2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/list.h>
14 #include <linux/skbuff.h>
15 #include <linux/netlink.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter/nfnetlink.h>
19 #include <linux/netfilter/nf_tables.h>
20 #include <net/netfilter/nf_flow_table.h>
21 #include <net/netfilter/nf_tables_core.h>
22 #include <net/netfilter/nf_tables.h>
23 #include <net/net_namespace.h>
26 static LIST_HEAD(nf_tables_expressions);
27 static LIST_HEAD(nf_tables_objects);
28 static LIST_HEAD(nf_tables_flowtables);
29 static u64 table_handle;
32 NFT_VALIDATE_SKIP = 0,
37 static void nft_validate_state_update(struct net *net, u8 new_validate_state)
39 switch (net->nft.validate_state) {
40 case NFT_VALIDATE_SKIP:
41 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
43 case NFT_VALIDATE_NEED:
46 if (new_validate_state == NFT_VALIDATE_NEED)
50 net->nft.validate_state = new_validate_state;
53 static void nft_ctx_init(struct nft_ctx *ctx,
55 const struct sk_buff *skb,
56 const struct nlmsghdr *nlh,
58 struct nft_table *table,
59 struct nft_chain *chain,
60 const struct nlattr * const *nla)
67 ctx->portid = NETLINK_CB(skb).portid;
68 ctx->report = nlmsg_report(nlh);
69 ctx->seq = nlh->nlmsg_seq;
72 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
73 int msg_type, u32 size, gfp_t gfp)
75 struct nft_trans *trans;
77 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
81 trans->msg_type = msg_type;
87 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
88 int msg_type, u32 size)
90 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
93 static void nft_trans_destroy(struct nft_trans *trans)
95 list_del(&trans->list);
99 static int nf_tables_register_hook(struct net *net,
100 const struct nft_table *table,
101 struct nft_chain *chain)
103 const struct nft_base_chain *basechain;
104 const struct nf_hook_ops *ops;
106 if (table->flags & NFT_TABLE_F_DORMANT ||
107 !nft_is_base_chain(chain))
110 basechain = nft_base_chain(chain);
111 ops = &basechain->ops;
113 if (basechain->type->ops_register)
114 return basechain->type->ops_register(net, ops);
116 return nf_register_net_hook(net, ops);
119 static void nf_tables_unregister_hook(struct net *net,
120 const struct nft_table *table,
121 struct nft_chain *chain)
123 const struct nft_base_chain *basechain;
124 const struct nf_hook_ops *ops;
126 if (table->flags & NFT_TABLE_F_DORMANT ||
127 !nft_is_base_chain(chain))
129 basechain = nft_base_chain(chain);
130 ops = &basechain->ops;
132 if (basechain->type->ops_unregister)
133 return basechain->type->ops_unregister(net, ops);
135 nf_unregister_net_hook(net, ops);
138 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
140 struct nft_trans *trans;
142 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
146 if (msg_type == NFT_MSG_NEWTABLE)
147 nft_activate_next(ctx->net, ctx->table);
149 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
153 static int nft_deltable(struct nft_ctx *ctx)
157 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
161 nft_deactivate_next(ctx->net, ctx->table);
165 static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
167 struct nft_trans *trans;
169 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
173 if (msg_type == NFT_MSG_NEWCHAIN)
174 nft_activate_next(ctx->net, ctx->chain);
176 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
180 static int nft_delchain(struct nft_ctx *ctx)
184 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
189 nft_deactivate_next(ctx->net, ctx->chain);
194 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
195 struct nft_rule *rule)
197 struct nft_expr *expr;
199 expr = nft_expr_first(rule);
200 while (expr != nft_expr_last(rule) && expr->ops) {
201 if (expr->ops->activate)
202 expr->ops->activate(ctx, expr);
204 expr = nft_expr_next(expr);
208 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
209 struct nft_rule *rule)
211 struct nft_expr *expr;
213 expr = nft_expr_first(rule);
214 while (expr != nft_expr_last(rule) && expr->ops) {
215 if (expr->ops->deactivate)
216 expr->ops->deactivate(ctx, expr);
218 expr = nft_expr_next(expr);
223 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
225 /* You cannot delete the same rule twice */
226 if (nft_is_active_next(ctx->net, rule)) {
227 nft_deactivate_next(ctx->net, rule);
234 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
235 struct nft_rule *rule)
237 struct nft_trans *trans;
239 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
243 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
244 nft_trans_rule_id(trans) =
245 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
247 nft_trans_rule(trans) = rule;
248 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
253 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
255 struct nft_trans *trans;
258 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
262 err = nf_tables_delrule_deactivate(ctx, rule);
264 nft_trans_destroy(trans);
267 nft_rule_expr_deactivate(ctx, rule);
272 static int nft_delrule_by_chain(struct nft_ctx *ctx)
274 struct nft_rule *rule;
277 list_for_each_entry(rule, &ctx->chain->rules, list) {
278 err = nft_delrule(ctx, rule);
285 static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
288 struct nft_trans *trans;
290 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
294 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
295 nft_trans_set_id(trans) =
296 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
297 nft_activate_next(ctx->net, set);
299 nft_trans_set(trans) = set;
300 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
305 static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
309 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
313 nft_deactivate_next(ctx->net, set);
319 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
320 struct nft_object *obj)
322 struct nft_trans *trans;
324 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
328 if (msg_type == NFT_MSG_NEWOBJ)
329 nft_activate_next(ctx->net, obj);
331 nft_trans_obj(trans) = obj;
332 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
337 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
341 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
345 nft_deactivate_next(ctx->net, obj);
351 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
352 struct nft_flowtable *flowtable)
354 struct nft_trans *trans;
356 trans = nft_trans_alloc(ctx, msg_type,
357 sizeof(struct nft_trans_flowtable));
361 if (msg_type == NFT_MSG_NEWFLOWTABLE)
362 nft_activate_next(ctx->net, flowtable);
364 nft_trans_flowtable(trans) = flowtable;
365 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
370 static int nft_delflowtable(struct nft_ctx *ctx,
371 struct nft_flowtable *flowtable)
375 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
379 nft_deactivate_next(ctx->net, flowtable);
389 static struct nft_table *nft_table_lookup(const struct net *net,
390 const struct nlattr *nla,
391 u8 family, u8 genmask)
393 struct nft_table *table;
396 return ERR_PTR(-EINVAL);
398 list_for_each_entry_rcu(table, &net->nft.tables, list) {
399 if (!nla_strcmp(nla, table->name) &&
400 table->family == family &&
401 nft_active_genmask(table, genmask))
405 return ERR_PTR(-ENOENT);
408 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
409 const struct nlattr *nla,
412 struct nft_table *table;
414 list_for_each_entry(table, &net->nft.tables, list) {
415 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
416 nft_active_genmask(table, genmask))
420 return ERR_PTR(-ENOENT);
423 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
425 return ++table->hgenerator;
428 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
430 static const struct nft_chain_type *
431 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
435 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
436 if (chain_type[family][i] != NULL &&
437 !nla_strcmp(nla, chain_type[family][i]->name))
438 return chain_type[family][i];
443 static const struct nft_chain_type *
444 nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload)
446 const struct nft_chain_type *type;
448 type = __nf_tables_chain_type_lookup(nla, family);
451 #ifdef CONFIG_MODULES
453 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
454 request_module("nft-chain-%u-%.*s", family,
455 nla_len(nla), (const char *)nla_data(nla));
456 nfnl_lock(NFNL_SUBSYS_NFTABLES);
457 type = __nf_tables_chain_type_lookup(nla, family);
459 return ERR_PTR(-EAGAIN);
462 return ERR_PTR(-ENOENT);
465 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
466 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
467 .len = NFT_TABLE_MAXNAMELEN - 1 },
468 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
469 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
472 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
473 u32 portid, u32 seq, int event, u32 flags,
474 int family, const struct nft_table *table)
476 struct nlmsghdr *nlh;
477 struct nfgenmsg *nfmsg;
479 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
480 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
482 goto nla_put_failure;
484 nfmsg = nlmsg_data(nlh);
485 nfmsg->nfgen_family = family;
486 nfmsg->version = NFNETLINK_V0;
487 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
489 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
490 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
491 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
492 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
494 goto nla_put_failure;
500 nlmsg_trim(skb, nlh);
504 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
510 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
513 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
517 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
518 event, 0, ctx->family, ctx->table);
524 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
525 ctx->report, GFP_KERNEL);
528 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
531 static int nf_tables_dump_tables(struct sk_buff *skb,
532 struct netlink_callback *cb)
534 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
535 const struct nft_table *table;
536 unsigned int idx = 0, s_idx = cb->args[0];
537 struct net *net = sock_net(skb->sk);
538 int family = nfmsg->nfgen_family;
541 cb->seq = net->nft.base_seq;
543 list_for_each_entry_rcu(table, &net->nft.tables, list) {
544 if (family != NFPROTO_UNSPEC && family != table->family)
550 memset(&cb->args[1], 0,
551 sizeof(cb->args) - sizeof(cb->args[0]));
552 if (!nft_is_active(net, table))
554 if (nf_tables_fill_table_info(skb, net,
555 NETLINK_CB(cb->skb).portid,
557 NFT_MSG_NEWTABLE, NLM_F_MULTI,
558 table->family, table) < 0)
561 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
571 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
572 const struct nlmsghdr *nlh,
573 struct netlink_dump_control *c)
577 if (!try_module_get(THIS_MODULE))
581 err = netlink_dump_start(nlsk, skb, nlh, c);
583 module_put(THIS_MODULE);
588 /* called with rcu_read_lock held */
589 static int nf_tables_gettable(struct net *net, struct sock *nlsk,
590 struct sk_buff *skb, const struct nlmsghdr *nlh,
591 const struct nlattr * const nla[],
592 struct netlink_ext_ack *extack)
594 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
595 u8 genmask = nft_genmask_cur(net);
596 const struct nft_table *table;
597 struct sk_buff *skb2;
598 int family = nfmsg->nfgen_family;
601 if (nlh->nlmsg_flags & NLM_F_DUMP) {
602 struct netlink_dump_control c = {
603 .dump = nf_tables_dump_tables,
604 .module = THIS_MODULE,
607 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
610 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
612 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
613 return PTR_ERR(table);
616 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
620 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
621 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
626 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
633 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
635 struct nft_chain *chain;
638 list_for_each_entry(chain, &table->chains, list) {
639 if (!nft_is_active_next(net, chain))
641 if (!nft_is_base_chain(chain))
644 if (cnt && i++ == cnt)
647 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
651 static int nf_tables_table_enable(struct net *net, struct nft_table *table)
653 struct nft_chain *chain;
656 list_for_each_entry(chain, &table->chains, list) {
657 if (!nft_is_active_next(net, chain))
659 if (!nft_is_base_chain(chain))
662 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
671 nft_table_disable(net, table, i);
675 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
677 nft_table_disable(net, table, 0);
680 static int nf_tables_updtable(struct nft_ctx *ctx)
682 struct nft_trans *trans;
686 if (!ctx->nla[NFTA_TABLE_FLAGS])
689 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
690 if (flags & ~NFT_TABLE_F_DORMANT)
693 if (flags == ctx->table->flags)
696 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
697 sizeof(struct nft_trans_table));
701 if ((flags & NFT_TABLE_F_DORMANT) &&
702 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
703 nft_trans_table_enable(trans) = false;
704 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
705 ctx->table->flags & NFT_TABLE_F_DORMANT) {
706 ret = nf_tables_table_enable(ctx->net, ctx->table);
708 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
709 nft_trans_table_enable(trans) = true;
715 nft_trans_table_update(trans) = true;
716 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
719 nft_trans_destroy(trans);
723 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
724 struct sk_buff *skb, const struct nlmsghdr *nlh,
725 const struct nlattr * const nla[],
726 struct netlink_ext_ack *extack)
728 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
729 u8 genmask = nft_genmask_next(net);
730 int family = nfmsg->nfgen_family;
731 const struct nlattr *attr;
732 struct nft_table *table;
737 attr = nla[NFTA_TABLE_NAME];
738 table = nft_table_lookup(net, attr, family, genmask);
740 if (PTR_ERR(table) != -ENOENT)
741 return PTR_ERR(table);
743 if (nlh->nlmsg_flags & NLM_F_EXCL) {
744 NL_SET_BAD_ATTR(extack, attr);
747 if (nlh->nlmsg_flags & NLM_F_REPLACE)
750 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
751 return nf_tables_updtable(&ctx);
754 if (nla[NFTA_TABLE_FLAGS]) {
755 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
756 if (flags & ~NFT_TABLE_F_DORMANT)
761 table = kzalloc(sizeof(*table), GFP_KERNEL);
765 table->name = nla_strdup(attr, GFP_KERNEL);
766 if (table->name == NULL)
769 INIT_LIST_HEAD(&table->chains);
770 INIT_LIST_HEAD(&table->sets);
771 INIT_LIST_HEAD(&table->objects);
772 INIT_LIST_HEAD(&table->flowtables);
773 table->family = family;
774 table->flags = flags;
775 table->handle = ++table_handle;
777 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
778 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
782 list_add_tail_rcu(&table->list, &net->nft.tables);
792 static int nft_flush_table(struct nft_ctx *ctx)
794 struct nft_flowtable *flowtable, *nft;
795 struct nft_chain *chain, *nc;
796 struct nft_object *obj, *ne;
797 struct nft_set *set, *ns;
800 list_for_each_entry(chain, &ctx->table->chains, list) {
801 if (!nft_is_active_next(ctx->net, chain))
806 err = nft_delrule_by_chain(ctx);
811 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
812 if (!nft_is_active_next(ctx->net, set))
815 if (nft_set_is_anonymous(set) &&
816 !list_empty(&set->bindings))
819 err = nft_delset(ctx, set);
824 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
825 err = nft_delflowtable(ctx, flowtable);
830 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
831 err = nft_delobj(ctx, obj);
836 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
837 if (!nft_is_active_next(ctx->net, chain))
842 err = nft_delchain(ctx);
847 err = nft_deltable(ctx);
852 static int nft_flush(struct nft_ctx *ctx, int family)
854 struct nft_table *table, *nt;
855 const struct nlattr * const *nla = ctx->nla;
858 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
859 if (family != AF_UNSPEC && table->family != family)
862 ctx->family = table->family;
864 if (!nft_is_active_next(ctx->net, table))
867 if (nla[NFTA_TABLE_NAME] &&
868 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
873 err = nft_flush_table(ctx);
881 static int nf_tables_deltable(struct net *net, struct sock *nlsk,
882 struct sk_buff *skb, const struct nlmsghdr *nlh,
883 const struct nlattr * const nla[],
884 struct netlink_ext_ack *extack)
886 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
887 u8 genmask = nft_genmask_next(net);
888 int family = nfmsg->nfgen_family;
889 const struct nlattr *attr;
890 struct nft_table *table;
893 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
894 if (family == AF_UNSPEC ||
895 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
896 return nft_flush(&ctx, family);
898 if (nla[NFTA_TABLE_HANDLE]) {
899 attr = nla[NFTA_TABLE_HANDLE];
900 table = nft_table_lookup_byhandle(net, attr, genmask);
902 attr = nla[NFTA_TABLE_NAME];
903 table = nft_table_lookup(net, attr, family, genmask);
907 NL_SET_BAD_ATTR(extack, attr);
908 return PTR_ERR(table);
911 if (nlh->nlmsg_flags & NLM_F_NONREC &&
918 return nft_flush_table(&ctx);
921 static void nf_tables_table_destroy(struct nft_ctx *ctx)
923 BUG_ON(ctx->table->use > 0);
925 kfree(ctx->table->name);
929 void nft_register_chain_type(const struct nft_chain_type *ctype)
931 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
934 nfnl_lock(NFNL_SUBSYS_NFTABLES);
935 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
936 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
939 chain_type[ctype->family][ctype->type] = ctype;
940 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
942 EXPORT_SYMBOL_GPL(nft_register_chain_type);
944 void nft_unregister_chain_type(const struct nft_chain_type *ctype)
946 nfnl_lock(NFNL_SUBSYS_NFTABLES);
947 chain_type[ctype->family][ctype->type] = NULL;
948 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
950 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
956 static struct nft_chain *
957 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
959 struct nft_chain *chain;
961 list_for_each_entry(chain, &table->chains, list) {
962 if (chain->handle == handle &&
963 nft_active_genmask(chain, genmask))
967 return ERR_PTR(-ENOENT);
970 static struct nft_chain *nft_chain_lookup(const struct nft_table *table,
971 const struct nlattr *nla, u8 genmask)
973 struct nft_chain *chain;
976 return ERR_PTR(-EINVAL);
978 list_for_each_entry_rcu(chain, &table->chains, list) {
979 if (!nla_strcmp(nla, chain->name) &&
980 nft_active_genmask(chain, genmask))
984 return ERR_PTR(-ENOENT);
987 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
988 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
989 .len = NFT_TABLE_MAXNAMELEN - 1 },
990 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
991 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
992 .len = NFT_CHAIN_MAXNAMELEN - 1 },
993 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
994 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
995 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
996 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
999 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1000 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1001 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
1002 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1003 .len = IFNAMSIZ - 1 },
1006 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1008 struct nft_stats *cpu_stats, total;
1009 struct nlattr *nest;
1014 memset(&total, 0, sizeof(total));
1015 for_each_possible_cpu(cpu) {
1016 cpu_stats = per_cpu_ptr(stats, cpu);
1018 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1019 pkts = cpu_stats->pkts;
1020 bytes = cpu_stats->bytes;
1021 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1023 total.bytes += bytes;
1025 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1027 goto nla_put_failure;
1029 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1030 NFTA_COUNTER_PAD) ||
1031 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1033 goto nla_put_failure;
1035 nla_nest_end(skb, nest);
1042 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1043 u32 portid, u32 seq, int event, u32 flags,
1044 int family, const struct nft_table *table,
1045 const struct nft_chain *chain)
1047 struct nlmsghdr *nlh;
1048 struct nfgenmsg *nfmsg;
1050 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1051 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1053 goto nla_put_failure;
1055 nfmsg = nlmsg_data(nlh);
1056 nfmsg->nfgen_family = family;
1057 nfmsg->version = NFNETLINK_V0;
1058 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
1060 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1061 goto nla_put_failure;
1062 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1064 goto nla_put_failure;
1065 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1066 goto nla_put_failure;
1068 if (nft_is_base_chain(chain)) {
1069 const struct nft_base_chain *basechain = nft_base_chain(chain);
1070 const struct nf_hook_ops *ops = &basechain->ops;
1071 struct nlattr *nest;
1073 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
1075 goto nla_put_failure;
1076 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1077 goto nla_put_failure;
1078 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1079 goto nla_put_failure;
1080 if (basechain->dev_name[0] &&
1081 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1082 goto nla_put_failure;
1083 nla_nest_end(skb, nest);
1085 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1086 htonl(basechain->policy)))
1087 goto nla_put_failure;
1089 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1090 goto nla_put_failure;
1092 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
1093 goto nla_put_failure;
1096 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1097 goto nla_put_failure;
1099 nlmsg_end(skb, nlh);
1103 nlmsg_trim(skb, nlh);
1107 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1109 struct sk_buff *skb;
1113 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1116 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1120 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1121 event, 0, ctx->family, ctx->table,
1128 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1129 ctx->report, GFP_KERNEL);
1132 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1135 static int nf_tables_dump_chains(struct sk_buff *skb,
1136 struct netlink_callback *cb)
1138 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1139 const struct nft_table *table;
1140 const struct nft_chain *chain;
1141 unsigned int idx = 0, s_idx = cb->args[0];
1142 struct net *net = sock_net(skb->sk);
1143 int family = nfmsg->nfgen_family;
1146 cb->seq = net->nft.base_seq;
1148 list_for_each_entry_rcu(table, &net->nft.tables, list) {
1149 if (family != NFPROTO_UNSPEC && family != table->family)
1152 list_for_each_entry_rcu(chain, &table->chains, list) {
1156 memset(&cb->args[1], 0,
1157 sizeof(cb->args) - sizeof(cb->args[0]));
1158 if (!nft_is_active(net, chain))
1160 if (nf_tables_fill_chain_info(skb, net,
1161 NETLINK_CB(cb->skb).portid,
1165 table->family, table,
1169 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1180 /* called with rcu_read_lock held */
1181 static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1182 struct sk_buff *skb, const struct nlmsghdr *nlh,
1183 const struct nlattr * const nla[],
1184 struct netlink_ext_ack *extack)
1186 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1187 u8 genmask = nft_genmask_cur(net);
1188 const struct nft_table *table;
1189 const struct nft_chain *chain;
1190 struct sk_buff *skb2;
1191 int family = nfmsg->nfgen_family;
1194 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1195 struct netlink_dump_control c = {
1196 .dump = nf_tables_dump_chains,
1197 .module = THIS_MODULE,
1200 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
1203 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1204 if (IS_ERR(table)) {
1205 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1206 return PTR_ERR(table);
1209 chain = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1210 if (IS_ERR(chain)) {
1211 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
1212 return PTR_ERR(chain);
1215 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1219 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1220 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1221 family, table, chain);
1225 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1232 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1233 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1234 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1237 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1239 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1240 struct nft_stats __percpu *newstats;
1241 struct nft_stats *stats;
1244 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1247 return ERR_PTR(err);
1249 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1250 return ERR_PTR(-EINVAL);
1252 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1253 if (newstats == NULL)
1254 return ERR_PTR(-ENOMEM);
1256 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1257 * are not exposed to userspace.
