net/netfilter/nf_tables_api.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
   4  *
   5  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/init.h>
  10 #include <linux/list.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/netlink.h>
  13 #include <linux/vmalloc.h>
  14 #include <linux/rhashtable.h>
  15 #include <linux/audit.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nfnetlink.h>
  18 #include <linux/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_flow_table.h>
  20 #include <net/netfilter/nf_tables_core.h>
  21 #include <net/netfilter/nf_tables.h>
  22 #include <net/netfilter/nf_tables_offload.h>
  23 #include <net/net_namespace.h>
  24 #include <net/sock.h>
  25
  26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
  27
  28 static LIST_HEAD(nf_tables_expressions);
  29 static LIST_HEAD(nf_tables_objects);
  30 static LIST_HEAD(nf_tables_flowtables);
  31 static LIST_HEAD(nf_tables_destroy_list);
  32 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
  33 static u64 table_handle;
  34
  35 enum {
  36         NFT_VALIDATE_SKIP       = 0,
  37         NFT_VALIDATE_NEED,
  38         NFT_VALIDATE_DO,
  39 };
  40
  41 static struct rhltable nft_objname_ht;
  42
  43 static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
  44 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
  45 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
  46
  47 static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
  48 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
  49 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
  50
  51 static const struct rhashtable_params nft_chain_ht_params = {
  52         .head_offset            = offsetof(struct nft_chain, rhlhead),
  53         .key_offset             = offsetof(struct nft_chain, name),
  54         .hashfn                 = nft_chain_hash,
  55         .obj_hashfn             = nft_chain_hash_obj,
  56         .obj_cmpfn              = nft_chain_hash_cmp,
  57         .automatic_shrinking    = true,
  58 };
  59
  60 static const struct rhashtable_params nft_objname_ht_params = {
  61         .head_offset            = offsetof(struct nft_object, rhlhead),
  62         .key_offset             = offsetof(struct nft_object, key),
  63         .hashfn                 = nft_objname_hash,
  64         .obj_hashfn             = nft_objname_hash_obj,
  65         .obj_cmpfn              = nft_objname_hash_cmp,
  66         .automatic_shrinking    = true,
  67 };
  68
  69 static void nft_validate_state_update(struct net *net, u8 new_validate_state)
  70 {
  71         switch (net->nft.validate_state) {
  72         case NFT_VALIDATE_SKIP:
  73                 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
  74                 break;
  75         case NFT_VALIDATE_NEED:
  76                 break;
  77         case NFT_VALIDATE_DO:
  78                 if (new_validate_state == NFT_VALIDATE_NEED)
  79                         return;
  80         }
  81
  82         net->nft.validate_state = new_validate_state;
  83 }
  84 static void nf_tables_trans_destroy_work(struct work_struct *w);
  85 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
  86
  87 static void nft_ctx_init(struct nft_ctx *ctx,
  88                          struct net *net,
  89                          const struct sk_buff *skb,
  90                          const struct nlmsghdr *nlh,
  91                          u8 family,
  92                          struct nft_table *table,
  93                          struct nft_chain *chain,
  94                          const struct nlattr * const *nla)
  95 {
  96         ctx->net        = net;
  97         ctx->family     = family;
  98         ctx->level      = 0;
  99         ctx->table      = table;
 100         ctx->chain      = chain;
 101         ctx->nla        = nla;
 102         ctx->portid     = NETLINK_CB(skb).portid;
 103         ctx->report     = nlmsg_report(nlh);
 104         ctx->flags      = nlh->nlmsg_flags;
 105         ctx->seq        = nlh->nlmsg_seq;
 106 }
 107
 108 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
 109                                              int msg_type, u32 size, gfp_t gfp)
 110 {
 111         struct nft_trans *trans;
 112
 113         trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
 114         if (trans == NULL)
 115                 return NULL;
 116
 117         trans->msg_type = msg_type;
 118         trans->ctx      = *ctx;
 119
 120         return trans;
 121 }
 122
 123 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
 124                                          int msg_type, u32 size)
 125 {
 126         return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
 127 }
 128
 129 static void nft_trans_destroy(struct nft_trans *trans)
 130 {
 131         list_del(&trans->list);
 132         kfree(trans);
 133 }
 134
 135 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
 136 {
 137         struct net *net = ctx->net;
 138         struct nft_trans *trans;
 139
 140         if (!nft_set_is_anonymous(set))
 141                 return;
 142
 143         list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
 144                 switch (trans->msg_type) {
 145                 case NFT_MSG_NEWSET:
 146                         if (nft_trans_set(trans) == set)
 147                                 nft_trans_set_bound(trans) = true;
 148                         break;
 149                 case NFT_MSG_NEWSETELEM:
 150                         if (nft_trans_elem_set(trans) == set)
 151                                 nft_trans_elem_set_bound(trans) = true;
 152                         break;
 153                 }
 154         }
 155 }
 156
 157 static int nft_netdev_register_hooks(struct net *net,
 158                                      struct list_head *hook_list)
 159 {
 160         struct nft_hook *hook;
 161         int err, j;
 162
 163         j = 0;
 164         list_for_each_entry(hook, hook_list, list) {
 165                 err = nf_register_net_hook(net, &hook->ops);
 166                 if (err < 0)
 167                         goto err_register;
 168
 169                 j++;
 170         }
 171         return 0;
 172
 173 err_register:
 174         list_for_each_entry(hook, hook_list, list) {
 175                 if (j-- <= 0)
 176                         break;
 177
 178                 nf_unregister_net_hook(net, &hook->ops);
 179         }
 180         return err;
 181 }
 182
 183 static void nft_netdev_unregister_hooks(struct net *net,
 184                                         struct list_head *hook_list)
 185 {
 186         struct nft_hook *hook;
 187
 188         list_for_each_entry(hook, hook_list, list)
 189                 nf_unregister_net_hook(net, &hook->ops);
 190 }
 191
 192 static int nf_tables_register_hook(struct net *net,
 193                                    const struct nft_table *table,
 194                                    struct nft_chain *chain)
 195 {
 196         struct nft_base_chain *basechain;
 197         const struct nf_hook_ops *ops;
 198
 199         if (table->flags & NFT_TABLE_F_DORMANT ||
 200             !nft_is_base_chain(chain))
 201                 return 0;
 202
 203         basechain = nft_base_chain(chain);
 204         ops = &basechain->ops;
 205
 206         if (basechain->type->ops_register)
 207                 return basechain->type->ops_register(net, ops);
 208
 209         if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
 210                 return nft_netdev_register_hooks(net, &basechain->hook_list);
 211
 212         return nf_register_net_hook(net, &basechain->ops);
 213 }
 214
 215 static void nf_tables_unregister_hook(struct net *net,
 216                                       const struct nft_table *table,
 217                                       struct nft_chain *chain)
 218 {
 219         struct nft_base_chain *basechain;
 220         const struct nf_hook_ops *ops;
 221
 222         if (table->flags & NFT_TABLE_F_DORMANT ||
 223             !nft_is_base_chain(chain))
 224                 return;
 225         basechain = nft_base_chain(chain);
 226         ops = &basechain->ops;
 227
 228         if (basechain->type->ops_unregister)
 229                 return basechain->type->ops_unregister(net, ops);
 230
 231         if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
 232                 nft_netdev_unregister_hooks(net, &basechain->hook_list);
 233         else
 234                 nf_unregister_net_hook(net, &basechain->ops);
 235 }
 236
 237 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
 238 {
 239         struct nft_trans *trans;
 240
 241         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
 242         if (trans == NULL)
 243                 return -ENOMEM;
 244
 245         if (msg_type == NFT_MSG_NEWTABLE)
 246                 nft_activate_next(ctx->net, ctx->table);
 247
 248         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 249         return 0;
 250 }
 251
 252 static int nft_deltable(struct nft_ctx *ctx)
 253 {
 254         int err;
 255
 256         err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
 257         if (err < 0)
 258                 return err;
 259
 260         nft_deactivate_next(ctx->net, ctx->table);
 261         return err;
 262 }
 263
 264 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
 265 {
 266         struct nft_trans *trans;
 267
 268         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
 269         if (trans == NULL)
 270                 return ERR_PTR(-ENOMEM);
 271
 272         if (msg_type == NFT_MSG_NEWCHAIN) {
 273                 nft_activate_next(ctx->net, ctx->chain);
 274
 275                 if (ctx->nla[NFTA_CHAIN_ID]) {
 276                         nft_trans_chain_id(trans) =
 277                                 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID]));
 278                 }
 279         }
 280
 281         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 282         return trans;
 283 }
 284
 285 static int nft_delchain(struct nft_ctx *ctx)
 286 {
 287         struct nft_trans *trans;
 288
 289         trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
 290         if (IS_ERR(trans))
 291                 return PTR_ERR(trans);
 292
 293         ctx->table->use--;
 294         nft_deactivate_next(ctx->net, ctx->chain);
 295
 296         return 0;
 297 }
 298
 299 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
 300                                    struct nft_rule *rule)
 301 {
 302         struct nft_expr *expr;
 303
 304         expr = nft_expr_first(rule);
 305         while (nft_expr_more(rule, expr)) {
 306                 if (expr->ops->activate)
 307                         expr->ops->activate(ctx, expr);
 308
 309                 expr = nft_expr_next(expr);
 310         }
 311 }
 312
 313 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
 314                                      struct nft_rule *rule,
 315                                      enum nft_trans_phase phase)
 316 {
 317         struct nft_expr *expr;
 318
 319         expr = nft_expr_first(rule);
 320         while (nft_expr_more(rule, expr)) {
 321                 if (expr->ops->deactivate)
 322                         expr->ops->deactivate(ctx, expr, phase);
 323
 324                 expr = nft_expr_next(expr);
 325         }
 326 }
 327
 328 static int
 329 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
 330 {
 331         /* You cannot delete the same rule twice */
 332         if (nft_is_active_next(ctx->net, rule)) {
 333                 nft_deactivate_next(ctx->net, rule);
 334                 ctx->chain->use--;
 335                 return 0;
 336         }
 337         return -ENOENT;
 338 }
 339
 340 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
 341                                             struct nft_rule *rule)
 342 {
 343         struct nft_trans *trans;
 344
 345         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
 346         if (trans == NULL)
 347                 return NULL;
 348
 349         if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
 350                 nft_trans_rule_id(trans) =
 351                         ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
 352         }
 353         nft_trans_rule(trans) = rule;
 354         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 355
 356         return trans;
 357 }
 358
 359 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
 360 {
 361         struct nft_flow_rule *flow;
 362         struct nft_trans *trans;
 363         int err;
 364
 365         trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
 366         if (trans == NULL)
 367                 return -ENOMEM;
 368
 369         if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
 370                 flow = nft_flow_rule_create(ctx->net, rule);
 371                 if (IS_ERR(flow)) {
 372                         nft_trans_destroy(trans);
 373                         return PTR_ERR(flow);
 374                 }
 375
 376                 nft_trans_flow_rule(trans) = flow;
 377         }
 378
 379         err = nf_tables_delrule_deactivate(ctx, rule);
 380         if (err < 0) {
 381                 nft_trans_destroy(trans);
 382                 return err;
 383         }
 384         nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
 385
 386         return 0;
 387 }
 388
 389 static int nft_delrule_by_chain(struct nft_ctx *ctx)
 390 {
 391         struct nft_rule *rule;
 392         int err;
 393
 394         list_for_each_entry(rule, &ctx->chain->rules, list) {
 395                 if (!nft_is_active_next(ctx->net, rule))
 396                         continue;
 397
 398                 err = nft_delrule(ctx, rule);
 399                 if (err < 0)
 400                         return err;
 401         }
 402         return 0;
 403 }
 404
 405 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
 406                              struct nft_set *set)
 407 {
 408         struct nft_trans *trans;
 409
 410         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
 411         if (trans == NULL)
 412                 return -ENOMEM;
 413
 414         if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
 415                 nft_trans_set_id(trans) =
 416                         ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
 417                 nft_activate_next(ctx->net, set);
 418         }
 419         nft_trans_set(trans) = set;
 420         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 421
 422         return 0;
 423 }
 424
 425 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
 426 {
 427         int err;
 428
 429         err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
 430         if (err < 0)
 431                 return err;
 432
 433         nft_deactivate_next(ctx->net, set);
 434         ctx->table->use--;
 435
 436         return err;
 437 }
 438
 439 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
 440                              struct nft_object *obj)
 441 {
 442         struct nft_trans *trans;
 443
 444         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
 445         if (trans == NULL)
 446                 return -ENOMEM;
 447
 448         if (msg_type == NFT_MSG_NEWOBJ)
 449                 nft_activate_next(ctx->net, obj);
 450
 451         nft_trans_obj(trans) = obj;
 452         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 453
 454         return 0;
 455 }
 456
 457 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
 458 {
 459         int err;
 460
 461         err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
 462         if (err < 0)
 463                 return err;
 464
 465         nft_deactivate_next(ctx->net, obj);
 466         ctx->table->use--;
 467
 468         return err;
 469 }
 470
 471 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
 472                                    struct nft_flowtable *flowtable)
 473 {
 474         struct nft_trans *trans;
 475
 476         trans = nft_trans_alloc(ctx, msg_type,
 477                                 sizeof(struct nft_trans_flowtable));
 478         if (trans == NULL)
 479                 return -ENOMEM;
 480
 481         if (msg_type == NFT_MSG_NEWFLOWTABLE)
 482                 nft_activate_next(ctx->net, flowtable);
 483
 484         nft_trans_flowtable(trans) = flowtable;
 485         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 486
 487         return 0;
 488 }
 489
 490 static int nft_delflowtable(struct nft_ctx *ctx,
 491                             struct nft_flowtable *flowtable)
 492 {
 493         int err;
 494
 495         err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
 496         if (err < 0)
 497                 return err;
 498
 499         nft_deactivate_next(ctx->net, flowtable);
 500         ctx->table->use--;
 501
 502         return err;
 503 }
 504
 505 /*
 506  * Tables
 507  */
 508
 509 static struct nft_table *nft_table_lookup(const struct net *net,
 510                                           const struct nlattr *nla,
 511                                           u8 family, u8 genmask)
 512 {
 513         struct nft_table *table;
 514
 515         if (nla == NULL)
 516                 return ERR_PTR(-EINVAL);
 517
 518         list_for_each_entry_rcu(table, &net->nft.tables, list,
 519                                 lockdep_is_held(&net->nft.commit_mutex)) {
 520                 if (!nla_strcmp(nla, table->name) &&
 521                     table->family == family &&
 522                     nft_active_genmask(table, genmask))
 523                         return table;
 524         }
 525
 526         return ERR_PTR(-ENOENT);
 527 }
 528
 529 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
 530                                                    const struct nlattr *nla,
 531                                                    u8 genmask)
 532 {
 533         struct nft_table *table;
 534
 535         list_for_each_entry(table, &net->nft.tables, list) {
 536                 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
 537                     nft_active_genmask(table, genmask))
 538                         return table;
 539         }
 540
 541         return ERR_PTR(-ENOENT);
 542 }
 543
 544 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
 545 {
 546         return ++table->hgenerator;
 547 }
 548
 549 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
 550
 551 static const struct nft_chain_type *
 552 __nft_chain_type_get(u8 family, enum nft_chain_types type)
 553 {
 554         if (family >= NFPROTO_NUMPROTO ||
 555             type >= NFT_CHAIN_T_MAX)
 556                 return NULL;
 557
 558         return chain_type[family][type];
 559 }
 560
 561 static const struct nft_chain_type *
 562 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
 563 {
 564         const struct nft_chain_type *type;
 565         int i;
 566
 567         for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
 568                 type = __nft_chain_type_get(family, i);
 569                 if (!type)
 570                         continue;
 571                 if (!nla_strcmp(nla, type->name))
 572                         return type;
 573         }
 574         return NULL;
 575 }
 576
 577 struct nft_module_request {
 578         struct list_head        list;
 579         char                    module[MODULE_NAME_LEN];
 580         bool                    done;
 581 };
 582
 583 #ifdef CONFIG_MODULES
 584 static int nft_request_module(struct net *net, const char *fmt, ...)
 585 {
 586         char module_name[MODULE_NAME_LEN];
 587         struct nft_module_request *req;
 588         va_list args;
 589         int ret;
 590
 591         va_start(args, fmt);
 592         ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
 593         va_end(args);
 594         if (ret >= MODULE_NAME_LEN)
 595                 return 0;
 596
 597         list_for_each_entry(req, &net->nft.module_list, list) {
 598                 if (!strcmp(req->module, module_name)) {
 599                         if (req->done)
 600                                 return 0;
 601
 602                         /* A request to load this module already exists. */
 603                         return -EAGAIN;
 604                 }
 605         }
 606
 607         req = kmalloc(sizeof(*req), GFP_KERNEL);
 608         if (!req)
 609                 return -ENOMEM;
 610
 611         req->done = false;
 612         strlcpy(req->module, module_name, MODULE_NAME_LEN);
 613         list_add_tail(&req->list, &net->nft.module_list);
 614
 615         return -EAGAIN;
 616 }
 617 #endif
 618
 619 static void lockdep_nfnl_nft_mutex_not_held(void)
 620 {
 621 #ifdef CONFIG_PROVE_LOCKING
 622         WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
 623 #endif
 624 }
 625
 626 static const struct nft_chain_type *
 627 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
 628                             u8 family, bool autoload)
 629 {
 630         const struct nft_chain_type *type;
 631
 632         type = __nf_tables_chain_type_lookup(nla, family);
 633         if (type != NULL)
 634                 return type;
 635
 636         lockdep_nfnl_nft_mutex_not_held();
 637 #ifdef CONFIG_MODULES
 638         if (autoload) {
 639                 if (nft_request_module(net, "nft-chain-%u-%.*s", family,
 640                                        nla_len(nla),
 641                                        (const char *)nla_data(nla)) == -EAGAIN)
 642                         return ERR_PTR(-EAGAIN);
 643         }
 644 #endif
 645         return ERR_PTR(-ENOENT);
 646 }
 647
 648 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
 649         [NFTA_TABLE_NAME]       = { .type = NLA_STRING,
 650                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
 651         [NFTA_TABLE_FLAGS]      = { .type = NLA_U32 },
 652         [NFTA_TABLE_HANDLE]     = { .type = NLA_U64 },
 653         [NFTA_TABLE_USERDATA]   = { .type = NLA_BINARY,
 654                                     .len = NFT_USERDATA_MAXLEN }
 655 };
 656
 657 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
 658                                      u32 portid, u32 seq, int event, u32 flags,
 659                                      int family, const struct nft_table *table)
 660 {
 661         struct nlmsghdr *nlh;
 662         struct nfgenmsg *nfmsg;
 663
 664         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
 665         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
 666         if (nlh == NULL)
 667                 goto nla_put_failure;
 668
 669         nfmsg = nlmsg_data(nlh);
 670         nfmsg->nfgen_family     = family;
 671         nfmsg->version          = NFNETLINK_V0;
 672         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
 673
 674         if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
 675             nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
 676             nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
 677             nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
 678                          NFTA_TABLE_PAD))
 679                 goto nla_put_failure;
 680
 681         if (table->udata) {
 682                 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata))
 683                         goto nla_put_failure;
 684         }
 685
 686         nlmsg_end(skb, nlh);
 687         return 0;
 688
 689 nla_put_failure:
 690         nlmsg_trim(skb, nlh);
 691         return -1;
 692 }
 693
 694 struct nftnl_skb_parms {
 695         bool report;
 696 };
 697 #define NFT_CB(skb)     (*(struct nftnl_skb_parms*)&((skb)->cb))
 698
 699 static void nft_notify_enqueue(struct sk_buff *skb, bool report,
 700                                struct list_head *notify_list)
 701 {
 702         NFT_CB(skb).report = report;
 703         list_add_tail(&skb->list, notify_list);
 704 }
 705
 706 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
 707 {
 708         struct sk_buff *skb;
 709         int err;
 710         char *buf = kasprintf(GFP_KERNEL, "%s:%llu;?:0",
 711                               ctx->table->name, ctx->table->handle);
 712
 713         audit_log_nfcfg(buf,
 714                         ctx->family,
 715                         ctx->table->use,
 716                         event == NFT_MSG_NEWTABLE ?
