ON(offsetof(struct nft_trans_table, nft_trans) != 0); 12279 BUILD_BUG_ON(offsetof(struct nft_trans_chain, nft_trans_binding.nft_trans) != 0); 12280 BUILD_BUG_ON(offsetof(struct nft_trans_rule, nft_trans) != 0); 12281 BUILD_BUG_ON(offsetof(struct nft_trans_set, nft_trans_binding.nft_trans) != 0); 12282 BUILD_BUG_ON(offsetof(struct nft_trans_elem, nft_trans) != 0); 12283 BUILD_BUG_ON(offsetof(struct nft_trans_obj, nft_trans) != 0); 12284 BUILD_BUG_ON(offsetof(struct nft_trans_flowtable, nft_trans) != 0); 12285 12286 err = register_pernet_subsys(&nf_tables_net_ops); 12287 if (err < 0) 12288 return err; 12289 12290 err = nft_chain_filter_init(); 12291 if (err < 0) 12292 goto err_chain_filter; 12293 12294 err = nf_tables_core_module_init(); 12295 if (err < 0) 12296 goto err_core_module; 12297 12298 err = register_netdevice_notifier(&nf_tables_flowtable_notifier); 12299 if (err < 0) 12300 goto err_netdev_notifier; 12301 12302 err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params); 12303 if (err < 0) 12304 goto err_rht_objname; 12305 12306 err = nft_offload_init(); 12307 if (err < 0) 12308 goto err_offload; 12309 12310 err = netlink_register_notifier(&nft_nl_notifier); 12311 if (err < 0) 12312 goto err_netlink_notifier; 12313 12314 /* must be last */ 12315 err = nfnetlink_subsys_register(&nf_tables_subsys); 12316 if (err < 0) 12317 goto err_nfnl_subsys; 12318 12319 nft_chain_route_init(); 12320 12321 return err; 12322 12323 err_nfnl_subsys: 12324 netlink_unregister_notifier(&nft_nl_notifier); 12325 err_netlink_notifier: 12326 nft_offload_exit(); 12327 err_offload: 12328 rhltable_destroy(&nft_objname_ht); 12329 err_rht_objname: 12330 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 12331 err_netdev_notifier: 12332 nf_tables_core_module_exit(); 12333 err_core_module: 12334 nft_chain_filter_fini(); 12335 err_chain_filter: 12336 unregister_pernet_subsys(&nf_tables_net_ops); 12337 return err; 12338 } 12339 12340 static void __exit nf_tables_module_exit(void) 12341 { 12342 nfnetlink_subsys_unregister(&nf_tables_subsys); 12343 netlink_unregister_notifier(&nft_nl_notifier); 12344 nft_offload_exit(); 12345 unregister_netdevice_notifier(&nf_tables_flowtable_notifier); 12346 nft_chain_filter_fini(); 12347 nft_chain_route_fini(); 12348 unregister_pernet_subsys(&nf_tables_net_ops); 12349 cancel_work_sync(&trans_gc_work); 12350 rcu_barrier(); 12351 rhltable_destroy(&nft_objname_ht); 12352 nf_tables_core_module_exit(); 12353 } 12354 12355 module_init(nf_tables_module_init); 12356 module_exit(nf_tables_module_exit); 12357 12358 MODULE_LICENSE("GPL"); 12359 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 12360 MODULE_DESCRIPTION("Framework for packet filtering and classification"); 12361 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES); 12362