1260 stats = this_cpu_ptr(newstats);
1261 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1262 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1268 static void nft_chain_stats_replace(struct nft_base_chain *chain,
1269 struct nft_stats __percpu *newstats)
1271 struct nft_stats __percpu *oldstats;
1273 if (newstats == NULL)
1277 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
1278 rcu_assign_pointer(chain->stats, newstats);
1280 free_percpu(oldstats);
1282 rcu_assign_pointer(chain->stats, newstats);
1285 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1287 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1288 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1294 /* should be NULL either via abort or via successful commit */
1295 WARN_ON_ONCE(chain->rules_next);
1296 kvfree(chain->rules_next);
1299 static void nf_tables_chain_destroy(struct nft_ctx *ctx)
1301 struct nft_chain *chain = ctx->chain;
1303 BUG_ON(chain->use > 0);
1305 /* no concurrent access possible anymore */
1306 nf_tables_chain_free_chain_rules(chain);
1308 if (nft_is_base_chain(chain)) {
1309 struct nft_base_chain *basechain = nft_base_chain(chain);
1311 module_put(basechain->type->owner);
1312 free_percpu(basechain->stats);
1313 if (basechain->stats)
1314 static_branch_dec(&nft_counters_enabled);
1323 struct nft_chain_hook {
1326 const struct nft_chain_type *type;
1327 struct net_device *dev;
1330 static int nft_chain_parse_hook(struct net *net,
1331 const struct nlattr * const nla[],
1332 struct nft_chain_hook *hook, u8 family,
1335 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1336 const struct nft_chain_type *type;
1337 struct net_device *dev;
1340 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
1341 nft_hook_policy, NULL);
1345 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1346 ha[NFTA_HOOK_PRIORITY] == NULL)
1349 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1350 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1352 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
1353 if (nla[NFTA_CHAIN_TYPE]) {
1354 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
1357 return PTR_ERR(type);
1359 if (!(type->hook_mask & (1 << hook->num)))
1362 if (type->type == NFT_CHAIN_T_NAT &&
1363 hook->priority <= NF_IP_PRI_CONNTRACK)
1366 if (!try_module_get(type->owner))
1372 if (family == NFPROTO_NETDEV) {
1373 char ifname[IFNAMSIZ];
1375 if (!ha[NFTA_HOOK_DEV]) {
1376 module_put(type->owner);
1380 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1381 dev = __dev_get_by_name(net, ifname);
1383 module_put(type->owner);
1387 } else if (ha[NFTA_HOOK_DEV]) {
1388 module_put(type->owner);
1395 static void nft_chain_release_hook(struct nft_chain_hook *hook)
1397 module_put(hook->type->owner);
1400 struct nft_rules_old {
1402 struct nft_rule **start;
1405 static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1408 if (alloc > INT_MAX)
1411 alloc += 1; /* NULL, ends rules */
1412 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1415 alloc *= sizeof(struct nft_rule *);
1416 alloc += sizeof(struct nft_rules_old);
1418 return kvmalloc(alloc, GFP_KERNEL);
1421 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1422 u8 policy, bool create)
1424 const struct nlattr * const *nla = ctx->nla;
1425 struct nft_table *table = ctx->table;
1426 struct nft_base_chain *basechain;
1427 struct nft_stats __percpu *stats;
1428 struct net *net = ctx->net;
1429 struct nft_chain *chain;
1430 struct nft_rule **rules;
1433 if (table->use == UINT_MAX)
1436 if (nla[NFTA_CHAIN_HOOK]) {
1437 struct nft_chain_hook hook;
1438 struct nf_hook_ops *ops;
1440 err = nft_chain_parse_hook(net, nla, &hook, family, create);
1444 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1445 if (basechain == NULL) {
1446 nft_chain_release_hook(&hook);
1450 if (hook.dev != NULL)
1451 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1453 if (nla[NFTA_CHAIN_COUNTERS]) {
1454 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1455 if (IS_ERR(stats)) {
1456 nft_chain_release_hook(&hook);
1458 return PTR_ERR(stats);
1460 basechain->stats = stats;
1461 static_branch_inc(&nft_counters_enabled);
1464 basechain->type = hook.type;
1465 chain = &basechain->chain;
1467 ops = &basechain->ops;
1469 ops->hooknum = hook.num;
1470 ops->priority = hook.priority;
1472 ops->hook = hook.type->hooks[ops->hooknum];
1473 ops->dev = hook.dev;
1475 chain->flags |= NFT_BASE_CHAIN;
1476 basechain->policy = policy;
1478 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1484 INIT_LIST_HEAD(&chain->rules);
1485 chain->handle = nf_tables_alloc_handle(table);
1486 chain->table = table;
1487 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1493 rules = nf_tables_chain_alloc_rules(chain, 0);
1500 rcu_assign_pointer(chain->rules_gen_0, rules);
1501 rcu_assign_pointer(chain->rules_gen_1, rules);
1503 err = nf_tables_register_hook(net, table, chain);
1507 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1512 list_add_tail_rcu(&chain->list, &table->chains);
1516 nf_tables_unregister_hook(net, table, chain);
1518 nf_tables_chain_destroy(ctx);
1523 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1526 const struct nlattr * const *nla = ctx->nla;
1527 struct nft_table *table = ctx->table;
1528 struct nft_chain *chain = ctx->chain;
1529 struct nft_base_chain *basechain;
1530 struct nft_stats *stats = NULL;
1531 struct nft_chain_hook hook;
1532 const struct nlattr *name;
1533 struct nf_hook_ops *ops;
1534 struct nft_trans *trans;
1537 if (nla[NFTA_CHAIN_HOOK]) {
1538 if (!nft_is_base_chain(chain))
1541 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
1546 basechain = nft_base_chain(chain);
1547 if (basechain->type != hook.type) {
1548 nft_chain_release_hook(&hook);
1552 ops = &basechain->ops;
1553 if (ops->hooknum != hook.num ||
1554 ops->priority != hook.priority ||
1555 ops->dev != hook.dev) {
1556 nft_chain_release_hook(&hook);
1559 nft_chain_release_hook(&hook);
1562 if (nla[NFTA_CHAIN_HANDLE] &&
1563 nla[NFTA_CHAIN_NAME]) {
1564 struct nft_chain *chain2;
1566 chain2 = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1567 if (!IS_ERR(chain2))
1571 if (nla[NFTA_CHAIN_COUNTERS]) {
1572 if (!nft_is_base_chain(chain))
1575 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1577 return PTR_ERR(stats);
1580 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1581 sizeof(struct nft_trans_chain));
1582 if (trans == NULL) {
1587 nft_trans_chain_stats(trans) = stats;
1588 nft_trans_chain_update(trans) = true;
1590 if (nla[NFTA_CHAIN_POLICY])
1591 nft_trans_chain_policy(trans) = policy;
1593 nft_trans_chain_policy(trans) = -1;
1595 name = nla[NFTA_CHAIN_NAME];
1596 if (nla[NFTA_CHAIN_HANDLE] && name) {
1597 nft_trans_chain_name(trans) =
1598 nla_strdup(name, GFP_KERNEL);
1599 if (!nft_trans_chain_name(trans)) {
1605 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1610 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1611 struct sk_buff *skb, const struct nlmsghdr *nlh,
1612 const struct nlattr * const nla[],
1613 struct netlink_ext_ack *extack)
1615 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1616 u8 genmask = nft_genmask_next(net);
1617 int family = nfmsg->nfgen_family;
1618 const struct nlattr *attr;
1619 struct nft_table *table;
1620 struct nft_chain *chain;
1621 u8 policy = NF_ACCEPT;
1626 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1628 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1629 if (IS_ERR(table)) {
1630 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1631 return PTR_ERR(table);
1635 attr = nla[NFTA_CHAIN_NAME];
1637 if (nla[NFTA_CHAIN_HANDLE]) {
1638 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1639 chain = nft_chain_lookup_byhandle(table, handle, genmask);
1640 if (IS_ERR(chain)) {
1641 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
1642 return PTR_ERR(chain);
1644 attr = nla[NFTA_CHAIN_HANDLE];
1646 chain = nft_chain_lookup(table, attr, genmask);
1647 if (IS_ERR(chain)) {
1648 if (PTR_ERR(chain) != -ENOENT) {
1649 NL_SET_BAD_ATTR(extack, attr);
1650 return PTR_ERR(chain);
1656 if (nla[NFTA_CHAIN_POLICY]) {
1657 if (chain != NULL &&
1658 !nft_is_base_chain(chain)) {
1659 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
1663 if (chain == NULL &&
1664 nla[NFTA_CHAIN_HOOK] == NULL) {
1665 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
1669 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
1679 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1681 if (chain != NULL) {
1682 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1683 NL_SET_BAD_ATTR(extack, attr);
1686 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1689 return nf_tables_updchain(&ctx, genmask, policy, create);
1692 return nf_tables_addchain(&ctx, family, genmask, policy, create);
1695 static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1696 struct sk_buff *skb, const struct nlmsghdr *nlh,
1697 const struct nlattr * const nla[],
1698 struct netlink_ext_ack *extack)
1700 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1701 u8 genmask = nft_genmask_next(net);
1702 int family = nfmsg->nfgen_family;
1703 const struct nlattr *attr;
1704 struct nft_table *table;
1705 struct nft_chain *chain;
1706 struct nft_rule *rule;
1712 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1713 if (IS_ERR(table)) {
1714 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1715 return PTR_ERR(table);
1718 if (nla[NFTA_CHAIN_HANDLE]) {
1719 attr = nla[NFTA_CHAIN_HANDLE];
1720 handle = be64_to_cpu(nla_get_be64(attr));
1721 chain = nft_chain_lookup_byhandle(table, handle, genmask);
1723 attr = nla[NFTA_CHAIN_NAME];
1724 chain = nft_chain_lookup(table, attr, genmask);
1726 if (IS_ERR(chain)) {
1727 NL_SET_BAD_ATTR(extack, attr);
1728 return PTR_ERR(chain);
1731 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1735 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1738 list_for_each_entry(rule, &chain->rules, list) {
1739 if (!nft_is_active_next(net, rule))
1743 err = nft_delrule(&ctx, rule);
1748 /* There are rules and elements that are still holding references to us,
1749 * we cannot do a recursive removal in this case.
1752 NL_SET_BAD_ATTR(extack, attr);
1756 return nft_delchain(&ctx);
1764 * nft_register_expr - register nf_tables expr type
1767 * Registers the expr type for use with nf_tables. Returns zero on
1768 * success or a negative errno code otherwise.
1770 int nft_register_expr(struct nft_expr_type *type)
1772 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1773 if (type->family == NFPROTO_UNSPEC)
1774 list_add_tail_rcu(&type->list, &nf_tables_expressions);
1776 list_add_rcu(&type->list, &nf_tables_expressions);
1777 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1780 EXPORT_SYMBOL_GPL(nft_register_expr);
1783 * nft_unregister_expr - unregister nf_tables expr type
1786 * Unregisters the expr typefor use with nf_tables.