 717                                 AUDIT_NFT_OP_TABLE_REGISTER :
 718                                 AUDIT_NFT_OP_TABLE_UNREGISTER,
 719                         GFP_KERNEL);
 720         kfree(buf);
 721
 722         if (!ctx->report &&
 723             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
 724                 return;
 725
 726         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 727         if (skb == NULL)
 728                 goto err;
 729
 730         err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
 731                                         event, 0, ctx->family, ctx->table);
 732         if (err < 0) {
 733                 kfree_skb(skb);
 734                 goto err;
 735         }
 736
 737         nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
 738         return;
 739 err:
 740         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
 741 }
 742
 743 static int nf_tables_dump_tables(struct sk_buff *skb,
 744                                  struct netlink_callback *cb)
 745 {
 746         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 747         const struct nft_table *table;
 748         unsigned int idx = 0, s_idx = cb->args[0];
 749         struct net *net = sock_net(skb->sk);
 750         int family = nfmsg->nfgen_family;
 751
 752         rcu_read_lock();
 753         cb->seq = net->nft.base_seq;
 754
 755         list_for_each_entry_rcu(table, &net->nft.tables, list) {
 756                 if (family != NFPROTO_UNSPEC && family != table->family)
 757                         continue;
 758
 759                 if (idx < s_idx)
 760                         goto cont;
 761                 if (idx > s_idx)
 762                         memset(&cb->args[1], 0,
 763                                sizeof(cb->args) - sizeof(cb->args[0]));
 764                 if (!nft_is_active(net, table))
 765                         continue;
 766                 if (nf_tables_fill_table_info(skb, net,
 767                                               NETLINK_CB(cb->skb).portid,
 768                                               cb->nlh->nlmsg_seq,
 769                                               NFT_MSG_NEWTABLE, NLM_F_MULTI,
 770                                               table->family, table) < 0)
 771                         goto done;
 772
 773                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 774 cont:
 775                 idx++;
 776         }
 777 done:
 778         rcu_read_unlock();
 779         cb->args[0] = idx;
 780         return skb->len;
 781 }
 782
 783 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
 784                                       const struct nlmsghdr *nlh,
 785                                       struct netlink_dump_control *c)
 786 {
 787         int err;
 788
 789         if (!try_module_get(THIS_MODULE))
 790                 return -EINVAL;
 791
 792         rcu_read_unlock();
 793         err = netlink_dump_start(nlsk, skb, nlh, c);
 794         rcu_read_lock();
 795         module_put(THIS_MODULE);
 796
 797         return err;
 798 }
 799
 800 /* called with rcu_read_lock held */
 801 static int nf_tables_gettable(struct net *net, struct sock *nlsk,
 802                               struct sk_buff *skb, const struct nlmsghdr *nlh,
 803                               const struct nlattr * const nla[],
 804                               struct netlink_ext_ack *extack)
 805 {
 806         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 807         u8 genmask = nft_genmask_cur(net);
 808         const struct nft_table *table;
 809         struct sk_buff *skb2;
 810         int family = nfmsg->nfgen_family;
 811         int err;
 812
 813         if (nlh->nlmsg_flags & NLM_F_DUMP) {
 814                 struct netlink_dump_control c = {
 815                         .dump = nf_tables_dump_tables,
 816                         .module = THIS_MODULE,
 817                 };
 818
 819                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
 820         }
 821
 822         table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
 823         if (IS_ERR(table)) {
 824                 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
 825                 return PTR_ERR(table);
 826         }
 827
 828         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
 829         if (!skb2)
 830                 return -ENOMEM;
 831
 832         err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
 833                                         nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
 834                                         family, table);
 835         if (err < 0)
 836                 goto err_fill_table_info;
 837
 838         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
 839
 840 err_fill_table_info:
 841         kfree_skb(skb2);
 842         return err;
 843 }
 844
 845 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
 846 {
 847         struct nft_chain *chain;
 848         u32 i = 0;
 849
 850         list_for_each_entry(chain, &table->chains, list) {
 851                 if (!nft_is_active_next(net, chain))
 852                         continue;
 853                 if (!nft_is_base_chain(chain))
 854                         continue;
 855
 856                 if (cnt && i++ == cnt)
 857                         break;
 858
 859                 nf_tables_unregister_hook(net, table, chain);
 860         }
 861 }
 862
 863 static int nf_tables_table_enable(struct net *net, struct nft_table *table)
 864 {
 865         struct nft_chain *chain;
 866         int err, i = 0;
 867
 868         list_for_each_entry(chain, &table->chains, list) {
 869                 if (!nft_is_active_next(net, chain))
 870                         continue;
 871                 if (!nft_is_base_chain(chain))
 872                         continue;
 873
 874                 err = nf_tables_register_hook(net, table, chain);
 875                 if (err < 0)
 876                         goto err_register_hooks;
 877
 878                 i++;
 879         }
 880         return 0;
 881
 882 err_register_hooks:
 883         if (i)
 884                 nft_table_disable(net, table, i);
 885         return err;
 886 }
 887
 888 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
 889 {
 890         nft_table_disable(net, table, 0);
 891 }
 892
 893 static int nf_tables_updtable(struct nft_ctx *ctx)
 894 {
 895         struct nft_trans *trans;
 896         u32 flags;
 897         int ret = 0;
 898
 899         if (!ctx->nla[NFTA_TABLE_FLAGS])
 900                 return 0;
 901
 902         flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
 903         if (flags & ~NFT_TABLE_F_DORMANT)
 904                 return -EINVAL;
 905
 906         if (flags == ctx->table->flags)
 907                 return 0;
 908
 909         trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
 910                                 sizeof(struct nft_trans_table));
 911         if (trans == NULL)
 912                 return -ENOMEM;
 913
 914         if ((flags & NFT_TABLE_F_DORMANT) &&
 915             !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
 916                 nft_trans_table_enable(trans) = false;
 917         } else if (!(flags & NFT_TABLE_F_DORMANT) &&
 918                    ctx->table->flags & NFT_TABLE_F_DORMANT) {
 919                 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
 920                 ret = nf_tables_table_enable(ctx->net, ctx->table);
 921                 if (ret >= 0)
 922                         nft_trans_table_enable(trans) = true;
 923                 else
 924                         ctx->table->flags |= NFT_TABLE_F_DORMANT;
 925         }
 926         if (ret < 0)
 927                 goto err;
 928
 929         nft_trans_table_update(trans) = true;
 930         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 931         return 0;
 932 err:
 933         nft_trans_destroy(trans);
 934         return ret;
 935 }
 936
 937 static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
 938 {
 939         const char *name = data;
 940
 941         return jhash(name, strlen(name), seed);
 942 }
 943
 944 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
 945 {
 946         const struct nft_chain *chain = data;
 947
 948         return nft_chain_hash(chain->name, 0, seed);
 949 }
 950
 951 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
 952                               const void *ptr)
 953 {
 954         const struct nft_chain *chain = ptr;
 955         const char *name = arg->key;
 956
 957         return strcmp(chain->name, name);
 958 }
 959
 960 static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
 961 {
 962         const struct nft_object_hash_key *k = data;
 963
 964         seed ^= hash_ptr(k->table, 32);
 965
 966         return jhash(k->name, strlen(k->name), seed);
 967 }
 968
 969 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
 970 {
 971         const struct nft_object *obj = data;
 972
 973         return nft_objname_hash(&obj->key, 0, seed);
 974 }
 975
 976 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
 977                                 const void *ptr)
 978 {
 979         const struct nft_object_hash_key *k = arg->key;
 980         const struct nft_object *obj = ptr;
 981
 982         if (obj->key.table != k->table)
 983                 return -1;
 984
 985         return strcmp(obj->key.name, k->name);
 986 }
 987
 988 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 989                               struct sk_buff *skb, const struct nlmsghdr *nlh,
 990                               const struct nlattr * const nla[],
 991                               struct netlink_ext_ack *extack)
 992 {
 993         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 994         u8 genmask = nft_genmask_next(net);
 995         int family = nfmsg->nfgen_family;
 996         const struct nlattr *attr;
 997         struct nft_table *table;
 998         struct nft_ctx ctx;
 999         u32 flags = 0;
1000         int err;
1001
1002         lockdep_assert_held(&net->nft.commit_mutex);
1003         attr = nla[NFTA_TABLE_NAME];
1004         table = nft_table_lookup(net, attr, family, genmask);
1005         if (IS_ERR(table)) {
1006                 if (PTR_ERR(table) != -ENOENT)
1007                         return PTR_ERR(table);
1008         } else {
1009                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1010                         NL_SET_BAD_ATTR(extack, attr);
1011                         return -EEXIST;
1012                 }
1013                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1014                         return -EOPNOTSUPP;
1015
1016                 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
1017                 return nf_tables_updtable(&ctx);
1018         }
1019
1020         if (nla[NFTA_TABLE_FLAGS]) {
1021                 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
1022                 if (flags & ~NFT_TABLE_F_DORMANT)
1023                         return -EINVAL;
1024         }
1025
1026         err = -ENOMEM;
1027         table = kzalloc(sizeof(*table), GFP_KERNEL);
1028         if (table == NULL)
1029                 goto err_kzalloc;
1030
1031         table->name = nla_strdup(attr, GFP_KERNEL);
1032         if (table->name == NULL)
1033                 goto err_strdup;
1034
1035         if (nla[NFTA_TABLE_USERDATA]) {
1036                 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL);
1037                 if (table->udata == NULL)
1038                         goto err_table_udata;
1039
1040                 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]);
1041         }
1042
1043         err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
1044         if (err)
1045                 goto err_chain_ht;
1046
1047         INIT_LIST_HEAD(&table->chains);
1048         INIT_LIST_HEAD(&table->sets);
1049         INIT_LIST_HEAD(&table->objects);
1050         INIT_LIST_HEAD(&table->flowtables);
1051         table->family = family;
1052         table->flags = flags;
1053         table->handle = ++table_handle;
1054
1055         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
1056         err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
1057         if (err < 0)
1058                 goto err_trans;
1059
1060         list_add_tail_rcu(&table->list, &net->nft.tables);
1061         return 0;
1062 err_trans:
1063         rhltable_destroy(&table->chains_ht);
1064 err_chain_ht:
1065         kfree(table->udata);
1066 err_table_udata:
1067         kfree(table->name);
1068 err_strdup:
1069         kfree(table);
1070 err_kzalloc:
1071         return err;
1072 }
1073
1074 static int nft_flush_table(struct nft_ctx *ctx)
1075 {
1076         struct nft_flowtable *flowtable, *nft;
1077         struct nft_chain *chain, *nc;
1078         struct nft_object *obj, *ne;
1079         struct nft_set *set, *ns;
1080         int err;
1081
1082         list_for_each_entry(chain, &ctx->table->chains, list) {
1083                 if (!nft_is_active_next(ctx->net, chain))
1084                         continue;
1085
1086                 if (nft_chain_is_bound(chain))
1087                         continue;
1088
1089                 ctx->chain = chain;
1090
1091                 err = nft_delrule_by_chain(ctx);
1092                 if (err < 0)
1093                         goto out;
1094         }
1095
1096         list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
1097                 if (!nft_is_active_next(ctx->net, set))
1098                         continue;
1099
1100                 if (nft_set_is_anonymous(set) &&
1101                     !list_empty(&set->bindings))
1102                         continue;
1103
1104                 err = nft_delset(ctx, set);
1105                 if (err < 0)
1106                         goto out;
1107         }
1108
1109         list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
1110                 if (!nft_is_active_next(ctx->net, flowtable))
1111                         continue;
1112
1113                 err = nft_delflowtable(ctx, flowtable);
1114                 if (err < 0)
1115                         goto out;
1116         }
1117
1118         list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
1119                 if (!nft_is_active_next(ctx->net, obj))
1120                         continue;
1121
1122                 err = nft_delobj(ctx, obj);
1123                 if (err < 0)
1124                         goto out;
1125         }
1126
1127         list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
1128                 if (!nft_is_active_next(ctx->net, chain))
1129                         continue;
1130
1131                 if (nft_chain_is_bound(chain))
1132                         continue;
1133
1134                 ctx->chain = chain;
1135
1136                 err = nft_delchain(ctx);
1137                 if (err < 0)
1138                         goto out;
1139         }
1140
1141         err = nft_deltable(ctx);
1142 out:
1143         return err;
1144 }
1145
1146 static int nft_flush(struct nft_ctx *ctx, int family)
1147 {
1148         struct nft_table *table, *nt;
1149         const struct nlattr * const *nla = ctx->nla;
1150         int err = 0;
1151
1152         list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
1153                 if (family != AF_UNSPEC && table->family != family)
1154                         continue;
1155
1156                 ctx->family = table->family;
1157
1158                 if (!nft_is_active_next(ctx->net, table))
1159                         continue;
1160
1161                 if (nla[NFTA_TABLE_NAME] &&
1162                     nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1163                         continue;
1164
1165                 ctx->table = table;
1166
1167                 err = nft_flush_table(ctx);
1168                 if (err < 0)
1169                         goto out;
1170         }
1171 out:
1172         return err;
1173 }
1174
1175 static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1176                               struct sk_buff *skb, const struct nlmsghdr *nlh,
1177                               const struct nlattr * const nla[],
1178                               struct netlink_ext_ack *extack)
1179 {
1180         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1181         u8 genmask = nft_genmask_next(net);
1182         int family = nfmsg->nfgen_family;
1183         const struct nlattr *attr;
1184         struct nft_table *table;
1185         struct nft_ctx ctx;
1186
1187         nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
1188         if (family == AF_UNSPEC ||
1189             (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
1190                 return nft_flush(&ctx, family);
1191
1192         if (nla[NFTA_TABLE_HANDLE]) {
1193                 attr = nla[NFTA_TABLE_HANDLE];
1194                 table = nft_table_lookup_byhandle(net, attr, genmask);
1195         } else {
1196                 attr = nla[NFTA_TABLE_NAME];
1197                 table = nft_table_lookup(net, attr, family, genmask);
1198         }
1199
1200         if (IS_ERR(table)) {
1201                 NL_SET_BAD_ATTR(extack, attr);
1202                 return PTR_ERR(table);
1203         }
1204
1205         if (nlh->nlmsg_flags & NLM_F_NONREC &&
1206             table->use > 0)
1207                 return -EBUSY;
1208
1209         ctx.family = family;
1210         ctx.table = table;
1211
1212         return nft_flush_table(&ctx);
1213 }
1214
1215 static void nf_tables_table_destroy(struct nft_ctx *ctx)
1216 {
1217         if (WARN_ON(ctx->table->use > 0))
1218                 return;
1219
1220         rhltable_destroy(&ctx->table->chains_ht);
1221         kfree(ctx->table->name);
1222         kfree(ctx->table->udata);
1223         kfree(ctx->table);
1224 }
1225
1226 void nft_register_chain_type(const struct nft_chain_type *ctype)
1227 {
1228         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1229         if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
1230                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1231                 return;
1232         }
1233         chain_type[ctype->family][ctype->type] = ctype;
1234         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1235 }
1236 EXPORT_SYMBOL_GPL(nft_register_chain_type);
1237
1238 void nft_unregister_chain_type(const struct nft_chain_type *ctype)
1239 {
1240         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1241         chain_type[ctype->family][ctype->type] = NULL;
1242         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1243 }
1244 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
1245
1246 /*
1247  * Chains
1248  */
1249
1250 static struct nft_chain *
1251 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
1252 {
1253         struct nft_chain *chain;
1254
1255         list_for_each_entry(chain, &table->chains, list) {
1256                 if (chain->handle == handle &&
1257                     nft_active_genmask(chain, genmask))
1258                         return chain;
1259         }
1260
1261         return ERR_PTR(-ENOENT);
1262 }
1263
1264 static bool lockdep_commit_lock_is_held(const struct net *net)
1265 {
1266 #ifdef CONFIG_PROVE_LOCKING
1267         return lockdep_is_held(&net->nft.commit_mutex);
1268 #else
1269         return true;
1270 #endif
1271 }
1272
1273 static struct nft_chain *nft_chain_lookup(struct net *net,
1274                                           struct nft_table *table,
1275                                           const struct nlattr *nla, u8 genmask)
1276 {
1277         char search[NFT_CHAIN_MAXNAMELEN + 1];
1278         struct rhlist_head *tmp, *list;
1279         struct nft_chain *chain;
1280
1281         if (nla == NULL)
1282                 return ERR_PTR(-EINVAL);
1283
1284         nla_strlcpy(search, nla, sizeof(search));
1285
1286         WARN_ON(!rcu_read_lock_held() &&
1287                 !lockdep_commit_lock_is_held(net));
1288
1289         chain = ERR_PTR(-ENOENT);
1290         rcu_read_lock();
1291         list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1292         if (!list)
1293                 goto out_unlock;
1294
1295         rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1296                 if (nft_active_genmask(chain, genmask))
1297                         goto out_unlock;
1298         }
1299         chain = ERR_PTR(-ENOENT);
1300 out_unlock:
1301         rcu_read_unlock();
1302         return chain;
1303 }
1304
1305 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
1306         [NFTA_CHAIN_TABLE]      = { .type = NLA_STRING,
1307                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
1308         [NFTA_CHAIN_HANDLE]     = { .type = NLA_U64 },
1309         [NFTA_CHAIN_NAME]       = { .type = NLA_STRING,
1310                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
1311         [NFTA_CHAIN_HOOK]       = { .type = NLA_NESTED },
1312         [NFTA_CHAIN_POLICY]     = { .type = NLA_U32 },
1313         [NFTA_CHAIN_TYPE]       = { .type = NLA_STRING,
1314                                     .len = NFT_MODULE_AUTOLOAD_LIMIT },
1315         [NFTA_CHAIN_COUNTERS]   = { .type = NLA_NESTED },
1316         [NFTA_CHAIN_FLAGS]      = { .type = NLA_U32 },
1317         [NFTA_CHAIN_ID]         = { .type = NLA_U32 },
1318         [NFTA_CHAIN_USERDATA]   = { .type = NLA_BINARY,
1319                                     .len = NFT_USERDATA_MAXLEN },
1320 };
1321
1322 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1323         [NFTA_HOOK_HOOKNUM]     = { .type = NLA_U32 },
1324         [NFTA_HOOK_PRIORITY]    = { .type = NLA_U32 },
1325         [NFTA_HOOK_DEV]         = { .type = NLA_STRING,
1326                                     .len = IFNAMSIZ - 1 },
1327 };
1328
1329 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1330 {
1331         struct nft_stats *cpu_stats, total;
1332         struct nlattr *nest;
1333         unsigned int seq;
1334         u64 pkts, bytes;
1335         int cpu;
1336
1337         if (!stats)
1338                 return 0;
1339
1340         memset(&total, 0, sizeof(total));
1341         for_each_possible_cpu(cpu) {
1342                 cpu_stats = per_cpu_ptr(stats, cpu);
1343                 do {
1344                         seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1345                         pkts = cpu_stats->pkts;
1346                         bytes = cpu_stats->bytes;
1347                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1348                 total.pkts += pkts;
1349                 total.bytes += bytes;
1350         }
1351         nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
1352         if (nest == NULL)
1353                 goto nla_put_failure;
1354
1355         if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1356                          NFTA_COUNTER_PAD) ||
1357             nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1358                          NFTA_COUNTER_PAD))
1359                 goto nla_put_failure;
1360
1361         nla_nest_end(skb, nest);
1362         return 0;
1363
1364 nla_put_failure:
1365         return -ENOSPC;
1366 }
1367
1368 static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
1369                                    const struct nft_base_chain *basechain)
1370 {
1371         const struct nf_hook_ops *ops = &basechain->ops;
1372         struct nft_hook *hook, *first = NULL;
1373         struct nlattr *nest, *nest_devs;
1374         int n = 0;
1375
1376         nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1377         if (nest == NULL)
1378                 goto nla_put_failure;
1379         if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1380                 goto nla_put_failure;
1381         if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1382                 goto nla_put_failure;
1383
1384         if (nft_base_chain_netdev(family, ops->hooknum)) {
1385                 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
1386                 list_for_each_entry(hook, &basechain->hook_list, list) {
1387                         if (!first)
1388                                 first = hook;
1389
1390                         if (nla_put_string(skb, NFTA_DEVICE_NAME,
1391                                            hook->ops.dev->name))
1392                                 goto nla_put_failure;
1393                         n++;
1394                 }
1395                 nla_nest_end(skb, nest_devs);
1396
1397                 if (n == 1 &&
1398                     nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name))
1399                         goto nla_put_failure;
1400         }
1401         nla_nest_end(skb, nest);
1402
1403         return 0;
1404 nla_put_failure:
1405         return -1;
1406 }
1407
1408 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1409                                      u32 portid, u32 seq, int event, u32 flags,
1410                                      int family, const struct nft_table *table,
1411                                      const struct nft_chain *chain)
1412 {
1413         struct nlmsghdr *nlh;
1414         struct nfgenmsg *nfmsg;
1415
1416         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1417         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1418         if (nlh == NULL)
1419                 goto nla_put_failure;
1420
1421         nfmsg = nlmsg_data(nlh);
1422         nfmsg->nfgen_family     = family;
1423         nfmsg->version          = NFNETLINK_V0;
1424         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
1425
1426         if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1427                 goto nla_put_failure;
1428         if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1429                          NFTA_CHAIN_PAD))
1430                 goto nla_put_failure;
1431         if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1432                 goto nla_put_failure;
1433
1434         if (nft_is_base_chain(chain)) {
1435                 const struct nft_base_chain *basechain = nft_base_chain(chain);
1436                 struct nft_stats __percpu *stats;
1437
1438                 if (nft_dump_basechain_hook(skb, family, basechain))
1439                         goto nla_put_failure;
1440
1441                 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1442                                  htonl(basechain->policy)))
1443                         goto nla_put_failure;
1444
1445                 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1446                         goto nla_put_failure;
1447
1448                 stats = rcu_dereference_check(basechain->stats,
1449                                               lockdep_commit_lock_is_held(net));
1450                 if (nft_dump_stats(skb, stats))
1451                         goto nla_put_failure;
1452         }
1453
1454         if (chain->flags &&
1455             nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags)))
1456                 goto nla_put_failure;
1457
1458         if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1459                 goto nla_put_failure;
1460
1461         if (chain->udata &&
1462             nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata))
1463                 goto nla_put_failure;
1464
1465         nlmsg_end(skb, nlh);
1466         return 0;
1467
1468 nla_put_failure:
1469         nlmsg_trim(skb, nlh);
1470         return -1;
1471 }
1472
1473 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1474 {
1475         struct sk_buff *skb;
1476         int err;
1477         char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
1478                               ctx->table->name, ctx->table->handle,
1479                               ctx->chain->name, ctx->chain->handle);
1480
1481         audit_log_nfcfg(buf,
1482                         ctx->family,
1483                         ctx->chain->use,
1484                         event == NFT_MSG_NEWCHAIN ?
1485                                 AUDIT_NFT_OP_CHAIN_REGISTER :
1486                                 AUDIT_NFT_OP_CHAIN_UNREGISTER,
1487                         GFP_KERNEL);
1488         kfree(buf);
1489
1490         if (!ctx->report &&
1491             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1492                 return;
1493
1494         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1495         if (skb == NULL)
1496                 goto err;
1497
1498         err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1499                                         event, 0, ctx->family, ctx->table,
1500                                         ctx->chain);
1501         if (err < 0) {
1502                 kfree_skb(skb);
1503                 goto err;
1504         }
1505
1506         nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
1507         return;
1508 err:
1509         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1510 }
1511
1512 static int nf_tables_dump_chains(struct sk_buff *skb,
1513                                  struct netlink_callback *cb)
1514 {
1515         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1516         const struct nft_table *table;
1517         const struct nft_chain *chain;
1518         unsigned int idx = 0, s_idx = cb->args[0];
1519         struct net *net = sock_net(skb->sk);
1520         int family = nfmsg->nfgen_family;
1521
1522         rcu_read_lock();
1523         cb->seq = net->nft.base_seq;
1524
1525         list_for_each_entry_rcu(table, &net->nft.tables, list) {
1526                 if (family != NFPROTO_UNSPEC && family != table->family)
1527                         continue;
1528
1529                 list_for_each_entry_rcu(chain, &table->chains, list) {
1530                         if (idx < s_idx)
1531                                 goto cont;
1532                         if (idx > s_idx)
1533                                 memset(&cb->args[1], 0,
1534                                        sizeof(cb->args) - sizeof(cb->args[0]));
1535                         if (!nft_is_active(net, chain))
1536                                 continue;
1537                         if (nf_tables_fill_chain_info(skb, net,
1538                                                       NETLINK_CB(cb->skb).portid,
1539                                                       cb->nlh->nlmsg_seq,
1540                                                       NFT_MSG_NEWCHAIN,
1541                                                       NLM_F_MULTI,
1542                                                       table->family, table,
1543                                                       chain) < 0)
1544                                 goto done;
1545
1546                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1547 cont:
1548                         idx++;
1549                 }
1550         }
1551 done:
1552         rcu_read_unlock();
1553         cb->args[0] = idx;
1554         return skb->len;
1555 }
1556
1557 /* called with rcu_read_lock held */
1558 static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1559                               struct sk_buff *skb, const struct nlmsghdr *nlh,
1560                               const struct nlattr * const nla[],
1561                               struct netlink_ext_ack *extack)
1562 {
1563         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1564         u8 genmask = nft_genmask_cur(net);
1565         const struct nft_chain *chain;
1566         struct nft_table *table;
1567         struct sk_buff *skb2;
1568         int family = nfmsg->nfgen_family;
1569         int err;
1570
1571         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1572                 struct netlink_dump_control c = {
1573                         .dump = nf_tables_dump_chains,
1574                         .module = THIS_MODULE,
1575                 };
1576
1577                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
1578         }
1579
1580         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1581         if (IS_ERR(table)) {
1582                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1583                 return PTR_ERR(table);
1584         }
1585
1586         chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
1587         if (IS_ERR(chain)) {
1588                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
1589                 return PTR_ERR(chain);
1590         }
1591
1592         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1593         if (!skb2)
1594                 return -ENOMEM;
1595
1596         err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1597                                         nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1598                                         family, table, chain);
1599         if (err < 0)
1600                 goto err_fill_chain_info;
1601
1602         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
1603
1604 err_fill_chain_info:
1605         kfree_skb(skb2);
1606         return err;
1607 }
1608
1609 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1610         [NFTA_COUNTER_PACKETS]  = { .type = NLA_U64 },
1611         [NFTA_COUNTER_BYTES]    = { .type = NLA_U64 },
1612 };
1613
1614 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1615 {
1616         struct nlattr *tb[NFTA_COUNTER_MAX+1];
1617         struct nft_stats __percpu *newstats;
1618         struct nft_stats *stats;
1619         int err;
1620
1621         err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1622                                           nft_counter_policy, NULL);
1623         if (err < 0)
1624                 return ERR_PTR(err);
1625
1626         if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1627                 return ERR_PTR(-EINVAL);
1628
1629         newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1630         if (newstats == NULL)
1631                 return ERR_PTR(-ENOMEM);
1632
1633         /* Restore old counters on this cpu, no problem. Per-cpu statistics
1634          * are not exposed to userspace.
1635          */
1636         preempt_disable();
1637         stats = this_cpu_ptr(newstats);
1638         stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1639         stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1640         preempt_enable();
1641
1642         return newstats;
1643 }
1644
1645 static void nft_chain_stats_replace(struct nft_trans *trans)
1646 {
1647         struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
1648
1649         if (!nft_trans_chain_stats(trans))
1650                 return;
1651
1652         nft_trans_chain_stats(trans) =
1653                 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans),
1654                                     lockdep_commit_lock_is_held(trans->ctx.net));
1655
1656         if (!nft_trans_chain_stats(trans))
1657                 static_branch_inc(&nft_counters_enabled);
1658 }
1659
1660 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1661 {
1662         struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1663         struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1664
1665         if (g0 != g1)
1666                 kvfree(g1);
1667         kvfree(g0);
1668
1669         /* should be NULL either via abort or via successful commit */
1670         WARN_ON_ONCE(chain->rules_next);
1671         kvfree(chain->rules_next);
1672 }
1673
1674 void nf_tables_chain_destroy(struct nft_ctx *ctx)
1675 {
1676         struct nft_chain *chain = ctx->chain;
1677         struct nft_hook *hook, *next;
1678
1679         if (WARN_ON(chain->use > 0))
1680                 return;
1681
1682         /* no concurrent access possible anymore */
1683         nf_tables_chain_free_chain_rules(chain);
1684
1685         if (nft_is_base_chain(chain)) {
1686                 struct nft_base_chain *basechain = nft_base_chain(chain);
1687
1688                 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
1689                         list_for_each_entry_safe(hook, next,
1690                                                  &basechain->hook_list, list) {
1691                                 list_del_rcu(&hook->list);
1692                                 kfree_rcu(hook, rcu);
1693                         }
1694                 }
1695                 module_put(basechain->type->owner);
1696                 if (rcu_access_pointer(basechain->stats)) {
1697                         static_branch_dec(&nft_counters_enabled);
1698                         free_percpu(rcu_dereference_raw(basechain->stats));
1699                 }
1700                 kfree(chain->name);
1701                 kfree(chain->udata);
1702                 kfree(basechain);
1703         } else {
1704                 kfree(chain->name);
1705                 kfree(chain->udata);
1706                 kfree(chain);
1707         }
1708 }
1709
1710 static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
1711                                               const struct nlattr *attr)
1712 {
1713         struct net_device *dev;
1714         char ifname[IFNAMSIZ];
1715         struct nft_hook *hook;
1716         int err;
1717
1718         hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1719         if (!hook) {
1720                 err = -ENOMEM;
1721                 goto err_hook_alloc;
1722         }
1723
1724         nla_strlcpy(ifname, attr, IFNAMSIZ);
1725         dev = __dev_get_by_name(net, ifname);
1726         if (!dev) {
1727                 err = -ENOENT;
1728                 goto err_hook_dev;
1729         }
1730         hook->ops.dev = dev;
1731         hook->inactive = false;
1732
1733         return hook;
1734
1735 err_hook_dev:
1736         kfree(hook);
1737 err_hook_alloc:
1738         return ERR_PTR(err);
1739 }
1740
1741 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,
1742                                            const struct nft_hook *this)
1743 {
1744         struct nft_hook *hook;
1745
1746         list_for_each_entry(hook, hook_list, list) {
1747                 if (this->ops.dev == hook->ops.dev)
1748                         return hook;
1749         }
1750
1751         return NULL;
1752 }
1753
1754 static int nf_tables_parse_netdev_hooks(struct net *net,
1755                                         const struct nlattr *attr,
1756                                         struct list_head *hook_list)
1757 {
1758         struct nft_hook *hook, *next;
1759         const struct nlattr *tmp;
1760         int rem, n = 0, err;
1761
1762         nla_for_each_nested(tmp, attr, rem) {
1763                 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
1764                         err = -EINVAL;
1765                         goto err_hook;
1766                 }
1767
1768                 hook = nft_netdev_hook_alloc(net, tmp);
1769                 if (IS_ERR(hook)) {
1770                         err = PTR_ERR(hook);
1771                         goto err_hook;
1772                 }
1773                 if (nft_hook_list_find(hook_list, hook)) {
1774                         kfree(hook);
1775                         err = -EEXIST;
1776                         goto err_hook;
1777                 }
1778                 list_add_tail(&hook->list, hook_list);
1779                 n++;
1780
1781                 if (n == NFT_NETDEVICE_MAX) {
1782                         err = -EFBIG;