1788 void nft_unregister_expr(struct nft_expr_type *type)
1790 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1791 list_del_rcu(&type->list);
1792 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1794 EXPORT_SYMBOL_GPL(nft_unregister_expr);
1796 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1799 const struct nft_expr_type *type;
1801 list_for_each_entry(type, &nf_tables_expressions, list) {
1802 if (!nla_strcmp(nla, type->name) &&
1803 (!type->family || type->family == family))
1809 static const struct nft_expr_type *nft_expr_type_get(u8 family,
1812 const struct nft_expr_type *type;
1815 return ERR_PTR(-EINVAL);
1817 type = __nft_expr_type_get(family, nla);
1818 if (type != NULL && try_module_get(type->owner))
1821 #ifdef CONFIG_MODULES
1823 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1824 request_module("nft-expr-%u-%.*s", family,
1825 nla_len(nla), (char *)nla_data(nla));
1826 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1827 if (__nft_expr_type_get(family, nla))
1828 return ERR_PTR(-EAGAIN);
1830 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1831 request_module("nft-expr-%.*s",
1832 nla_len(nla), (char *)nla_data(nla));
1833 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1834 if (__nft_expr_type_get(family, nla))
1835 return ERR_PTR(-EAGAIN);
1838 return ERR_PTR(-ENOENT);
1841 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1842 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1843 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1846 static int nf_tables_fill_expr_info(struct sk_buff *skb,
1847 const struct nft_expr *expr)
1849 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
1850 goto nla_put_failure;
1852 if (expr->ops->dump) {
1853 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1855 goto nla_put_failure;
1856 if (expr->ops->dump(skb, expr) < 0)
1857 goto nla_put_failure;
1858 nla_nest_end(skb, data);
1867 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1868 const struct nft_expr *expr)
1870 struct nlattr *nest;
1872 nest = nla_nest_start(skb, attr);
1874 goto nla_put_failure;
1875 if (nf_tables_fill_expr_info(skb, expr) < 0)
1876 goto nla_put_failure;
1877 nla_nest_end(skb, nest);
1884 struct nft_expr_info {
1885 const struct nft_expr_ops *ops;
1886 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
1889 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1890 const struct nlattr *nla,
1891 struct nft_expr_info *info)
1893 const struct nft_expr_type *type;
1894 const struct nft_expr_ops *ops;
1895 struct nlattr *tb[NFTA_EXPR_MAX + 1];
1898 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
1902 type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
1904 return PTR_ERR(type);
1906 if (tb[NFTA_EXPR_DATA]) {
1907 err = nla_parse_nested(info->tb, type->maxattr,
1908 tb[NFTA_EXPR_DATA], type->policy, NULL);
1912 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1914 if (type->select_ops != NULL) {
1915 ops = type->select_ops(ctx,
1916 (const struct nlattr * const *)info->tb);
1928 module_put(type->owner);
1932 static int nf_tables_newexpr(const struct nft_ctx *ctx,
1933 const struct nft_expr_info *info,
1934 struct nft_expr *expr)
1936 const struct nft_expr_ops *ops = info->ops;
1941 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
1952 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1953 struct nft_expr *expr)
1955 if (expr->ops->destroy)
1956 expr->ops->destroy(ctx, expr);
1957 module_put(expr->ops->type->owner);
1960 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1961 const struct nlattr *nla)
1963 struct nft_expr_info info;
1964 struct nft_expr *expr;
1967 err = nf_tables_expr_parse(ctx, nla, &info);
1972 expr = kzalloc(info.ops->size, GFP_KERNEL);
1976 err = nf_tables_newexpr(ctx, &info, expr);
1984 module_put(info.ops->type->owner);
1986 return ERR_PTR(err);
1989 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1991 nf_tables_expr_destroy(ctx, expr);
1999 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2002 struct nft_rule *rule;
2004 // FIXME: this sucks
2005 list_for_each_entry_rcu(rule, &chain->rules, list) {
2006 if (handle == rule->handle)
2010 return ERR_PTR(-ENOENT);
2013 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2014 const struct nlattr *nla)
2017 return ERR_PTR(-EINVAL);
2019 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
2022 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
2023 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2024 .len = NFT_TABLE_MAXNAMELEN - 1 },
2025 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2026 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2027 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2028 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
2029 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
2030 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
2031 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2032 .len = NFT_USERDATA_MAXLEN },
2033 [NFTA_RULE_ID] = { .type = NLA_U32 },
2036 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2037 u32 portid, u32 seq, int event,
2038 u32 flags, int family,
2039 const struct nft_table *table,
2040 const struct nft_chain *chain,
2041 const struct nft_rule *rule)
2043 struct nlmsghdr *nlh;
2044 struct nfgenmsg *nfmsg;
2045 const struct nft_expr *expr, *next;
2046 struct nlattr *list;
2047 const struct nft_rule *prule;
2048 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2050 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
2052 goto nla_put_failure;
2054 nfmsg = nlmsg_data(nlh);
2055 nfmsg->nfgen_family = family;
2056 nfmsg->version = NFNETLINK_V0;
2057 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
2059 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2060 goto nla_put_failure;
2061 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2062 goto nla_put_failure;
2063 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2065 goto nla_put_failure;
2067 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
2068 prule = list_prev_entry(rule, list);
2069 if (nla_put_be64(skb, NFTA_RULE_POSITION,
2070 cpu_to_be64(prule->handle),
2072 goto nla_put_failure;
2075 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2077 goto nla_put_failure;
2078 nft_rule_for_each_expr(expr, next, rule) {
2079 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
2080 goto nla_put_failure;
2082 nla_nest_end(skb, list);
2085 struct nft_userdata *udata = nft_userdata(rule);
2086 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2088 goto nla_put_failure;
2091 nlmsg_end(skb, nlh);
2095 nlmsg_trim(skb, nlh);
2099 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2100 const struct nft_rule *rule, int event)
2102 struct sk_buff *skb;
2106 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2109 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2113 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2114 event, 0, ctx->family, ctx->table,
2121 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2122 ctx->report, GFP_KERNEL);
2125 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2128 struct nft_rule_dump_ctx {
2133 static int nf_tables_dump_rules(struct sk_buff *skb,
2134 struct netlink_callback *cb)
2136 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2137 const struct nft_rule_dump_ctx *ctx = cb->data;
2138 const struct nft_table *table;
2139 const struct nft_chain *chain;
2140 const struct nft_rule *rule;
2141 unsigned int idx = 0, s_idx = cb->args[0];
2142 struct net *net = sock_net(skb->sk);
2143 int family = nfmsg->nfgen_family;
2146 cb->seq = net->nft.base_seq;
2148 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2149 if (family != NFPROTO_UNSPEC && family != table->family)
2152 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
2155 list_for_each_entry_rcu(chain, &table->chains, list) {
2156 if (ctx && ctx->chain &&
2157 strcmp(ctx->chain, chain->name) != 0)
2160 list_for_each_entry_rcu(rule, &chain->rules, list) {
2161 if (!nft_is_active(net, rule))
2166 memset(&cb->args[1], 0,
2167 sizeof(cb->args) - sizeof(cb->args[0]));
2168 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2171 NLM_F_MULTI | NLM_F_APPEND,
2173 table, chain, rule) < 0)
2176 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2189 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2191 struct nft_rule_dump_ctx *ctx = cb->data;
2201 /* called with rcu_read_lock held */
2202 static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2203 struct sk_buff *skb, const struct nlmsghdr *nlh,
2204 const struct nlattr * const nla[],
2205 struct netlink_ext_ack *extack)
2207 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2208 u8 genmask = nft_genmask_cur(net);
2209 const struct nft_table *table;
2210 const struct nft_chain *chain;
2211 const struct nft_rule *rule;
2212 struct sk_buff *skb2;
2213 int family = nfmsg->nfgen_family;
2216 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2217 struct netlink_dump_control c = {
2218 .dump = nf_tables_dump_rules,
2219 .done = nf_tables_dump_rules_done,
2220 .module = THIS_MODULE,
2223 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2224 struct nft_rule_dump_ctx *ctx;
2226 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2230 if (nla[NFTA_RULE_TABLE]) {
2231 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2238 if (nla[NFTA_RULE_CHAIN]) {
2239 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2250 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
2253 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2254 if (IS_ERR(table)) {
2255 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2256 return PTR_ERR(table);
2259 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2260 if (IS_ERR(chain)) {
2261 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2262 return PTR_ERR(chain);
2265 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2267 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2268 return PTR_ERR(rule);
2271 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
2275 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
2276 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2277 family, table, chain, rule);
2281 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2288 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2289 struct nft_rule *rule)
2291 struct nft_expr *expr;
2294 * Careful: some expressions might not be initialized in case this
2295 * is called on error from nf_tables_newrule().
2297 expr = nft_expr_first(rule);
2298 while (expr != nft_expr_last(rule) && expr->ops) {
2299 nf_tables_expr_destroy(ctx, expr);
2300 expr = nft_expr_next(expr);
2305 static void nf_tables_rule_release(const struct nft_ctx *ctx,
2306 struct nft_rule *rule)
2308 nft_rule_expr_deactivate(ctx, rule);
2309 nf_tables_rule_destroy(ctx, rule);
2312 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2314 struct nft_expr *expr, *last;
2315 const struct nft_data *data;
2316 struct nft_rule *rule;
2319 list_for_each_entry(rule, &chain->rules, list) {
2320 if (!nft_is_active_next(ctx->net, rule))
2323 nft_rule_for_each_expr(expr, last, rule) {
2324 if (!expr->ops->validate)
2327 err = expr->ops->validate(ctx, expr, &data);
2335 EXPORT_SYMBOL_GPL(nft_chain_validate);
2337 static int nft_table_validate(struct net *net, const struct nft_table *table)
2339 struct nft_chain *chain;
2340 struct nft_ctx ctx = {
2342 .family = table->family,
2346 list_for_each_entry(chain, &table->chains, list) {
2347 if (!nft_is_base_chain(chain))
2351 err = nft_chain_validate(&ctx, chain);
2359 #define NFT_RULE_MAXEXPRS 128
2361 static struct nft_expr_info *info;
2363 static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2364 struct sk_buff *skb, const struct nlmsghdr *nlh,
2365 const struct nlattr * const nla[],
2366 struct netlink_ext_ack *extack)
2368 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2369 u8 genmask = nft_genmask_next(net);
2370 int family = nfmsg->nfgen_family;
2371 struct nft_table *table;
2372 struct nft_chain *chain;
2373 struct nft_rule *rule, *old_rule = NULL;
2374 struct nft_userdata *udata;
2375 struct nft_trans *trans = NULL;
2376 struct nft_expr *expr;
2379 unsigned int size, i, n, ulen = 0, usize = 0;
2382 u64 handle, pos_handle;
2384 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2386 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2387 if (IS_ERR(table)) {
2388 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2389 return PTR_ERR(table);
2392 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2393 if (IS_ERR(chain)) {
2394 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2395 return PTR_ERR(chain);
2398 if (nla[NFTA_RULE_HANDLE]) {
2399 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2400 rule = __nft_rule_lookup(chain, handle);
2402 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2403 return PTR_ERR(rule);
2406 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2407 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2410 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2415 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2417 handle = nf_tables_alloc_handle(table);
2419 if (chain->use == UINT_MAX)
2423 if (nla[NFTA_RULE_POSITION]) {
2424 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2427 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2428 old_rule = __nft_rule_lookup(chain, pos_handle);
2429 if (IS_ERR(old_rule)) {
2430 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
2431 return PTR_ERR(old_rule);
2435 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2439 if (nla[NFTA_RULE_EXPRESSIONS]) {
2440 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2442 if (nla_type(tmp) != NFTA_LIST_ELEM)
2444 if (n == NFT_RULE_MAXEXPRS)
2446 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
2449 size += info[n].ops->size;
2453 /* Check for overflow of dlen field */
2455 if (size >= 1 << 12)
2458 if (nla[NFTA_RULE_USERDATA]) {
2459 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
2461 usize = sizeof(struct nft_userdata) + ulen;
2465 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
2469 nft_activate_next(net, rule);
2471 rule->handle = handle;
2473 rule->udata = ulen ? 1 : 0;
2476 udata = nft_userdata(rule);
2477 udata->len = ulen - 1;
2478 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2481 expr = nft_expr_first(rule);
2482 for (i = 0; i < n; i++) {
2483 err = nf_tables_newexpr(&ctx, &info[i], expr);
2487 if (info[i].ops->validate)
2488 nft_validate_state_update(net, NFT_VALIDATE_NEED);
2491 expr = nft_expr_next(expr);
2494 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
2495 if (!nft_is_active_next(net, old_rule)) {
2499 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
2501 if (trans == NULL) {
2505 nft_deactivate_next(net, old_rule);
2508 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2513 list_add_tail_rcu(&rule->list, &old_rule->list);
2515 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2520 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2522 list_add_rcu(&rule->list, &old_rule->list);
2524 list_add_tail_rcu(&rule->list, &chain->rules);
2527 list_add_tail_rcu(&rule->list, &old_rule->list);
2529 list_add_rcu(&rule->list, &chain->rules);
2534 if (net->nft.validate_state == NFT_VALIDATE_DO)
2535 return nft_table_validate(net, table);
2539 nf_tables_rule_release(&ctx, rule);
2541 for (i = 0; i < n; i++) {
2542 if (info[i].ops != NULL)
2543 module_put(info[i].ops->type->owner);
2548 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2549 const struct nlattr *nla)
2551 u32 id = ntohl(nla_get_be32(nla));
2552 struct nft_trans *trans;
2554 list_for_each_entry(trans, &net->nft.commit_list, list) {
2555 struct nft_rule *rule = nft_trans_rule(trans);
2557 if (trans->msg_type == NFT_MSG_NEWRULE &&
2558 id == nft_trans_rule_id(trans))
2561 return ERR_PTR(-ENOENT);
2564 static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2565 struct sk_buff *skb, const struct nlmsghdr *nlh,
2566 const struct nlattr * const nla[],
2567 struct netlink_ext_ack *extack)
2569 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2570 u8 genmask = nft_genmask_next(net);
2571 struct nft_table *table;
2572 struct nft_chain *chain = NULL;
2573 struct nft_rule *rule;
2574 int family = nfmsg->nfgen_family, err = 0;
2577 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2578 if (IS_ERR(table)) {
2579 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2580 return PTR_ERR(table);
2583 if (nla[NFTA_RULE_CHAIN]) {
2584 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2585 if (IS_ERR(chain)) {
2586 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2587 return PTR_ERR(chain);
2591 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2594 if (nla[NFTA_RULE_HANDLE]) {
2595 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2597 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2598 return PTR_ERR(rule);
2601 err = nft_delrule(&ctx, rule);
2602 } else if (nla[NFTA_RULE_ID]) {
2603 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2605 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
2606 return PTR_ERR(rule);
2609 err = nft_delrule(&ctx, rule);
2611 err = nft_delrule_by_chain(&ctx);
2614 list_for_each_entry(chain, &table->chains, list) {
2615 if (!nft_is_active_next(net, chain))
2619 err = nft_delrule_by_chain(&ctx);
2632 static LIST_HEAD(nf_tables_set_types);
2634 int nft_register_set(struct nft_set_type *type)
2636 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2637 list_add_tail_rcu(&type->list, &nf_tables_set_types);
2638 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2641 EXPORT_SYMBOL_GPL(nft_register_set);
2643 void nft_unregister_set(struct nft_set_type *type)
2645 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2646 list_del_rcu(&type->list);
2647 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2649 EXPORT_SYMBOL_GPL(nft_unregister_set);
2651 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2652 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
2655 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2657 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2661 * Select a set implementation based on the data characteristics and the
2662 * given policy. The total memory use might not be known if no size is
2663 * given, in that case the amount of memory per element is used.