1783                         goto err_hook;
1784                 }
1785         }
1786
1787         return 0;
1788
1789 err_hook:
1790         list_for_each_entry_safe(hook, next, hook_list, list) {
1791                 list_del(&hook->list);
1792                 kfree(hook);
1793         }
1794         return err;
1795 }
1796
1797 struct nft_chain_hook {
1798         u32                             num;
1799         s32                             priority;
1800         const struct nft_chain_type     *type;
1801         struct list_head                list;
1802 };
1803
1804 static int nft_chain_parse_netdev(struct net *net,
1805                                   struct nlattr *tb[],
1806                                   struct list_head *hook_list)
1807 {
1808         struct nft_hook *hook;
1809         int err;
1810
1811         if (tb[NFTA_HOOK_DEV]) {
1812                 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
1813                 if (IS_ERR(hook))
1814                         return PTR_ERR(hook);
1815
1816                 list_add_tail(&hook->list, hook_list);
1817         } else if (tb[NFTA_HOOK_DEVS]) {
1818                 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
1819                                                    hook_list);
1820                 if (err < 0)
1821                         return err;
1822
1823                 if (list_empty(hook_list))
1824                         return -EINVAL;
1825         } else {
1826                 return -EINVAL;
1827         }
1828
1829         return 0;
1830 }
1831
1832 static int nft_chain_parse_hook(struct net *net,
1833                                 const struct nlattr * const nla[],
1834                                 struct nft_chain_hook *hook, u8 family,
1835                                 bool autoload)
1836 {
1837         struct nlattr *ha[NFTA_HOOK_MAX + 1];
1838         const struct nft_chain_type *type;
1839         int err;
1840
1841         lockdep_assert_held(&net->nft.commit_mutex);
1842         lockdep_nfnl_nft_mutex_not_held();
1843
1844         err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
1845                                           nla[NFTA_CHAIN_HOOK],
1846                                           nft_hook_policy, NULL);
1847         if (err < 0)
1848                 return err;
1849
1850         if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1851             ha[NFTA_HOOK_PRIORITY] == NULL)
1852                 return -EINVAL;
1853
1854         hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1855         hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1856
1857         type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
1858         if (!type)
1859                 return -EOPNOTSUPP;
1860
1861         if (nla[NFTA_CHAIN_TYPE]) {
1862                 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
1863                                                    family, autoload);
1864                 if (IS_ERR(type))
1865                         return PTR_ERR(type);
1866         }
1867         if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
1868                 return -EOPNOTSUPP;
1869
1870         if (type->type == NFT_CHAIN_T_NAT &&
1871             hook->priority <= NF_IP_PRI_CONNTRACK)
1872                 return -EOPNOTSUPP;
1873
1874         if (!try_module_get(type->owner))
1875                 return -ENOENT;
1876
1877         hook->type = type;
1878
1879         INIT_LIST_HEAD(&hook->list);
1880         if (nft_base_chain_netdev(family, hook->num)) {
1881                 err = nft_chain_parse_netdev(net, ha, &hook->list);
1882                 if (err < 0) {
1883                         module_put(type->owner);
1884                         return err;
1885                 }
1886         } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) {
1887                 module_put(type->owner);
1888                 return -EOPNOTSUPP;
1889         }
1890
1891         return 0;
1892 }
1893
1894 static void nft_chain_release_hook(struct nft_chain_hook *hook)
1895 {
1896         struct nft_hook *h, *next;
1897
1898         list_for_each_entry_safe(h, next, &hook->list, list) {
1899                 list_del(&h->list);
1900                 kfree(h);
1901         }
1902         module_put(hook->type->owner);
1903 }
1904
1905 struct nft_rules_old {
1906         struct rcu_head h;
1907         struct nft_rule **start;
1908 };
1909
1910 static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1911                                                      unsigned int alloc)
1912 {
1913         if (alloc > INT_MAX)
1914                 return NULL;
1915
1916         alloc += 1;     /* NULL, ends rules */
1917         if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1918                 return NULL;
1919
1920         alloc *= sizeof(struct nft_rule *);
1921         alloc += sizeof(struct nft_rules_old);
1922
1923         return kvmalloc(alloc, GFP_KERNEL);
1924 }
1925
1926 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family,
1927                                     const struct nft_chain_hook *hook,
1928                                     struct nft_chain *chain)
1929 {
1930         ops->pf         = family;
1931         ops->hooknum    = hook->num;
1932         ops->priority   = hook->priority;
1933         ops->priv       = chain;
1934         ops->hook       = hook->type->hooks[ops->hooknum];
1935 }
1936
1937 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
1938                               struct nft_chain_hook *hook, u32 flags)
1939 {
1940         struct nft_chain *chain;
1941         struct nft_hook *h;
1942
1943         basechain->type = hook->type;
1944         INIT_LIST_HEAD(&basechain->hook_list);
1945         chain = &basechain->chain;
1946
1947         if (nft_base_chain_netdev(family, hook->num)) {
1948                 list_splice_init(&hook->list, &basechain->hook_list);
1949                 list_for_each_entry(h, &basechain->hook_list, list)
1950                         nft_basechain_hook_init(&h->ops, family, hook, chain);
1951
1952                 basechain->ops.hooknum  = hook->num;
1953                 basechain->ops.priority = hook->priority;
1954         } else {
1955                 nft_basechain_hook_init(&basechain->ops, family, hook, chain);
1956         }
1957
1958         chain->flags |= NFT_CHAIN_BASE | flags;
1959         basechain->policy = NF_ACCEPT;
1960         if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
1961             nft_chain_offload_priority(basechain) < 0)
1962                 return -EOPNOTSUPP;
1963
1964         flow_block_init(&basechain->flow_block);
1965
1966         return 0;
1967 }
1968
1969 static int nft_chain_add(struct nft_table *table, struct nft_chain *chain)
1970 {
1971         int err;
1972
1973         err = rhltable_insert_key(&table->chains_ht, chain->name,
1974                                   &chain->rhlhead, nft_chain_ht_params);
1975         if (err)
1976                 return err;
1977
1978         list_add_tail_rcu(&chain->list, &table->chains);
1979
1980         return 0;
1981 }
1982
1983 static u64 chain_id;
1984
1985 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1986                               u8 policy, u32 flags)
1987 {
1988         const struct nlattr * const *nla = ctx->nla;
1989         struct nft_table *table = ctx->table;
1990         struct nft_base_chain *basechain;
1991         struct nft_stats __percpu *stats;
1992         struct net *net = ctx->net;
1993         char name[NFT_NAME_MAXLEN];
1994         struct nft_trans *trans;
1995         struct nft_chain *chain;
1996         struct nft_rule **rules;
1997         int err;
1998
1999         if (table->use == UINT_MAX)
2000                 return -EOVERFLOW;
2001
2002         if (nla[NFTA_CHAIN_HOOK]) {
2003                 struct nft_chain_hook hook;
2004
2005                 if (flags & NFT_CHAIN_BINDING)
2006                         return -EOPNOTSUPP;
2007
2008                 err = nft_chain_parse_hook(net, nla, &hook, family, true);
2009                 if (err < 0)
2010                         return err;
2011
2012                 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
2013                 if (basechain == NULL) {
2014                         nft_chain_release_hook(&hook);
2015                         return -ENOMEM;
2016                 }
2017                 chain = &basechain->chain;
2018
2019                 if (nla[NFTA_CHAIN_COUNTERS]) {
2020                         stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2021                         if (IS_ERR(stats)) {
2022                                 nft_chain_release_hook(&hook);
2023                                 kfree(basechain);
2024                                 return PTR_ERR(stats);
2025                         }
2026                         rcu_assign_pointer(basechain->stats, stats);
2027                         static_branch_inc(&nft_counters_enabled);
2028                 }
2029
2030                 err = nft_basechain_init(basechain, family, &hook, flags);
2031                 if (err < 0) {
2032                         nft_chain_release_hook(&hook);
2033                         kfree(basechain);
2034                         return err;
2035                 }
2036         } else {
2037                 if (flags & NFT_CHAIN_BASE)
2038                         return -EINVAL;
2039                 if (flags & NFT_CHAIN_HW_OFFLOAD)
2040                         return -EOPNOTSUPP;
2041
2042                 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
2043                 if (chain == NULL)
2044                         return -ENOMEM;
2045
2046                 chain->flags = flags;
2047         }
2048         ctx->chain = chain;
2049
2050         INIT_LIST_HEAD(&chain->rules);
2051         chain->handle = nf_tables_alloc_handle(table);
2052         chain->table = table;
2053
2054         if (nla[NFTA_CHAIN_NAME]) {
2055                 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2056         } else {
2057                 if (!(flags & NFT_CHAIN_BINDING)) {
2058                         err = -EINVAL;
2059                         goto err_destroy_chain;
2060                 }
2061
2062                 snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
2063                 chain->name = kstrdup(name, GFP_KERNEL);
2064         }
2065
2066         if (!chain->name) {
2067                 err = -ENOMEM;
2068                 goto err_destroy_chain;
2069         }
2070
2071         if (nla[NFTA_CHAIN_USERDATA]) {
2072                 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);
2073                 if (chain->udata == NULL) {
2074                         err = -ENOMEM;
2075                         goto err_destroy_chain;
2076                 }
2077                 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]);
2078         }
2079
2080         rules = nf_tables_chain_alloc_rules(chain, 0);
2081         if (!rules) {
2082                 err = -ENOMEM;
2083                 goto err_destroy_chain;
2084         }
2085
2086         *rules = NULL;
2087         rcu_assign_pointer(chain->rules_gen_0, rules);
2088         rcu_assign_pointer(chain->rules_gen_1, rules);
2089
2090         err = nf_tables_register_hook(net, table, chain);
2091         if (err < 0)
2092                 goto err_destroy_chain;
2093
2094         trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
2095         if (IS_ERR(trans)) {
2096                 err = PTR_ERR(trans);
2097                 goto err_unregister_hook;
2098         }
2099
2100         nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
2101         if (nft_is_base_chain(chain))
2102                 nft_trans_chain_policy(trans) = policy;
2103
2104         err = nft_chain_add(table, chain);
2105         if (err < 0) {
2106                 nft_trans_destroy(trans);
2107                 goto err_unregister_hook;
2108         }
2109
2110         table->use++;
2111
2112         return 0;
2113 err_unregister_hook:
2114         nf_tables_unregister_hook(net, table, chain);
2115 err_destroy_chain:
2116         nf_tables_chain_destroy(ctx);
2117
2118         return err;
2119 }
2120
2121 static bool nft_hook_list_equal(struct list_head *hook_list1,
2122                                 struct list_head *hook_list2)
2123 {
2124         struct nft_hook *hook;
2125         int n = 0, m = 0;
2126
2127         n = 0;
2128         list_for_each_entry(hook, hook_list2, list) {
2129                 if (!nft_hook_list_find(hook_list1, hook))
2130                         return false;
2131
2132                 n++;
2133         }
2134         list_for_each_entry(hook, hook_list1, list)
2135                 m++;
2136
2137         return n == m;
2138 }
2139
2140 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
2141                               u32 flags, const struct nlattr *attr,
2142                               struct netlink_ext_ack *extack)
2143 {
2144         const struct nlattr * const *nla = ctx->nla;
2145         struct nft_table *table = ctx->table;
2146         struct nft_chain *chain = ctx->chain;
2147         struct nft_base_chain *basechain;
2148         struct nft_stats *stats = NULL;
2149         struct nft_chain_hook hook;
2150         struct nf_hook_ops *ops;
2151         struct nft_trans *trans;
2152         int err;
2153
2154         if (chain->flags ^ flags)
2155                 return -EOPNOTSUPP;
2156
2157         if (nla[NFTA_CHAIN_HOOK]) {
2158                 if (!nft_is_base_chain(chain)) {
2159                         NL_SET_BAD_ATTR(extack, attr);
2160                         return -EEXIST;
2161                 }
2162                 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
2163                                            false);
2164                 if (err < 0)
2165                         return err;
2166
2167                 basechain = nft_base_chain(chain);
2168                 if (basechain->type != hook.type) {
2169                         nft_chain_release_hook(&hook);
2170                         NL_SET_BAD_ATTR(extack, attr);
2171                         return -EEXIST;
2172                 }
2173
2174                 if (nft_base_chain_netdev(ctx->family, hook.num)) {
2175                         if (!nft_hook_list_equal(&basechain->hook_list,
2176                                                  &hook.list)) {
2177                                 nft_chain_release_hook(&hook);
2178                                 NL_SET_BAD_ATTR(extack, attr);
2179                                 return -EEXIST;
2180                         }
2181                 } else {
2182                         ops = &basechain->ops;
2183                         if (ops->hooknum != hook.num ||
2184                             ops->priority != hook.priority) {
2185                                 nft_chain_release_hook(&hook);
2186                                 NL_SET_BAD_ATTR(extack, attr);
2187                                 return -EEXIST;
2188                         }
2189                 }
2190                 nft_chain_release_hook(&hook);
2191         }
2192
2193         if (nla[NFTA_CHAIN_HANDLE] &&
2194             nla[NFTA_CHAIN_NAME]) {
2195                 struct nft_chain *chain2;
2196
2197                 chain2 = nft_chain_lookup(ctx->net, table,
2198                                           nla[NFTA_CHAIN_NAME], genmask);
2199                 if (!IS_ERR(chain2)) {
2200                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2201                         return -EEXIST;
2202                 }
2203         }
2204
2205         if (nla[NFTA_CHAIN_COUNTERS]) {
2206                 if (!nft_is_base_chain(chain))
2207                         return -EOPNOTSUPP;
2208
2209                 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2210                 if (IS_ERR(stats))
2211                         return PTR_ERR(stats);
2212         }
2213
2214         err = -ENOMEM;
2215         trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
2216                                 sizeof(struct nft_trans_chain));
2217         if (trans == NULL)
2218                 goto err;
2219
2220         nft_trans_chain_stats(trans) = stats;
2221         nft_trans_chain_update(trans) = true;
2222
2223         if (nla[NFTA_CHAIN_POLICY])
2224                 nft_trans_chain_policy(trans) = policy;
2225         else
2226                 nft_trans_chain_policy(trans) = -1;
2227
2228         if (nla[NFTA_CHAIN_HANDLE] &&
2229             nla[NFTA_CHAIN_NAME]) {
2230                 struct nft_trans *tmp;
2231                 char *name;
2232
2233                 err = -ENOMEM;
2234                 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2235                 if (!name)
2236                         goto err;
2237
2238                 err = -EEXIST;
2239                 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
2240                         if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
2241                             tmp->ctx.table == table &&
2242                             nft_trans_chain_update(tmp) &&
2243                             nft_trans_chain_name(tmp) &&
2244                             strcmp(name, nft_trans_chain_name(tmp)) == 0) {
2245                                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2246                                 kfree(name);
2247                                 goto err;
2248                         }
2249                 }
2250
2251                 nft_trans_chain_name(trans) = name;
2252         }
2253         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
2254
2255         return 0;
2256 err:
2257         free_percpu(stats);
2258         kfree(trans);
2259         return err;
2260 }
2261
2262 static struct nft_chain *nft_chain_lookup_byid(const struct net *net,
2263                                                const struct nlattr *nla)
2264 {
2265         u32 id = ntohl(nla_get_be32(nla));
2266         struct nft_trans *trans;
2267
2268         list_for_each_entry(trans, &net->nft.commit_list, list) {
2269                 struct nft_chain *chain = trans->ctx.chain;
2270
2271                 if (trans->msg_type == NFT_MSG_NEWCHAIN &&
2272                     id == nft_trans_chain_id(trans))
2273                         return chain;
2274         }
2275         return ERR_PTR(-ENOENT);
2276 }
2277
2278 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
2279                               struct sk_buff *skb, const struct nlmsghdr *nlh,
2280                               const struct nlattr * const nla[],
2281                               struct netlink_ext_ack *extack)
2282 {
2283         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2284         u8 genmask = nft_genmask_next(net);
2285         int family = nfmsg->nfgen_family;
2286         struct nft_chain *chain = NULL;
2287         const struct nlattr *attr;
2288         struct nft_table *table;
2289         u8 policy = NF_ACCEPT;
2290         struct nft_ctx ctx;
2291         u64 handle = 0;
2292         u32 flags = 0;
2293
2294         lockdep_assert_held(&net->nft.commit_mutex);
2295
2296         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
2297         if (IS_ERR(table)) {
2298                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2299                 return PTR_ERR(table);
2300         }
2301
2302         chain = NULL;
2303         attr = nla[NFTA_CHAIN_NAME];
2304
2305         if (nla[NFTA_CHAIN_HANDLE]) {
2306                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
2307                 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2308                 if (IS_ERR(chain)) {
2309                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
2310                         return PTR_ERR(chain);
2311                 }
2312                 attr = nla[NFTA_CHAIN_HANDLE];
2313         } else if (nla[NFTA_CHAIN_NAME]) {
2314                 chain = nft_chain_lookup(net, table, attr, genmask);
2315                 if (IS_ERR(chain)) {
2316                         if (PTR_ERR(chain) != -ENOENT) {
2317                                 NL_SET_BAD_ATTR(extack, attr);
2318                                 return PTR_ERR(chain);
2319                         }
2320                         chain = NULL;
2321                 }
2322         } else if (!nla[NFTA_CHAIN_ID]) {
2323                 return -EINVAL;
2324         }
2325
2326         if (nla[NFTA_CHAIN_POLICY]) {
2327                 if (chain != NULL &&
2328                     !nft_is_base_chain(chain)) {
2329                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2330                         return -EOPNOTSUPP;
2331                 }
2332
2333                 if (chain == NULL &&
2334                     nla[NFTA_CHAIN_HOOK] == NULL) {
2335                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2336                         return -EOPNOTSUPP;
2337                 }
2338
2339                 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
2340                 switch (policy) {
2341                 case NF_DROP:
2342                 case NF_ACCEPT:
2343                         break;
2344                 default:
2345                         return -EINVAL;
2346                 }
2347         }
2348
2349         if (nla[NFTA_CHAIN_FLAGS])
2350                 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
2351         else if (chain)
2352                 flags = chain->flags;
2353
2354         if (flags & ~NFT_CHAIN_FLAGS)
2355                 return -EOPNOTSUPP;
2356
2357         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2358
2359         if (chain != NULL) {
2360                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2361                         NL_SET_BAD_ATTR(extack, attr);
2362                         return -EEXIST;
2363                 }
2364                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2365                         return -EOPNOTSUPP;
2366
2367                 flags |= chain->flags & NFT_CHAIN_BASE;
2368                 return nf_tables_updchain(&ctx, genmask, policy, flags, attr,
2369                                           extack);
2370         }
2371
2372         return nf_tables_addchain(&ctx, family, genmask, policy, flags);
2373 }
2374
2375 static int nf_tables_delchain(struct net *net, struct sock *nlsk,
2376                               struct sk_buff *skb, const struct nlmsghdr *nlh,
2377                               const struct nlattr * const nla[],
2378                               struct netlink_ext_ack *extack)
2379 {
2380         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2381         u8 genmask = nft_genmask_next(net);
2382         int family = nfmsg->nfgen_family;
2383         const struct nlattr *attr;
2384         struct nft_table *table;
2385         struct nft_chain *chain;
2386         struct nft_rule *rule;
2387         struct nft_ctx ctx;
2388         u64 handle;
2389         u32 use;
2390         int err;
2391
2392         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
2393         if (IS_ERR(table)) {
2394                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2395                 return PTR_ERR(table);
2396         }
2397
2398         if (nla[NFTA_CHAIN_HANDLE]) {
2399                 attr = nla[NFTA_CHAIN_HANDLE];
2400                 handle = be64_to_cpu(nla_get_be64(attr));
2401                 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2402         } else {
2403                 attr = nla[NFTA_CHAIN_NAME];
2404                 chain = nft_chain_lookup(net, table, attr, genmask);
2405         }
2406         if (IS_ERR(chain)) {
2407                 NL_SET_BAD_ATTR(extack, attr);
2408                 return PTR_ERR(chain);
2409         }
2410
2411         if (nlh->nlmsg_flags & NLM_F_NONREC &&
2412             chain->use > 0)
2413                 return -EBUSY;
2414
2415         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2416
2417         use = chain->use;
2418         list_for_each_entry(rule, &chain->rules, list) {
2419                 if (!nft_is_active_next(net, rule))
2420                         continue;
2421                 use--;
2422
2423                 err = nft_delrule(&ctx, rule);
2424                 if (err < 0)
2425                         return err;
2426         }
2427
2428         /* There are rules and elements that are still holding references to us,
2429          * we cannot do a recursive removal in this case.
2430          */
2431         if (use > 0) {
2432                 NL_SET_BAD_ATTR(extack, attr);
2433                 return -EBUSY;
2434         }
2435
2436         return nft_delchain(&ctx);
2437 }
2438
2439 /*
2440  * Expressions
2441  */
2442
2443 /**
2444  *      nft_register_expr - register nf_tables expr type
2445  *      @type: expr type
2446  *
2447  *      Registers the expr type for use with nf_tables. Returns zero on
2448  *      success or a negative errno code otherwise.
2449  */
2450 int nft_register_expr(struct nft_expr_type *type)
2451 {
2452         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2453         if (type->family == NFPROTO_UNSPEC)
2454                 list_add_tail_rcu(&type->list, &nf_tables_expressions);
2455         else
2456                 list_add_rcu(&type->list, &nf_tables_expressions);
2457         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2458         return 0;
2459 }
2460 EXPORT_SYMBOL_GPL(nft_register_expr);
2461
2462 /**
2463  *      nft_unregister_expr - unregister nf_tables expr type
2464  *      @type: expr type
2465  *
2466  *      Unregisters the expr typefor use with nf_tables.
2467  */
2468 void nft_unregister_expr(struct nft_expr_type *type)
2469 {
2470         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2471         list_del_rcu(&type->list);
2472         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2473 }
2474 EXPORT_SYMBOL_GPL(nft_unregister_expr);
2475
2476 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2477                                                        struct nlattr *nla)
2478 {
2479         const struct nft_expr_type *type, *candidate = NULL;
2480
2481         list_for_each_entry(type, &nf_tables_expressions, list) {
2482                 if (!nla_strcmp(nla, type->name)) {
2483                         if (!type->family && !candidate)
2484                                 candidate = type;
2485                         else if (type->family == family)
2486                                 candidate = type;
2487                 }
2488         }
2489         return candidate;
2490 }
2491
2492 #ifdef CONFIG_MODULES
2493 static int nft_expr_type_request_module(struct net *net, u8 family,
2494                                         struct nlattr *nla)
2495 {
2496         if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2497                                nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
2498                 return -EAGAIN;
2499
2500         return 0;
2501 }
2502 #endif
2503
2504 static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2505                                                      u8 family,
2506                                                      struct nlattr *nla)
2507 {
2508         const struct nft_expr_type *type;
2509
2510         if (nla == NULL)
2511                 return ERR_PTR(-EINVAL);
2512
2513         type = __nft_expr_type_get(family, nla);
2514         if (type != NULL && try_module_get(type->owner))
2515                 return type;
2516
2517         lockdep_nfnl_nft_mutex_not_held();
2518 #ifdef CONFIG_MODULES
2519         if (type == NULL) {
2520                 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
2521                         return ERR_PTR(-EAGAIN);
2522
2523                 if (nft_request_module(net, "nft-expr-%.*s",
2524                                        nla_len(nla),
2525                                        (char *)nla_data(nla)) == -EAGAIN)
2526                         return ERR_PTR(-EAGAIN);
2527         }
2528 #endif
2529         return ERR_PTR(-ENOENT);
2530 }
2531
2532 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2533         [NFTA_EXPR_NAME]        = { .type = NLA_STRING,
2534                                     .len = NFT_MODULE_AUTOLOAD_LIMIT },
2535         [NFTA_EXPR_DATA]        = { .type = NLA_NESTED },
2536 };
2537
2538 static int nf_tables_fill_expr_info(struct sk_buff *skb,
2539                                     const struct nft_expr *expr)
2540 {
2541         if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
2542                 goto nla_put_failure;
2543
2544         if (expr->ops->dump) {
2545                 struct nlattr *data = nla_nest_start_noflag(skb,
2546                                                             NFTA_EXPR_DATA);
2547                 if (data == NULL)
2548                         goto nla_put_failure;
2549                 if (expr->ops->dump(skb, expr) < 0)
2550                         goto nla_put_failure;
2551                 nla_nest_end(skb, data);
2552         }
2553
2554         return skb->len;
2555
2556 nla_put_failure:
2557         return -1;
2558 };
2559
2560 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2561                   const struct nft_expr *expr)
2562 {
2563         struct nlattr *nest;
2564
2565         nest = nla_nest_start_noflag(skb, attr);
2566         if (!nest)
2567                 goto nla_put_failure;
2568         if (nf_tables_fill_expr_info(skb, expr) < 0)
2569                 goto nla_put_failure;
2570         nla_nest_end(skb, nest);
2571         return 0;
2572
2573 nla_put_failure:
2574         return -1;
2575 }
2576
2577 struct nft_expr_info {
2578         const struct nft_expr_ops       *ops;
2579         const struct nlattr             *attr;
2580         struct nlattr                   *tb[NFT_EXPR_MAXATTR + 1];
2581 };
2582
2583 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2584                                 const struct nlattr *nla,
2585                                 struct nft_expr_info *info)
2586 {
2587         const struct nft_expr_type *type;
2588         const struct nft_expr_ops *ops;
2589         struct nlattr *tb[NFTA_EXPR_MAX + 1];
2590         int err;
2591
2592         err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2593                                           nft_expr_policy, NULL);
2594         if (err < 0)
2595                 return err;
2596
2597         type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
2598         if (IS_ERR(type))
2599                 return PTR_ERR(type);
2600
2601         if (tb[NFTA_EXPR_DATA]) {
2602                 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2603                                                   tb[NFTA_EXPR_DATA],
2604                                                   type->policy, NULL);
2605                 if (err < 0)
2606                         goto err1;
2607         } else
2608                 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2609
2610         if (type->select_ops != NULL) {
2611                 ops = type->select_ops(ctx,
2612                                        (const struct nlattr * const *)info->tb);
2613                 if (IS_ERR(ops)) {
2614                         err = PTR_ERR(ops);
2615 #ifdef CONFIG_MODULES
2616                         if (err == -EAGAIN)
2617                                 if (nft_expr_type_request_module(ctx->net,
2618                                                                  ctx->family,
2619                                                                  tb[NFTA_EXPR_NAME]) != -EAGAIN)
2620                                         err = -ENOENT;
2621 #endif
2622                         goto err1;
2623                 }
2624         } else
2625                 ops = type->ops;
2626
2627         info->attr = nla;
2628         info->ops = ops;
2629
2630         return 0;
2631
2632 err1:
2633         module_put(type->owner);
2634         return err;
2635 }
2636
2637 static int nf_tables_newexpr(const struct nft_ctx *ctx,
2638                              const struct nft_expr_info *info,
2639                              struct nft_expr *expr)
2640 {
2641         const struct nft_expr_ops *ops = info->ops;
2642         int err;
2643
2644         expr->ops = ops;
2645         if (ops->init) {
2646                 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
2647                 if (err < 0)
2648                         goto err1;
2649         }
2650
2651         return 0;
2652 err1:
2653         expr->ops = NULL;
2654         return err;
2655 }
2656
2657 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2658                                    struct nft_expr *expr)
2659 {
2660         const struct nft_expr_type *type = expr->ops->type;
2661
2662         if (expr->ops->destroy)
2663                 expr->ops->destroy(ctx, expr);
2664         module_put(type->owner);
2665 }
2666
2667 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2668                                       const struct nlattr *nla)
2669 {
2670         struct nft_expr_info info;
2671         struct nft_expr *expr;
2672         struct module *owner;
2673         int err;
2674
2675         err = nf_tables_expr_parse(ctx, nla, &info);
2676         if (err < 0)
2677                 goto err1;
2678
2679         err = -ENOMEM;
2680         expr = kzalloc(info.ops->size, GFP_KERNEL);
2681         if (expr == NULL)
2682                 goto err2;
2683
2684         err = nf_tables_newexpr(ctx, &info, expr);
2685         if (err < 0)
2686                 goto err3;
2687
2688         return expr;
2689 err3:
2690         kfree(expr);
2691 err2:
2692         owner = info.ops->type->owner;
2693         if (info.ops->type->release_ops)
2694                 info.ops->type->release_ops(info.ops);
2695
2696         module_put(owner);
2697 err1:
2698         return ERR_PTR(err);
2699 }
2700
2701 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
2702 {
2703         int err;
2704
2705         if (src->ops->clone) {
2706                 dst->ops = src->ops;
2707                 err = src->ops->clone(dst, src);
2708                 if (err < 0)
2709                         return err;
2710         } else {
2711                 memcpy(dst, src, src->ops->size);
2712         }
2713
2714         __module_get(src->ops->type->owner);
2715
2716         return 0;
2717 }
2718
2719 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2720 {
2721         nf_tables_expr_destroy(ctx, expr);
2722         kfree(expr);
2723 }
2724
2725 /*
2726  * Rules
2727  */
2728
2729 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2730                                           u64 handle)
2731 {
2732         struct nft_rule *rule;
2733
2734         // FIXME: this sucks
2735         list_for_each_entry_rcu(rule, &chain->rules, list) {
2736                 if (handle == rule->handle)
2737                         return rule;
2738         }
2739
2740         return ERR_PTR(-ENOENT);
2741 }
2742
2743 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2744                                         const struct nlattr *nla)
2745 {
2746         if (nla == NULL)
2747                 return ERR_PTR(-EINVAL);
2748
2749         return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
2750 }
2751
2752 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
2753         [NFTA_RULE_TABLE]       = { .type = NLA_STRING,
2754                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
2755         [NFTA_RULE_CHAIN]       = { .type = NLA_STRING,
2756                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
2757         [NFTA_RULE_HANDLE]      = { .type = NLA_U64 },
2758         [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
2759         [NFTA_RULE_COMPAT]      = { .type = NLA_NESTED },
2760         [NFTA_RULE_POSITION]    = { .type = NLA_U64 },
2761         [NFTA_RULE_USERDATA]    = { .type = NLA_BINARY,
2762                                     .len = NFT_USERDATA_MAXLEN },
2763         [NFTA_RULE_ID]          = { .type = NLA_U32 },
2764         [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
2765         [NFTA_RULE_CHAIN_ID]    = { .type = NLA_U32 },
2766 };
2767
2768 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2769                                     u32 portid, u32 seq, int event,
2770                                     u32 flags, int family,
2771                                     const struct nft_table *table,
2772                                     const struct nft_chain *chain,
2773                                     const struct nft_rule *rule,
2774                                     const struct nft_rule *prule)
2775 {
2776         struct nlmsghdr *nlh;
2777         struct nfgenmsg *nfmsg;
2778         const struct nft_expr *expr, *next;
2779         struct nlattr *list;
2780         u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2781
2782         nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
2783         if (nlh == NULL)
2784                 goto nla_put_failure;
2785
2786         nfmsg = nlmsg_data(nlh);
2787         nfmsg->nfgen_family     = family;
2788         nfmsg->version          = NFNETLINK_V0;
2789         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
2790
2791         if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2792                 goto nla_put_failure;
2793         if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2794                 goto nla_put_failure;
2795         if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2796                          NFTA_RULE_PAD))
2797                 goto nla_put_failure;
2798
2799         if (event != NFT_MSG_DELRULE && prule) {
2800                 if (nla_put_be64(skb, NFTA_RULE_POSITION,
2801                                  cpu_to_be64(prule->handle),
2802                                  NFTA_RULE_PAD))
2803                         goto nla_put_failure;
2804         }
2805
2806         list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
2807         if (list == NULL)
2808                 goto nla_put_failure;
2809         nft_rule_for_each_expr(expr, next, rule) {
2810                 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
2811                         goto nla_put_failure;
2812         }
2813         nla_nest_end(skb, list);
2814
2815         if (rule->udata) {
2816                 struct nft_userdata *udata = nft_userdata(rule);
2817                 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2818                             udata->data) < 0)
2819                         goto nla_put_failure;
2820         }
2821
2822         nlmsg_end(skb, nlh);
2823         return 0;
2824
2825 nla_put_failure:
2826         nlmsg_trim(skb, nlh);
2827         return -1;
2828 }
2829
2830 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2831                                   const struct nft_rule *rule, int event)
2832 {
2833         struct sk_buff *skb;
2834         int err;
2835         char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
2836                               ctx->table->name, ctx->table->handle,
2837                               ctx->chain->name, ctx->chain->handle);
2838
2839         audit_log_nfcfg(buf,
2840                         ctx->family,
2841                         rule->handle,
2842                         event == NFT_MSG_NEWRULE ?
2843                                 AUDIT_NFT_OP_RULE_REGISTER :
2844                                 AUDIT_NFT_OP_RULE_UNREGISTER,
2845                         GFP_KERNEL);
2846         kfree(buf);
2847
2848         if (!ctx->report &&
2849             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2850                 return;
2851
2852         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2853         if (skb == NULL)
2854                 goto err;
2855
2856         err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2857                                        event, 0, ctx->family, ctx->table,
2858                                        ctx->chain, rule, NULL);
2859         if (err < 0) {
2860                 kfree_skb(skb);
2861                 goto err;
2862         }
2863
2864         nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
2865         return;
2866 err:
2867         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2868 }
2869
2870 struct nft_rule_dump_ctx {
2871         char *table;
2872         char *chain;
2873 };
2874
2875 static int __nf_tables_dump_rules(struct sk_buff *skb,
2876                                   unsigned int *idx,
2877                                   struct netlink_callback *cb,
2878                                   const struct nft_table *table,
2879                                   const struct nft_chain *chain)
2880 {
2881         struct net *net = sock_net(skb->sk);
2882         const struct nft_rule *rule, *prule;
2883         unsigned int s_idx = cb->args[0];
2884
2885         prule = NULL;
2886         list_for_each_entry_rcu(rule, &chain->rules, list) {
2887                 if (!nft_is_active(net, rule))
2888                         goto cont_skip;
2889                 if (*idx < s_idx)
2890                         goto cont;
2891                 if (*idx > s_idx) {
2892                         memset(&cb->args[1], 0,
2893                                         sizeof(cb->args) - sizeof(cb->args[0]));
2894                 }
2895                 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2896                                         cb->nlh->nlmsg_seq,
2897                                         NFT_MSG_NEWRULE,
2898                                         NLM_F_MULTI | NLM_F_APPEND,
2899                                         table->family,
2900                                         table, chain, rule, prule) < 0)
2901                         return 1;
2902
2903                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2904 cont:
2905                 prule = rule;
2906 cont_skip:
2907                 (*idx)++;
2908         }
2909         return 0;
2910 }
2911
2912 static int nf_tables_dump_rules(struct sk_buff *skb,
2913                                 struct netlink_callback *cb)
2914 {
2915         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2916         const struct nft_rule_dump_ctx *ctx = cb->data;
2917         struct nft_table *table;
2918         const struct nft_chain *chain;
2919         unsigned int idx = 0;
2920         struct net *net = sock_net(skb->sk);
2921         int family = nfmsg->nfgen_family;
2922
2923         rcu_read_lock();
2924         cb->seq = net->nft.base_seq;
2925
2926         list_for_each_entry_rcu(table, &net->nft.tables, list) {
2927                 if (family != NFPROTO_UNSPEC && family != table->family)
2928                         continue;
2929
2930                 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
2931                         continue;
2932
2933                 if (ctx && ctx->table && ctx->chain) {
2934                         struct rhlist_head *list, *tmp;
2935
2936                         list = rhltable_lookup(&table->chains_ht, ctx->chain,
2937                                                nft_chain_ht_params);
2938                         if (!list)
2939                                 goto done;
2940
2941                         rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2942                                 if (!nft_is_active(net, chain))
2943                                         continue;
2944                                 __nf_tables_dump_rules(skb, &idx,
2945                                                        cb, table, chain);
2946                                 break;
2947                         }
2948                         goto done;
2949                 }
2950
2951                 list_for_each_entry_rcu(chain, &table->chains, list) {
2952                         if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2953                                 goto done;
2954                 }
2955
2956                 if (ctx && ctx->table)
2957                         break;
2958         }
2959 done:
2960         rcu_read_unlock();
2961
2962         cb->args[0] = idx;
2963         return skb->len;
2964 }
2965
2966 static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2967 {
2968         const struct nlattr * const *nla = cb->data;
2969         struct nft_rule_dump_ctx *ctx = NULL;
2970
2971         if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2972                 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2973                 if (!ctx)
2974                         return -ENOMEM;
2975
2976                 if (nla[NFTA_RULE_TABLE]) {
2977                         ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2978                                                         GFP_ATOMIC);
2979                         if (!ctx->table) {
2980                                 kfree(ctx);
2981                                 return -ENOMEM;
2982                         }
2983                 }
2984                 if (nla[NFTA_RULE_CHAIN]) {
2985                         ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2986                                                 GFP_ATOMIC);
2987                         if (!ctx->chain) {
2988                                 kfree(ctx->table);
2989                                 kfree(ctx);
2990                                 return -ENOMEM;
2991                         }
2992                 }
2993         }
2994
2995         cb->data = ctx;
2996         return 0;
2997 }
2998
2999 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
3000 {
3001         struct nft_rule_dump_ctx *ctx = cb->data;
3002
3003         if (ctx) {
3004                 kfree(ctx->table);
3005                 kfree(ctx->chain);
3006                 kfree(ctx);
3007         }
3008         return 0;
3009 }
3010
3011 /* called with rcu_read_lock held */
3012 static int nf_tables_getrule(struct net *net, struct sock *nlsk,
3013                              struct sk_buff *skb, const struct nlmsghdr *nlh,
3014                              const struct nlattr * const nla[],
3015                              struct netlink_ext_ack *extack)
3016 {
3017         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3018         u8 genmask = nft_genmask_cur(net);
3019         const struct nft_chain *chain;
3020         const struct nft_rule *rule;
3021         struct nft_table *table;
3022         struct sk_buff *skb2;
3023         int family = nfmsg->nfgen_family;
3024         int err;
3025
3026         if (nlh->nlmsg_flags & NLM_F_DUMP) {
3027                 struct netlink_dump_control c = {
3028                         .start= nf_tables_dump_rules_start,
3029                         .dump = nf_tables_dump_rules,
3030                         .done = nf_tables_dump_rules_done,
3031                         .module = THIS_MODULE,
3032                         .data = (void *)nla,
3033                 };
3034
3035                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3036         }
3037
3038         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3039         if (IS_ERR(table)) {
3040                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3041                 return PTR_ERR(table);
3042         }
3043
3044         chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
3045         if (IS_ERR(chain)) {
3046                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3047                 return PTR_ERR(chain);
3048         }
3049
3050         rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3051         if (IS_ERR(rule)) {
3052                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3053                 return PTR_ERR(rule);
3054         }
3055
3056         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3057         if (!skb2)
3058                 return -ENOMEM;
3059
3060         err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
3061                                        nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
3062                                        family, table, chain, rule, NULL);
3063         if (err < 0)
3064                 goto err_fill_rule_info;
3065
3066         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
3067
3068 err_fill_rule_info:
3069         kfree_skb(skb2);
3070         return err;
3071 }
3072
3073 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
3074                                    struct nft_rule *rule)
3075 {
3076         struct nft_expr *expr, *next;
3077
3078         /*
3079          * Careful: some expressions might not be initialized in case this
3080          * is called on error from nf_tables_newrule().
3081          */
3082         expr = nft_expr_first(rule);
3083         while (nft_expr_more(rule, expr)) {
3084                 next = nft_expr_next(expr);
3085                 nf_tables_expr_destroy(ctx, expr);
3086                 expr = next;
3087         }
3088         kfree(rule);
3089 }
3090
3091 void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)
3092 {
3093         nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
3094         nf_tables_rule_destroy(ctx, rule);
3095 }
3096
3097 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
3098 {
3099         struct nft_expr *expr, *last;
3100         const struct nft_data *data;
3101         struct nft_rule *rule;
3102         int err;
3103
3104         if (ctx->level == NFT_JUMP_STACK_SIZE)
3105                 return -EMLINK;
3106
3107         list_for_each_entry(rule, &chain->rules, list) {
3108                 if (!nft_is_active_next(ctx->net, rule))
3109                         continue;
3110
3111                 nft_rule_for_each_expr(expr, last, rule) {
3112                         if (!expr->ops->validate)
3113                                 continue;
3114
3115                         err = expr->ops->validate(ctx, expr, &data);
3116                         if (err < 0)
3117                                 return err;
3118                 }
3119         }
3120
3121         return 0;
3122 }
3123 EXPORT_SYMBOL_GPL(nft_chain_validate);
3124
3125 static int nft_table_validate(struct net *net, const struct nft_table *table)
3126 {
3127         struct nft_chain *chain;
3128         struct nft_ctx ctx = {
3129                 .net    = net,
3130                 .family = table->family,
3131         };
3132         int err;
3133
3134         list_for_each_entry(chain, &table->chains, list) {
3135                 if (!nft_is_base_chain(chain))
3136                         continue;
3137
3138                 ctx.chain = chain;
3139                 err = nft_chain_validate(&ctx, chain);
3140                 if (err < 0)
3141                         return err;
3142         }
3143
3144         return 0;
3145 }
3146
3147 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3148                                              const struct nlattr *nla);
3149
3150 #define NFT_RULE_MAXEXPRS       128
3151
3152 static int nf_tables_newrule(struct net *net, struct sock *nlsk,
3153                              struct sk_buff *skb, const struct nlmsghdr *nlh,
3154                              const struct nlattr * const nla[],
3155                              struct netlink_ext_ack *extack)
3156 {
3157         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3158         u8 genmask = nft_genmask_next(net);
3159         struct nft_expr_info *info = NULL;
3160         int family = nfmsg->nfgen_family;
3161         struct nft_flow_rule *flow;
3162         struct nft_table *table;
3163         struct nft_chain *chain;
3164         struct nft_rule *rule, *old_rule = NULL;
3165         struct nft_userdata *udata;
3166         struct nft_trans *trans = NULL;
3167         struct nft_expr *expr;
3168         struct nft_ctx ctx;
3169         struct nlattr *tmp;
3170         unsigned int size, i, n, ulen = 0, usize = 0;
3171         int err, rem;
3172         u64 handle, pos_handle;
3173
3174         lockdep_assert_held(&net->nft.commit_mutex);
3175
3176         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3177         if (IS_ERR(table)) {
3178                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3179                 return PTR_ERR(table);
3180         }
3181
3182         if (nla[NFTA_RULE_CHAIN]) {
3183                 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3184                                          genmask);
3185                 if (IS_ERR(chain)) {
3186                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3187                         return PTR_ERR(chain);
3188                 }
3189                 if (nft_chain_is_bound(chain))
3190                         return -EOPNOTSUPP;
3191
3192         } else if (nla[NFTA_RULE_CHAIN_ID]) {
3193                 chain = nft_chain_lookup_byid(net, nla[NFTA_RULE_CHAIN_ID]);
3194                 if (IS_ERR(chain)) {
3195                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);
3196                         return PTR_ERR(chain);
3197                 }
3198         } else {
3199                 return -EINVAL;
3200         }
3201
3202         if (nla[NFTA_RULE_HANDLE]) {
3203                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
3204                 rule = __nft_rule_lookup(chain, handle);
3205                 if (IS_ERR(rule)) {
3206                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3207                         return PTR_ERR(rule);
3208                 }
3209
3210                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3211                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3212                         return -EEXIST;
3213                 }
3214                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3215                         old_rule = rule;
3216                 else
3217                         return -EOPNOTSUPP;
3218         } else {
3219                 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
3220                     nlh->nlmsg_flags & NLM_F_REPLACE)
3221                         return -EINVAL;
3222                 handle = nf_tables_alloc_handle(table);
3223
3224                 if (chain->use == UINT_MAX)
3225                         return -EOVERFLOW;
3226
3227                 if (nla[NFTA_RULE_POSITION]) {
3228                         pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
3229                         old_rule = __nft_rule_lookup(chain, pos_handle);
3230                         if (IS_ERR(old_rule)) {
3231                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
3232                                 return PTR_ERR(old_rule);
3233                         }
3234                 } else if (nla[NFTA_RULE_POSITION_ID]) {
3235                         old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
3236                         if (IS_ERR(old_rule)) {
3237                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
3238                                 return PTR_ERR(old_rule);
3239                         }
3240                 }
3241         }
3242
3243         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
3244
3245         n = 0;
3246         size = 0;
3247         if (nla[NFTA_RULE_EXPRESSIONS]) {
3248                 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
3249                                       sizeof(struct nft_expr_info),
3250                                       GFP_KERNEL);
3251                 if (!info)
3252                         return -ENOMEM;
3253
3254                 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
3255                         err = -EINVAL;
3256                         if (nla_type(tmp) != NFTA_LIST_ELEM)
3257                                 goto err1;
3258                         if (n == NFT_RULE_MAXEXPRS)
3259                                 goto err1;
3260                         err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
3261                         if (err < 0)
3262                                 goto err1;
3263                         size += info[n].ops->size;
3264                         n++;
3265                 }
3266         }
3267         /* Check for overflow of dlen field */
3268         err = -EFBIG;
3269         if (size >= 1 << 12)
3270                 goto err1;
3271
3272         if (nla[NFTA_RULE_USERDATA]) {
3273                 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
3274                 if (ulen > 0)
3275                         usize = sizeof(struct nft_userdata) + ulen;
3276         }
3277
3278         err = -ENOMEM;
3279         rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
3280         if (rule == NULL)
3281                 goto err1;
3282
3283         nft_activate_next(net, rule);
3284
3285         rule->handle = handle;
3286         rule->dlen   = size;
3287         rule->udata  = ulen ? 1 : 0;
3288
3289         if (ulen) {
3290                 udata = nft_userdata(rule);
3291                 udata->len = ulen - 1;
3292                 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
3293         }
3294
3295         expr = nft_expr_first(rule);
3296         for (i = 0; i < n; i++) {
3297                 err = nf_tables_newexpr(&ctx, &info[i], expr);
3298                 if (err < 0) {
3299                         NL_SET_BAD_ATTR(extack, info[i].attr);
3300                         goto err2;
3301                 }
3302
3303                 if (info[i].ops->validate)
3304                         nft_validate_state_update(net, NFT_VALIDATE_NEED);
3305
3306                 info[i].ops = NULL;
3307                 expr = nft_expr_next(expr);
3308         }
3309
3310         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
3311                 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3312                 if (trans == NULL) {
3313                         err = -ENOMEM;
3314                         goto err2;
3315                 }
3316                 err = nft_delrule(&ctx, old_rule);
3317                 if (err < 0) {
3318                         nft_trans_destroy(trans);
3319                         goto err2;
3320                 }
3321
3322                 list_add_tail_rcu(&rule->list, &old_rule->list);
3323         } else {
3324                 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3325                 if (!trans) {
3326                         err = -ENOMEM;
3327                         goto err2;
3328                 }
3329
3330                 if (nlh->nlmsg_flags & NLM_F_APPEND) {
3331                         if (old_rule)
3332                                 list_add_rcu(&rule->list, &old_rule->list);
3333                         else
3334                                 list_add_tail_rcu(&rule->list, &chain->rules);
3335                  } else {
3336                         if (old_rule)
3337                                 list_add_tail_rcu(&rule->list, &old_rule->list);
3338                         else
3339                                 list_add_rcu(&rule->list, &chain->rules);
3340                 }
3341         }
3342         kvfree(info);
3343         chain->use++;
3344
3345         if (net->nft.validate_state == NFT_VALIDATE_DO)
3346                 return nft_table_validate(net, table);
3347
3348         if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
3349                 flow = nft_flow_rule_create(net, rule);
3350                 if (IS_ERR(flow))
3351                         return PTR_ERR(flow);
3352
3353                 nft_trans_flow_rule(trans) = flow;
3354         }
3355
3356         return 0;
3357 err2:
3358         nf_tables_rule_release(&ctx, rule);
3359 err1:
3360         for (i = 0; i < n; i++) {
3361                 if (info[i].ops) {
3362                         module_put(info[i].ops->type->owner);
3363                         if (info[i].ops->type->release_ops)
3364                                 info[i].ops->type->release_ops(info[i].ops);
3365                 }
3366         }
3367         kvfree(info);
3368         return err;
3369 }
3370
3371 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3372                                              const struct nlattr *nla)
3373 {
3374         u32 id = ntohl(nla_get_be32(nla));
3375         struct nft_trans *trans;
3376
3377         list_for_each_entry(trans, &net->nft.commit_list, list) {
3378                 struct nft_rule *rule = nft_trans_rule(trans);
3379
3380                 if (trans->msg_type == NFT_MSG_NEWRULE &&
3381                     id == nft_trans_rule_id(trans))
3382                         return rule;
3383         }
3384         return ERR_PTR(-ENOENT);
3385 }
3386
3387 static int nf_tables_delrule(struct net *net, struct sock *nlsk,
3388                              struct sk_buff *skb, const struct nlmsghdr *nlh,
3389                              const struct nlattr * const nla[],
3390                              struct netlink_ext_ack *extack)
3391 {
3392         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3393         u8 genmask = nft_genmask_next(net);
3394         struct nft_table *table;
3395         struct nft_chain *chain = NULL;
3396         struct nft_rule *rule;
3397         int family = nfmsg->nfgen_family, err = 0;
3398         struct nft_ctx ctx;
3399
3400         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
3401         if (IS_ERR(table)) {
3402                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3403                 return PTR_ERR(table);
3404         }
3405
3406         if (nla[NFTA_RULE_CHAIN]) {
3407                 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3408                                          genmask);
3409                 if (IS_ERR(chain)) {
3410                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3411                         return PTR_ERR(chain);
3412                 }
3413                 if (nft_chain_is_bound(chain))
3414                         return -EOPNOTSUPP;
3415         }
3416
3417         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
3418
3419         if (chain) {
3420                 if (nla[NFTA_RULE_HANDLE]) {
3421                         rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3422                         if (IS_ERR(rule)) {
3423                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3424                                 return PTR_ERR(rule);
3425                         }
3426
3427                         err = nft_delrule(&ctx, rule);
3428                 } else if (nla[NFTA_RULE_ID]) {
3429                         rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
3430                         if (IS_ERR(rule)) {
3431                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
3432                                 return PTR_ERR(rule);
3433                         }
3434
3435                         err = nft_delrule(&ctx, rule);
3436                 } else {
3437                         err = nft_delrule_by_chain(&ctx);
3438                 }
3439         } else {
3440                 list_for_each_entry(chain, &table->chains, list) {
3441                         if (!nft_is_active_next(net, chain))
3442                                 continue;
3443
3444                         ctx.chain = chain;
3445                         err = nft_delrule_by_chain(&ctx);
3446                         if (err < 0)
3447                                 break;
3448                 }
3449         }
3450
3451         return err;
3452 }
3453
3454 /*
3455  * Sets
3456  */
3457 static const struct nft_set_type *nft_set_types[] = {
3458         &nft_set_hash_fast_type,
3459         &nft_set_hash_type,
3460         &nft_set_rhash_type,
3461         &nft_set_bitmap_type,
3462         &nft_set_rbtree_type,
3463 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
3464         &nft_set_pipapo_avx2_type,
3465 #endif
3466         &nft_set_pipapo_type,
3467 };
3468
3469 #define NFT_SET_FEATURES        (NFT_SET_INTERVAL | NFT_SET_MAP | \
3470                                  NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3471                                  NFT_SET_EVAL)
3472
3473 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
3474 {
3475         return (flags & type->features) == (flags & NFT_SET_FEATURES);
3476 }
3477
3478 /*
3479  * Select a set implementation based on the data characteristics and the
3480  * given policy. The total memory use might not be known if no size is
3481  * given, in that case the amount of memory per element is used.
3482  */
3483 static const struct nft_set_ops *
3484 nft_select_set_ops(const struct nft_ctx *ctx,
3485                    const struct nlattr * const nla[],
3486                    const struct nft_set_desc *desc,
3487                    enum nft_set_policies policy)
3488 {
3489         const struct nft_set_ops *ops, *bops;
3490         struct nft_set_estimate est, best;
3491         const struct nft_set_type *type;
3492         u32 flags = 0;
3493         int i;
3494
3495         lockdep_assert_held(&ctx->net->nft.commit_mutex);
3496         lockdep_nfnl_nft_mutex_not_held();
3497
3498         if (nla[NFTA_SET_FLAGS] != NULL)
3499                 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3500
3501         bops        = NULL;
3502         best.size   = ~0;
3503         best.lookup = ~0;
3504         best.space  = ~0;
3505
3506         for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) {
3507                 type = nft_set_types[i];
3508                 ops = &type->ops;
3509
3510                 if (!nft_set_ops_candidate(type, flags))
3511                         continue;
3512                 if (!ops->estimate(desc, flags, &est))
3513                         continue;
3514
3515                 switch (policy) {
3516                 case NFT_SET_POL_PERFORMANCE:
3517                         if (est.lookup < best.lookup)
3518                                 break;
3519                         if (est.lookup == best.lookup &&
3520                             est.space < best.space)
3521                                 break;
3522                         continue;
3523                 case NFT_SET_POL_MEMORY:
3524                         if (!desc->size) {
3525                                 if (est.space < best.space)
3526                                         break;
3527                                 if (est.space == best.space &&
3528                                     est.lookup < best.lookup)
3529                                         break;
3530                         } else if (est.size < best.size || !bops) {
3531                                 break;
3532                         }
3533                         continue;
3534                 default:
3535                         break;
3536                 }
3537
3538                 bops = ops;
3539                 best = est;
3540         }
3541
3542         if (bops != NULL)
3543                 return bops;
3544
3545         return ERR_PTR(-EOPNOTSUPP);
3546 }
3547
3548 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
3549         [NFTA_SET_TABLE]                = { .type = NLA_STRING,
3550                                             .len = NFT_TABLE_MAXNAMELEN - 1 },
3551         [NFTA_SET_NAME]                 = { .type = NLA_STRING,
3552                                             .len = NFT_SET_MAXNAMELEN - 1 },
3553         [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
3554         [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
3555         [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
3556         [NFTA_SET_DATA_TYPE]            = { .type = NLA_U32 },
3557         [NFTA_SET_DATA_LEN]             = { .type = NLA_U32 },
3558         [NFTA_SET_POLICY]               = { .type = NLA_U32 },
3559         [NFTA_SET_DESC]                 = { .type = NLA_NESTED },
3560         [NFTA_SET_ID]                   = { .type = NLA_U32 },
3561         [NFTA_SET_TIMEOUT]              = { .type = NLA_U64 },
3562         [NFTA_SET_GC_INTERVAL]          = { .type = NLA_U32 },
3563         [NFTA_SET_USERDATA]             = { .type = NLA_BINARY,
3564                                             .len  = NFT_USERDATA_MAXLEN },
3565         [NFTA_SET_OBJ_TYPE]             = { .type = NLA_U32 },
3566         [NFTA_SET_HANDLE]               = { .type = NLA_U64 },
3567         [NFTA_SET_EXPR]                 = { .type = NLA_NESTED },
3568 };
3569
3570 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3571         [NFTA_SET_DESC_SIZE]            = { .type = NLA_U32 },
3572         [NFTA_SET_DESC_CONCAT]          = { .type = NLA_NESTED },
3573 };
3574
3575 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
3576                                      const struct sk_buff *skb,
3577                                      const struct nlmsghdr *nlh,
3578                                      const struct nlattr * const nla[],
3579                                      struct netlink_ext_ack *extack,
3580                                      u8 genmask)
3581 {
3582         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3583         int family = nfmsg->nfgen_family;
3584         struct nft_table *table = NULL;
3585
3586         if (nla[NFTA_SET_TABLE] != NULL) {
3587                 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3588                                          genmask);
3589                 if (IS_ERR(table)) {
3590                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
3591                         return PTR_ERR(table);
3592                 }
3593         }
3594
3595         nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
3596         return 0;
3597 }
3598
3599 static struct nft_set *nft_set_lookup(const struct nft_table *table,
3600                                       const struct nlattr *nla, u8 genmask)
3601 {
3602         struct nft_set *set;
3603
3604         if (nla == NULL)
3605                 return ERR_PTR(-EINVAL);
3606
3607         list_for_each_entry_rcu(set, &table->sets, list) {
3608                 if (!nla_strcmp(nla, set->name) &&
3609                     nft_active_genmask(set, genmask))
3610                         return set;
3611         }
3612         return ERR_PTR(-ENOENT);
3613 }
3614
3615 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3616                                                const struct nlattr *nla,
3617                                                u8 genmask)
3618 {
3619         struct nft_set *set;
3620
3621         list_for_each_entry(set, &table->sets, list) {
3622                 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3623                     nft_active_genmask(set, genmask))
3624                         return set;
3625         }
3626         return ERR_PTR(-ENOENT);
3627 }
3628
3629 static struct nft_set *nft_set_lookup_byid(const struct net *net,
3630                                            const struct nlattr *nla, u8 genmask)
3631 {
3632         struct nft_trans *trans;
3633         u32 id = ntohl(nla_get_be32(nla));
3634
3635         list_for_each_entry(trans, &net->nft.commit_list, list) {
3636                 if (trans->msg_type == NFT_MSG_NEWSET) {
3637                         struct nft_set *set = nft_trans_set(trans);
3638
3639                         if (id == nft_trans_set_id(trans) &&
3640                             nft_active_genmask(set, genmask))
3641                                 return set;
3642                 }
3643         }
3644         return ERR_PTR(-ENOENT);
3645 }
3646
3647 struct nft_set *nft_set_lookup_global(const struct net *net,
3648                                       const struct nft_table *table,
3649                                       const struct nlattr *nla_set_name,
3650                                       const struct nlattr *nla_set_id,
3651                                       u8 genmask)
3652 {
3653         struct nft_set *set;
3654
3655         set = nft_set_lookup(table, nla_set_name, genmask);
3656         if (IS_ERR(set)) {
3657                 if (!nla_set_id)
3658                         return set;
3659
3660                 set = nft_set_lookup_byid(net, nla_set_id, genmask);
3661         }
3662         return set;
3663 }
3664 EXPORT_SYMBOL_GPL(nft_set_lookup_global);
3665
3666 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3667                                     const char *name)
3668 {
3669         const struct nft_set *i;
3670         const char *p;
3671         unsigned long *inuse;
3672         unsigned int n = 0, min = 0;
3673
3674         p = strchr(name, '%');
3675         if (p != NULL) {
3676                 if (p[1] != 'd' || strchr(p + 2, '%'))
3677                         return -EINVAL;
3678
3679                 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3680                 if (inuse == NULL)
3681                         return -ENOMEM;
3682 cont:
3683                 list_for_each_entry(i, &ctx->table->sets, list) {
3684                         int tmp;
3685
3686                         if (!nft_is_active_next(ctx->net, set))
3687                                 continue;
3688                         if (!sscanf(i->name, name, &tmp))
3689                                 continue;
3690                         if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
3691                                 continue;
3692
3693                         set_bit(tmp - min, inuse);
3694                 }
3695
3696                 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
3697                 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3698                         min += BITS_PER_BYTE * PAGE_SIZE;
3699                         memset(inuse, 0, PAGE_SIZE);
3700                         goto cont;
3701                 }
3702                 free_page((unsigned long)inuse);
3703         }
3704
3705         set->name = kasprintf(GFP_KERNEL, name, min + n);
3706         if (!set->name)
3707                 return -ENOMEM;
3708
3709         list_for_each_entry(i, &ctx->table->sets, list) {
3710                 if (!nft_is_active_next(ctx->net, i))
3711                         continue;
3712                 if (!strcmp(set->name, i->name)) {
3713                         kfree(set->name);
3714                         set->name = NULL;
3715                         return -ENFILE;
3716                 }
3717         }
3718         return 0;
3719 }
3720
3721 static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3722 {
3723         u64 ms = be64_to_cpu(nla_get_be64(nla));
3724         u64 max = (u64)(~((u64)0));
3725
3726         max = div_u64(max, NSEC_PER_MSEC);
3727         if (ms >= max)
3728                 return -ERANGE;
3729
3730         ms *= NSEC_PER_MSEC;
3731         *result = nsecs_to_jiffies64(ms);
3732         return 0;
3733 }
3734
3735 static __be64 nf_jiffies64_to_msecs(u64 input)
3736 {
3737         return cpu_to_be64(jiffies64_to_msecs(input));
3738 }
3739
3740 static int nf_tables_fill_set_concat(struct sk_buff *skb,
3741                                      const struct nft_set *set)
3742 {
3743         struct nlattr *concat, *field;
3744         int i;
3745
3746         concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT);
3747         if (!concat)
3748                 return -ENOMEM;
3749
3750         for (i = 0; i < set->field_count; i++) {
3751                 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
3752                 if (!field)
3753                         return -ENOMEM;
3754
3755                 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN,
3756                                  htonl(set->field_len[i])))
3757                         return -ENOMEM;
3758
3759                 nla_nest_end(skb, field);
3760         }
3761
3762         nla_nest_end(skb, concat);
3763
3764         return 0;
3765 }
3766
3767 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3768                               const struct nft_set *set, u16 event, u16 flags)
3769 {
3770         struct nfgenmsg *nfmsg;
3771         struct nlmsghdr *nlh;
3772         u32 portid = ctx->portid;
3773         struct nlattr *nest;
3774         u32 seq = ctx->seq;
3775
3776         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3777         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3778                         flags);
3779         if (nlh == NULL)
3780                 goto nla_put_failure;
3781
3782         nfmsg = nlmsg_data(nlh);
3783         nfmsg->nfgen_family     = ctx->family;
3784         nfmsg->version          = NFNETLINK_V0;
3785         nfmsg->res_id           = htons(ctx->net->nft.base_seq & 0xffff);
3786
3787         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3788                 goto nla_put_failure;
3789         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3790                 goto nla_put_failure;
3791         if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3792                          NFTA_SET_PAD))
3793                 goto nla_put_failure;
3794         if (set->flags != 0)
3795                 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3796                         goto nla_put_failure;
3797
3798         if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3799                 goto nla_put_failure;
3800         if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3801                 goto nla_put_failure;
3802         if (set->flags & NFT_SET_MAP) {
3803                 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3804                         goto nla_put_failure;
3805                 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3806                         goto nla_put_failure;
3807         }
3808         if (set->flags & NFT_SET_OBJECT &&
3809             nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3810                 goto nla_put_failure;
3811
3812         if (set->timeout &&
3813             nla_put_be64(skb, NFTA_SET_TIMEOUT,
3814                          nf_jiffies64_to_msecs(set->timeout),
3815                          NFTA_SET_PAD))
3816                 goto nla_put_failure;
3817         if (set->gc_int &&
3818             nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3819                 goto nla_put_failure;
3820
3821         if (set->policy != NFT_SET_POL_PERFORMANCE) {
3822                 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3823                         goto nla_put_failure;
3824         }
3825
3826         if (set->udata &&
3827             nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3828                 goto nla_put_failure;
3829
3830         nest = nla_nest_start_noflag(skb, NFTA_SET_DESC);
3831         if (!nest)
3832                 goto nla_put_failure;
3833         if (set->size &&
3834             nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3835                 goto nla_put_failure;
3836
3837         if (set->field_count > 1 &&
3838             nf_tables_fill_set_concat(skb, set))
3839                 goto nla_put_failure;
3840
3841         nla_nest_end(skb, nest);
3842
3843         if (set->expr) {
3844                 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR);
3845                 if (nf_tables_fill_expr_info(skb, set->expr) < 0)
3846                         goto nla_put_failure;
3847
3848                 nla_nest_end(skb, nest);
3849         }
3850
3851         nlmsg_end(skb, nlh);
3852         return 0;
3853
3854 nla_put_failure:
3855         nlmsg_trim(skb, nlh);
3856         return -1;
3857 }
3858
3859 static void nf_tables_set_notify(const struct nft_ctx *ctx,
3860                                  const struct nft_set *set, int event,
3861                                  gfp_t gfp_flags)
3862 {
3863         struct sk_buff *skb;
3864         u32 portid = ctx->portid;
3865         int err;
3866         char *buf = kasprintf(gfp_flags, "%s:%llu;%s:%llu",
3867                               ctx->table->name, ctx->table->handle,
3868                               set->name, set->handle);
3869
3870         audit_log_nfcfg(buf,
3871                         ctx->family,
3872                         set->field_count,
3873                         event == NFT_MSG_NEWSET ?