2665 static const struct nft_set_ops *
2666 nft_select_set_ops(const struct nft_ctx *ctx,
2667 const struct nlattr * const nla[],
2668 const struct nft_set_desc *desc,
2669 enum nft_set_policies policy)
2671 const struct nft_set_ops *ops, *bops;
2672 struct nft_set_estimate est, best;
2673 const struct nft_set_type *type;
2676 #ifdef CONFIG_MODULES
2677 if (list_empty(&nf_tables_set_types)) {
2678 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2679 request_module("nft-set");
2680 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2681 if (!list_empty(&nf_tables_set_types))
2682 return ERR_PTR(-EAGAIN);
2685 if (nla[NFTA_SET_FLAGS] != NULL)
2686 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2693 list_for_each_entry(type, &nf_tables_set_types, list) {
2696 if (!nft_set_ops_candidate(type, flags))
2698 if (!ops->estimate(desc, flags, &est))
2702 case NFT_SET_POL_PERFORMANCE:
2703 if (est.lookup < best.lookup)
2705 if (est.lookup == best.lookup &&
2706 est.space < best.space)
2709 case NFT_SET_POL_MEMORY:
2711 if (est.space < best.space)
2713 if (est.space == best.space &&
2714 est.lookup < best.lookup)
2716 } else if (est.size < best.size || !bops) {
2724 if (!try_module_get(type->owner))
2727 module_put(to_set_type(bops)->owner);
2736 return ERR_PTR(-EOPNOTSUPP);
2739 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
2740 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2741 .len = NFT_TABLE_MAXNAMELEN - 1 },
2742 [NFTA_SET_NAME] = { .type = NLA_STRING,
2743 .len = NFT_SET_MAXNAMELEN - 1 },
2744 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2745 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2746 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2747 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2748 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
2749 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2750 [NFTA_SET_DESC] = { .type = NLA_NESTED },
2751 [NFTA_SET_ID] = { .type = NLA_U32 },
2752 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2753 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
2754 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2755 .len = NFT_USERDATA_MAXLEN },
2756 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
2757 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
2760 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2761 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
2764 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
2765 const struct sk_buff *skb,
2766 const struct nlmsghdr *nlh,
2767 const struct nlattr * const nla[],
2768 struct netlink_ext_ack *extack,
2771 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2772 int family = nfmsg->nfgen_family;
2773 struct nft_table *table = NULL;
2775 if (nla[NFTA_SET_TABLE] != NULL) {
2776 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
2778 if (IS_ERR(table)) {
2779 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
2780 return PTR_ERR(table);
2784 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
2788 static struct nft_set *nft_set_lookup(const struct nft_table *table,
2789 const struct nlattr *nla, u8 genmask)
2791 struct nft_set *set;
2794 return ERR_PTR(-EINVAL);
2796 list_for_each_entry_rcu(set, &table->sets, list) {
2797 if (!nla_strcmp(nla, set->name) &&
2798 nft_active_genmask(set, genmask))
2801 return ERR_PTR(-ENOENT);
2804 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
2805 const struct nlattr *nla,
2808 struct nft_set *set;
2810 list_for_each_entry(set, &table->sets, list) {
2811 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2812 nft_active_genmask(set, genmask))
2815 return ERR_PTR(-ENOENT);
2818 static struct nft_set *nft_set_lookup_byid(const struct net *net,
2819 const struct nlattr *nla, u8 genmask)
2821 struct nft_trans *trans;
2822 u32 id = ntohl(nla_get_be32(nla));
2824 list_for_each_entry(trans, &net->nft.commit_list, list) {
2825 struct nft_set *set = nft_trans_set(trans);
2827 if (trans->msg_type == NFT_MSG_NEWSET &&
2828 id == nft_trans_set_id(trans) &&
2829 nft_active_genmask(set, genmask))
2832 return ERR_PTR(-ENOENT);
2835 struct nft_set *nft_set_lookup_global(const struct net *net,
2836 const struct nft_table *table,
2837 const struct nlattr *nla_set_name,
2838 const struct nlattr *nla_set_id,
2841 struct nft_set *set;
2843 set = nft_set_lookup(table, nla_set_name, genmask);
2848 set = nft_set_lookup_byid(net, nla_set_id, genmask);
2852 EXPORT_SYMBOL_GPL(nft_set_lookup_global);
2854 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2857 const struct nft_set *i;
2859 unsigned long *inuse;
2860 unsigned int n = 0, min = 0;
2862 p = strchr(name, '%');
2864 if (p[1] != 'd' || strchr(p + 2, '%'))
2867 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2871 list_for_each_entry(i, &ctx->table->sets, list) {
2874 if (!nft_is_active_next(ctx->net, set))
2876 if (!sscanf(i->name, name, &tmp))
2878 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
2881 set_bit(tmp - min, inuse);
2884 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
2885 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2886 min += BITS_PER_BYTE * PAGE_SIZE;
2887 memset(inuse, 0, PAGE_SIZE);
2890 free_page((unsigned long)inuse);
2893 set->name = kasprintf(GFP_KERNEL, name, min + n);
2897 list_for_each_entry(i, &ctx->table->sets, list) {
2898 if (!nft_is_active_next(ctx->net, i))
2900 if (!strcmp(set->name, i->name)) {
2908 static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
2910 u64 ms = be64_to_cpu(nla_get_be64(nla));
2911 u64 max = (u64)(~((u64)0));
2913 max = div_u64(max, NSEC_PER_MSEC);
2917 ms *= NSEC_PER_MSEC;
2918 *result = nsecs_to_jiffies64(ms);
2922 static __be64 nf_jiffies64_to_msecs(u64 input)
2924 u64 ms = jiffies64_to_nsecs(input);
2926 return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
2929 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2930 const struct nft_set *set, u16 event, u16 flags)
2932 struct nfgenmsg *nfmsg;
2933 struct nlmsghdr *nlh;
2934 struct nlattr *desc;
2935 u32 portid = ctx->portid;
2938 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2939 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2942 goto nla_put_failure;
2944 nfmsg = nlmsg_data(nlh);
2945 nfmsg->nfgen_family = ctx->family;
2946 nfmsg->version = NFNETLINK_V0;
2947 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
2949 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2950 goto nla_put_failure;
2951 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2952 goto nla_put_failure;
2953 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
2955 goto nla_put_failure;
2956 if (set->flags != 0)
2957 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2958 goto nla_put_failure;
2960 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2961 goto nla_put_failure;
2962 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2963 goto nla_put_failure;
2964 if (set->flags & NFT_SET_MAP) {
2965 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2966 goto nla_put_failure;
2967 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2968 goto nla_put_failure;
2970 if (set->flags & NFT_SET_OBJECT &&
2971 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2972 goto nla_put_failure;
2975 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2976 nf_jiffies64_to_msecs(set->timeout),
2978 goto nla_put_failure;
2980 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2981 goto nla_put_failure;
2983 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2984 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2985 goto nla_put_failure;
2988 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2989 goto nla_put_failure;
2991 desc = nla_nest_start(skb, NFTA_SET_DESC);
2993 goto nla_put_failure;
2995 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2996 goto nla_put_failure;
2997 nla_nest_end(skb, desc);
2999 nlmsg_end(skb, nlh);
3003 nlmsg_trim(skb, nlh);
3007 static void nf_tables_set_notify(const struct nft_ctx *ctx,
3008 const struct nft_set *set, int event,
3011 struct sk_buff *skb;
3012 u32 portid = ctx->portid;
3016 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
3019 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
3023 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3029 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3033 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3036 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
3038 const struct nft_set *set;
3039 unsigned int idx, s_idx = cb->args[0];
3040 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3041 struct net *net = sock_net(skb->sk);
3042 struct nft_ctx *ctx = cb->data, ctx_set;
3048 cb->seq = net->nft.base_seq;
3050 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3051 if (ctx->family != NFPROTO_UNSPEC &&
3052 ctx->family != table->family)
3055 if (ctx->table && ctx->table != table)
3059 if (cur_table != table)
3065 list_for_each_entry_rcu(set, &table->sets, list) {
3068 if (!nft_is_active(net, set))
3072 ctx_set.table = table;
3073 ctx_set.family = table->family;
3075 if (nf_tables_fill_set(skb, &ctx_set, set,
3079 cb->args[2] = (unsigned long) table;
3082 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3095 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
3101 /* called with rcu_read_lock held */
3102 static int nf_tables_getset(struct net *net, struct sock *nlsk,
3103 struct sk_buff *skb, const struct nlmsghdr *nlh,
3104 const struct nlattr * const nla[],
3105 struct netlink_ext_ack *extack)
3107 u8 genmask = nft_genmask_cur(net);
3108 const struct nft_set *set;
3110 struct sk_buff *skb2;
3111 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3114 /* Verify existence before starting dump */
3115 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3120 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3121 struct netlink_dump_control c = {
3122 .dump = nf_tables_dump_sets,
3123 .done = nf_tables_dump_sets_done,
3124 .module = THIS_MODULE,
3126 struct nft_ctx *ctx_dump;
3128 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_ATOMIC);
3129 if (ctx_dump == NULL)
3135 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3138 /* Only accept unspec with dump */
3139 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3140 return -EAFNOSUPPORT;
3141 if (!nla[NFTA_SET_TABLE])
3144 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
3146 return PTR_ERR(set);
3148 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3152 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3156 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3163 static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3164 struct nft_set_desc *desc,
3165 const struct nlattr *nla)
3167 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3170 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3171 nft_set_desc_policy, NULL);
3175 if (da[NFTA_SET_DESC_SIZE] != NULL)
3176 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3181 static int nf_tables_newset(struct net *net, struct sock *nlsk,
3182 struct sk_buff *skb, const struct nlmsghdr *nlh,
3183 const struct nlattr * const nla[],
3184 struct netlink_ext_ack *extack)
3186 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3187 u8 genmask = nft_genmask_next(net);
3188 int family = nfmsg->nfgen_family;
3189 const struct nft_set_ops *ops;
3190 struct nft_table *table;
3191 struct nft_set *set;
3197 u32 ktype, dtype, flags, policy, gc_int, objtype;
3198 struct nft_set_desc desc;
3199 unsigned char *udata;
3203 if (nla[NFTA_SET_TABLE] == NULL ||
3204 nla[NFTA_SET_NAME] == NULL ||
3205 nla[NFTA_SET_KEY_LEN] == NULL ||
3206 nla[NFTA_SET_ID] == NULL)
3209 memset(&desc, 0, sizeof(desc));
3211 ktype = NFT_DATA_VALUE;
3212 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3213 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3214 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3218 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
3219 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
3223 if (nla[NFTA_SET_FLAGS] != NULL) {
3224 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3225 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
3226 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
3227 NFT_SET_MAP | NFT_SET_EVAL |
3230 /* Only one of these operations is supported */
3231 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3232 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
3237 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3238 if (!(flags & NFT_SET_MAP))
3241 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3242 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3243 dtype != NFT_DATA_VERDICT)
3246 if (dtype != NFT_DATA_VERDICT) {
3247 if (nla[NFTA_SET_DATA_LEN] == NULL)
3249 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
3250 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
3253 desc.dlen = sizeof(struct nft_verdict);
3254 } else if (flags & NFT_SET_MAP)
3257 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3258 if (!(flags & NFT_SET_OBJECT))
3261 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3262 if (objtype == NFT_OBJECT_UNSPEC ||
3263 objtype > NFT_OBJECT_MAX)
3265 } else if (flags & NFT_SET_OBJECT)
3268 objtype = NFT_OBJECT_UNSPEC;
3271 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3272 if (!(flags & NFT_SET_TIMEOUT))
3275 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3280 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3281 if (!(flags & NFT_SET_TIMEOUT))
3283 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3286 policy = NFT_SET_POL_PERFORMANCE;
3287 if (nla[NFTA_SET_POLICY] != NULL)
3288 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3290 if (nla[NFTA_SET_DESC] != NULL) {
3291 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3296 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3298 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
3299 if (IS_ERR(table)) {
3300 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
3301 return PTR_ERR(table);
3304 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3306 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
3308 if (PTR_ERR(set) != -ENOENT) {
3309 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
3310 return PTR_ERR(set);
3313 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3314 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
3317 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3323 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3326 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
3328 return PTR_ERR(ops);
3331 if (nla[NFTA_SET_USERDATA])
3332 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3335 if (ops->privsize != NULL)
3336 size = ops->privsize(nla, &desc);
3338 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3344 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3350 err = nf_tables_set_alloc_name(&ctx, set, name);
3357 udata = set->data + size;
3358 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3361 INIT_LIST_HEAD(&set->bindings);
3364 set->klen = desc.klen;
3366 set->objtype = objtype;
3367 set->dlen = desc.dlen;
3369 set->size = desc.size;
3370 set->policy = policy;
3373 set->timeout = timeout;
3374 set->gc_int = gc_int;
3375 set->handle = nf_tables_alloc_handle(table);
3377 err = ops->init(set, &desc, nla);
3381 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
3385 list_add_tail_rcu(&set->list, &table->sets);
3396 module_put(to_set_type(ops)->owner);
3400 static void nft_set_destroy(struct nft_set *set)
3402 set->ops->destroy(set);
3403 module_put(to_set_type(set->ops)->owner);
3408 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3410 list_del_rcu(&set->list);
3411 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
3412 nft_set_destroy(set);
3415 static int nf_tables_delset(struct net *net, struct sock *nlsk,
3416 struct sk_buff *skb, const struct nlmsghdr *nlh,
3417 const struct nlattr * const nla[],
3418 struct netlink_ext_ack *extack)
3420 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3421 u8 genmask = nft_genmask_next(net);
3422 const struct nlattr *attr;
3423 struct nft_set *set;
3427 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3428 return -EAFNOSUPPORT;
3429 if (nla[NFTA_SET_TABLE] == NULL)
3432 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3437 if (nla[NFTA_SET_HANDLE]) {
3438 attr = nla[NFTA_SET_HANDLE];
3439 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3441 attr = nla[NFTA_SET_NAME];
3442 set = nft_set_lookup(ctx.table, attr, genmask);
3446 NL_SET_BAD_ATTR(extack, attr);
3447 return PTR_ERR(set);
3449 if (!list_empty(&set->bindings) ||
3450 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3451 NL_SET_BAD_ATTR(extack, attr);
3455 return nft_delset(&ctx, set);
3458 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
3459 struct nft_set *set,
3460 const struct nft_set_iter *iter,
3461 struct nft_set_elem *elem)
3463 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3464 enum nft_registers dreg;
3466 dreg = nft_type_to_reg(set->dtype);
3467 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3468 set->dtype == NFT_DATA_VERDICT ?
3469 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3473 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3474 struct nft_set_binding *binding)
3476 struct nft_set_binding *i;
3477 struct nft_set_iter iter;
3479 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
3482 if (binding->flags & NFT_SET_MAP) {
3483 /* If the set is already bound to the same chain all
3484 * jumps are already validated for that chain.