3874                                 AUDIT_NFT_OP_SET_REGISTER :
3875                                 AUDIT_NFT_OP_SET_UNREGISTER,
3876                         gfp_flags);
3877         kfree(buf);
3878
3879         if (!ctx->report &&
3880             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
3881                 return;
3882
3883         skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
3884         if (skb == NULL)
3885                 goto err;
3886
3887         err = nf_tables_fill_set(skb, ctx, set, event, 0);
3888         if (err < 0) {
3889                 kfree_skb(skb);
3890                 goto err;
3891         }
3892
3893         nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
3894         return;
3895 err:
3896         nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3897 }
3898
3899 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
3900 {
3901         const struct nft_set *set;
3902         unsigned int idx, s_idx = cb->args[0];
3903         struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3904         struct net *net = sock_net(skb->sk);
3905         struct nft_ctx *ctx = cb->data, ctx_set;
3906
3907         if (cb->args[1])
3908                 return skb->len;
3909
3910         rcu_read_lock();
3911         cb->seq = net->nft.base_seq;
3912
3913         list_for_each_entry_rcu(table, &net->nft.tables, list) {
3914                 if (ctx->family != NFPROTO_UNSPEC &&
3915                     ctx->family != table->family)
3916                         continue;
3917
3918                 if (ctx->table && ctx->table != table)
3919                         continue;
3920
3921                 if (cur_table) {
3922                         if (cur_table != table)
3923                                 continue;
3924
3925                         cur_table = NULL;
3926                 }
3927                 idx = 0;
3928                 list_for_each_entry_rcu(set, &table->sets, list) {
3929                         if (idx < s_idx)
3930                                 goto cont;
3931                         if (!nft_is_active(net, set))
3932                                 goto cont;
3933
3934                         ctx_set = *ctx;
3935                         ctx_set.table = table;
3936                         ctx_set.family = table->family;
3937
3938                         if (nf_tables_fill_set(skb, &ctx_set, set,
3939                                                NFT_MSG_NEWSET,
3940                                                NLM_F_MULTI) < 0) {
3941                                 cb->args[0] = idx;
3942                                 cb->args[2] = (unsigned long) table;
3943                                 goto done;
3944                         }
3945                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3946 cont:
3947                         idx++;
3948                 }
3949                 if (s_idx)
3950                         s_idx = 0;
3951         }
3952         cb->args[1] = 1;
3953 done:
3954         rcu_read_unlock();
3955         return skb->len;
3956 }
3957
3958 static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3959 {
3960         struct nft_ctx *ctx_dump = NULL;
3961
3962         ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3963         if (ctx_dump == NULL)
3964                 return -ENOMEM;
3965
3966         cb->data = ctx_dump;
3967         return 0;
3968 }
3969
3970 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
3971 {
3972         kfree(cb->data);
3973         return 0;
3974 }
3975
3976 /* called with rcu_read_lock held */
3977 static int nf_tables_getset(struct net *net, struct sock *nlsk,
3978                             struct sk_buff *skb, const struct nlmsghdr *nlh,
3979                             const struct nlattr * const nla[],
3980                             struct netlink_ext_ack *extack)
3981 {
3982         u8 genmask = nft_genmask_cur(net);
3983         const struct nft_set *set;
3984         struct nft_ctx ctx;
3985         struct sk_buff *skb2;
3986         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3987         int err;
3988
3989         /* Verify existence before starting dump */
3990         err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3991                                         genmask);
3992         if (err < 0)
3993                 return err;
3994
3995         if (nlh->nlmsg_flags & NLM_F_DUMP) {
3996                 struct netlink_dump_control c = {
3997                         .start = nf_tables_dump_sets_start,
3998                         .dump = nf_tables_dump_sets,
3999                         .done = nf_tables_dump_sets_done,
4000                         .data = &ctx,
4001                         .module = THIS_MODULE,
4002                 };
4003
4004                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4005         }
4006
4007         /* Only accept unspec with dump */
4008         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4009                 return -EAFNOSUPPORT;
4010         if (!nla[NFTA_SET_TABLE])
4011                 return -EINVAL;
4012
4013         set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
4014         if (IS_ERR(set))
4015                 return PTR_ERR(set);
4016
4017         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
4018         if (skb2 == NULL)
4019                 return -ENOMEM;
4020
4021         err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
4022         if (err < 0)
4023                 goto err_fill_set_info;
4024
4025         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
4026
4027 err_fill_set_info:
4028         kfree_skb(skb2);
4029         return err;
4030 }
4031
4032 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = {
4033         [NFTA_SET_FIELD_LEN]    = { .type = NLA_U32 },
4034 };
4035
4036 static int nft_set_desc_concat_parse(const struct nlattr *attr,
4037                                      struct nft_set_desc *desc)
4038 {
4039         struct nlattr *tb[NFTA_SET_FIELD_MAX + 1];
4040         u32 len;
4041         int err;
4042
4043         err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr,
4044                                           nft_concat_policy, NULL);
4045         if (err < 0)
4046                 return err;
4047
4048         if (!tb[NFTA_SET_FIELD_LEN])
4049                 return -EINVAL;
4050
4051         len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN]));
4052
4053         if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT)
4054                 return -E2BIG;
4055
4056         desc->field_len[desc->field_count++] = len;
4057
4058         return 0;
4059 }
4060
4061 static int nft_set_desc_concat(struct nft_set_desc *desc,
4062                                const struct nlattr *nla)
4063 {
4064         struct nlattr *attr;
4065         int rem, err;
4066
4067         nla_for_each_nested(attr, nla, rem) {
4068                 if (nla_type(attr) != NFTA_LIST_ELEM)
4069                         return -EINVAL;
4070
4071                 err = nft_set_desc_concat_parse(attr, desc);
4072                 if (err < 0)
4073                         return err;
4074         }
4075
4076         return 0;
4077 }
4078
4079 static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
4080                                     const struct nlattr *nla)
4081 {
4082         struct nlattr *da[NFTA_SET_DESC_MAX + 1];
4083         int err;
4084
4085         err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
4086                                           nft_set_desc_policy, NULL);
4087         if (err < 0)
4088                 return err;
4089
4090         if (da[NFTA_SET_DESC_SIZE] != NULL)
4091                 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
4092         if (da[NFTA_SET_DESC_CONCAT])
4093                 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]);
4094
4095         return err;
4096 }
4097
4098 static int nf_tables_newset(struct net *net, struct sock *nlsk,
4099                             struct sk_buff *skb, const struct nlmsghdr *nlh,
4100                             const struct nlattr * const nla[],
4101                             struct netlink_ext_ack *extack)
4102 {
4103         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4104         u8 genmask = nft_genmask_next(net);
4105         int family = nfmsg->nfgen_family;
4106         const struct nft_set_ops *ops;
4107         struct nft_expr *expr = NULL;
4108         struct nft_table *table;
4109         struct nft_set *set;
4110         struct nft_ctx ctx;
4111         char *name;
4112         u64 size;
4113         u64 timeout;
4114         u32 ktype, dtype, flags, policy, gc_int, objtype;
4115         struct nft_set_desc desc;
4116         unsigned char *udata;
4117         u16 udlen;
4118         int err;
4119         int i;
4120
4121         if (nla[NFTA_SET_TABLE] == NULL ||
4122             nla[NFTA_SET_NAME] == NULL ||
4123             nla[NFTA_SET_KEY_LEN] == NULL ||
4124             nla[NFTA_SET_ID] == NULL)
4125                 return -EINVAL;
4126
4127         memset(&desc, 0, sizeof(desc));
4128
4129         ktype = NFT_DATA_VALUE;
4130         if (nla[NFTA_SET_KEY_TYPE] != NULL) {
4131                 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
4132                 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
4133                         return -EINVAL;
4134         }
4135
4136         desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
4137         if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
4138                 return -EINVAL;
4139
4140         flags = 0;
4141         if (nla[NFTA_SET_FLAGS] != NULL) {
4142                 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
4143                 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
4144                               NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
4145                               NFT_SET_MAP | NFT_SET_EVAL |
4146                               NFT_SET_OBJECT | NFT_SET_CONCAT))
4147                         return -EOPNOTSUPP;
4148                 /* Only one of these operations is supported */
4149                 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
4150                              (NFT_SET_MAP | NFT_SET_OBJECT))
4151                         return -EOPNOTSUPP;
4152                 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
4153                              (NFT_SET_EVAL | NFT_SET_OBJECT))
4154                         return -EOPNOTSUPP;
4155         }
4156
4157         dtype = 0;
4158         if (nla[NFTA_SET_DATA_TYPE] != NULL) {
4159                 if (!(flags & NFT_SET_MAP))
4160                         return -EINVAL;
4161
4162                 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
4163                 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
4164                     dtype != NFT_DATA_VERDICT)
4165                         return -EINVAL;
4166
4167                 if (dtype != NFT_DATA_VERDICT) {
4168                         if (nla[NFTA_SET_DATA_LEN] == NULL)
4169                                 return -EINVAL;
4170                         desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
4171                         if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
4172                                 return -EINVAL;
4173                 } else
4174                         desc.dlen = sizeof(struct nft_verdict);
4175         } else if (flags & NFT_SET_MAP)
4176                 return -EINVAL;
4177
4178         if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
4179                 if (!(flags & NFT_SET_OBJECT))
4180                         return -EINVAL;
4181
4182                 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
4183                 if (objtype == NFT_OBJECT_UNSPEC ||
4184                     objtype > NFT_OBJECT_MAX)
4185                         return -EOPNOTSUPP;
4186         } else if (flags & NFT_SET_OBJECT)
4187                 return -EINVAL;
4188         else
4189                 objtype = NFT_OBJECT_UNSPEC;
4190
4191         timeout = 0;
4192         if (nla[NFTA_SET_TIMEOUT] != NULL) {
4193                 if (!(flags & NFT_SET_TIMEOUT))
4194                         return -EINVAL;
4195
4196                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
4197                 if (err)
4198                         return err;
4199         }
4200         gc_int = 0;
4201         if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
4202                 if (!(flags & NFT_SET_TIMEOUT))
4203                         return -EINVAL;
4204                 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
4205         }
4206
4207         policy = NFT_SET_POL_PERFORMANCE;
4208         if (nla[NFTA_SET_POLICY] != NULL)
4209                 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
4210
4211         if (nla[NFTA_SET_DESC] != NULL) {
4212                 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
4213                 if (err < 0)
4214                         return err;
4215         }
4216
4217         if (nla[NFTA_SET_EXPR])
4218                 desc.expr = true;
4219
4220         table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
4221         if (IS_ERR(table)) {
4222                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
4223                 return PTR_ERR(table);
4224         }
4225
4226         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
4227
4228         set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
4229         if (IS_ERR(set)) {
4230                 if (PTR_ERR(set) != -ENOENT) {
4231                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4232                         return PTR_ERR(set);
4233                 }
4234         } else {
4235                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4236                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4237                         return -EEXIST;
4238                 }
4239                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
4240                         return -EOPNOTSUPP;
4241
4242                 return 0;
4243         }
4244
4245         if (!(nlh->nlmsg_flags & NLM_F_CREATE))
4246                 return -ENOENT;
4247
4248         ops = nft_select_set_ops(&ctx, nla, &desc, policy);
4249         if (IS_ERR(ops))
4250                 return PTR_ERR(ops);
4251
4252         udlen = 0;
4253         if (nla[NFTA_SET_USERDATA])
4254                 udlen = nla_len(nla[NFTA_SET_USERDATA]);
4255
4256         size = 0;
4257         if (ops->privsize != NULL)
4258                 size = ops->privsize(nla, &desc);
4259
4260         set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
4261         if (!set)
4262                 return -ENOMEM;
4263
4264         name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
4265         if (!name) {
4266                 err = -ENOMEM;
4267                 goto err_set_name;
4268         }
4269
4270         err = nf_tables_set_alloc_name(&ctx, set, name);
4271         kfree(name);
4272         if (err < 0)
4273                 goto err_set_alloc_name;
4274
4275         if (nla[NFTA_SET_EXPR]) {
4276                 expr = nft_set_elem_expr_alloc(&ctx, set, nla[NFTA_SET_EXPR]);
4277                 if (IS_ERR(expr)) {
4278                         err = PTR_ERR(expr);
4279                         goto err_set_alloc_name;
4280                 }
4281         }
4282
4283         udata = NULL;
4284         if (udlen) {
4285                 udata = set->data + size;
4286                 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
4287         }
4288
4289         INIT_LIST_HEAD(&set->bindings);
4290         set->table = table;
4291         write_pnet(&set->net, net);
4292         set->ops   = ops;
4293         set->ktype = ktype;
4294         set->klen  = desc.klen;
4295         set->dtype = dtype;
4296         set->objtype = objtype;
4297         set->dlen  = desc.dlen;
4298         set->expr = expr;
4299         set->flags = flags;
4300         set->size  = desc.size;
4301         set->policy = policy;
4302         set->udlen  = udlen;
4303         set->udata  = udata;
4304         set->timeout = timeout;
4305         set->gc_int = gc_int;
4306         set->handle = nf_tables_alloc_handle(table);
4307
4308         set->field_count = desc.field_count;
4309         for (i = 0; i < desc.field_count; i++)
4310                 set->field_len[i] = desc.field_len[i];
4311
4312         err = ops->init(set, &desc, nla);
4313         if (err < 0)
4314                 goto err_set_init;
4315
4316         err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
4317         if (err < 0)
4318                 goto err_set_trans;
4319
4320         list_add_tail_rcu(&set->list, &table->sets);
4321         table->use++;
4322         return 0;
4323
4324 err_set_trans:
4325         ops->destroy(set);
4326 err_set_init:
4327         if (expr)
4328                 nft_expr_destroy(&ctx, expr);
4329 err_set_alloc_name:
4330         kfree(set->name);
4331 err_set_name:
4332         kvfree(set);
4333         return err;
4334 }
4335
4336 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
4337 {
4338         if (WARN_ON(set->use > 0))
4339                 return;
4340
4341         if (set->expr)
4342                 nft_expr_destroy(ctx, set->expr);
4343
4344         set->ops->destroy(set);
4345         kfree(set->name);
4346         kvfree(set);
4347 }
4348
4349 static int nf_tables_delset(struct net *net, struct sock *nlsk,
4350                             struct sk_buff *skb, const struct nlmsghdr *nlh,
4351                             const struct nlattr * const nla[],
4352                             struct netlink_ext_ack *extack)
4353 {
4354         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4355         u8 genmask = nft_genmask_next(net);
4356         const struct nlattr *attr;
4357         struct nft_set *set;
4358         struct nft_ctx ctx;
4359         int err;
4360
4361         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
4362                 return -EAFNOSUPPORT;
4363         if (nla[NFTA_SET_TABLE] == NULL)
4364                 return -EINVAL;
4365
4366         err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
4367                                         genmask);
4368         if (err < 0)
4369                 return err;
4370
4371         if (nla[NFTA_SET_HANDLE]) {
4372                 attr = nla[NFTA_SET_HANDLE];
4373                 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
4374         } else {
4375                 attr = nla[NFTA_SET_NAME];
4376                 set = nft_set_lookup(ctx.table, attr, genmask);
4377         }
4378
4379         if (IS_ERR(set)) {
4380                 NL_SET_BAD_ATTR(extack, attr);
4381                 return PTR_ERR(set);
4382         }
4383         if (set->use ||
4384             (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
4385                 NL_SET_BAD_ATTR(extack, attr);
4386                 return -EBUSY;
4387         }
4388
4389         return nft_delset(&ctx, set);
4390 }
4391
4392 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
4393                                         struct nft_set *set,
4394                                         const struct nft_set_iter *iter,
4395                                         struct nft_set_elem *elem)
4396 {
4397         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4398         enum nft_registers dreg;
4399
4400         dreg = nft_type_to_reg(set->dtype);
4401         return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
4402                                            set->dtype == NFT_DATA_VERDICT ?
4403                                            NFT_DATA_VERDICT : NFT_DATA_VALUE,
4404                                            set->dlen);
4405 }
4406
4407 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
4408                        struct nft_set_binding *binding)
4409 {
4410         struct nft_set_binding *i;
4411         struct nft_set_iter iter;
4412
4413         if (set->use == UINT_MAX)
4414                 return -EOVERFLOW;
4415
4416         if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
4417                 return -EBUSY;
4418
4419         if (binding->flags & NFT_SET_MAP) {
4420                 /* If the set is already bound to the same chain all
4421                  * jumps are already validated for that chain.
4422                  */
4423                 list_for_each_entry(i, &set->bindings, list) {
4424                         if (i->flags & NFT_SET_MAP &&
4425                             i->chain == binding->chain)
4426                                 goto bind;
4427                 }
4428
4429                 iter.genmask    = nft_genmask_next(ctx->net);
4430                 iter.skip       = 0;
4431                 iter.count      = 0;
4432                 iter.err        = 0;
4433                 iter.fn         = nf_tables_bind_check_setelem;
4434
4435                 set->ops->walk(ctx, set, &iter);
4436                 if (iter.err < 0)
4437                         return iter.err;
4438         }
4439 bind:
4440         binding->chain = ctx->chain;
4441         list_add_tail_rcu(&binding->list, &set->bindings);
4442         nft_set_trans_bind(ctx, set);
4443         set->use++;
4444
4445         return 0;
4446 }
4447 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
4448
4449 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
4450                                  struct nft_set_binding *binding, bool event)
4451 {
4452         list_del_rcu(&binding->list);
4453
4454         if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
4455                 list_del_rcu(&set->list);
4456                 if (event)
4457                         nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
4458                                              GFP_KERNEL);
4459         }
4460 }
4461
4462 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
4463                               struct nft_set_binding *binding,
4464                               enum nft_trans_phase phase)
4465 {
4466         switch (phase) {
4467         case NFT_TRANS_PREPARE:
4468                 set->use--;
4469                 return;
4470         case NFT_TRANS_ABORT:
4471         case NFT_TRANS_RELEASE:
4472                 set->use--;
4473                 fallthrough;
4474         default:
4475                 nf_tables_unbind_set(ctx, set, binding,
4476                                      phase == NFT_TRANS_COMMIT);
4477         }
4478 }
4479 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
4480
4481 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
4482 {
4483         if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
4484                 nft_set_destroy(ctx, set);
4485 }
4486 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
4487
4488 const struct nft_set_ext_type nft_set_ext_types[] = {
4489         [NFT_SET_EXT_KEY]               = {
4490                 .align  = __alignof__(u32),
4491         },
4492         [NFT_SET_EXT_DATA]              = {
4493                 .align  = __alignof__(u32),
4494         },
4495         [NFT_SET_EXT_EXPR]              = {
4496                 .align  = __alignof__(struct nft_expr),
4497         },
4498         [NFT_SET_EXT_OBJREF]            = {
4499                 .len    = sizeof(struct nft_object *),
4500                 .align  = __alignof__(struct nft_object *),
4501         },
4502         [NFT_SET_EXT_FLAGS]             = {
4503                 .len    = sizeof(u8),
4504                 .align  = __alignof__(u8),
4505         },
4506         [NFT_SET_EXT_TIMEOUT]           = {
4507                 .len    = sizeof(u64),
4508                 .align  = __alignof__(u64),
4509         },
4510         [NFT_SET_EXT_EXPIRATION]        = {
4511                 .len    = sizeof(u64),
4512                 .align  = __alignof__(u64),
4513         },
4514         [NFT_SET_EXT_USERDATA]          = {
4515                 .len    = sizeof(struct nft_userdata),
4516                 .align  = __alignof__(struct nft_userdata),
4517         },
4518         [NFT_SET_EXT_KEY_END]           = {
4519                 .align  = __alignof__(u32),
4520         },
4521 };
4522
4523 /*
4524  * Set elements
4525  */
4526
4527 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
4528         [NFTA_SET_ELEM_KEY]             = { .type = NLA_NESTED },
4529         [NFTA_SET_ELEM_DATA]            = { .type = NLA_NESTED },
4530         [NFTA_SET_ELEM_FLAGS]           = { .type = NLA_U32 },
4531         [NFTA_SET_ELEM_TIMEOUT]         = { .type = NLA_U64 },
4532         [NFTA_SET_ELEM_EXPIRATION]      = { .type = NLA_U64 },
4533         [NFTA_SET_ELEM_USERDATA]        = { .type = NLA_BINARY,
4534                                             .len = NFT_USERDATA_MAXLEN },
4535         [NFTA_SET_ELEM_EXPR]            = { .type = NLA_NESTED },
4536         [NFTA_SET_ELEM_OBJREF]          = { .type = NLA_STRING,
4537                                             .len = NFT_OBJ_MAXNAMELEN - 1 },
4538         [NFTA_SET_ELEM_KEY_END]         = { .type = NLA_NESTED },
4539 };
4540
4541 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
4542         [NFTA_SET_ELEM_LIST_TABLE]      = { .type = NLA_STRING,
4543                                             .len = NFT_TABLE_MAXNAMELEN - 1 },
4544         [NFTA_SET_ELEM_LIST_SET]        = { .type = NLA_STRING,
4545                                             .len = NFT_SET_MAXNAMELEN - 1 },
4546         [NFTA_SET_ELEM_LIST_ELEMENTS]   = { .type = NLA_NESTED },
4547         [NFTA_SET_ELEM_LIST_SET_ID]     = { .type = NLA_U32 },
4548 };
4549
4550 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
4551                                       const struct sk_buff *skb,
4552                                       const struct nlmsghdr *nlh,
4553                                       const struct nlattr * const nla[],
4554                                       struct netlink_ext_ack *extack,
4555                                       u8 genmask)
4556 {
4557         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4558         int family = nfmsg->nfgen_family;
4559         struct nft_table *table;
4560
4561         table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
4562                                  genmask);
4563         if (IS_ERR(table)) {
4564                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
4565                 return PTR_ERR(table);
4566         }
4567
4568         nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
4569         return 0;
4570 }
4571
4572 static int nf_tables_fill_setelem(struct sk_buff *skb,
4573                                   const struct nft_set *set,
4574                                   const struct nft_set_elem *elem)
4575 {
4576         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4577         unsigned char *b = skb_tail_pointer(skb);
4578         struct nlattr *nest;
4579
4580         nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
4581         if (nest == NULL)
4582                 goto nla_put_failure;
4583
4584         if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4585                           NFT_DATA_VALUE, set->klen) < 0)
4586                 goto nla_put_failure;
4587
4588         if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) &&
4589             nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext),
4590                           NFT_DATA_VALUE, set->klen) < 0)
4591                 goto nla_put_failure;
4592
4593         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4594             nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
4595                           set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4596                           set->dlen) < 0)
4597                 goto nla_put_failure;
4598
4599         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
4600             nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
4601                 goto nla_put_failure;
4602
4603         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4604             nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
4605                            (*nft_set_ext_obj(ext))->key.name) < 0)
4606                 goto nla_put_failure;
4607
4608         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4609             nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4610                          htonl(*nft_set_ext_flags(ext))))
4611                 goto nla_put_failure;
4612
4613         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4614             nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
4615                          nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
4616                          NFTA_SET_ELEM_PAD))
4617                 goto nla_put_failure;
4618
4619         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4620                 u64 expires, now = get_jiffies_64();
4621
4622                 expires = *nft_set_ext_expiration(ext);
4623                 if (time_before64(now, expires))
4624                         expires -= now;
4625                 else
4626                         expires = 0;
4627
4628                 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
4629                                  nf_jiffies64_to_msecs(expires),
4630                                  NFTA_SET_ELEM_PAD))
4631                         goto nla_put_failure;
4632         }
4633
4634         if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4635                 struct nft_userdata *udata;
4636
4637                 udata = nft_set_ext_userdata(ext);
4638                 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4639                             udata->len + 1, udata->data))
4640                         goto nla_put_failure;
4641         }
4642
4643         nla_nest_end(skb, nest);
4644         return 0;
4645
4646 nla_put_failure:
4647         nlmsg_trim(skb, b);
4648         return -EMSGSIZE;
4649 }
4650
4651 struct nft_set_dump_args {
4652         const struct netlink_callback   *cb;
4653         struct nft_set_iter             iter;
4654         struct sk_buff                  *skb;
4655 };
4656
4657 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
4658                                   struct nft_set *set,
4659                                   const struct nft_set_iter *iter,
4660                                   struct nft_set_elem *elem)
4661 {
4662         struct nft_set_dump_args *args;
4663
4664         args = container_of(iter, struct nft_set_dump_args, iter);
4665         return nf_tables_fill_setelem(args->skb, set, elem);
4666 }
4667
4668 struct nft_set_dump_ctx {
4669         const struct nft_set    *set;
4670         struct nft_ctx          ctx;
4671 };
4672
4673 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4674 {
4675         struct nft_set_dump_ctx *dump_ctx = cb->data;
4676         struct net *net = sock_net(skb->sk);
4677         struct nft_table *table;
4678         struct nft_set *set;
4679         struct nft_set_dump_args args;
4680         bool set_found = false;
4681         struct nfgenmsg *nfmsg;
4682         struct nlmsghdr *nlh;
4683         struct nlattr *nest;
4684         u32 portid, seq;
4685         int event;
4686
4687         rcu_read_lock();
4688         list_for_each_entry_rcu(table, &net->nft.tables, list) {
4689                 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
4690                     dump_ctx->ctx.family != table->family)
4691                         continue;
4692
4693                 if (table != dump_ctx->ctx.table)
4694                         continue;
4695
4696                 list_for_each_entry_rcu(set, &table->sets, list) {
4697                         if (set == dump_ctx->set) {
4698                                 set_found = true;
4699                                 break;
4700                         }
4701                 }
4702                 break;
4703         }
4704
4705         if (!set_found) {
4706                 rcu_read_unlock();
4707                 return -ENOENT;
4708         }
4709
4710         event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
4711         portid = NETLINK_CB(cb->skb).portid;
4712         seq    = cb->nlh->nlmsg_seq;
4713
4714         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4715                         NLM_F_MULTI);
4716         if (nlh == NULL)
4717                 goto nla_put_failure;
4718
4719         nfmsg = nlmsg_data(nlh);
4720         nfmsg->nfgen_family = table->family;
4721         nfmsg->version      = NFNETLINK_V0;
4722         nfmsg->res_id       = htons(net->nft.base_seq & 0xffff);
4723
4724         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
4725                 goto nla_put_failure;
4726         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4727                 goto nla_put_failure;
4728
4729         nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4730         if (nest == NULL)
4731                 goto nla_put_failure;
4732
4733         args.cb                 = cb;
4734         args.skb                = skb;
4735         args.iter.genmask       = nft_genmask_cur(net);
4736         args.iter.skip          = cb->args[0];
4737         args.iter.count         = 0;
4738         args.iter.err           = 0;
4739         args.iter.fn            = nf_tables_dump_setelem;
4740         set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4741         rcu_read_unlock();
4742
4743         nla_nest_end(skb, nest);
4744         nlmsg_end(skb, nlh);
4745
4746         if (args.iter.err && args.iter.err != -EMSGSIZE)
4747                 return args.iter.err;
4748         if (args.iter.count == cb->args[0])
4749                 return 0;
4750
4751         cb->args[0] = args.iter.count;
4752         return skb->len;
4753
4754 nla_put_failure:
4755         rcu_read_unlock();
4756         return -ENOSPC;
4757 }
4758
4759 static int nf_tables_dump_set_start(struct netlink_callback *cb)
4760 {
4761         struct nft_set_dump_ctx *dump_ctx = cb->data;
4762
4763         cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4764
4765         return cb->data ? 0 : -ENOMEM;
4766 }
4767
4768 static int nf_tables_dump_set_done(struct netlink_callback *cb)
4769 {
4770         kfree(cb->data);
4771         return 0;
4772 }
4773
4774 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4775                                        const struct nft_ctx *ctx, u32 seq,
4776                                        u32 portid, int event, u16 flags,
4777                                        const struct nft_set *set,
4778                                        const struct nft_set_elem *elem)
4779 {
4780         struct nfgenmsg *nfmsg;
4781         struct nlmsghdr *nlh;
4782         struct nlattr *nest;
4783         int err;
4784
4785         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4786         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4787                         flags);
4788         if (nlh == NULL)
4789                 goto nla_put_failure;
4790
4791         nfmsg = nlmsg_data(nlh);
4792         nfmsg->nfgen_family     = ctx->family;
4793         nfmsg->version          = NFNETLINK_V0;
4794         nfmsg->res_id           = htons(ctx->net->nft.base_seq & 0xffff);
4795
4796         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4797                 goto nla_put_failure;
4798         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4799                 goto nla_put_failure;
4800
4801         nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4802         if (nest == NULL)
4803                 goto nla_put_failure;
4804
4805         err = nf_tables_fill_setelem(skb, set, elem);
4806         if (err < 0)
4807                 goto nla_put_failure;
4808
4809         nla_nest_end(skb, nest);
4810
4811         nlmsg_end(skb, nlh);
4812         return 0;
4813
4814 nla_put_failure:
4815         nlmsg_trim(skb, nlh);
4816         return -1;
4817 }
4818
4819 static int nft_setelem_parse_flags(const struct nft_set *set,
4820                                    const struct nlattr *attr, u32 *flags)
4821 {
4822         if (attr == NULL)
4823                 return 0;
4824
4825         *flags = ntohl(nla_get_be32(attr));
4826         if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4827                 return -EINVAL;
4828         if (!(set->flags & NFT_SET_INTERVAL) &&
4829             *flags & NFT_SET_ELEM_INTERVAL_END)
4830                 return -EINVAL;
4831
4832         return 0;
4833 }
4834
4835 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
4836                                  struct nft_data *key, struct nlattr *attr)
4837 {
4838         struct nft_data_desc desc;
4839         int err;
4840
4841         err = nft_data_init(ctx, key, NFT_DATA_VALUE_MAXLEN, &desc, attr);
4842         if (err < 0)
4843                 return err;
4844
4845         if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
4846                 nft_data_release(key, desc.type);
4847                 return -EINVAL;
4848         }
4849
4850         return 0;
4851 }
4852
4853 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
4854                                   struct nft_data_desc *desc,
4855                                   struct nft_data *data,
4856                                   struct nlattr *attr)
4857 {
4858         int err;
4859
4860         err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
4861         if (err < 0)
4862                 return err;
4863
4864         if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) {
4865                 nft_data_release(data, desc->type);
4866                 return -EINVAL;
4867         }
4868
4869         return 0;
4870 }
4871
4872 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4873                             const struct nlattr *attr)
4874 {
4875         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4876         struct nft_set_elem elem;
4877         struct sk_buff *skb;
4878         uint32_t flags = 0;
4879         void *priv;
4880         int err;
4881
4882         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4883                                           nft_set_elem_policy, NULL);
4884         if (err < 0)
4885                 return err;
4886
4887         if (!nla[NFTA_SET_ELEM_KEY])
4888                 return -EINVAL;
4889
4890         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4891         if (err < 0)
4892                 return err;
4893
4894         err = nft_setelem_parse_key(ctx, set, &elem.key.val,
4895                                     nla[NFTA_SET_ELEM_KEY]);
4896         if (err < 0)
4897                 return err;
4898
4899         if (nla[NFTA_SET_ELEM_KEY_END]) {
4900                 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
4901                                             nla[NFTA_SET_ELEM_KEY_END]);
4902                 if (err < 0)
4903                         return err;
4904         }
4905
4906         priv = set->ops->get(ctx->net, set, &elem, flags);
4907         if (IS_ERR(priv))
4908                 return PTR_ERR(priv);
4909
4910         elem.priv = priv;
4911
4912         err = -ENOMEM;
4913         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
4914         if (skb == NULL)
4915                 return err;
4916
4917         err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4918                                           NFT_MSG_NEWSETELEM, 0, set, &elem);
4919         if (err < 0)
4920                 goto err_fill_setelem;
4921
4922         return nfnetlink_unicast(skb, ctx->net, ctx->portid);
4923
4924 err_fill_setelem:
4925         kfree_skb(skb);
4926         return err;
4927 }
4928
4929 /* called with rcu_read_lock held */
4930 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4931                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
4932                                 const struct nlattr * const nla[],
4933                                 struct netlink_ext_ack *extack)
4934 {
4935         u8 genmask = nft_genmask_cur(net);
4936         struct nft_set *set;
4937         struct nlattr *attr;
4938         struct nft_ctx ctx;
4939         int rem, err = 0;
4940
4941         err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4942                                          genmask);
4943         if (err < 0)
4944                 return err;
4945
4946         set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
4947         if (IS_ERR(set))
4948                 return PTR_ERR(set);
4949
4950         if (nlh->nlmsg_flags & NLM_F_DUMP) {
4951                 struct netlink_dump_control c = {
4952                         .start = nf_tables_dump_set_start,
4953                         .dump = nf_tables_dump_set,
4954                         .done = nf_tables_dump_set_done,
4955                         .module = THIS_MODULE,
4956                 };
4957                 struct nft_set_dump_ctx dump_ctx = {
4958                         .set = set,
4959                         .ctx = ctx,
4960                 };
4961
4962                 c.data = &dump_ctx;
4963                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4964         }
4965
4966         if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4967                 return -EINVAL;
4968
4969         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4970                 err = nft_get_set_elem(&ctx, set, attr);
4971                 if (err < 0)
4972                         break;
4973         }
4974
4975         return err;
4976 }
4977
4978 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4979                                      const struct nft_set *set,
4980                                      const struct nft_set_elem *elem,
4981                                      int event, u16 flags)
4982 {
4983         struct net *net = ctx->net;
4984         u32 portid = ctx->portid;
4985         struct sk_buff *skb;
4986         int err;
4987         char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
4988                               ctx->table->name, ctx->table->handle,
4989                               set->name, set->handle);
4990
4991         audit_log_nfcfg(buf,
4992                         ctx->family,
4993                         set->handle,
4994                         event == NFT_MSG_NEWSETELEM ?
4995                                 AUDIT_NFT_OP_SETELEM_REGISTER :
4996                                 AUDIT_NFT_OP_SETELEM_UNREGISTER,
4997                         GFP_KERNEL);
4998         kfree(buf);
4999
5000         if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5001                 return;
5002
5003         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5004         if (skb == NULL)
5005                 goto err;
5006
5007         err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
5008                                           set, elem);
5009         if (err < 0) {
5010                 kfree_skb(skb);
5011                 goto err;
5012         }
5013
5014         nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
5015         return;
5016 err:
5017         nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
5018 }
5019
5020 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
5021                                               int msg_type,
5022                                               struct nft_set *set)
5023 {
5024         struct nft_trans *trans;
5025
5026         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
5027         if (trans == NULL)
5028                 return NULL;
5029
5030         nft_trans_elem_set(trans) = set;
5031         return trans;
5032 }
5033
5034 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
5035                                          const struct nft_set *set,
5036                                          const struct nlattr *attr)
5037 {
5038         struct nft_expr *expr;
5039         int err;
5040
5041         expr = nft_expr_init(ctx, attr);
5042         if (IS_ERR(expr))
5043                 return expr;
5044
5045         err = -EOPNOTSUPP;
5046         if (!(expr->ops->type->flags & NFT_EXPR_STATEFUL))
5047                 goto err_set_elem_expr;
5048
5049         if (expr->ops->type->flags & NFT_EXPR_GC) {
5050                 if (set->flags & NFT_SET_TIMEOUT)
5051                         goto err_set_elem_expr;
5052                 if (!set->ops->gc_init)
5053                         goto err_set_elem_expr;
5054                 set->ops->gc_init(set);
5055         }
5056
5057         return expr;
5058
5059 err_set_elem_expr:
5060         nft_expr_destroy(ctx, expr);
5061         return ERR_PTR(err);
5062 }
5063
5064 void *nft_set_elem_init(const struct nft_set *set,
5065                         const struct nft_set_ext_tmpl *tmpl,
5066                         const u32 *key, const u32 *key_end,
5067                         const u32 *data, u64 timeout, u64 expiration, gfp_t gfp)
5068 {
5069         struct nft_set_ext *ext;
5070         void *elem;
5071
5072         elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
5073         if (elem == NULL)
5074                 return NULL;
5075
5076         ext = nft_set_elem_ext(set, elem);
5077         nft_set_ext_init(ext, tmpl);
5078
5079         memcpy(nft_set_ext_key(ext), key, set->klen);
5080         if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
5081                 memcpy(nft_set_ext_key_end(ext), key_end, set->klen);
5082         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5083                 memcpy(nft_set_ext_data(ext), data, set->dlen);
5084         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
5085                 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
5086                 if (expiration == 0)
5087                         *nft_set_ext_expiration(ext) += timeout;
5088         }
5089         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
5090                 *nft_set_ext_timeout(ext) = timeout;
5091
5092         return elem;
5093 }
5094
5095 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
5096                                       struct nft_expr *expr)
5097 {
5098         if (expr->ops->destroy_clone) {
5099                 expr->ops->destroy_clone(ctx, expr);
5100                 module_put(expr->ops->type->owner);
5101         } else {
5102                 nf_tables_expr_destroy(ctx, expr);
5103         }
5104 }
5105
5106 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
5107                           bool destroy_expr)
5108 {
5109         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5110         struct nft_ctx ctx = {
5111                 .net    = read_pnet(&set->net),
5112                 .family = set->table->family,
5113         };
5114
5115         nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
5116         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5117                 nft_data_release(nft_set_ext_data(ext), set->dtype);
5118         if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
5119                 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext));
5120
5121         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5122                 (*nft_set_ext_obj(ext))->use--;
5123         kfree(elem);
5124 }
5125 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
5126
5127 /* Only called from commit path, nft_set_elem_deactivate() already deals with
5128  * the refcounting from the preparation phase.
5129  */
5130 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
5131                                        const struct nft_set *set, void *elem)
5132 {
5133         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5134
5135         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
5136                 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));
5137
5138         kfree(elem);
5139 }
5140
5141 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
5142                             const struct nlattr *attr, u32 nlmsg_flags)
5143 {
5144         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5145         u8 genmask = nft_genmask_next(ctx->net);
5146         struct nft_set_ext_tmpl tmpl;
5147         struct nft_set_ext *ext, *ext2;
5148         struct nft_set_elem elem;
5149         struct nft_set_binding *binding;
5150         struct nft_object *obj = NULL;
5151         struct nft_expr *expr = NULL;
5152         struct nft_userdata *udata;
5153         struct nft_data_desc desc;
5154         enum nft_registers dreg;
5155         struct nft_trans *trans;
5156         u32 flags = 0;
5157         u64 timeout;
5158         u64 expiration;
5159         u8 ulen;
5160         int err;
5161
5162         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5163                                           nft_set_elem_policy, NULL);
5164         if (err < 0)
5165                 return err;
5166
5167         if (nla[NFTA_SET_ELEM_KEY] == NULL)
5168                 return -EINVAL;
5169
5170         nft_set_ext_prepare(&tmpl);
5171
5172         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5173         if (err < 0)
5174                 return err;
5175         if (flags != 0)
5176                 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5177
5178         if (set->flags & NFT_SET_MAP) {
5179                 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
5180                     !(flags & NFT_SET_ELEM_INTERVAL_END))
5181                         return -EINVAL;
5182         } else {
5183                 if (nla[NFTA_SET_ELEM_DATA] != NULL)
5184                         return -EINVAL;
5185         }
5186
5187         if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
5188              (nla[NFTA_SET_ELEM_DATA] ||
5189               nla[NFTA_SET_ELEM_OBJREF] ||
5190               nla[NFTA_SET_ELEM_TIMEOUT] ||
5191               nla[NFTA_SET_ELEM_EXPIRATION] ||
5192               nla[NFTA_SET_ELEM_USERDATA] ||
5193               nla[NFTA_SET_ELEM_EXPR]))
5194                 return -EINVAL;
5195
5196         timeout = 0;
5197         if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
5198                 if (!(set->flags & NFT_SET_TIMEOUT))
5199                         return -EINVAL;
5200                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
5201                                             &timeout);
5202                 if (err)
5203                         return err;
5204         } else if (set->flags & NFT_SET_TIMEOUT) {
5205                 timeout = set->timeout;
5206         }
5207
5208         expiration = 0;
5209         if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
5210                 if (!(set->flags & NFT_SET_TIMEOUT))
5211                         return -EINVAL;
5212                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
5213                                             &expiration);
5214                 if (err)
5215                         return err;
5216         }
5217
5218         if (nla[NFTA_SET_ELEM_EXPR] != NULL) {
5219                 expr = nft_set_elem_expr_alloc(ctx, set,
5220                                                nla[NFTA_SET_ELEM_EXPR]);
5221                 if (IS_ERR(expr))
5222                         return PTR_ERR(expr);
5223
5224                 err = -EOPNOTSUPP;
5225                 if (set->expr && set->expr->ops != expr->ops)
5226                         goto err_set_elem_expr;
5227         } else if (set->expr) {
5228                 expr = kzalloc(set->expr->ops->size, GFP_KERNEL);
5229                 if (!expr)
5230                         return -ENOMEM;
5231
5232                 err = nft_expr_clone(expr, set->expr);
5233                 if (err < 0)
5234                         goto err_set_elem_expr;
5235         }
5236
5237         err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5238                                     nla[NFTA_SET_ELEM_KEY]);
5239         if (err < 0)
5240                 goto err_set_elem_expr;
5241
5242         nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
5243
5244         if (nla[NFTA_SET_ELEM_KEY_END]) {
5245                 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5246                                             nla[NFTA_SET_ELEM_KEY_END]);
5247                 if (err < 0)
5248                         goto err_parse_key;
5249
5250                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5251         }
5252
5253         if (timeout > 0) {
5254                 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
5255                 if (timeout != set->timeout)
5256                         nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
5257         }
5258
5259         if (expr)
5260                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPR,
5261                                        expr->ops->size);
5262
5263         if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
5264                 if (!(set->flags & NFT_SET_OBJECT)) {
5265                         err = -EINVAL;
5266                         goto err_parse_key_end;
5267                 }
5268                 obj = nft_obj_lookup(ctx->net, ctx->table,
5269                                      nla[NFTA_SET_ELEM_OBJREF],
5270                                      set->objtype, genmask);
5271                 if (IS_ERR(obj)) {
5272                         err = PTR_ERR(obj);
5273                         goto err_parse_key_end;
5274                 }
5275                 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
5276         }
5277
5278         if (nla[NFTA_SET_ELEM_DATA] != NULL) {
5279                 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
5280                                              nla[NFTA_SET_ELEM_DATA]);
5281                 if (err < 0)
5282                         goto err_parse_key_end;
5283
5284                 dreg = nft_type_to_reg(set->dtype);
5285                 list_for_each_entry(binding, &set->bindings, list) {
5286                         struct nft_ctx bind_ctx = {
5287                                 .net    = ctx->net,
5288                                 .family = ctx->family,
5289                                 .table  = ctx->table,
5290                                 .chain  = (struct nft_chain *)binding->chain,
5291                         };
5292
5293                         if (!(binding->flags & NFT_SET_MAP))
5294                                 continue;
5295
5296                         err = nft_validate_register_store(&bind_ctx, dreg,
5297                                                           &elem.data.val,
5298                                                           desc.type, desc.len);
5299                         if (err < 0)
5300                                 goto err_parse_data;
5301
5302                         if (desc.type == NFT_DATA_VERDICT &&
5303                             (elem.data.val.verdict.code == NFT_GOTO ||
5304                              elem.data.val.verdict.code == NFT_JUMP))
5305                                 nft_validate_state_update(ctx->net,
5306                                                           NFT_VALIDATE_NEED);
5307                 }
5308
5309                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len);
5310         }
5311
5312         /* The full maximum length of userdata can exceed the maximum
5313          * offset value (U8_MAX) for following extensions, therefor it
5314          * must be the last extension added.
5315          */
5316         ulen = 0;
5317         if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
5318                 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
5319                 if (ulen > 0)
5320                         nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
5321                                                ulen);
5322         }
5323
5324         err = -ENOMEM;
5325         elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5326                                       elem.key_end.val.data, elem.data.val.data,
5327                                       timeout, expiration, GFP_KERNEL);
5328         if (elem.priv == NULL)
5329                 goto err_parse_data;
5330
5331         ext = nft_set_elem_ext(set, elem.priv);
5332         if (flags)
5333                 *nft_set_ext_flags(ext) = flags;
5334         if (ulen > 0) {
5335                 udata = nft_set_ext_userdata(ext);
5336                 udata->len = ulen - 1;
5337                 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
5338         }
5339         if (obj) {
5340                 *nft_set_ext_obj(ext) = obj;
5341                 obj->use++;
5342         }
5343         if (expr) {
5344                 memcpy(nft_set_ext_expr(ext), expr, expr->ops->size);
5345                 kfree(expr);
5346                 expr = NULL;
5347         }
5348
5349         trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
5350         if (trans == NULL)
5351                 goto err_trans;
5352
5353         ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
5354         err = set->ops->insert(ctx->net, set, &elem, &ext2);
5355         if (err) {
5356                 if (err == -EEXIST) {
5357                         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
5358                             nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
5359                             nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
5360                             nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
5361                                 goto err_element_clash;
5362                         if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
5363                              nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
5364                              memcmp(nft_set_ext_data(ext),
5365                                     nft_set_ext_data(ext2), set->dlen) != 0) ||
5366                             (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
5367                              nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
5368                              *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
5369                                 goto err_element_clash;
5370                         else if (!(nlmsg_flags & NLM_F_EXCL))
5371                                 err = 0;
5372                 } else if (err == -ENOTEMPTY) {
5373                         /* ENOTEMPTY reports overlapping between this element
5374                          * and an existing one.
5375                          */
5376                         err = -EEXIST;
5377                 }
5378                 goto err_element_clash;
5379         }
5380
5381         if (set->size &&
5382             !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
5383                 err = -ENFILE;
5384                 goto err_set_full;
5385         }
5386
5387         nft_trans_elem(trans) = elem;
5388         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5389         return 0;
5390
5391 err_set_full:
5392         set->ops->remove(ctx->net, set, &elem);
5393 err_element_clash:
5394         kfree(trans);
5395 err_trans:
5396         if (obj)
5397                 obj->use--;
5398
5399         nf_tables_set_elem_destroy(ctx, set, elem.priv);
5400 err_parse_data:
5401         if (nla[NFTA_SET_ELEM_DATA] != NULL)
5402                 nft_data_release(&elem.data.val, desc.type);
5403 err_parse_key_end:
5404         nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
5405 err_parse_key:
5406         nft_data_release(&elem.key.val, NFT_DATA_VALUE);
5407 err_set_elem_expr:
5408         if (expr != NULL)
5409                 nft_expr_destroy(ctx, expr);
5410
5411         return err;
5412 }
5413
5414 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
5415                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
5416                                 const struct nlattr * const nla[],
5417                                 struct netlink_ext_ack *extack)
5418 {
5419         u8 genmask = nft_genmask_next(net);
5420         const struct nlattr *attr;
5421         struct nft_set *set;
5422         struct nft_ctx ctx;
5423         int rem, err;
5424
5425         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
5426                 return -EINVAL;
5427
5428         err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5429                                          genmask);
5430         if (err < 0)
5431                 return err;
5432
5433         set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
5434                                     nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
5435         if (IS_ERR(set))
5436                 return PTR_ERR(set);
5437
5438         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5439                 return -EBUSY;
5440
5441         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5442                 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
5443                 if (err < 0)
5444                         return err;
5445         }
5446
5447         if (net->nft.validate_state == NFT_VALIDATE_DO)
5448                 return nft_table_validate(net, ctx.table);
5449
5450         return 0;
5451 }
5452
5453 /**
5454  *      nft_data_hold - hold a nft_data item
5455  *
5456  *      @data: struct nft_data to release
5457  *      @type: type of data
5458  *
5459  *      Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
5460  *      NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
5461  *      NFT_GOTO verdicts. This function must be called on active data objects
5462  *      from the second phase of the commit protocol.
5463  */
5464 void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
5465 {
5466         struct nft_chain *chain;
5467         struct nft_rule *rule;
5468
5469         if (type == NFT_DATA_VERDICT) {
5470                 switch (data->verdict.code) {
5471                 case NFT_JUMP:
5472                 case NFT_GOTO:
5473                         chain = data->verdict.chain;
5474                         chain->use++;
5475
5476                         if (!nft_chain_is_bound(chain))
5477                                 break;
5478
5479                         chain->table->use++;
5480                         list_for_each_entry(rule, &chain->rules, list)
5481                                 chain->use++;
5482
5483                         nft_chain_add(chain->table, chain);
5484                         break;
5485                 }
5486         }
5487 }
5488
5489 static void nft_set_elem_activate(const struct net *net,
5490                                   const struct nft_set *set,
5491                                   struct nft_set_elem *elem)
5492 {
5493         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5494
5495         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5496                 nft_data_hold(nft_set_ext_data(ext), set->dtype);
5497         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5498                 (*nft_set_ext_obj(ext))->use++;
5499 }
5500
5501 static void nft_set_elem_deactivate(const struct net *net,
5502                                     const struct nft_set *set,
5503                                     struct nft_set_elem *elem)
5504 {
5505         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5506
5507         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5508                 nft_data_release(nft_set_ext_data(ext), set->dtype);
5509         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5510                 (*nft_set_ext_obj(ext))->use--;
5511 }
5512
5513 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
5514                            const struct nlattr *attr)
5515 {
5516         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5517         struct nft_set_ext_tmpl tmpl;
5518         struct nft_set_elem elem;
5519         struct nft_set_ext *ext;
5520         struct nft_trans *trans;
5521         u32 flags = 0;
5522         void *priv;
5523         int err;
5524
5525         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5526                                           nft_set_elem_policy, NULL);
5527         if (err < 0)
5528                 return err;
5529
5530         if (nla[NFTA_SET_ELEM_KEY] == NULL)
5531                 return -EINVAL;
5532
5533         nft_set_ext_prepare(&tmpl);
5534
5535         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5536         if (err < 0)
5537                 return err;
5538         if (flags != 0)
5539                 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5540
5541         err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5542                                     nla[NFTA_SET_ELEM_KEY]);
5543         if (err < 0)
5544                 return err;
5545
5546         nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
5547
5548         if (nla[NFTA_SET_ELEM_KEY_END]) {
5549                 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5550                                             nla[NFTA_SET_ELEM_KEY_END]);
5551                 if (err < 0)
5552                         return err;
5553
5554                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5555         }
5556
5557         err = -ENOMEM;
5558         elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5559                                       elem.key_end.val.data, NULL, 0, 0,
5560                                       GFP_KERNEL);
5561         if (elem.priv == NULL)
5562                 goto fail_elem;
5563
5564         ext = nft_set_elem_ext(set, elem.priv);
5565         if (flags)
5566                 *nft_set_ext_flags(ext) = flags;
5567
5568         trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
5569         if (trans == NULL)
5570                 goto fail_trans;
5571
5572         priv = set->ops->deactivate(ctx->net, set, &elem);
5573         if (priv == NULL) {
5574                 err = -ENOENT;
5575                 goto fail_ops;
5576         }
5577         kfree(elem.priv);
5578         elem.priv = priv;
5579
5580         nft_set_elem_deactivate(ctx->net, set, &elem);
5581
5582         nft_trans_elem(trans) = elem;
5583         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5584         return 0;
5585
5586 fail_ops:
5587         kfree(trans);
5588 fail_trans:
5589         kfree(elem.priv);
5590 fail_elem:
5591         nft_data_release(&elem.key.val, NFT_DATA_VALUE);
5592         return err;
5593 }
5594
5595 static int nft_flush_set(const struct nft_ctx *ctx,
5596                          struct nft_set *set,
5597                          const struct nft_set_iter *iter,
5598                          struct nft_set_elem *elem)
5599 {
5600         struct nft_trans *trans;
5601         int err;
5602
5603         trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
5604                                     sizeof(struct nft_trans_elem), GFP_ATOMIC);
5605         if (!trans)
5606                 return -ENOMEM;
5607
5608         if (!set->ops->flush(ctx->net, set, elem->priv)) {
5609                 err = -ENOENT;
5610                 goto err1;
5611         }
5612         set->ndeact++;
5613
5614         nft_set_elem_deactivate(ctx->net, set, elem);
5615         nft_trans_elem_set(trans) = set;
5616         nft_trans_elem(trans) = *elem;
5617         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5618
5619         return 0;
5620 err1:
5621         kfree(trans);
5622         return err;
5623 }
5624
5625 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
5626                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
5627                                 const struct nlattr * const nla[],
5628                                 struct netlink_ext_ack *extack)
5629 {
5630         u8 genmask = nft_genmask_next(net);
5631         const struct nlattr *attr;
5632         struct nft_set *set;
5633         struct nft_ctx ctx;
5634         int rem, err = 0;
5635
5636         err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
5637                                          genmask);
5638         if (err < 0)
5639                 return err;
5640
5641         set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
5642         if (IS_ERR(set))
5643                 return PTR_ERR(set);
5644         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5645                 return -EBUSY;
5646
5647         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
5648                 struct nft_set_iter iter = {
5649                         .genmask        = genmask,
5650                         .fn             = nft_flush_set,
5651                 };
5652                 set->ops->walk(&ctx, set, &iter);
5653
5654                 return iter.err;
5655         }
5656
5657         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5658                 err = nft_del_setelem(&ctx, set, attr);
5659                 if (err < 0)
5660                         break;
5661
5662                 set->ndeact++;
5663         }
5664         return err;
5665 }
5666
5667 void nft_set_gc_batch_release(struct rcu_head *rcu)
5668 {
5669         struct nft_set_gc_batch *gcb;
5670         unsigned int i;
5671
5672         gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
5673         for (i = 0; i < gcb->head.cnt; i++)
5674                 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
5675         kfree(gcb);
5676 }
5677
5678 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
5679                                                 gfp_t gfp)
5680 {
5681         struct nft_set_gc_batch *gcb;
5682
5683         gcb = kzalloc(sizeof(*gcb), gfp);
5684         if (gcb == NULL)
5685                 return gcb;
5686         gcb->head.set = set;
5687         return gcb;
5688 }
5689
5690 /*
5691  * Stateful objects
5692  */
5693
5694 /**
5695  *      nft_register_obj- register nf_tables stateful object type
5696  *      @obj_type: object type
5697  *
5698  *      Registers the object type for use with nf_tables. Returns zero on
5699  *      success or a negative errno code otherwise.