3486 list_for_each_entry(i, &set->bindings, list) {
3487 if (i->flags & NFT_SET_MAP &&
3488 i->chain == binding->chain)
3492 iter.genmask = nft_genmask_next(ctx->net);
3496 iter.fn = nf_tables_bind_check_setelem;
3498 set->ops->walk(ctx, set, &iter);
3503 binding->chain = ctx->chain;
3504 list_add_tail_rcu(&binding->list, &set->bindings);
3507 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
3509 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3510 struct nft_set_binding *binding)
3512 list_del_rcu(&binding->list);
3514 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
3515 nft_is_active(ctx->net, set))
3516 nf_tables_set_destroy(ctx, set);
3518 EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
3520 const struct nft_set_ext_type nft_set_ext_types[] = {
3521 [NFT_SET_EXT_KEY] = {
3522 .align = __alignof__(u32),
3524 [NFT_SET_EXT_DATA] = {
3525 .align = __alignof__(u32),
3527 [NFT_SET_EXT_EXPR] = {
3528 .align = __alignof__(struct nft_expr),
3530 [NFT_SET_EXT_OBJREF] = {
3531 .len = sizeof(struct nft_object *),
3532 .align = __alignof__(struct nft_object *),
3534 [NFT_SET_EXT_FLAGS] = {
3536 .align = __alignof__(u8),
3538 [NFT_SET_EXT_TIMEOUT] = {
3540 .align = __alignof__(u64),
3542 [NFT_SET_EXT_EXPIRATION] = {
3544 .align = __alignof__(u64),
3546 [NFT_SET_EXT_USERDATA] = {
3547 .len = sizeof(struct nft_userdata),
3548 .align = __alignof__(struct nft_userdata),
3551 EXPORT_SYMBOL_GPL(nft_set_ext_types);
3557 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3558 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3559 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3560 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
3561 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
3562 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3563 .len = NFT_USERDATA_MAXLEN },
3564 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3565 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
3568 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
3569 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3570 .len = NFT_TABLE_MAXNAMELEN - 1 },
3571 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3572 .len = NFT_SET_MAXNAMELEN - 1 },
3573 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
3574 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
3577 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
3578 const struct sk_buff *skb,
3579 const struct nlmsghdr *nlh,
3580 const struct nlattr * const nla[],
3581 struct netlink_ext_ack *extack,
3584 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3585 int family = nfmsg->nfgen_family;
3586 struct nft_table *table;
3588 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3590 if (IS_ERR(table)) {
3591 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
3592 return PTR_ERR(table);
3595 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
3599 static int nf_tables_fill_setelem(struct sk_buff *skb,
3600 const struct nft_set *set,
3601 const struct nft_set_elem *elem)
3603 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3604 unsigned char *b = skb_tail_pointer(skb);
3605 struct nlattr *nest;
3607 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3609 goto nla_put_failure;
3611 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3612 NFT_DATA_VALUE, set->klen) < 0)
3613 goto nla_put_failure;
3615 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3616 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
3617 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3619 goto nla_put_failure;
3621 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3622 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3623 goto nla_put_failure;
3625 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3626 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3627 (*nft_set_ext_obj(ext))->name) < 0)
3628 goto nla_put_failure;
3630 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3631 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3632 htonl(*nft_set_ext_flags(ext))))
3633 goto nla_put_failure;
3635 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3636 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
3637 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
3639 goto nla_put_failure;
3641 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3642 u64 expires, now = get_jiffies_64();
3644 expires = *nft_set_ext_expiration(ext);
3645 if (time_before64(now, expires))
3650 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
3651 nf_jiffies64_to_msecs(expires),
3653 goto nla_put_failure;
3656 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3657 struct nft_userdata *udata;
3659 udata = nft_set_ext_userdata(ext);
3660 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3661 udata->len + 1, udata->data))
3662 goto nla_put_failure;
3665 nla_nest_end(skb, nest);
3673 struct nft_set_dump_args {
3674 const struct netlink_callback *cb;
3675 struct nft_set_iter iter;
3676 struct sk_buff *skb;
3679 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
3680 struct nft_set *set,
3681 const struct nft_set_iter *iter,
3682 struct nft_set_elem *elem)
3684 struct nft_set_dump_args *args;
3686 args = container_of(iter, struct nft_set_dump_args, iter);
3687 return nf_tables_fill_setelem(args->skb, set, elem);
3690 struct nft_set_dump_ctx {
3691 const struct nft_set *set;
3695 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3697 struct nft_set_dump_ctx *dump_ctx = cb->data;
3698 struct net *net = sock_net(skb->sk);
3699 struct nft_table *table;
3700 struct nft_set *set;
3701 struct nft_set_dump_args args;
3702 bool set_found = false;
3703 struct nfgenmsg *nfmsg;
3704 struct nlmsghdr *nlh;
3705 struct nlattr *nest;
3710 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3711 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
3712 dump_ctx->ctx.family != table->family)
3715 if (table != dump_ctx->ctx.table)
3718 list_for_each_entry_rcu(set, &table->sets, list) {
3719 if (set == dump_ctx->set) {
3732 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
3733 portid = NETLINK_CB(cb->skb).portid;
3734 seq = cb->nlh->nlmsg_seq;
3736 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3739 goto nla_put_failure;
3741 nfmsg = nlmsg_data(nlh);
3742 nfmsg->nfgen_family = table->family;
3743 nfmsg->version = NFNETLINK_V0;
3744 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
3746 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
3747 goto nla_put_failure;
3748 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3749 goto nla_put_failure;
3751 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3753 goto nla_put_failure;
3757 args.iter.genmask = nft_genmask_cur(net);
3758 args.iter.skip = cb->args[0];
3759 args.iter.count = 0;
3761 args.iter.fn = nf_tables_dump_setelem;
3762 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3765 nla_nest_end(skb, nest);
3766 nlmsg_end(skb, nlh);
3768 if (args.iter.err && args.iter.err != -EMSGSIZE)
3769 return args.iter.err;
3770 if (args.iter.count == cb->args[0])
3773 cb->args[0] = args.iter.count;
3781 static int nf_tables_dump_set_done(struct netlink_callback *cb)
3787 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3788 const struct nft_ctx *ctx, u32 seq,
3789 u32 portid, int event, u16 flags,
3790 const struct nft_set *set,
3791 const struct nft_set_elem *elem)
3793 struct nfgenmsg *nfmsg;
3794 struct nlmsghdr *nlh;
3795 struct nlattr *nest;
3798 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3799 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3802 goto nla_put_failure;
3804 nfmsg = nlmsg_data(nlh);
3805 nfmsg->nfgen_family = ctx->family;
3806 nfmsg->version = NFNETLINK_V0;
3807 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
3809 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3810 goto nla_put_failure;
3811 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3812 goto nla_put_failure;
3814 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3816 goto nla_put_failure;
3818 err = nf_tables_fill_setelem(skb, set, elem);
3820 goto nla_put_failure;
3822 nla_nest_end(skb, nest);
3824 nlmsg_end(skb, nlh);
3828 nlmsg_trim(skb, nlh);
3832 static int nft_setelem_parse_flags(const struct nft_set *set,
3833 const struct nlattr *attr, u32 *flags)
3838 *flags = ntohl(nla_get_be32(attr));
3839 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3841 if (!(set->flags & NFT_SET_INTERVAL) &&
3842 *flags & NFT_SET_ELEM_INTERVAL_END)
3848 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3849 const struct nlattr *attr)
3851 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3852 const struct nft_set_ext *ext;
3853 struct nft_data_desc desc;
3854 struct nft_set_elem elem;
3855 struct sk_buff *skb;
3860 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3861 nft_set_elem_policy, NULL);
3865 if (!nla[NFTA_SET_ELEM_KEY])
3868 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3872 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3873 nla[NFTA_SET_ELEM_KEY]);
3878 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3881 priv = set->ops->get(ctx->net, set, &elem, flags);
3883 return PTR_ERR(priv);
3886 ext = nft_set_elem_ext(set, &elem);
3889 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3893 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3894 NFT_MSG_NEWSETELEM, 0, set, &elem);
3898 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3899 /* This avoids a loop in nfnetlink. */
3907 /* this avoids a loop in nfnetlink. */
3908 return err == -EAGAIN ? -ENOBUFS : err;
3911 /* called with rcu_read_lock held */
3912 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3913 struct sk_buff *skb, const struct nlmsghdr *nlh,
3914 const struct nlattr * const nla[],
3915 struct netlink_ext_ack *extack)
3917 u8 genmask = nft_genmask_cur(net);
3918 struct nft_set *set;
3919 struct nlattr *attr;
3923 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
3928 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
3930 return PTR_ERR(set);
3932 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3933 struct netlink_dump_control c = {
3934 .dump = nf_tables_dump_set,
3935 .done = nf_tables_dump_set_done,
3936 .module = THIS_MODULE,
3938 struct nft_set_dump_ctx *dump_ctx;
3940 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_ATOMIC);
3944 dump_ctx->set = set;
3945 dump_ctx->ctx = ctx;
3948 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3951 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3954 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3955 err = nft_get_set_elem(&ctx, set, attr);
3963 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3964 const struct nft_set *set,
3965 const struct nft_set_elem *elem,
3966 int event, u16 flags)
3968 struct net *net = ctx->net;
3969 u32 portid = ctx->portid;
3970 struct sk_buff *skb;
3973 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
3976 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3980 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3987 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3991 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3994 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3996 struct nft_set *set)
3998 struct nft_trans *trans;
4000 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4004 nft_trans_elem_set(trans) = set;
4008 void *nft_set_elem_init(const struct nft_set *set,
4009 const struct nft_set_ext_tmpl *tmpl,
4010 const u32 *key, const u32 *data,
4011 u64 timeout, gfp_t gfp)
4013 struct nft_set_ext *ext;
4016 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4020 ext = nft_set_elem_ext(set, elem);
4021 nft_set_ext_init(ext, tmpl);
4023 memcpy(nft_set_ext_key(ext), key, set->klen);
4024 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4025 memcpy(nft_set_ext_data(ext), data, set->dlen);
4026 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
4027 *nft_set_ext_expiration(ext) =
4028 get_jiffies_64() + timeout;
4029 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4030 *nft_set_ext_timeout(ext) = timeout;
4035 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4038 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4040 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
4041 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4042 nft_data_release(nft_set_ext_data(ext), set->dtype);
4043 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
4044 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
4045 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4046 (*nft_set_ext_obj(ext))->use--;
4049 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4051 /* Only called from commit path, nft_set_elem_deactivate() already deals with
4052 * the refcounting from the preparation phase.
4054 static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
4056 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4058 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
4059 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
4063 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4064 const struct nlattr *attr, u32 nlmsg_flags)
4066 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4067 u8 genmask = nft_genmask_next(ctx->net);
4068 struct nft_data_desc d1, d2;
4069 struct nft_set_ext_tmpl tmpl;
4070 struct nft_set_ext *ext, *ext2;
4071 struct nft_set_elem elem;
4072 struct nft_set_binding *binding;
4073 struct nft_object *obj = NULL;
4074 struct nft_userdata *udata;
4075 struct nft_data data;
4076 enum nft_registers dreg;
4077 struct nft_trans *trans;
4083 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4084 nft_set_elem_policy, NULL);
4088 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4091 nft_set_ext_prepare(&tmpl);
4093 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4097 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4099 if (set->flags & NFT_SET_MAP) {
4100 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
4101 !(flags & NFT_SET_ELEM_INTERVAL_END))
4103 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
4104 flags & NFT_SET_ELEM_INTERVAL_END)
4107 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4112 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4113 if (!(set->flags & NFT_SET_TIMEOUT))
4115 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4119 } else if (set->flags & NFT_SET_TIMEOUT) {
4120 timeout = set->timeout;
4123 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
4124 nla[NFTA_SET_ELEM_KEY]);
4128 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4131 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
4133 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4134 if (timeout != set->timeout)
4135 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4138 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4139 if (!(set->flags & NFT_SET_OBJECT)) {
4143 obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
4144 set->objtype, genmask);
4149 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4152 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
4153 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4154 nla[NFTA_SET_ELEM_DATA]);
4159 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4162 dreg = nft_type_to_reg(set->dtype);
4163 list_for_each_entry(binding, &set->bindings, list) {
4164 struct nft_ctx bind_ctx = {
4166 .family = ctx->family,
4167 .table = ctx->table,
4168 .chain = (struct nft_chain *)binding->chain,
4171 if (!(binding->flags & NFT_SET_MAP))
4174 err = nft_validate_register_store(&bind_ctx, dreg,
4180 if (d2.type == NFT_DATA_VERDICT &&
4181 (data.verdict.code == NFT_GOTO ||
4182 data.verdict.code == NFT_JUMP))
4183 nft_validate_state_update(ctx->net,
4187 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
4190 /* The full maximum length of userdata can exceed the maximum
4191 * offset value (U8_MAX) for following extensions, therefor it
4192 * must be the last extension added.
4195 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4196 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4198 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4203 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
4204 timeout, GFP_KERNEL);
4205 if (elem.priv == NULL)
4208 ext = nft_set_elem_ext(set, elem.priv);
4210 *nft_set_ext_flags(ext) = flags;
4212 udata = nft_set_ext_userdata(ext);
4213 udata->len = ulen - 1;
4214 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4217 *nft_set_ext_obj(ext) = obj;
4221 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4225 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
4226 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4228 if (err == -EEXIST) {
4229 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4230 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4231 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4232 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4236 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4237 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4238 memcmp(nft_set_ext_data(ext),
4239 nft_set_ext_data(ext2), set->dlen) != 0) ||
4240 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4241 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4242 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
4244 else if (!(nlmsg_flags & NLM_F_EXCL))
4251 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4256 nft_trans_elem(trans) = elem;
4257 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4261 set->ops->remove(ctx->net, set, &elem);
4267 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4268 nft_data_release(&data, d2.type);
4270 nft_data_release(&elem.key.val, d1.type);
4275 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4276 struct sk_buff *skb, const struct nlmsghdr *nlh,
4277 const struct nlattr * const nla[],
4278 struct netlink_ext_ack *extack)
4280 u8 genmask = nft_genmask_next(net);
4281 const struct nlattr *attr;
4282 struct nft_set *set;
4286 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4289 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4294 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4295 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4297 return PTR_ERR(set);
4299 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4302 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4303 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
4308 if (net->nft.validate_state == NFT_VALIDATE_DO)
4309 return nft_table_validate(net, ctx.table);
4315 * nft_data_hold - hold a nft_data item
4317 * @data: struct nft_data to release
4318 * @type: type of data
4320 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4321 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4322 * NFT_GOTO verdicts. This function must be called on active data objects
4323 * from the second phase of the commit protocol.
4325 void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4327 if (type == NFT_DATA_VERDICT) {
4328 switch (data->verdict.code) {
4331 data->verdict.chain->use++;
4337 static void nft_set_elem_activate(const struct net *net,
4338 const struct nft_set *set,
4339 struct nft_set_elem *elem)
4341 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4343 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4344 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4345 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4346 (*nft_set_ext_obj(ext))->use++;
4349 static void nft_set_elem_deactivate(const struct net *net,
4350 const struct nft_set *set,
4351 struct nft_set_elem *elem)
4353 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4355 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4356 nft_data_release(nft_set_ext_data(ext), set->dtype);
4357 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4358 (*nft_set_ext_obj(ext))->use--;
4361 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
4362 const struct nlattr *attr)
4364 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4365 struct nft_set_ext_tmpl tmpl;
4366 struct nft_data_desc desc;
4367 struct nft_set_elem elem;
4368 struct nft_set_ext *ext;
4369 struct nft_trans *trans;
4374 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4375 nft_set_elem_policy, NULL);
4380 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4383 nft_set_ext_prepare(&tmpl);
4385 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4389 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4391 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4392 nla[NFTA_SET_ELEM_KEY]);
4397 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4400 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4403 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4405 if (elem.priv == NULL)
4408 ext = nft_set_elem_ext(set, elem.priv);
4410 *nft_set_ext_flags(ext) = flags;
4412 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
4413 if (trans == NULL) {
4418 priv = set->ops->deactivate(ctx->net, set, &elem);
4426 nft_set_elem_deactivate(ctx->net, set, &elem);
4428 nft_trans_elem(trans) = elem;
4429 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4437 nft_data_release(&elem.key.val, desc.type);
4442 static int nft_flush_set(const struct nft_ctx *ctx,
4443 struct nft_set *set,
4444 const struct nft_set_iter *iter,
4445 struct nft_set_elem *elem)
4447 struct nft_trans *trans;
4450 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4451 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4455 if (!set->ops->flush(ctx->net, set, elem->priv)) {
4461 nft_trans_elem_set(trans) = set;
4462 nft_trans_elem(trans) = *elem;
4463 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4471 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4472 struct sk_buff *skb, const struct nlmsghdr *nlh,
4473 const struct nlattr * const nla[],
4474 struct netlink_ext_ack *extack)
4476 u8 genmask = nft_genmask_next(net);
4477 const struct nlattr *attr;
4478 struct nft_set *set;
4482 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4487 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
4489 return PTR_ERR(set);
4490 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4493 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
4494 struct nft_set_iter iter = {
4496 .fn = nft_flush_set,
4498 set->ops->walk(&ctx, set, &iter);
4503 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4504 err = nft_del_setelem(&ctx, set, attr);
4513 void nft_set_gc_batch_release(struct rcu_head *rcu)
4515 struct nft_set_gc_batch *gcb;
4518 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4519 for (i = 0; i < gcb->head.cnt; i++)
4520 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
4523 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4525 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4528 struct nft_set_gc_batch *gcb;
4530 gcb = kzalloc(sizeof(*gcb), gfp);
4533 gcb->head.set = set;
4536 EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4543 * nft_register_obj- register nf_tables stateful object type
4546 * Registers the object type for use with nf_tables. Returns zero on
4547 * success or a negative errno code otherwise.
4549 int nft_register_obj(struct nft_object_type *obj_type)
4551 if (obj_type->type == NFT_OBJECT_UNSPEC)
4554 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4555 list_add_rcu(&obj_type->list, &nf_tables_objects);
4556 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4559 EXPORT_SYMBOL_GPL(nft_register_obj);
4562 * nft_unregister_obj - unregister nf_tables object type
4565 * Unregisters the object type for use with nf_tables.