5700  */
5701 int nft_register_obj(struct nft_object_type *obj_type)
5702 {
5703         if (obj_type->type == NFT_OBJECT_UNSPEC)
5704                 return -EINVAL;
5705
5706         nfnl_lock(NFNL_SUBSYS_NFTABLES);
5707         list_add_rcu(&obj_type->list, &nf_tables_objects);
5708         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5709         return 0;
5710 }
5711 EXPORT_SYMBOL_GPL(nft_register_obj);
5712
5713 /**
5714  *      nft_unregister_obj - unregister nf_tables object type
5715  *      @obj_type: object type
5716  *
5717  *      Unregisters the object type for use with nf_tables.
5718  */
5719 void nft_unregister_obj(struct nft_object_type *obj_type)
5720 {
5721         nfnl_lock(NFNL_SUBSYS_NFTABLES);
5722         list_del_rcu(&obj_type->list);
5723         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5724 }
5725 EXPORT_SYMBOL_GPL(nft_unregister_obj);
5726
5727 struct nft_object *nft_obj_lookup(const struct net *net,
5728                                   const struct nft_table *table,
5729                                   const struct nlattr *nla, u32 objtype,
5730                                   u8 genmask)
5731 {
5732         struct nft_object_hash_key k = { .table = table };
5733         char search[NFT_OBJ_MAXNAMELEN];
5734         struct rhlist_head *tmp, *list;
5735         struct nft_object *obj;
5736
5737         nla_strlcpy(search, nla, sizeof(search));
5738         k.name = search;
5739
5740         WARN_ON_ONCE(!rcu_read_lock_held() &&
5741                      !lockdep_commit_lock_is_held(net));
5742
5743         rcu_read_lock();
5744         list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
5745         if (!list)
5746                 goto out;
5747
5748         rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
5749                 if (objtype == obj->ops->type->type &&
5750                     nft_active_genmask(obj, genmask)) {
5751                         rcu_read_unlock();
5752                         return obj;
5753                 }
5754         }
5755 out:
5756         rcu_read_unlock();
5757         return ERR_PTR(-ENOENT);
5758 }
5759 EXPORT_SYMBOL_GPL(nft_obj_lookup);
5760
5761 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
5762                                                   const struct nlattr *nla,
5763                                                   u32 objtype, u8 genmask)
5764 {
5765         struct nft_object *obj;
5766
5767         list_for_each_entry(obj, &table->objects, list) {
5768                 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
5769                     objtype == obj->ops->type->type &&
5770                     nft_active_genmask(obj, genmask))
5771                         return obj;
5772         }
5773         return ERR_PTR(-ENOENT);
5774 }
5775
5776 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
5777         [NFTA_OBJ_TABLE]        = { .type = NLA_STRING,
5778                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
5779         [NFTA_OBJ_NAME]         = { .type = NLA_STRING,
5780                                     .len = NFT_OBJ_MAXNAMELEN - 1 },
5781         [NFTA_OBJ_TYPE]         = { .type = NLA_U32 },
5782         [NFTA_OBJ_DATA]         = { .type = NLA_NESTED },
5783         [NFTA_OBJ_HANDLE]       = { .type = NLA_U64},
5784         [NFTA_OBJ_USERDATA]     = { .type = NLA_BINARY,
5785                                     .len = NFT_USERDATA_MAXLEN },
5786 };
5787
5788 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
5789                                        const struct nft_object_type *type,
5790                                        const struct nlattr *attr)
5791 {
5792         struct nlattr **tb;
5793         const struct nft_object_ops *ops;
5794         struct nft_object *obj;
5795         int err = -ENOMEM;
5796
5797         tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
5798         if (!tb)
5799                 goto err1;
5800
5801         if (attr) {
5802                 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
5803                                                   type->policy, NULL);
5804                 if (err < 0)
5805                         goto err2;
5806         } else {
5807                 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
5808         }
5809
5810         if (type->select_ops) {
5811                 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
5812                 if (IS_ERR(ops)) {
5813                         err = PTR_ERR(ops);
5814                         goto err2;
5815                 }
5816         } else {
5817                 ops = type->ops;
5818         }
5819
5820         err = -ENOMEM;
5821         obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5822         if (!obj)
5823                 goto err2;
5824
5825         err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
5826         if (err < 0)
5827                 goto err3;
5828
5829         obj->ops = ops;
5830
5831         kfree(tb);
5832         return obj;
5833 err3:
5834         kfree(obj);
5835 err2:
5836         kfree(tb);
5837 err1:
5838         return ERR_PTR(err);
5839 }
5840
5841 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
5842                            struct nft_object *obj, bool reset)
5843 {
5844         struct nlattr *nest;
5845
5846         nest = nla_nest_start_noflag(skb, attr);
5847         if (!nest)
5848                 goto nla_put_failure;
5849         if (obj->ops->dump(skb, obj, reset) < 0)
5850                 goto nla_put_failure;
5851         nla_nest_end(skb, nest);
5852         return 0;
5853
5854 nla_put_failure:
5855         return -1;
5856 }
5857
5858 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5859 {
5860         const struct nft_object_type *type;
5861
5862         list_for_each_entry(type, &nf_tables_objects, list) {
5863                 if (objtype == type->type)
5864                         return type;
5865         }
5866         return NULL;
5867 }
5868
5869 static const struct nft_object_type *
5870 nft_obj_type_get(struct net *net, u32 objtype)
5871 {
5872         const struct nft_object_type *type;
5873
5874         type = __nft_obj_type_get(objtype);
5875         if (type != NULL && try_module_get(type->owner))
5876                 return type;
5877
5878         lockdep_nfnl_nft_mutex_not_held();
5879 #ifdef CONFIG_MODULES
5880         if (type == NULL) {
5881                 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
5882                         return ERR_PTR(-EAGAIN);
5883         }
5884 #endif
5885         return ERR_PTR(-ENOENT);
5886 }
5887
5888 static int nf_tables_updobj(const struct nft_ctx *ctx,
5889                             const struct nft_object_type *type,
5890                             const struct nlattr *attr,
5891                             struct nft_object *obj)
5892 {
5893         struct nft_object *newobj;
5894         struct nft_trans *trans;
5895         int err;
5896
5897         trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
5898                                 sizeof(struct nft_trans_obj));
5899         if (!trans)
5900                 return -ENOMEM;
5901
5902         newobj = nft_obj_init(ctx, type, attr);
5903         if (IS_ERR(newobj)) {
5904                 err = PTR_ERR(newobj);
5905                 goto err_free_trans;
5906         }
5907
5908         nft_trans_obj(trans) = obj;
5909         nft_trans_obj_update(trans) = true;
5910         nft_trans_obj_newobj(trans) = newobj;
5911         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5912
5913         return 0;
5914
5915 err_free_trans:
5916         kfree(trans);
5917         return err;
5918 }
5919
5920 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5921                             struct sk_buff *skb, const struct nlmsghdr *nlh,
5922                             const struct nlattr * const nla[],
5923                             struct netlink_ext_ack *extack)
5924 {
5925         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5926         const struct nft_object_type *type;
5927         u8 genmask = nft_genmask_next(net);
5928         int family = nfmsg->nfgen_family;
5929         struct nft_table *table;
5930         struct nft_object *obj;
5931         struct nft_ctx ctx;
5932         u32 objtype;
5933         int err;
5934
5935         if (!nla[NFTA_OBJ_TYPE] ||
5936             !nla[NFTA_OBJ_NAME] ||
5937             !nla[NFTA_OBJ_DATA])
5938                 return -EINVAL;
5939
5940         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
5941         if (IS_ERR(table)) {
5942                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
5943                 return PTR_ERR(table);
5944         }
5945
5946         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5947         obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
5948         if (IS_ERR(obj)) {
5949                 err = PTR_ERR(obj);
5950                 if (err != -ENOENT) {
5951                         NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
5952                         return err;
5953                 }
5954         } else {
5955                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5956                         NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
5957                         return -EEXIST;
5958                 }
5959                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
5960                         return -EOPNOTSUPP;
5961
5962                 type = __nft_obj_type_get(objtype);
5963                 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5964
5965                 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
5966         }
5967
5968         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5969
5970         type = nft_obj_type_get(net, objtype);
5971         if (IS_ERR(type))
5972                 return PTR_ERR(type);
5973
5974         obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
5975         if (IS_ERR(obj)) {
5976                 err = PTR_ERR(obj);
5977                 goto err_init;
5978         }
5979         obj->key.table = table;
5980         obj->handle = nf_tables_alloc_handle(table);
5981
5982         obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5983         if (!obj->key.name) {
5984                 err = -ENOMEM;
5985                 goto err_strdup;
5986         }
5987
5988         if (nla[NFTA_OBJ_USERDATA]) {
5989                 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL);
5990                 if (obj->udata == NULL)
5991                         goto err_userdata;
5992
5993                 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]);
5994         }
5995
5996         err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5997         if (err < 0)
5998                 goto err_trans;
5999
6000         err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
6001                               nft_objname_ht_params);
6002         if (err < 0)
6003                 goto err_obj_ht;
6004
6005         list_add_tail_rcu(&obj->list, &table->objects);
6006         table->use++;
6007         return 0;
6008 err_obj_ht:
6009         /* queued in transaction log */
6010         INIT_LIST_HEAD(&obj->list);
6011         return err;
6012 err_trans:
6013         kfree(obj->key.name);
6014 err_userdata:
6015         kfree(obj->udata);
6016 err_strdup:
6017         if (obj->ops->destroy)
6018                 obj->ops->destroy(&ctx, obj);
6019         kfree(obj);
6020 err_init:
6021         module_put(type->owner);
6022         return err;
6023 }
6024
6025 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
6026                                    u32 portid, u32 seq, int event, u32 flags,
6027                                    int family, const struct nft_table *table,
6028                                    struct nft_object *obj, bool reset)
6029 {
6030         struct nfgenmsg *nfmsg;
6031         struct nlmsghdr *nlh;
6032
6033         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6034         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
6035         if (nlh == NULL)
6036                 goto nla_put_failure;
6037
6038         nfmsg = nlmsg_data(nlh);
6039         nfmsg->nfgen_family     = family;
6040         nfmsg->version          = NFNETLINK_V0;
6041         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
6042
6043         if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
6044             nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
6045             nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
6046             nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
6047             nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
6048             nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
6049                          NFTA_OBJ_PAD))
6050                 goto nla_put_failure;
6051
6052         if (obj->udata &&
6053             nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata))
6054                 goto nla_put_failure;
6055
6056         nlmsg_end(skb, nlh);
6057         return 0;
6058
6059 nla_put_failure:
6060         nlmsg_trim(skb, nlh);
6061         return -1;
6062 }
6063
6064 struct nft_obj_filter {
6065         char            *table;
6066         u32             type;
6067 };
6068
6069 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
6070 {
6071         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6072         const struct nft_table *table;
6073         unsigned int idx = 0, s_idx = cb->args[0];
6074         struct nft_obj_filter *filter = cb->data;
6075         struct net *net = sock_net(skb->sk);
6076         int family = nfmsg->nfgen_family;
6077         struct nft_object *obj;
6078         bool reset = false;
6079
6080         if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6081                 reset = true;
6082
6083         rcu_read_lock();
6084         cb->seq = net->nft.base_seq;
6085
6086         list_for_each_entry_rcu(table, &net->nft.tables, list) {
6087                 if (family != NFPROTO_UNSPEC && family != table->family)
6088                         continue;
6089
6090                 list_for_each_entry_rcu(obj, &table->objects, list) {
6091                         if (!nft_is_active(net, obj))
6092                                 goto cont;
6093                         if (idx < s_idx)
6094                                 goto cont;
6095                         if (idx > s_idx)
6096                                 memset(&cb->args[1], 0,
6097                                        sizeof(cb->args) - sizeof(cb->args[0]));
6098                         if (filter && filter->table &&
6099                             strcmp(filter->table, table->name))
6100                                 goto cont;
6101                         if (filter &&
6102                             filter->type != NFT_OBJECT_UNSPEC &&
6103                             obj->ops->type->type != filter->type)
6104                                 goto cont;
6105
6106                         if (reset) {
6107                                 char *buf = kasprintf(GFP_ATOMIC,
6108                                                       "%s:%llu;?:0",
6109                                                       table->name,
6110                                                       table->handle);
6111
6112                                 audit_log_nfcfg(buf,
6113                                                 family,
6114                                                 obj->handle,
6115                                                 AUDIT_NFT_OP_OBJ_RESET,
6116                                                 GFP_ATOMIC);
6117                                 kfree(buf);
6118                         }
6119
6120                         if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
6121                                                     cb->nlh->nlmsg_seq,
6122                                                     NFT_MSG_NEWOBJ,
6123                                                     NLM_F_MULTI | NLM_F_APPEND,
6124                                                     table->family, table,
6125                                                     obj, reset) < 0)
6126                                 goto done;
6127
6128                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
6129 cont:
6130                         idx++;
6131                 }
6132         }
6133 done:
6134         rcu_read_unlock();
6135
6136         cb->args[0] = idx;
6137         return skb->len;
6138 }
6139
6140 static int nf_tables_dump_obj_start(struct netlink_callback *cb)
6141 {
6142         const struct nlattr * const *nla = cb->data;
6143         struct nft_obj_filter *filter = NULL;
6144
6145         if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
6146                 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6147                 if (!filter)
6148                         return -ENOMEM;
6149
6150                 if (nla[NFTA_OBJ_TABLE]) {
6151                         filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
6152                         if (!filter->table) {
6153                                 kfree(filter);
6154                                 return -ENOMEM;
6155                         }
6156                 }
6157
6158                 if (nla[NFTA_OBJ_TYPE])
6159                         filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6160         }
6161
6162         cb->data = filter;
6163         return 0;
6164 }
6165
6166 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
6167 {
6168         struct nft_obj_filter *filter = cb->data;
6169
6170         if (filter) {
6171                 kfree(filter->table);
6172                 kfree(filter);
6173         }
6174
6175         return 0;
6176 }
6177
6178 /* called with rcu_read_lock held */
6179 static int nf_tables_getobj(struct net *net, struct sock *nlsk,
6180                             struct sk_buff *skb, const struct nlmsghdr *nlh,
6181                             const struct nlattr * const nla[],
6182                             struct netlink_ext_ack *extack)
6183 {
6184         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6185         u8 genmask = nft_genmask_cur(net);
6186         int family = nfmsg->nfgen_family;
6187         const struct nft_table *table;
6188         struct nft_object *obj;
6189         struct sk_buff *skb2;
6190         bool reset = false;
6191         u32 objtype;
6192         int err;
6193
6194         if (nlh->nlmsg_flags & NLM_F_DUMP) {
6195                 struct netlink_dump_control c = {
6196                         .start = nf_tables_dump_obj_start,
6197                         .dump = nf_tables_dump_obj,
6198                         .done = nf_tables_dump_obj_done,
6199                         .module = THIS_MODULE,
6200                         .data = (void *)nla,
6201                 };
6202
6203                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
6204         }
6205
6206         if (!nla[NFTA_OBJ_NAME] ||
6207             !nla[NFTA_OBJ_TYPE])
6208                 return -EINVAL;
6209
6210         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
6211         if (IS_ERR(table)) {
6212                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6213                 return PTR_ERR(table);
6214         }
6215
6216         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6217         obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
6218         if (IS_ERR(obj)) {
6219                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6220                 return PTR_ERR(obj);
6221         }
6222
6223         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
6224         if (!skb2)
6225                 return -ENOMEM;
6226
6227         if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6228                 reset = true;
6229
6230         if (reset) {
6231                 char *buf = kasprintf(GFP_ATOMIC, "%s:%llu;?:0",
6232                                       table->name, table->handle);
6233
6234                 audit_log_nfcfg(buf,
6235                                 family,
6236                                 obj->handle,
6237                                 AUDIT_NFT_OP_OBJ_RESET,
6238                                 GFP_ATOMIC);
6239                 kfree(buf);
6240         }
6241
6242         err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
6243                                       nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
6244                                       family, table, obj, reset);
6245         if (err < 0)
6246                 goto err_fill_obj_info;
6247
6248         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
6249
6250 err_fill_obj_info:
6251         kfree_skb(skb2);
6252         return err;
6253 }
6254
6255 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
6256 {
6257         if (obj->ops->destroy)
6258                 obj->ops->destroy(ctx, obj);
6259
6260         module_put(obj->ops->type->owner);
6261         kfree(obj->key.name);
6262         kfree(obj->udata);
6263         kfree(obj);
6264 }
6265
6266 static int nf_tables_delobj(struct net *net, struct sock *nlsk,
6267                             struct sk_buff *skb, const struct nlmsghdr *nlh,
6268                             const struct nlattr * const nla[],
6269                             struct netlink_ext_ack *extack)
6270 {
6271         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6272         u8 genmask = nft_genmask_next(net);
6273         int family = nfmsg->nfgen_family;
6274         const struct nlattr *attr;
6275         struct nft_table *table;
6276         struct nft_object *obj;
6277         struct nft_ctx ctx;
6278         u32 objtype;
6279
6280         if (!nla[NFTA_OBJ_TYPE] ||
6281             (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
6282                 return -EINVAL;
6283
6284         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
6285         if (IS_ERR(table)) {
6286                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6287                 return PTR_ERR(table);
6288         }
6289
6290         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6291         if (nla[NFTA_OBJ_HANDLE]) {
6292                 attr = nla[NFTA_OBJ_HANDLE];
6293                 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
6294         } else {
6295                 attr = nla[NFTA_OBJ_NAME];
6296                 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
6297         }
6298
6299         if (IS_ERR(obj)) {
6300                 NL_SET_BAD_ATTR(extack, attr);
6301                 return PTR_ERR(obj);
6302         }
6303         if (obj->use > 0) {
6304                 NL_SET_BAD_ATTR(extack, attr);
6305                 return -EBUSY;
6306         }
6307
6308         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6309
6310         return nft_delobj(&ctx, obj);
6311 }
6312
6313 void nft_obj_notify(struct net *net, const struct nft_table *table,
6314                     struct nft_object *obj, u32 portid, u32 seq, int event,
6315                     int family, int report, gfp_t gfp)
6316 {
6317         struct sk_buff *skb;
6318         int err;
6319         char *buf = kasprintf(gfp, "%s:%llu;?:0",
6320                               table->name, table->handle);
6321
6322         audit_log_nfcfg(buf,
6323                         family,
6324                         obj->handle,
6325                         event == NFT_MSG_NEWOBJ ?