4567 void nft_unregister_obj(struct nft_object_type *obj_type)
4569 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4570 list_del_rcu(&obj_type->list);
4571 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4573 EXPORT_SYMBOL_GPL(nft_unregister_obj);
4575 struct nft_object *nft_obj_lookup(const struct nft_table *table,
4576 const struct nlattr *nla, u32 objtype,
4579 struct nft_object *obj;
4581 list_for_each_entry_rcu(obj, &table->objects, list) {
4582 if (!nla_strcmp(nla, obj->name) &&
4583 objtype == obj->ops->type->type &&
4584 nft_active_genmask(obj, genmask))
4587 return ERR_PTR(-ENOENT);
4589 EXPORT_SYMBOL_GPL(nft_obj_lookup);
4591 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4592 const struct nlattr *nla,
4593 u32 objtype, u8 genmask)
4595 struct nft_object *obj;
4597 list_for_each_entry(obj, &table->objects, list) {
4598 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4599 objtype == obj->ops->type->type &&
4600 nft_active_genmask(obj, genmask))
4603 return ERR_PTR(-ENOENT);
4606 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
4607 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4608 .len = NFT_TABLE_MAXNAMELEN - 1 },
4609 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4610 .len = NFT_OBJ_MAXNAMELEN - 1 },
4611 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4612 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4613 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
4616 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4617 const struct nft_object_type *type,
4618 const struct nlattr *attr)
4621 const struct nft_object_ops *ops;
4622 struct nft_object *obj;
4625 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4630 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4635 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4638 if (type->select_ops) {
4639 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4649 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
4653 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
4666 return ERR_PTR(err);
4669 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
4670 struct nft_object *obj, bool reset)
4672 struct nlattr *nest;
4674 nest = nla_nest_start(skb, attr);
4676 goto nla_put_failure;
4677 if (obj->ops->dump(skb, obj, reset) < 0)
4678 goto nla_put_failure;
4679 nla_nest_end(skb, nest);
4686 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4688 const struct nft_object_type *type;
4690 list_for_each_entry(type, &nf_tables_objects, list) {
4691 if (objtype == type->type)
4697 static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4699 const struct nft_object_type *type;
4701 type = __nft_obj_type_get(objtype);
4702 if (type != NULL && try_module_get(type->owner))
4705 #ifdef CONFIG_MODULES
4707 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4708 request_module("nft-obj-%u", objtype);
4709 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4710 if (__nft_obj_type_get(objtype))
4711 return ERR_PTR(-EAGAIN);
4714 return ERR_PTR(-ENOENT);
4717 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4718 struct sk_buff *skb, const struct nlmsghdr *nlh,
4719 const struct nlattr * const nla[],
4720 struct netlink_ext_ack *extack)
4722 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4723 const struct nft_object_type *type;
4724 u8 genmask = nft_genmask_next(net);
4725 int family = nfmsg->nfgen_family;
4726 struct nft_table *table;
4727 struct nft_object *obj;
4732 if (!nla[NFTA_OBJ_TYPE] ||
4733 !nla[NFTA_OBJ_NAME] ||
4734 !nla[NFTA_OBJ_DATA])
4737 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
4738 if (IS_ERR(table)) {
4739 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
4740 return PTR_ERR(table);
4743 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4744 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4747 if (err != -ENOENT) {
4748 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
4752 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4753 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
4759 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
4761 type = nft_obj_type_get(objtype);
4763 return PTR_ERR(type);
4765 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
4771 obj->handle = nf_tables_alloc_handle(table);
4773 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4779 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4783 list_add_tail_rcu(&obj->list, &table->objects);
4789 if (obj->ops->destroy)
4790 obj->ops->destroy(&ctx, obj);
4793 module_put(type->owner);
4797 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4798 u32 portid, u32 seq, int event, u32 flags,
4799 int family, const struct nft_table *table,
4800 struct nft_object *obj, bool reset)
4802 struct nfgenmsg *nfmsg;
4803 struct nlmsghdr *nlh;
4805 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4806 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4808 goto nla_put_failure;
4810 nfmsg = nlmsg_data(nlh);
4811 nfmsg->nfgen_family = family;
4812 nfmsg->version = NFNETLINK_V0;
4813 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4815 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4816 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
4817 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
4818 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
4819 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
4820 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
4822 goto nla_put_failure;
4824 nlmsg_end(skb, nlh);
4828 nlmsg_trim(skb, nlh);
4832 struct nft_obj_filter {
4837 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4839 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
4840 const struct nft_table *table;
4841 unsigned int idx = 0, s_idx = cb->args[0];
4842 struct nft_obj_filter *filter = cb->data;
4843 struct net *net = sock_net(skb->sk);
4844 int family = nfmsg->nfgen_family;
4845 struct nft_object *obj;
4848 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4852 cb->seq = net->nft.base_seq;
4854 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4855 if (family != NFPROTO_UNSPEC && family != table->family)
4858 list_for_each_entry_rcu(obj, &table->objects, list) {
4859 if (!nft_is_active(net, obj))
4864 memset(&cb->args[1], 0,
4865 sizeof(cb->args) - sizeof(cb->args[0]));
4866 if (filter && filter->table[0] &&
4867 strcmp(filter->table, table->name))
4870 filter->type != NFT_OBJECT_UNSPEC &&
4871 obj->ops->type->type != filter->type)
4874 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4877 NLM_F_MULTI | NLM_F_APPEND,
4878 table->family, table,
4882 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4894 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4896 struct nft_obj_filter *filter = cb->data;
4899 kfree(filter->table);
4906 static struct nft_obj_filter *
4907 nft_obj_filter_alloc(const struct nlattr * const nla[])
4909 struct nft_obj_filter *filter;
4911 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
4913 return ERR_PTR(-ENOMEM);
4915 if (nla[NFTA_OBJ_TABLE]) {
4916 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
4917 if (!filter->table) {
4919 return ERR_PTR(-ENOMEM);
4922 if (nla[NFTA_OBJ_TYPE])
4923 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4928 /* called with rcu_read_lock held */
4929 static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4930 struct sk_buff *skb, const struct nlmsghdr *nlh,
4931 const struct nlattr * const nla[],
4932 struct netlink_ext_ack *extack)
4934 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4935 u8 genmask = nft_genmask_cur(net);
4936 int family = nfmsg->nfgen_family;
4937 const struct nft_table *table;
4938 struct nft_object *obj;
4939 struct sk_buff *skb2;
4944 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4945 struct netlink_dump_control c = {
4946 .dump = nf_tables_dump_obj,
4947 .done = nf_tables_dump_obj_done,
4948 .module = THIS_MODULE,
4951 if (nla[NFTA_OBJ_TABLE] ||
4952 nla[NFTA_OBJ_TYPE]) {
4953 struct nft_obj_filter *filter;
4955 filter = nft_obj_filter_alloc(nla);
4961 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4964 if (!nla[NFTA_OBJ_NAME] ||
4965 !nla[NFTA_OBJ_TYPE])
4968 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
4969 if (IS_ERR(table)) {
4970 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
4971 return PTR_ERR(table);
4974 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4975 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4977 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
4978 return PTR_ERR(obj);
4981 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
4985 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4988 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
4989 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
4990 family, table, obj, reset);
4994 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5000 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
5002 if (obj->ops->destroy)
5003 obj->ops->destroy(ctx, obj);
5005 module_put(obj->ops->type->owner);
5010 static int nf_tables_delobj(struct net *net, struct sock *nlsk,
5011 struct sk_buff *skb, const struct nlmsghdr *nlh,
5012 const struct nlattr * const nla[],
5013 struct netlink_ext_ack *extack)
5015 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5016 u8 genmask = nft_genmask_next(net);
5017 int family = nfmsg->nfgen_family;
5018 const struct nlattr *attr;
5019 struct nft_table *table;
5020 struct nft_object *obj;
5024 if (!nla[NFTA_OBJ_TYPE] ||
5025 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
5028 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
5029 if (IS_ERR(table)) {
5030 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
5031 return PTR_ERR(table);
5034 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5035 if (nla[NFTA_OBJ_HANDLE]) {
5036 attr = nla[NFTA_OBJ_HANDLE];
5037 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5039 attr = nla[NFTA_OBJ_NAME];
5040 obj = nft_obj_lookup(table, attr, objtype, genmask);
5044 NL_SET_BAD_ATTR(extack, attr);
5045 return PTR_ERR(obj);
5048 NL_SET_BAD_ATTR(extack, attr);
5052 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5054 return nft_delobj(&ctx, obj);
5057 void nft_obj_notify(struct net *net, struct nft_table *table,
5058 struct nft_object *obj, u32 portid, u32 seq, int event,
5059 int family, int report, gfp_t gfp)
5061 struct sk_buff *skb;
5065 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5068 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
5072 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5079 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5082 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
5084 EXPORT_SYMBOL_GPL(nft_obj_notify);
5086 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5087 struct nft_object *obj, int event)
5089 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
5090 ctx->family, ctx->report, GFP_KERNEL);
5096 void nft_register_flowtable_type(struct nf_flowtable_type *type)
5098 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5099 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5100 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5102 EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5104 void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5106 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5107 list_del_rcu(&type->list);
5108 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5110 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5112 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5113 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
5114 .len = NFT_NAME_MAXLEN - 1 },
5115 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
5116 .len = NFT_NAME_MAXLEN - 1 },
5117 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
5118 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
5121 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5122 const struct nlattr *nla, u8 genmask)
5124 struct nft_flowtable *flowtable;
5126 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5127 if (!nla_strcmp(nla, flowtable->name) &&
5128 nft_active_genmask(flowtable, genmask))
5131 return ERR_PTR(-ENOENT);
5133 EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
5135 static struct nft_flowtable *
5136 nft_flowtable_lookup_byhandle(const struct nft_table *table,
5137 const struct nlattr *nla, u8 genmask)
5139 struct nft_flowtable *flowtable;
5141 list_for_each_entry(flowtable, &table->flowtables, list) {
5142 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5143 nft_active_genmask(flowtable, genmask))
5146 return ERR_PTR(-ENOENT);
5149 static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5150 const struct nlattr *attr,
5151 struct net_device *dev_array[], int *len)
5153 const struct nlattr *tmp;
5154 struct net_device *dev;
5155 char ifname[IFNAMSIZ];
5156 int rem, n = 0, err;
5158 nla_for_each_nested(tmp, attr, rem) {
5159 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5164 nla_strlcpy(ifname, tmp, IFNAMSIZ);
5165 dev = __dev_get_by_name(ctx->net, ifname);
5171 dev_array[n++] = dev;
5172 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5186 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5187 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5188 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5189 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5192 static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5193 const struct nlattr *attr,
5194 struct nft_flowtable *flowtable)
5196 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5197 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5198 struct nf_hook_ops *ops;
5199 int hooknum, priority;
5202 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5203 nft_flowtable_hook_policy, NULL);
5207 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5208 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5209 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5212 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
5213 if (hooknum != NF_NETDEV_INGRESS)
5216 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5218 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5223 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
5227 flowtable->hooknum = hooknum;
5228 flowtable->priority = priority;
5229 flowtable->ops = ops;
5230 flowtable->ops_len = n;
5232 for (i = 0; i < n; i++) {
5233 flowtable->ops[i].pf = NFPROTO_NETDEV;
5234 flowtable->ops[i].hooknum = hooknum;
5235 flowtable->ops[i].priority = priority;
5236 flowtable->ops[i].priv = &flowtable->data;
5237 flowtable->ops[i].hook = flowtable->data.type->hook;
5238 flowtable->ops[i].dev = dev_array[i];
5239 flowtable->dev_name[i] = kstrdup(dev_array[i]->name,
5246 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
5248 const struct nf_flowtable_type *type;
5250 list_for_each_entry(type, &nf_tables_flowtables, list) {
5251 if (family == type->family)
5257 static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
5259 const struct nf_flowtable_type *type;
5261 type = __nft_flowtable_type_get(family);
5262 if (type != NULL && try_module_get(type->owner))
5265 #ifdef CONFIG_MODULES
5267 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5268 request_module("nf-flowtable-%u", family);
5269 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5270 if (__nft_flowtable_type_get(family))
5271 return ERR_PTR(-EAGAIN);
5274 return ERR_PTR(-ENOENT);
5277 static void nft_unregister_flowtable_net_hooks(struct net *net,
5278 struct nft_flowtable *flowtable)
5282 for (i = 0; i < flowtable->ops_len; i++) {
5283 if (!flowtable->ops[i].dev)
5286 nf_unregister_net_hook(net, &flowtable->ops[i]);
5290 static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5291 struct sk_buff *skb,
5292 const struct nlmsghdr *nlh,
5293 const struct nlattr * const nla[],
5294 struct netlink_ext_ack *extack)
5296 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5297 const struct nf_flowtable_type *type;
5298 struct nft_flowtable *flowtable, *ft;
5299 u8 genmask = nft_genmask_next(net);
5300 int family = nfmsg->nfgen_family;
5301 struct nft_table *table;
5305 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5306 !nla[NFTA_FLOWTABLE_NAME] ||
5307 !nla[NFTA_FLOWTABLE_HOOK])
5310 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5312 if (IS_ERR(table)) {
5313 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
5314 return PTR_ERR(table);
5317 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5319 if (IS_ERR(flowtable)) {
5320 err = PTR_ERR(flowtable);
5321 if (err != -ENOENT) {
5322 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
5326 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5327 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
5334 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5336 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5340 flowtable->table = table;
5341 flowtable->handle = nf_tables_alloc_handle(table);
5343 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5344 if (!flowtable->name) {
5349 type = nft_flowtable_type_get(family);
5351 err = PTR_ERR(type);
5355 flowtable->data.type = type;
5356 err = type->init(&flowtable->data);
5360 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5365 for (i = 0; i < flowtable->ops_len; i++) {
5366 if (!flowtable->ops[i].dev)
5369 list_for_each_entry(ft, &table->flowtables, list) {
5370 for (k = 0; k < ft->ops_len; k++) {
5371 if (!ft->ops[k].dev)
5374 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5375 flowtable->ops[i].pf == ft->ops[k].pf) {
5382 err = nf_register_net_hook(net, &flowtable->ops[i]);
5387 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5391 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5396 i = flowtable->ops_len;
5398 for (k = i - 1; k >= 0; k--) {
5399 kfree(flowtable->dev_name[k]);
5400 nf_unregister_net_hook(net, &flowtable->ops[k]);
5403 kfree(flowtable->ops);
5405 flowtable->data.type->free(&flowtable->data);
5407 module_put(type->owner);
5409 kfree(flowtable->name);
5415 static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5416 struct sk_buff *skb,
5417 const struct nlmsghdr *nlh,
5418 const struct nlattr * const nla[],
5419 struct netlink_ext_ack *extack)
5421 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5422 u8 genmask = nft_genmask_next(net);
5423 int family = nfmsg->nfgen_family;
5424 struct nft_flowtable *flowtable;
5425 const struct nlattr *attr;
5426 struct nft_table *table;
5429 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5430 (!nla[NFTA_FLOWTABLE_NAME] &&
5431 !nla[NFTA_FLOWTABLE_HANDLE]))
5434 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5436 if (IS_ERR(table)) {
5437 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
5438 return PTR_ERR(table);
5441 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5442 attr = nla[NFTA_FLOWTABLE_HANDLE];
5443 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5445 attr = nla[NFTA_FLOWTABLE_NAME];
5446 flowtable = nft_flowtable_lookup(table, attr, genmask);
5449 if (IS_ERR(flowtable)) {
5450 NL_SET_BAD_ATTR(extack, attr);
5451 return PTR_ERR(flowtable);
5453 if (flowtable->use > 0) {
5454 NL_SET_BAD_ATTR(extack, attr);
5458 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5460 return nft_delflowtable(&ctx, flowtable);
5463 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5464 u32 portid, u32 seq, int event,
5465 u32 flags, int family,
5466 struct nft_flowtable *flowtable)
5468 struct nlattr *nest, *nest_devs;
5469 struct nfgenmsg *nfmsg;
5470 struct nlmsghdr *nlh;
5473 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5474 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5476 goto nla_put_failure;
5478 nfmsg = nlmsg_data(nlh);
5479 nfmsg->nfgen_family = family;
5480 nfmsg->version = NFNETLINK_V0;
5481 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5483 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5484 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
5485 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5486 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5487 NFTA_FLOWTABLE_PAD))
5488 goto nla_put_failure;
5490 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5491 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5492 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5493 goto nla_put_failure;
5495 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5497 goto nla_put_failure;
5499 for (i = 0; i < flowtable->ops_len; i++) {
5500 if (flowtable->dev_name[i][0] &&
5501 nla_put_string(skb, NFTA_DEVICE_NAME,
5502 flowtable->dev_name[i]))
5503 goto nla_put_failure;
5505 nla_nest_end(skb, nest_devs);
5506 nla_nest_end(skb, nest);
5508 nlmsg_end(skb, nlh);
5512 nlmsg_trim(skb, nlh);
5516 struct nft_flowtable_filter {
5520 static int nf_tables_dump_flowtable(struct sk_buff *skb,
5521 struct netlink_callback *cb)
5523 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5524 struct nft_flowtable_filter *filter = cb->data;
5525 unsigned int idx = 0, s_idx = cb->args[0];
5526 struct net *net = sock_net(skb->sk);
5527 int family = nfmsg->nfgen_family;
5528 struct nft_flowtable *flowtable;
5529 const struct nft_table *table;
5532 cb->seq = net->nft.base_seq;
5534 list_for_each_entry_rcu(table, &net->nft.tables, list) {
5535 if (family != NFPROTO_UNSPEC && family != table->family)
5538 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5539 if (!nft_is_active(net, flowtable))
5544 memset(&cb->args[1], 0,
5545 sizeof(cb->args) - sizeof(cb->args[0]));
5546 if (filter && filter->table[0] &&
5547 strcmp(filter->table, table->name))
5550 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5552 NFT_MSG_NEWFLOWTABLE,
5553 NLM_F_MULTI | NLM_F_APPEND,
5554 table->family, flowtable) < 0)
5557 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
5569 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
5571 struct nft_flowtable_filter *filter = cb->data;
5576 kfree(filter->table);
5582 static struct nft_flowtable_filter *
5583 nft_flowtable_filter_alloc(const struct nlattr * const nla[])
5585 struct nft_flowtable_filter *filter;
5587 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5589 return ERR_PTR(-ENOMEM);
5591 if (nla[NFTA_FLOWTABLE_TABLE]) {
5592 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5594 if (!filter->table) {
5596 return ERR_PTR(-ENOMEM);
5602 /* called with rcu_read_lock held */
5603 static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5604 struct sk_buff *skb,
5605 const struct nlmsghdr *nlh,
5606 const struct nlattr * const nla[],
5607 struct netlink_ext_ack *extack)
5609 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5610 u8 genmask = nft_genmask_cur(net);
5611 int family = nfmsg->nfgen_family;
5612 struct nft_flowtable *flowtable;
5613 const struct nft_table *table;
5614 struct sk_buff *skb2;
5617 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5618 struct netlink_dump_control c = {
5619 .dump = nf_tables_dump_flowtable,
5620 .done = nf_tables_dump_flowtable_done,
5621 .module = THIS_MODULE,
5624 if (nla[NFTA_FLOWTABLE_TABLE]) {
5625 struct nft_flowtable_filter *filter;
5627 filter = nft_flowtable_filter_alloc(nla);
5633 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
5636 if (!nla[NFTA_FLOWTABLE_NAME])
5639 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5642 return PTR_ERR(table);
5644 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5646 if (IS_ERR(flowtable))
5647 return PTR_ERR(flowtable);
5649 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
5653 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5655 NFT_MSG_NEWFLOWTABLE, 0, family,
5660 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5666 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5667 struct nft_flowtable *flowtable,
5670 struct sk_buff *skb;
5674 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5677 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5681 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5683 ctx->family, flowtable);
5689 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5690 ctx->report, GFP_KERNEL);
5693 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5696 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5698 kfree(flowtable->ops);
5699 kfree(flowtable->name);
5700 flowtable->data.type->free(&flowtable->data);
5701 module_put(flowtable->data.type->owner);
5704 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5705 u32 portid, u32 seq)
5707 struct nlmsghdr *nlh;
5708 struct nfgenmsg *nfmsg;
5709 char buf[TASK_COMM_LEN];
5710 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
5712 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5714 goto nla_put_failure;
5716 nfmsg = nlmsg_data(nlh);
5717 nfmsg->nfgen_family = AF_UNSPEC;
5718 nfmsg->version = NFNETLINK_V0;
5719 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5721 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5722 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5723 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
5724 goto nla_put_failure;
5726 nlmsg_end(skb, nlh);
5730 nlmsg_trim(skb, nlh);
5734 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5735 struct nft_flowtable *flowtable)
5739 for (i = 0; i < flowtable->ops_len; i++) {
5740 if (flowtable->ops[i].dev != dev)
5743 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
5744 flowtable->dev_name[i][0] = '\0';
5745 flowtable->ops[i].dev = NULL;
5750 static int nf_tables_flowtable_event(struct notifier_block *this,
5751 unsigned long event, void *ptr)
5753 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5754 struct nft_flowtable *flowtable;
5755 struct nft_table *table;
5757 if (event != NETDEV_UNREGISTER)
5760 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5761 list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
5762 list_for_each_entry(flowtable, &table->flowtables, list) {
5763 nft_flowtable_event(event, dev, flowtable);
5766 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5771 static struct notifier_block nf_tables_flowtable_notifier = {
5772 .notifier_call = nf_tables_flowtable_event,
5775 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5778 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5779 struct sk_buff *skb2;
5782 if (nlmsg_report(nlh) &&
5783 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5786 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5790 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5797 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5798 nlmsg_report(nlh), GFP_KERNEL);
5801 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5805 static int nf_tables_getgen(struct net *net, struct sock *nlsk,
5806 struct sk_buff *skb, const struct nlmsghdr *nlh,
5807 const struct nlattr * const nla[],
5808 struct netlink_ext_ack *extack)
5810 struct sk_buff *skb2;
5813 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
5817 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5822 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5828 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
5829 [NFT_MSG_NEWTABLE] = {
5830 .call_batch = nf_tables_newtable,
5831 .attr_count = NFTA_TABLE_MAX,
5832 .policy = nft_table_policy,
5834 [NFT_MSG_GETTABLE] = {
5835 .call_rcu = nf_tables_gettable,
5836 .attr_count = NFTA_TABLE_MAX,
5837 .policy = nft_table_policy,
5839 [NFT_MSG_DELTABLE] = {
5840 .call_batch = nf_tables_deltable,
5841 .attr_count = NFTA_TABLE_MAX,
5842 .policy = nft_table_policy,
5844 [NFT_MSG_NEWCHAIN] = {
5845 .call_batch = nf_tables_newchain,
5846 .attr_count = NFTA_CHAIN_MAX,
5847 .policy = nft_chain_policy,
5849 [NFT_MSG_GETCHAIN] = {
5850 .call_rcu = nf_tables_getchain,
5851 .attr_count = NFTA_CHAIN_MAX,
5852 .policy = nft_chain_policy,
5854 [NFT_MSG_DELCHAIN] = {
5855 .call_batch = nf_tables_delchain,
5856 .attr_count = NFTA_CHAIN_MAX,
5857 .policy = nft_chain_policy,
5859 [NFT_MSG_NEWRULE] = {
5860 .call_batch = nf_tables_newrule,
5861 .attr_count = NFTA_RULE_MAX,
5862 .policy = nft_rule_policy,
5864 [NFT_MSG_GETRULE] = {
5865 .call_rcu = nf_tables_getrule,
5866 .attr_count = NFTA_RULE_MAX,
5867 .policy = nft_rule_policy,
5869 [NFT_MSG_DELRULE] = {
5870 .call_batch = nf_tables_delrule,
5871 .attr_count = NFTA_RULE_MAX,
5872 .policy = nft_rule_policy,
5874 [NFT_MSG_NEWSET] = {
5875 .call_batch = nf_tables_newset,
5876 .attr_count = NFTA_SET_MAX,
5877 .policy = nft_set_policy,
5879 [NFT_MSG_GETSET] = {
5880 .call_rcu = nf_tables_getset,
5881 .attr_count = NFTA_SET_MAX,
5882 .policy = nft_set_policy,
5884 [NFT_MSG_DELSET] = {
5885 .call_batch = nf_tables_delset,
5886 .attr_count = NFTA_SET_MAX,
5887 .policy = nft_set_policy,
5889 [NFT_MSG_NEWSETELEM] = {
5890 .call_batch = nf_tables_newsetelem,
5891 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5892 .policy = nft_set_elem_list_policy,
5894 [NFT_MSG_GETSETELEM] = {
5895 .call_rcu = nf_tables_getsetelem,
5896 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5897 .policy = nft_set_elem_list_policy,
5899 [NFT_MSG_DELSETELEM] = {
5900 .call_batch = nf_tables_delsetelem,
5901 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5902 .policy = nft_set_elem_list_policy,
5904 [NFT_MSG_GETGEN] = {
5905 .call_rcu = nf_tables_getgen,
5907 [NFT_MSG_NEWOBJ] = {
5908 .call_batch = nf_tables_newobj,
5909 .attr_count = NFTA_OBJ_MAX,
5910 .policy = nft_obj_policy,
5912 [NFT_MSG_GETOBJ] = {
5913 .call_rcu = nf_tables_getobj,
5914 .attr_count = NFTA_OBJ_MAX,
5915 .policy = nft_obj_policy,
5917 [NFT_MSG_DELOBJ] = {
5918 .call_batch = nf_tables_delobj,
5919 .attr_count = NFTA_OBJ_MAX,
5920 .policy = nft_obj_policy,
5922 [NFT_MSG_GETOBJ_RESET] = {
5923 .call_rcu = nf_tables_getobj,
5924 .attr_count = NFTA_OBJ_MAX,
5925 .policy = nft_obj_policy,
5927 [NFT_MSG_NEWFLOWTABLE] = {
5928 .call_batch = nf_tables_newflowtable,
5929 .attr_count = NFTA_FLOWTABLE_MAX,
5930 .policy = nft_flowtable_policy,
5932 [NFT_MSG_GETFLOWTABLE] = {
5933 .call_rcu = nf_tables_getflowtable,
5934 .attr_count = NFTA_FLOWTABLE_MAX,
5935 .policy = nft_flowtable_policy,
5937 [NFT_MSG_DELFLOWTABLE] = {
5938 .call_batch = nf_tables_delflowtable,
5939 .attr_count = NFTA_FLOWTABLE_MAX,
5940 .policy = nft_flowtable_policy,
5944 static int nf_tables_validate(struct net *net)
5946 struct nft_table *table;
5948 switch (net->nft.validate_state) {
5949 case NFT_VALIDATE_SKIP:
5951 case NFT_VALIDATE_NEED:
5952 nft_validate_state_update(net, NFT_VALIDATE_DO);
5954 case NFT_VALIDATE_DO:
5955 list_for_each_entry(table, &net->nft.tables, list) {
5956 if (nft_table_validate(net, table) < 0)
5965 static void nft_chain_commit_update(struct nft_trans *trans)
5967 struct nft_base_chain *basechain;
5969 if (nft_trans_chain_name(trans))
5970 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
5972 if (!nft_is_base_chain(trans->ctx.chain))
5975 basechain = nft_base_chain(trans->ctx.chain);
5976 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5978 switch (nft_trans_chain_policy(trans)) {
5981 basechain->policy = nft_trans_chain_policy(trans);
5986 static void nft_commit_release(struct nft_trans *trans)
5988 switch (trans->msg_type) {
5989 case NFT_MSG_DELTABLE:
5990 nf_tables_table_destroy(&trans->ctx);
5992 case NFT_MSG_DELCHAIN:
5993 nf_tables_chain_destroy(&trans->ctx);
5995 case NFT_MSG_DELRULE:
5996 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
5998 case NFT_MSG_DELSET:
5999 nft_set_destroy(nft_trans_set(trans));
6001 case NFT_MSG_DELSETELEM:
6002 nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
6003 nft_trans_elem(trans).priv);
6005 case NFT_MSG_DELOBJ:
6006 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
6008 case NFT_MSG_DELFLOWTABLE:
6009 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6015 static void nf_tables_commit_release(struct net *net)
6017 struct nft_trans *trans, *next;
6019 if (list_empty(&net->nft.commit_list))
6024 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6025 list_del(&trans->list);
6026 nft_commit_release(trans);
6030 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6032 struct nft_rule *rule;
6033 unsigned int alloc = 0;
6036 /* already handled or inactive chain? */
6037 if (chain->rules_next || !nft_is_active_next(net, chain))
6040 rule = list_entry(&chain->rules, struct nft_rule, list);
6043 list_for_each_entry_continue(rule, &chain->rules, list) {
6044 if (nft_is_active_next(net, rule))
6048 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6049 if (!chain->rules_next)
6052 list_for_each_entry_continue(rule, &chain->rules, list) {
6053 if (nft_is_active_next(net, rule))
6054 chain->rules_next[i++] = rule;
6057 chain->rules_next[i] = NULL;
6061 static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6063 struct nft_trans *trans, *next;
6065 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6066 struct nft_chain *chain = trans->ctx.chain;
6068 if (trans->msg_type == NFT_MSG_NEWRULE ||
6069 trans->msg_type == NFT_MSG_DELRULE) {
6070 kvfree(chain->rules_next);
6071 chain->rules_next = NULL;
6076 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6078 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6083 static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6085 struct nft_rule **r = rules;
6086 struct nft_rules_old *old;
6091 r++; /* rcu_head is after end marker */
6095 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6098 static void nf_tables_commit_chain_active(struct net *net, struct nft_chain *chain)
6100 struct nft_rule **g0, **g1;
6103 next_genbit = nft_gencursor_next(net);
6105 g0 = rcu_dereference_protected(chain->rules_gen_0,
6106 lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
6107 g1 = rcu_dereference_protected(chain->rules_gen_1,
6108 lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
6110 /* No changes to this chain? */
6111 if (chain->rules_next == NULL) {
6112 /* chain had no change in last or next generation */
6116 * chain had no change in this generation; make sure next
6117 * one uses same rules as current generation.
6120 rcu_assign_pointer(chain->rules_gen_1, g0);
6121 nf_tables_commit_chain_free_rules_old(g1);
6123 rcu_assign_pointer(chain->rules_gen_0, g1);
6124 nf_tables_commit_chain_free_rules_old(g0);
6131 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6133 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6135 chain->rules_next = NULL;
6141 nf_tables_commit_chain_free_rules_old(g1);
6143 nf_tables_commit_chain_free_rules_old(g0);
6146 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
6148 struct nft_trans *trans, *next;
6149 struct nft_trans_elem *te;
6150 struct nft_chain *chain;
6151 struct nft_table *table;
6153 /* 0. Validate ruleset, otherwise roll back for error reporting. */
6154 if (nf_tables_validate(net) < 0)
6157 /* 1. Allocate space for next generation rules_gen_X[] */
6158 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6161 if (trans->msg_type == NFT_MSG_NEWRULE ||
6162 trans->msg_type == NFT_MSG_DELRULE) {
6163 chain = trans->ctx.chain;
6165 ret = nf_tables_commit_chain_prepare(net, chain);
6167 nf_tables_commit_chain_prepare_cancel(net);
6173 /* step 2. Make rules_gen_X visible to packet path */
6174 list_for_each_entry(table, &net->nft.tables, list) {
6175 list_for_each_entry(chain, &table->chains, list) {
6176 if (!nft_is_active_next(net, chain))
6178 nf_tables_commit_chain_active(net, chain);
6183 * Bump generation counter, invalidate any dump in progress.
6184 * Cannot fail after this point.
6186 while (++net->nft.base_seq == 0);
6188 /* step 3. Start new generation, rules_gen_X now in use. */
6189 net->nft.gencursor = nft_gencursor_next(net);
6191 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6192 switch (trans->msg_type) {
6193 case NFT_MSG_NEWTABLE:
6194 if (nft_trans_table_update(trans)) {
6195 if (!nft_trans_table_enable(trans)) {
6196 nf_tables_table_disable(net,
6198 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6201 nft_clear(net, trans->ctx.table);
6203 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
6204 nft_trans_destroy(trans);
6206 case NFT_MSG_DELTABLE:
6207 list_del_rcu(&trans->ctx.table->list);
6208 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
6210 case NFT_MSG_NEWCHAIN:
6211 if (nft_trans_chain_update(trans))
6212 nft_chain_commit_update(trans);
6214 nft_clear(net, trans->ctx.chain);
6216 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6217 nft_trans_destroy(trans);
6219 case NFT_MSG_DELCHAIN:
6220 list_del_rcu(&trans->ctx.chain->list);
6221 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
6222 nf_tables_unregister_hook(trans->ctx.net,
6226 case NFT_MSG_NEWRULE:
6227 nft_clear(trans->ctx.net, nft_trans_rule(trans));
6228 nf_tables_rule_notify(&trans->ctx,
6229 nft_trans_rule(trans),
6231 nft_trans_destroy(trans);
6233 case NFT_MSG_DELRULE:
6234 list_del_rcu(&nft_trans_rule(trans)->list);
6235 nf_tables_rule_notify(&trans->ctx,
6236 nft_trans_rule(trans),
6239 case NFT_MSG_NEWSET:
6240 nft_clear(net, nft_trans_set(trans));
6241 /* This avoids hitting -EBUSY when deleting the table
6242 * from the transaction.
6244 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
6245 !list_empty(&nft_trans_set(trans)->bindings))
6246 trans->ctx.table->use--;
6248 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
6249 NFT_MSG_NEWSET, GFP_KERNEL);
6250 nft_trans_destroy(trans);
6252 case NFT_MSG_DELSET:
6253 list_del_rcu(&nft_trans_set(trans)->list);
6254 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
6255 NFT_MSG_DELSET, GFP_KERNEL);
6257 case NFT_MSG_NEWSETELEM:
6258 te = (struct nft_trans_elem *)trans->data;
6260 te->set->ops->activate(net, te->set, &te->elem);
6261 nf_tables_setelem_notify(&trans->ctx, te->set,
6263 NFT_MSG_NEWSETELEM, 0);
6264 nft_trans_destroy(trans);
6266 case NFT_MSG_DELSETELEM:
6267 te = (struct nft_trans_elem *)trans->data;
6269 nf_tables_setelem_notify(&trans->ctx, te->set,
6271 NFT_MSG_DELSETELEM, 0);
6272 te->set->ops->remove(net, te->set, &te->elem);
6273 atomic_dec(&te->set->nelems);
6276 case NFT_MSG_NEWOBJ:
6277 nft_clear(net, nft_trans_obj(trans));
6278 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6280 nft_trans_destroy(trans);
6282 case NFT_MSG_DELOBJ:
6283 list_del_rcu(&nft_trans_obj(trans)->list);
6284 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6287 case NFT_MSG_NEWFLOWTABLE:
6288 nft_clear(net, nft_trans_flowtable(trans));
6289 nf_tables_flowtable_notify(&trans->ctx,
6290 nft_trans_flowtable(trans),
6291 NFT_MSG_NEWFLOWTABLE);
6292 nft_trans_destroy(trans);
6294 case NFT_MSG_DELFLOWTABLE:
6295 list_del_rcu(&nft_trans_flowtable(trans)->list);
6296 nf_tables_flowtable_notify(&trans->ctx,
6297 nft_trans_flowtable(trans),
6298 NFT_MSG_DELFLOWTABLE);
6299 nft_unregister_flowtable_net_hooks(net,
6300 nft_trans_flowtable(trans));
6305 nf_tables_commit_release(net);
6306 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
6311 static void nf_tables_abort_release(struct nft_trans *trans)
6313 switch (trans->msg_type) {
6314 case NFT_MSG_NEWTABLE:
6315 nf_tables_table_destroy(&trans->ctx);
6317 case NFT_MSG_NEWCHAIN:
6318 nf_tables_chain_destroy(&trans->ctx);
6320 case NFT_MSG_NEWRULE:
6321 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6323 case NFT_MSG_NEWSET:
6324 nft_set_destroy(nft_trans_set(trans));
6326 case NFT_MSG_NEWSETELEM:
6327 nft_set_elem_destroy(nft_trans_elem_set(trans),
6328 nft_trans_elem(trans).priv, true);
6330 case NFT_MSG_NEWOBJ:
6331 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
6333 case NFT_MSG_NEWFLOWTABLE:
6334 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6340 static int nf_tables_abort(struct net *net, struct sk_buff *skb)
6342 struct nft_trans *trans, *next;
6343 struct nft_trans_elem *te;
6345 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6347 switch (trans->msg_type) {
6348 case NFT_MSG_NEWTABLE:
6349 if (nft_trans_table_update(trans)) {
6350 if (nft_trans_table_enable(trans)) {
6351 nf_tables_table_disable(net,
6353 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6355 nft_trans_destroy(trans);
6357 list_del_rcu(&trans->ctx.table->list);
6360 case NFT_MSG_DELTABLE:
6361 nft_clear(trans->ctx.net, trans->ctx.table);
6362 nft_trans_destroy(trans);
6364 case NFT_MSG_NEWCHAIN:
6365 if (nft_trans_chain_update(trans)) {
6366 free_percpu(nft_trans_chain_stats(trans));
6368 nft_trans_destroy(trans);
6370 trans->ctx.table->use--;
6371 list_del_rcu(&trans->ctx.chain->list);
6372 nf_tables_unregister_hook(trans->ctx.net,
6377 case NFT_MSG_DELCHAIN:
6378 trans->ctx.table->use++;
6379 nft_clear(trans->ctx.net, trans->ctx.chain);
6380 nft_trans_destroy(trans);
6382 case NFT_MSG_NEWRULE:
6383 trans->ctx.chain->use--;
6384 list_del_rcu(&nft_trans_rule(trans)->list);
6385 nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
6387 case NFT_MSG_DELRULE:
6388 trans->ctx.chain->use++;
6389 nft_clear(trans->ctx.net, nft_trans_rule(trans));
6390 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
6391 nft_trans_destroy(trans);
6393 case NFT_MSG_NEWSET:
6394 trans->ctx.table->use--;
6395 list_del_rcu(&nft_trans_set(trans)->list);
6397 case NFT_MSG_DELSET:
6398 trans->ctx.table->use++;
6399 nft_clear(trans->ctx.net, nft_trans_set(trans));
6400 nft_trans_destroy(trans);
6402 case NFT_MSG_NEWSETELEM:
6403 te = (struct nft_trans_elem *)trans->data;
6405 te->set->ops->remove(net, te->set, &te->elem);
6406 atomic_dec(&te->set->nelems);
6408 case NFT_MSG_DELSETELEM:
6409 te = (struct nft_trans_elem *)trans->data;
6411 nft_set_elem_activate(net, te->set, &te->elem);
6412 te->set->ops->activate(net, te->set, &te->elem);
6415 nft_trans_destroy(trans);
6417 case NFT_MSG_NEWOBJ:
6418 trans->ctx.table->use--;
6419 list_del_rcu(&nft_trans_obj(trans)->list);
6421 case NFT_MSG_DELOBJ:
6422 trans->ctx.table->use++;
6423 nft_clear(trans->ctx.net, nft_trans_obj(trans));
6424 nft_trans_destroy(trans);
6426 case NFT_MSG_NEWFLOWTABLE:
6427 trans->ctx.table->use--;
6428 list_del_rcu(&nft_trans_flowtable(trans)->list);
6429 nft_unregister_flowtable_net_hooks(net,
6430 nft_trans_flowtable(trans));
6432 case NFT_MSG_DELFLOWTABLE:
6433 trans->ctx.table->use++;
6434 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6435 nft_trans_destroy(trans);
6442 list_for_each_entry_safe_reverse(trans, next,
6443 &net->nft.commit_list, list) {
6444 list_del(&trans->list);
6445 nf_tables_abort_release(trans);
6451 static void nf_tables_cleanup(struct net *net)
6453 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
6456 static bool nf_tables_valid_genid(struct net *net, u32 genid)
6458 return net->nft.base_seq == genid;
6461 static const struct nfnetlink_subsystem nf_tables_subsys = {
6462 .name = "nf_tables",
6463 .subsys_id = NFNL_SUBSYS_NFTABLES,
6464 .cb_count = NFT_MSG_MAX,
6466 .commit = nf_tables_commit,
6467 .abort = nf_tables_abort,
6468 .cleanup = nf_tables_cleanup,
6469 .valid_genid = nf_tables_valid_genid,
6472 int nft_chain_validate_dependency(const struct nft_chain *chain,
6473 enum nft_chain_types type)
6475 const struct nft_base_chain *basechain;
6477 if (nft_is_base_chain(chain)) {
6478 basechain = nft_base_chain(chain);
6479 if (basechain->type->type != type)
6484 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6486 int nft_chain_validate_hooks(const struct nft_chain *chain,
6487 unsigned int hook_flags)
6489 struct nft_base_chain *basechain;
6491 if (nft_is_base_chain(chain)) {
6492 basechain = nft_base_chain(chain);
6494 if ((1 << basechain->ops.hooknum) & hook_flags)
6502 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6505 * Loop detection - walk through the ruleset beginning at the destination chain
6506 * of a new jump until either the source chain is reached (loop) or all
6507 * reachable chains have been traversed.
6509 * The loop check is performed whenever a new jump verdict is added to an
6510 * expression or verdict map or a verdict map is bound to a new chain.
6513 static int nf_tables_check_loops(const struct nft_ctx *ctx,
6514 const struct nft_chain *chain);
6516 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
6517 struct nft_set *set,
6518 const struct nft_set_iter *iter,
6519 struct nft_set_elem *elem)
6521 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6522 const struct nft_data *data;
6524 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6525 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
6528 data = nft_set_ext_data(ext);
6529 switch (data->verdict.code) {
6532 return nf_tables_check_loops(ctx, data->verdict.chain);
6538 static int nf_tables_check_loops(const struct nft_ctx *ctx,
6539 const struct nft_chain *chain)
6541 const struct nft_rule *rule;
6542 const struct nft_expr *expr, *last;
6543 struct nft_set *set;
6544 struct nft_set_binding *binding;
6545 struct nft_set_iter iter;
6547 if (ctx->chain == chain)
6550 list_for_each_entry(rule, &chain->rules, list) {
6551 nft_rule_for_each_expr(expr, last, rule) {
6552 struct nft_immediate_expr *priv;
6553 const struct nft_data *data;
6556 if (strcmp(expr->ops->type->name, "immediate"))
6559 priv = nft_expr_priv(expr);
6560 if (priv->dreg != NFT_REG_VERDICT)
6564 switch (data->verdict.code) {
6567 err = nf_tables_check_loops(ctx,
6568 data->verdict.chain);
6577 list_for_each_entry(set, &ctx->table->sets, list) {
6578 if (!nft_is_active_next(ctx->net, set))
6580 if (!(set->flags & NFT_SET_MAP) ||
6581 set->dtype != NFT_DATA_VERDICT)
6584 list_for_each_entry(binding, &set->bindings, list) {
6585 if (!(binding->flags & NFT_SET_MAP) ||
6586 binding->chain != chain)
6589 iter.genmask = nft_genmask_next(ctx->net);
6593 iter.fn = nf_tables_loop_check_setelem;
6595 set->ops->walk(ctx, set, &iter);
6605 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6607 * @attr: netlink attribute to fetch value from
6608 * @max: maximum value to be stored in dest
6609 * @dest: pointer to the variable
6611 * Parse, check and store a given u32 netlink attribute into variable.
6612 * This function returns -ERANGE if the value goes over maximum value.
6613 * Otherwise a 0 is returned and the attribute value is stored in the
6614 * destination variable.
6616 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
6620 val = ntohl(nla_get_be32(attr));
6627 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6630 * nft_parse_register - parse a register value from a netlink attribute
6632 * @attr: netlink attribute
6634 * Parse and translate a register value from a netlink attribute.
6635 * Registers used to be 128 bit wide, these register numbers will be
6636 * mapped to the corresponding 32 bit register numbers.
6638 unsigned int nft_parse_register(const struct nlattr *attr)
6642 reg = ntohl(nla_get_be32(attr));
6644 case NFT_REG_VERDICT...NFT_REG_4:
6645 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6647 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6650 EXPORT_SYMBOL_GPL(nft_parse_register);
6653 * nft_dump_register - dump a register value to a netlink attribute
6655 * @skb: socket buffer
6656 * @attr: attribute number
6657 * @reg: register number
6659 * Construct a netlink attribute containing the register number. For
6660 * compatibility reasons, register numbers being a multiple of 4 are
6661 * translated to the corresponding 128 bit register numbers.
6663 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6665 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6666 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6668 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6670 return nla_put_be32(skb, attr, htonl(reg));
6672 EXPORT_SYMBOL_GPL(nft_dump_register);
6675 * nft_validate_register_load - validate a load from a register
6677 * @reg: the register number
6678 * @len: the length of the data
6680 * Validate that the input register is one of the general purpose
6681 * registers and that the length of the load is within the bounds.
6683 int nft_validate_register_load(enum nft_registers reg, unsigned int len)
6685 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
6689 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
6694 EXPORT_SYMBOL_GPL(nft_validate_register_load);
6697 * nft_validate_register_store - validate an expressions' register store
6699 * @ctx: context of the expression performing the load
6700 * @reg: the destination register number
6701 * @data: the data to load
6702 * @type: the data type
6703 * @len: the length of the data
6705 * Validate that a data load uses the appropriate data type for
6706 * the destination register and the length is within the bounds.
6707 * A value of NULL for the data means that its runtime gathered
6710 int nft_validate_register_store(const struct nft_ctx *ctx,
6711 enum nft_registers reg,
6712 const struct nft_data *data,
6713 enum nft_data_types type, unsigned int len)
6718 case NFT_REG_VERDICT:
6719 if (type != NFT_DATA_VERDICT)
6723 (data->verdict.code == NFT_GOTO ||
6724 data->verdict.code == NFT_JUMP)) {
6725 err = nf_tables_check_loops(ctx, data->verdict.chain);
6729 if (ctx->chain->level + 1 >
6730 data->verdict.chain->level) {
6731 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
6733 data->verdict.chain->level = ctx->chain->level + 1;
6739 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
6743 if (reg * NFT_REG32_SIZE + len >
6744 FIELD_SIZEOF(struct nft_regs, data))
6747 if (data != NULL && type != NFT_DATA_VALUE)
6752 EXPORT_SYMBOL_GPL(nft_validate_register_store);
6754 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
6755 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
6756 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
6757 .len = NFT_CHAIN_MAXNAMELEN - 1 },
6760 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
6761 struct nft_data_desc *desc, const struct nlattr *nla)
6763 u8 genmask = nft_genmask_next(ctx->net);
6764 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
6765 struct nft_chain *chain;
6768 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
6773 if (!tb[NFTA_VERDICT_CODE])
6775 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
6777 switch (data->verdict.code) {
6779 switch (data->verdict.code & NF_VERDICT_MASK) {
6794 if (!tb[NFTA_VERDICT_CHAIN])
6796 chain = nft_chain_lookup(ctx->table, tb[NFTA_VERDICT_CHAIN],
6799 return PTR_ERR(chain);
6800 if (nft_is_base_chain(chain))
6804 data->verdict.chain = chain;
6808 desc->len = sizeof(data->verdict);
6809 desc->type = NFT_DATA_VERDICT;
6813 static void nft_verdict_uninit(const struct nft_data *data)
6815 switch (data->verdict.code) {
6818 data->verdict.chain->use--;
6823 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
6825 struct nlattr *nest;
6827 nest = nla_nest_start(skb, type);
6829 goto nla_put_failure;
6831 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
6832 goto nla_put_failure;
6837 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
6839 goto nla_put_failure;
6841 nla_nest_end(skb, nest);
6848 static int nft_value_init(const struct nft_ctx *ctx,
6849 struct nft_data *data, unsigned int size,
6850 struct nft_data_desc *desc, const struct nlattr *nla)
6860 nla_memcpy(data->data, nla, len);
6861 desc->type = NFT_DATA_VALUE;
6866 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
6869 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
6872 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
6873 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
6874 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
6878 * nft_data_init - parse nf_tables data netlink attributes
6880 * @ctx: context of the expression using the data
6881 * @data: destination struct nft_data
6882 * @size: maximum data length
6883 * @desc: data description
6884 * @nla: netlink attribute containing data
6886 * Parse the netlink data attributes and initialize a struct nft_data.
6887 * The type and length of data are returned in the data description.
6889 * The caller can indicate that it only wants to accept data of type
6890 * NFT_DATA_VALUE by passing NULL for the ctx argument.
6892 int nft_data_init(const struct nft_ctx *ctx,
6893 struct nft_data *data, unsigned int size,
6894 struct nft_data_desc *desc, const struct nlattr *nla)
6896 struct nlattr *tb[NFTA_DATA_MAX + 1];
6899 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
6903 if (tb[NFTA_DATA_VALUE])
6904 return nft_value_init(ctx, data, size, desc,
6905 tb[NFTA_DATA_VALUE]);
6906 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
6907 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
6910 EXPORT_SYMBOL_GPL(nft_data_init);
6913 * nft_data_release - release a nft_data item
6915 * @data: struct nft_data to release
6916 * @type: type of data
6918 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6919 * all others need to be released by calling this function.
6921 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
6923 if (type < NFT_DATA_VERDICT)
6926 case NFT_DATA_VERDICT:
6927 return nft_verdict_uninit(data);
6932 EXPORT_SYMBOL_GPL(nft_data_release);
6934 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
6935 enum nft_data_types type, unsigned int len)
6937 struct nlattr *nest;
6940 nest = nla_nest_start(skb, attr);
6945 case NFT_DATA_VALUE:
6946 err = nft_value_dump(skb, data, len);
6948 case NFT_DATA_VERDICT:
6949 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
6956 nla_nest_end(skb, nest);
6959 EXPORT_SYMBOL_GPL(nft_data_dump);
6961 int __nft_release_basechain(struct nft_ctx *ctx)
6963 struct nft_rule *rule, *nr;
6965 BUG_ON(!nft_is_base_chain(ctx->chain));
6967 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
6968 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6969 list_del(&rule->list);
6971 nf_tables_rule_release(ctx, rule);
6973 list_del(&ctx->chain->list);
6975 nf_tables_chain_destroy(ctx);
6979 EXPORT_SYMBOL_GPL(__nft_release_basechain);
6981 static void __nft_release_tables(struct net *net)
6983 struct nft_flowtable *flowtable, *nf;
6984 struct nft_table *table, *nt;
6985 struct nft_chain *chain, *nc;
6986 struct nft_object *obj, *ne;
6987 struct nft_rule *rule, *nr;
6988 struct nft_set *set, *ns;
6989 struct nft_ctx ctx = {
6991 .family = NFPROTO_NETDEV,
6994 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
6995 ctx.family = table->family;
6997 list_for_each_entry(chain, &table->chains, list)
6998 nf_tables_unregister_hook(net, table, chain);
6999 list_for_each_entry(flowtable, &table->flowtables, list)
7000 nf_unregister_net_hooks(net, flowtable->ops,
7001 flowtable->ops_len);
7002 /* No packets are walking on these chains anymore. */
7004 list_for_each_entry(chain, &table->chains, list) {
7006 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7007 list_del(&rule->list);
7009 nf_tables_rule_release(&ctx, rule);
7012 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7013 list_del(&flowtable->list);
7015 nf_tables_flowtable_destroy(flowtable);
7017 list_for_each_entry_safe(set, ns, &table->sets, list) {
7018 list_del(&set->list);
7020 nft_set_destroy(set);
7022 list_for_each_entry_safe(obj, ne, &table->objects, list) {
7023 list_del(&obj->list);
7025 nft_obj_destroy(&ctx, obj);
7027 list_for_each_entry_safe(chain, nc, &table->chains, list) {
7029 list_del(&chain->list);
7031 nf_tables_chain_destroy(&ctx);
7033 list_del(&table->list);
7034 nf_tables_table_destroy(&ctx);
7038 static int __net_init nf_tables_init_net(struct net *net)
7040 INIT_LIST_HEAD(&net->nft.tables);
7041 INIT_LIST_HEAD(&net->nft.commit_list);
7042 net->nft.base_seq = 1;
7043 net->nft.validate_state = NFT_VALIDATE_SKIP;
7048 static void __net_exit nf_tables_exit_net(struct net *net)
7050 __nft_release_tables(net);
7051 WARN_ON_ONCE(!list_empty(&net->nft.tables));
7052 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
7055 static struct pernet_operations nf_tables_net_ops = {
7056 .init = nf_tables_init_net,
7057 .exit = nf_tables_exit_net,
7060 static int __init nf_tables_module_init(void)
7064 nft_chain_filter_init();
7066 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
7073 err = nf_tables_core_module_init();
7077 err = nfnetlink_subsys_register(&nf_tables_subsys);
7081 register_netdevice_notifier(&nf_tables_flowtable_notifier);
7083 return register_pernet_subsys(&nf_tables_net_ops);
7085 nf_tables_core_module_exit();
7092 static void __exit nf_tables_module_exit(void)
7094 unregister_pernet_subsys(&nf_tables_net_ops);
7095 nfnetlink_subsys_unregister(&nf_tables_subsys);
7096 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7098 nf_tables_core_module_exit();
7100 nft_chain_filter_fini();
7103 module_init(nf_tables_module_init);
7104 module_exit(nf_tables_module_exit);
7106 MODULE_LICENSE("GPL");
7107 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
7108 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);