6326                                 AUDIT_NFT_OP_OBJ_REGISTER :
6327                                 AUDIT_NFT_OP_OBJ_UNREGISTER,
6328                         gfp);
6329         kfree(buf);
6330
6331         if (!report &&
6332             !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
6333                 return;
6334
6335         skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
6336         if (skb == NULL)
6337                 goto err;
6338
6339         err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
6340                                       table, obj, false);
6341         if (err < 0) {
6342                 kfree_skb(skb);
6343                 goto err;
6344         }
6345
6346         nft_notify_enqueue(skb, report, &net->nft.notify_list);
6347         return;
6348 err:
6349         nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
6350 }
6351 EXPORT_SYMBOL_GPL(nft_obj_notify);
6352
6353 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
6354                                  struct nft_object *obj, int event)
6355 {
6356         nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
6357                        ctx->family, ctx->report, GFP_KERNEL);
6358 }
6359
6360 /*
6361  * Flow tables
6362  */
6363 void nft_register_flowtable_type(struct nf_flowtable_type *type)
6364 {
6365         nfnl_lock(NFNL_SUBSYS_NFTABLES);
6366         list_add_tail_rcu(&type->list, &nf_tables_flowtables);
6367         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6368 }
6369 EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
6370
6371 void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
6372 {
6373         nfnl_lock(NFNL_SUBSYS_NFTABLES);
6374         list_del_rcu(&type->list);
6375         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6376 }
6377 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
6378
6379 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
6380         [NFTA_FLOWTABLE_TABLE]          = { .type = NLA_STRING,
6381                                             .len = NFT_NAME_MAXLEN - 1 },
6382         [NFTA_FLOWTABLE_NAME]           = { .type = NLA_STRING,
6383                                             .len = NFT_NAME_MAXLEN - 1 },
6384         [NFTA_FLOWTABLE_HOOK]           = { .type = NLA_NESTED },
6385         [NFTA_FLOWTABLE_HANDLE]         = { .type = NLA_U64 },
6386         [NFTA_FLOWTABLE_FLAGS]          = { .type = NLA_U32 },
6387 };
6388
6389 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
6390                                            const struct nlattr *nla, u8 genmask)
6391 {
6392         struct nft_flowtable *flowtable;
6393
6394         list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6395                 if (!nla_strcmp(nla, flowtable->name) &&
6396                     nft_active_genmask(flowtable, genmask))
6397                         return flowtable;
6398         }
6399         return ERR_PTR(-ENOENT);
6400 }
6401 EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
6402
6403 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
6404                                     struct nft_flowtable *flowtable,
6405                                     enum nft_trans_phase phase)
6406 {
6407         switch (phase) {
6408         case NFT_TRANS_PREPARE:
6409         case NFT_TRANS_ABORT:
6410         case NFT_TRANS_RELEASE:
6411                 flowtable->use--;
6412                 fallthrough;
6413         default:
6414                 return;
6415         }
6416 }
6417 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
6418
6419 static struct nft_flowtable *
6420 nft_flowtable_lookup_byhandle(const struct nft_table *table,
6421                               const struct nlattr *nla, u8 genmask)
6422 {
6423        struct nft_flowtable *flowtable;
6424
6425        list_for_each_entry(flowtable, &table->flowtables, list) {
6426                if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
6427                    nft_active_genmask(flowtable, genmask))
6428                        return flowtable;
6429        }
6430        return ERR_PTR(-ENOENT);
6431 }
6432
6433 struct nft_flowtable_hook {
6434         u32                     num;
6435         int                     priority;
6436         struct list_head        list;
6437 };
6438
6439 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
6440         [NFTA_FLOWTABLE_HOOK_NUM]       = { .type = NLA_U32 },
6441         [NFTA_FLOWTABLE_HOOK_PRIORITY]  = { .type = NLA_U32 },
6442         [NFTA_FLOWTABLE_HOOK_DEVS]      = { .type = NLA_NESTED },
6443 };
6444
6445 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
6446                                     const struct nlattr *attr,
6447                                     struct nft_flowtable_hook *flowtable_hook,
6448                                     struct nft_flowtable *flowtable, bool add)
6449 {
6450         struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
6451         struct nft_hook *hook;
6452         int hooknum, priority;
6453         int err;
6454
6455         INIT_LIST_HEAD(&flowtable_hook->list);
6456
6457         err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
6458                                           nft_flowtable_hook_policy, NULL);
6459         if (err < 0)
6460                 return err;
6461
6462         if (add) {
6463                 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
6464                     !tb[NFTA_FLOWTABLE_HOOK_PRIORITY])
6465                         return -EINVAL;
6466
6467                 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6468                 if (hooknum != NF_NETDEV_INGRESS)
6469                         return -EOPNOTSUPP;
6470
6471                 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6472
6473                 flowtable_hook->priority        = priority;
6474                 flowtable_hook->num             = hooknum;
6475         } else {
6476                 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) {
6477                         hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
6478                         if (hooknum != flowtable->hooknum)
6479                                 return -EOPNOTSUPP;
6480                 }
6481
6482                 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
6483                         priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
6484                         if (priority != flowtable->data.priority)
6485                                 return -EOPNOTSUPP;
6486                 }
6487
6488                 flowtable_hook->priority        = flowtable->data.priority;
6489                 flowtable_hook->num             = flowtable->hooknum;
6490         }
6491
6492         if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
6493                 err = nf_tables_parse_netdev_hooks(ctx->net,
6494                                                    tb[NFTA_FLOWTABLE_HOOK_DEVS],
6495                                                    &flowtable_hook->list);
6496                 if (err < 0)
6497                         return err;
6498         }
6499
6500         list_for_each_entry(hook, &flowtable_hook->list, list) {
6501                 hook->ops.pf            = NFPROTO_NETDEV;
6502                 hook->ops.hooknum       = flowtable_hook->num;
6503                 hook->ops.priority      = flowtable_hook->priority;
6504                 hook->ops.priv          = &flowtable->data;
6505                 hook->ops.hook          = flowtable->data.type->hook;
6506         }
6507
6508         return err;
6509 }
6510
6511 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
6512 {
6513         const struct nf_flowtable_type *type;
6514
6515         list_for_each_entry(type, &nf_tables_flowtables, list) {
6516                 if (family == type->family)
6517                         return type;
6518         }
6519         return NULL;
6520 }
6521
6522 static const struct nf_flowtable_type *
6523 nft_flowtable_type_get(struct net *net, u8 family)
6524 {
6525         const struct nf_flowtable_type *type;
6526
6527         type = __nft_flowtable_type_get(family);
6528         if (type != NULL && try_module_get(type->owner))
6529                 return type;
6530
6531         lockdep_nfnl_nft_mutex_not_held();
6532 #ifdef CONFIG_MODULES
6533         if (type == NULL) {
6534                 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
6535                         return ERR_PTR(-EAGAIN);
6536         }
6537 #endif
6538         return ERR_PTR(-ENOENT);
6539 }
6540
6541 /* Only called from error and netdev event paths. */
6542 static void nft_unregister_flowtable_hook(struct net *net,
6543                                           struct nft_flowtable *flowtable,
6544                                           struct nft_hook *hook)
6545 {
6546         nf_unregister_net_hook(net, &hook->ops);
6547         flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
6548                                     FLOW_BLOCK_UNBIND);
6549 }
6550
6551 static void nft_unregister_flowtable_net_hooks(struct net *net,
6552                                                struct list_head *hook_list)
6553 {
6554         struct nft_hook *hook;
6555
6556         list_for_each_entry(hook, hook_list, list)
6557                 nf_unregister_net_hook(net, &hook->ops);
6558 }
6559
6560 static int nft_register_flowtable_net_hooks(struct net *net,
6561                                             struct nft_table *table,
6562                                             struct list_head *hook_list,
6563                                             struct nft_flowtable *flowtable)
6564 {
6565         struct nft_hook *hook, *hook2, *next;
6566         struct nft_flowtable *ft;
6567         int err, i = 0;
6568
6569         list_for_each_entry(hook, hook_list, list) {
6570                 list_for_each_entry(ft, &table->flowtables, list) {
6571                         list_for_each_entry(hook2, &ft->hook_list, list) {
6572                                 if (hook->ops.dev == hook2->ops.dev &&
6573                                     hook->ops.pf == hook2->ops.pf) {
6574                                         err = -EEXIST;
6575                                         goto err_unregister_net_hooks;
6576                                 }
6577                         }
6578                 }
6579
6580                 err = flowtable->data.type->setup(&flowtable->data,
6581                                                   hook->ops.dev,
6582                                                   FLOW_BLOCK_BIND);
6583                 if (err < 0)
6584                         goto err_unregister_net_hooks;
6585
6586                 err = nf_register_net_hook(net, &hook->ops);
6587                 if (err < 0) {
6588                         flowtable->data.type->setup(&flowtable->data,
6589                                                     hook->ops.dev,
6590                                                     FLOW_BLOCK_UNBIND);
6591                         goto err_unregister_net_hooks;
6592                 }
6593
6594                 i++;
6595         }
6596
6597         return 0;
6598
6599 err_unregister_net_hooks:
6600         list_for_each_entry_safe(hook, next, hook_list, list) {
6601                 if (i-- <= 0)
6602                         break;
6603
6604                 nft_unregister_flowtable_hook(net, flowtable, hook);
6605                 list_del_rcu(&hook->list);
6606                 kfree_rcu(hook, rcu);
6607         }
6608
6609         return err;
6610 }
6611
6612 static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
6613 {
6614         struct nft_hook *hook, *next;
6615
6616         list_for_each_entry_safe(hook, next, hook_list, list) {
6617                 list_del_rcu(&hook->list);
6618                 kfree_rcu(hook, rcu);
6619         }
6620 }
6621
6622 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
6623                                 struct nft_flowtable *flowtable)
6624 {
6625         const struct nlattr * const *nla = ctx->nla;
6626         struct nft_flowtable_hook flowtable_hook;
6627         struct nft_hook *hook, *next;
6628         struct nft_trans *trans;
6629         bool unregister = false;
6630         int err;
6631
6632         err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
6633                                        &flowtable_hook, flowtable, false);
6634         if (err < 0)
6635                 return err;
6636
6637         list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
6638                 if (nft_hook_list_find(&flowtable->hook_list, hook)) {
6639                         list_del(&hook->list);
6640                         kfree(hook);
6641                 }
6642         }
6643
6644         err = nft_register_flowtable_net_hooks(ctx->net, ctx->table,
6645                                                &flowtable_hook.list, flowtable);
6646         if (err < 0)
6647                 goto err_flowtable_update_hook;
6648
6649         trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE,
6650                                 sizeof(struct nft_trans_flowtable));
6651         if (!trans) {
6652                 unregister = true;
6653                 err = -ENOMEM;
6654                 goto err_flowtable_update_hook;
6655         }
6656
6657         nft_trans_flowtable(trans) = flowtable;
6658         nft_trans_flowtable_update(trans) = true;
6659         INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
6660         list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans));
6661
6662         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
6663
6664         return 0;
6665
6666 err_flowtable_update_hook:
6667         list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
6668                 if (unregister)
6669                         nft_unregister_flowtable_hook(ctx->net, flowtable, hook);
6670                 list_del_rcu(&hook->list);
6671                 kfree_rcu(hook, rcu);
6672         }
6673
6674         return err;
6675
6676 }
6677
6678 static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
6679                                   struct sk_buff *skb,
6680                                   const struct nlmsghdr *nlh,
6681                                   const struct nlattr * const nla[],
6682                                   struct netlink_ext_ack *extack)
6683 {
6684         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6685         struct nft_flowtable_hook flowtable_hook;
6686         const struct nf_flowtable_type *type;
6687         u8 genmask = nft_genmask_next(net);
6688         int family = nfmsg->nfgen_family;
6689         struct nft_flowtable *flowtable;
6690         struct nft_hook *hook, *next;
6691         struct nft_table *table;
6692         struct nft_ctx ctx;
6693         int err;
6694
6695         if (!nla[NFTA_FLOWTABLE_TABLE] ||
6696             !nla[NFTA_FLOWTABLE_NAME] ||
6697             !nla[NFTA_FLOWTABLE_HOOK])
6698                 return -EINVAL;
6699
6700         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6701                                  genmask);
6702         if (IS_ERR(table)) {
6703                 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
6704                 return PTR_ERR(table);
6705         }
6706
6707         flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6708                                          genmask);
6709         if (IS_ERR(flowtable)) {
6710                 err = PTR_ERR(flowtable);
6711                 if (err != -ENOENT) {
6712                         NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
6713                         return err;
6714                 }
6715         } else {
6716                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
6717                         NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
6718                         return -EEXIST;
6719                 }
6720
6721                 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6722
6723                 return nft_flowtable_update(&ctx, nlh, flowtable);
6724         }
6725
6726         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6727
6728         flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
6729         if (!flowtable)
6730                 return -ENOMEM;
6731
6732         flowtable->table = table;
6733         flowtable->handle = nf_tables_alloc_handle(table);
6734         INIT_LIST_HEAD(&flowtable->hook_list);
6735
6736         flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
6737         if (!flowtable->name) {
6738                 err = -ENOMEM;
6739                 goto err1;
6740         }
6741
6742         type = nft_flowtable_type_get(net, family);
6743         if (IS_ERR(type)) {
6744                 err = PTR_ERR(type);
6745                 goto err2;
6746         }
6747
6748         if (nla[NFTA_FLOWTABLE_FLAGS]) {
6749                 flowtable->data.flags =
6750                         ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
6751                 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK)
6752                         goto err3;
6753         }
6754
6755         write_pnet(&flowtable->data.net, net);
6756         flowtable->data.type = type;
6757         err = type->init(&flowtable->data);
6758         if (err < 0)
6759                 goto err3;
6760
6761         err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
6762                                        &flowtable_hook, flowtable, true);
6763         if (err < 0)
6764                 goto err4;
6765
6766         list_splice(&flowtable_hook.list, &flowtable->hook_list);
6767         flowtable->data.priority = flowtable_hook.priority;
6768         flowtable->hooknum = flowtable_hook.num;
6769
6770         err = nft_register_flowtable_net_hooks(ctx.net, table,
6771                                                &flowtable->hook_list,
6772                                                flowtable);
6773         if (err < 0) {
6774                 nft_flowtable_hooks_destroy(&flowtable->hook_list);
6775                 goto err4;
6776         }
6777
6778         err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
6779         if (err < 0)
6780                 goto err5;
6781
6782         list_add_tail_rcu(&flowtable->list, &table->flowtables);
6783         table->use++;
6784
6785         return 0;
6786 err5:
6787         list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
6788                 nft_unregister_flowtable_hook(net, flowtable, hook);
6789                 list_del_rcu(&hook->list);
6790                 kfree_rcu(hook, rcu);
6791         }
6792 err4:
6793         flowtable->data.type->free(&flowtable->data);
6794 err3:
6795         module_put(type->owner);
6796 err2:
6797         kfree(flowtable->name);
6798 err1:
6799         kfree(flowtable);
6800         return err;
6801 }
6802
6803 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook)
6804 {
6805         struct nft_hook *this, *next;
6806
6807         list_for_each_entry_safe(this, next, &flowtable_hook->list, list) {
6808                 list_del(&this->list);
6809                 kfree(this);
6810         }
6811 }
6812
6813 static int nft_delflowtable_hook(struct nft_ctx *ctx,
6814                                  struct nft_flowtable *flowtable)
6815 {
6816         const struct nlattr * const *nla = ctx->nla;
6817         struct nft_flowtable_hook flowtable_hook;
6818         struct nft_hook *this, *hook;
6819         struct nft_trans *trans;
6820         int err;
6821
6822         err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
6823                                        &flowtable_hook, flowtable, false);
6824         if (err < 0)
6825                 return err;
6826
6827         list_for_each_entry(this, &flowtable_hook.list, list) {
6828                 hook = nft_hook_list_find(&flowtable->hook_list, this);
6829                 if (!hook) {
6830                         err = -ENOENT;
6831                         goto err_flowtable_del_hook;
6832                 }
6833                 hook->inactive = true;
6834         }
6835
6836         trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
6837                                 sizeof(struct nft_trans_flowtable));
6838         if (!trans) {
6839                 err = -ENOMEM;
6840                 goto err_flowtable_del_hook;
6841         }
6842
6843         nft_trans_flowtable(trans) = flowtable;
6844         nft_trans_flowtable_update(trans) = true;
6845         INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
6846         nft_flowtable_hook_release(&flowtable_hook);
6847
6848         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
6849
6850         return 0;
6851
6852 err_flowtable_del_hook:
6853         list_for_each_entry(this, &flowtable_hook.list, list) {
6854                 hook = nft_hook_list_find(&flowtable->hook_list, this);
6855                 if (!hook)
6856                         break;
6857
6858                 hook->inactive = false;
6859         }
6860         nft_flowtable_hook_release(&flowtable_hook);
6861
6862         return err;
6863 }
6864
6865 static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
6866                                   struct sk_buff *skb,
6867                                   const struct nlmsghdr *nlh,
6868                                   const struct nlattr * const nla[],
6869                                   struct netlink_ext_ack *extack)
6870 {
6871         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6872         u8 genmask = nft_genmask_next(net);
6873         int family = nfmsg->nfgen_family;
6874         struct nft_flowtable *flowtable;
6875         const struct nlattr *attr;
6876         struct nft_table *table;
6877         struct nft_ctx ctx;
6878
6879         if (!nla[NFTA_FLOWTABLE_TABLE] ||
6880             (!nla[NFTA_FLOWTABLE_NAME] &&
6881              !nla[NFTA_FLOWTABLE_HANDLE]))
6882                 return -EINVAL;
6883
6884         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6885                                  genmask);
6886         if (IS_ERR(table)) {
6887                 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
6888                 return PTR_ERR(table);
6889         }
6890
6891         if (nla[NFTA_FLOWTABLE_HANDLE]) {
6892                 attr = nla[NFTA_FLOWTABLE_HANDLE];
6893                 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
6894         } else {
6895                 attr = nla[NFTA_FLOWTABLE_NAME];
6896                 flowtable = nft_flowtable_lookup(table, attr, genmask);
6897         }
6898
6899         if (IS_ERR(flowtable)) {
6900                 NL_SET_BAD_ATTR(extack, attr);
6901                 return PTR_ERR(flowtable);
6902         }
6903
6904         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
6905
6906         if (nla[NFTA_FLOWTABLE_HOOK])
6907                 return nft_delflowtable_hook(&ctx, flowtable);
6908
6909         if (flowtable->use > 0) {
6910                 NL_SET_BAD_ATTR(extack, attr);
6911                 return -EBUSY;
6912         }
6913
6914         return nft_delflowtable(&ctx, flowtable);
6915 }
6916
6917 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
6918                                          u32 portid, u32 seq, int event,
6919                                          u32 flags, int family,
6920                                          struct nft_flowtable *flowtable,
6921                                          struct list_head *hook_list)
6922 {
6923         struct nlattr *nest, *nest_devs;
6924         struct nfgenmsg *nfmsg;
6925         struct nft_hook *hook;
6926         struct nlmsghdr *nlh;
6927
6928         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6929         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
6930         if (nlh == NULL)
6931                 goto nla_put_failure;
6932
6933         nfmsg = nlmsg_data(nlh);
6934         nfmsg->nfgen_family     = family;
6935         nfmsg->version          = NFNETLINK_V0;
6936         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
6937
6938         if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
6939             nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
6940             nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
6941             nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
6942                          NFTA_FLOWTABLE_PAD) ||
6943             nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags)))
6944                 goto nla_put_failure;
6945
6946         nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
6947         if (!nest)
6948                 goto nla_put_failure;
6949         if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
6950             nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority)))
6951                 goto nla_put_failure;
6952
6953         nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
6954         if (!nest_devs)
6955                 goto nla_put_failure;
6956
6957         list_for_each_entry_rcu(hook, hook_list, list) {
6958                 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))
6959                         goto nla_put_failure;
6960         }
6961         nla_nest_end(skb, nest_devs);
6962         nla_nest_end(skb, nest);
6963
6964         nlmsg_end(skb, nlh);
6965         return 0;
6966
6967 nla_put_failure:
6968         nlmsg_trim(skb, nlh);
6969         return -1;
6970 }
6971
6972 struct nft_flowtable_filter {
6973         char            *table;
6974 };
6975
6976 static int nf_tables_dump_flowtable(struct sk_buff *skb,
6977                                     struct netlink_callback *cb)
6978 {
6979         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6980         struct nft_flowtable_filter *filter = cb->data;
6981         unsigned int idx = 0, s_idx = cb->args[0];
6982         struct net *net = sock_net(skb->sk);
6983         int family = nfmsg->nfgen_family;
6984         struct nft_flowtable *flowtable;
6985         const struct nft_table *table;
6986
6987         rcu_read_lock();
6988         cb->seq = net->nft.base_seq;
6989
6990         list_for_each_entry_rcu(table, &net->nft.tables, list) {
6991                 if (family != NFPROTO_UNSPEC && family != table->family)
6992                         continue;
6993
6994                 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6995                         if (!nft_is_active(net, flowtable))
6996                                 goto cont;
6997                         if (idx < s_idx)
6998                                 goto cont;
6999                         if (idx > s_idx)
7000                                 memset(&cb->args[1], 0,
7001                                        sizeof(cb->args) - sizeof(cb->args[0]));
7002                         if (filter && filter->table &&
7003                             strcmp(filter->table, table->name))
7004                                 goto cont;
7005
7006                         if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
7007                                                           cb->nlh->nlmsg_seq,
7008                                                           NFT_MSG_NEWFLOWTABLE,
7009                                                           NLM_F_MULTI | NLM_F_APPEND,
7010                                                           table->family,
7011                                                           flowtable,
7012                                                           &flowtable->hook_list) < 0)
7013                                 goto done;
7014
7015                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
7016 cont:
7017                         idx++;
7018                 }
7019         }
7020 done:
7021         rcu_read_unlock();
7022
7023         cb->args[0] = idx;
7024         return skb->len;
7025 }
7026
7027 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
7028 {
7029         const struct nlattr * const *nla = cb->data;
7030         struct nft_flowtable_filter *filter = NULL;
7031
7032         if (nla[NFTA_FLOWTABLE_TABLE]) {
7033                 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
7034                 if (!filter)
7035                         return -ENOMEM;
7036
7037                 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
7038                                            GFP_ATOMIC);
7039                 if (!filter->table) {
7040                         kfree(filter);
7041                         return -ENOMEM;
7042                 }
7043         }
7044
7045         cb->data = filter;
7046         return 0;
7047 }
7048
7049 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
7050 {
7051         struct nft_flowtable_filter *filter = cb->data;
7052
7053         if (!filter)
7054                 return 0;
7055
7056         kfree(filter->table);
7057         kfree(filter);
7058
7059         return 0;
7060 }
7061
7062 /* called with rcu_read_lock held */
7063 static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
7064                                   struct sk_buff *skb,
7065                                   const struct nlmsghdr *nlh,
7066                                   const struct nlattr * const nla[],
7067                                   struct netlink_ext_ack *extack)
7068 {
7069         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
7070         u8 genmask = nft_genmask_cur(net);
7071         int family = nfmsg->nfgen_family;
7072         struct nft_flowtable *flowtable;
7073         const struct nft_table *table;
7074         struct sk_buff *skb2;
7075         int err;
7076
7077         if (nlh->nlmsg_flags & NLM_F_DUMP) {
7078                 struct netlink_dump_control c = {
7079                         .start = nf_tables_dump_flowtable_start,
7080                         .dump = nf_tables_dump_flowtable,
7081                         .done = nf_tables_dump_flowtable_done,
7082                         .module = THIS_MODULE,
7083                         .data = (void *)nla,
7084                 };
7085
7086                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
7087         }
7088
7089         if (!nla[NFTA_FLOWTABLE_NAME])
7090                 return -EINVAL;
7091
7092         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7093                                  genmask);
7094         if (IS_ERR(table))
7095                 return PTR_ERR(table);
7096
7097         flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
7098                                          genmask);
7099         if (IS_ERR(flowtable))
7100                 return PTR_ERR(flowtable);
7101
7102         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7103         if (!skb2)
7104                 return -ENOMEM;
7105
7106         err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
7107                                             nlh->nlmsg_seq,
7108                                             NFT_MSG_NEWFLOWTABLE, 0, family,
7109                                             flowtable, &flowtable->hook_list);
7110         if (err < 0)
7111                 goto err_fill_flowtable_info;
7112
7113         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7114
7115 err_fill_flowtable_info:
7116         kfree_skb(skb2);
7117         return err;
7118 }
7119
7120 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
7121                                        struct nft_flowtable *flowtable,
7122                                        struct list_head *hook_list,
7123                                        int event)
7124 {
7125         struct sk_buff *skb;
7126         int err;
7127         char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
7128                               flowtable->table->name, flowtable->table->handle,
7129                               flowtable->name, flowtable->handle);
7130
7131         audit_log_nfcfg(buf,
7132                         ctx->family,
7133                         flowtable->hooknum,
7134                         event == NFT_MSG_NEWFLOWTABLE ?
7135                                 AUDIT_NFT_OP_FLOWTABLE_REGISTER :
7136                                 AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
7137                         GFP_KERNEL);
7138         kfree(buf);
7139
7140         if (ctx->report &&
7141             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
7142                 return;
7143
7144         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7145         if (skb == NULL)
7146                 goto err;
7147
7148         err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
7149                                             ctx->seq, event, 0,
7150                                             ctx->family, flowtable, hook_list);
7151         if (err < 0) {
7152                 kfree_skb(skb);
7153                 goto err;
7154         }
7155
7156         nft_notify_enqueue(skb, ctx->report, &ctx->net->nft.notify_list);
7157         return;
7158 err:
7159         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
7160 }
7161
7162 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
7163 {
7164         struct nft_hook *hook, *next;
7165
7166         flowtable->data.type->free(&flowtable->data);
7167         list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7168                 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
7169                                             FLOW_BLOCK_UNBIND);
7170                 list_del_rcu(&hook->list);
7171                 kfree(hook);
7172         }
7173         kfree(flowtable->name);
7174         module_put(flowtable->data.type->owner);
7175         kfree(flowtable);
7176 }
7177
7178 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
7179                                    u32 portid, u32 seq)
7180 {
7181         struct nlmsghdr *nlh;
7182         struct nfgenmsg *nfmsg;
7183         char buf[TASK_COMM_LEN];
7184         int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
7185
7186         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
7187         if (nlh == NULL)
7188                 goto nla_put_failure;
7189
7190         nfmsg = nlmsg_data(nlh);
7191         nfmsg->nfgen_family     = AF_UNSPEC;
7192         nfmsg->version          = NFNETLINK_V0;
7193         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
7194
7195         if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
7196             nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
7197             nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
7198                 goto nla_put_failure;
7199
7200         nlmsg_end(skb, nlh);
7201         return 0;
7202
7203 nla_put_failure:
7204         nlmsg_trim(skb, nlh);
7205         return -EMSGSIZE;
7206 }
7207
7208 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
7209                                 struct nft_flowtable *flowtable)
7210 {
7211         struct nft_hook *hook;
7212
7213         list_for_each_entry(hook, &flowtable->hook_list, list) {
7214                 if (hook->ops.dev != dev)
7215                         continue;
7216
7217                 /* flow_offload_netdev_event() cleans up entries for us. */
7218                 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook);
7219                 list_del_rcu(&hook->list);
7220                 kfree_rcu(hook, rcu);
7221                 break;
7222         }
7223 }
7224
7225 static int nf_tables_flowtable_event(struct notifier_block *this,
7226                                      unsigned long event, void *ptr)
7227 {
7228         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
7229         struct nft_flowtable *flowtable;
7230         struct nft_table *table;
7231         struct net *net;
7232
7233         if (event != NETDEV_UNREGISTER)
7234                 return 0;
7235
7236         net = dev_net(dev);
7237         mutex_lock(&net->nft.commit_mutex);
7238         list_for_each_entry(table, &net->nft.tables, list) {
7239                 list_for_each_entry(flowtable, &table->flowtables, list) {
7240                         nft_flowtable_event(event, dev, flowtable);
7241                 }
7242         }
7243         mutex_unlock(&net->nft.commit_mutex);
7244
7245         return NOTIFY_DONE;
7246 }
7247
7248 static struct notifier_block nf_tables_flowtable_notifier = {
7249         .notifier_call  = nf_tables_flowtable_event,
7250 };
7251
7252 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
7253                                  int event)
7254 {
7255         struct nlmsghdr *nlh = nlmsg_hdr(skb);
7256         struct sk_buff *skb2;
7257         int err;
7258
7259         audit_log_nfcfg("?:0;?:0", 0, net->nft.base_seq,
7260                         AUDIT_NFT_OP_GEN_REGISTER, GFP_KERNEL);
7261
7262         if (nlmsg_report(nlh) &&
7263             !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
7264                 return;
7265
7266         skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7267         if (skb2 == NULL)
7268                 goto err;
7269
7270         err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7271                                       nlh->nlmsg_seq);
7272         if (err < 0) {
7273                 kfree_skb(skb2);
7274                 goto err;
7275         }
7276
7277         nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7278                        nlmsg_report(nlh), GFP_KERNEL);
7279         return;
7280 err:
7281         nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7282                           -ENOBUFS);
7283 }
7284
7285 static int nf_tables_getgen(struct net *net, struct sock *nlsk,
7286                             struct sk_buff *skb, const struct nlmsghdr *nlh,
7287                             const struct nlattr * const nla[],
7288                             struct netlink_ext_ack *extack)
7289 {
7290         struct sk_buff *skb2;
7291         int err;
7292
7293         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7294         if (skb2 == NULL)
7295                 return -ENOMEM;
7296
7297         err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7298                                       nlh->nlmsg_seq);
7299         if (err < 0)
7300                 goto err_fill_gen_info;
7301
7302         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7303
7304 err_fill_gen_info:
7305         kfree_skb(skb2);
7306         return err;
7307 }
7308
7309 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
7310         [NFT_MSG_NEWTABLE] = {
7311                 .call_batch     = nf_tables_newtable,
7312                 .attr_count     = NFTA_TABLE_MAX,
7313                 .policy         = nft_table_policy,
7314         },
7315         [NFT_MSG_GETTABLE] = {
7316                 .call_rcu       = nf_tables_gettable,
7317                 .attr_count     = NFTA_TABLE_MAX,
7318                 .policy         = nft_table_policy,
7319         },
7320         [NFT_MSG_DELTABLE] = {
7321                 .call_batch     = nf_tables_deltable,
7322                 .attr_count     = NFTA_TABLE_MAX,
7323                 .policy         = nft_table_policy,
7324         },
7325         [NFT_MSG_NEWCHAIN] = {
7326                 .call_batch     = nf_tables_newchain,
7327                 .attr_count     = NFTA_CHAIN_MAX,
7328                 .policy         = nft_chain_policy,
7329         },
7330         [NFT_MSG_GETCHAIN] = {
7331                 .call_rcu       = nf_tables_getchain,
7332                 .attr_count     = NFTA_CHAIN_MAX,
7333                 .policy         = nft_chain_policy,
7334         },
7335         [NFT_MSG_DELCHAIN] = {
7336                 .call_batch     = nf_tables_delchain,
7337                 .attr_count     = NFTA_CHAIN_MAX,
7338                 .policy         = nft_chain_policy,
7339         },
7340         [NFT_MSG_NEWRULE] = {
7341                 .call_batch     = nf_tables_newrule,
7342                 .attr_count     = NFTA_RULE_MAX,
7343                 .policy         = nft_rule_policy,
7344         },
7345         [NFT_MSG_GETRULE] = {
7346                 .call_rcu       = nf_tables_getrule,
7347                 .attr_count     = NFTA_RULE_MAX,
7348                 .policy         = nft_rule_policy,
7349         },
7350         [NFT_MSG_DELRULE] = {
7351                 .call_batch     = nf_tables_delrule,
7352                 .attr_count     = NFTA_RULE_MAX,
7353                 .policy         = nft_rule_policy,
7354         },
7355         [NFT_MSG_NEWSET] = {
7356                 .call_batch     = nf_tables_newset,
7357                 .attr_count     = NFTA_SET_MAX,
7358                 .policy         = nft_set_policy,
7359         },
7360         [NFT_MSG_GETSET] = {
7361                 .call_rcu       = nf_tables_getset,
7362                 .attr_count     = NFTA_SET_MAX,
7363                 .policy         = nft_set_policy,
7364         },
7365         [NFT_MSG_DELSET] = {
7366                 .call_batch     = nf_tables_delset,
7367                 .attr_count     = NFTA_SET_MAX,
7368                 .policy         = nft_set_policy,
7369         },
7370         [NFT_MSG_NEWSETELEM] = {
7371                 .call_batch     = nf_tables_newsetelem,
7372                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
7373                 .policy         = nft_set_elem_list_policy,
7374         },
7375         [NFT_MSG_GETSETELEM] = {
7376                 .call_rcu       = nf_tables_getsetelem,
7377                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
7378                 .policy         = nft_set_elem_list_policy,
7379         },
7380         [NFT_MSG_DELSETELEM] = {
7381                 .call_batch     = nf_tables_delsetelem,
7382                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
7383                 .policy         = nft_set_elem_list_policy,
7384         },
7385         [NFT_MSG_GETGEN] = {
7386                 .call_rcu       = nf_tables_getgen,
7387         },
7388         [NFT_MSG_NEWOBJ] = {
7389                 .call_batch     = nf_tables_newobj,
7390                 .attr_count     = NFTA_OBJ_MAX,
7391                 .policy         = nft_obj_policy,
7392         },
7393         [NFT_MSG_GETOBJ] = {
7394                 .call_rcu       = nf_tables_getobj,
7395                 .attr_count     = NFTA_OBJ_MAX,
7396                 .policy         = nft_obj_policy,
7397         },
7398         [NFT_MSG_DELOBJ] = {
7399                 .call_batch     = nf_tables_delobj,
7400                 .attr_count     = NFTA_OBJ_MAX,
7401                 .policy         = nft_obj_policy,
7402         },
7403         [NFT_MSG_GETOBJ_RESET] = {
7404                 .call_rcu       = nf_tables_getobj,
7405                 .attr_count     = NFTA_OBJ_MAX,
7406                 .policy         = nft_obj_policy,
7407         },
7408         [NFT_MSG_NEWFLOWTABLE] = {
7409                 .call_batch     = nf_tables_newflowtable,
7410                 .attr_count     = NFTA_FLOWTABLE_MAX,
7411                 .policy         = nft_flowtable_policy,
7412         },
7413         [NFT_MSG_GETFLOWTABLE] = {
7414                 .call_rcu       = nf_tables_getflowtable,
7415                 .attr_count     = NFTA_FLOWTABLE_MAX,
7416                 .policy         = nft_flowtable_policy,
7417         },
7418         [NFT_MSG_DELFLOWTABLE] = {
7419                 .call_batch     = nf_tables_delflowtable,
7420                 .attr_count     = NFTA_FLOWTABLE_MAX,
7421                 .policy         = nft_flowtable_policy,
7422         },
7423 };
7424
7425 static int nf_tables_validate(struct net *net)
7426 {
7427         struct nft_table *table;
7428
7429         switch (net->nft.validate_state) {
7430         case NFT_VALIDATE_SKIP:
7431                 break;
7432         case NFT_VALIDATE_NEED:
7433                 nft_validate_state_update(net, NFT_VALIDATE_DO);
7434                 fallthrough;
7435         case NFT_VALIDATE_DO:
7436                 list_for_each_entry(table, &net->nft.tables, list) {
7437                         if (nft_table_validate(net, table) < 0)
7438                                 return -EAGAIN;
7439                 }
7440                 break;
7441         }
7442
7443         return 0;
7444 }
7445
7446 /* a drop policy has to be deferred until all rules have been activated,
7447  * otherwise a large ruleset that contains a drop-policy base chain will
7448  * cause all packets to get dropped until the full transaction has been
7449  * processed.
7450  *
7451  * We defer the drop policy until the transaction has been finalized.
7452  */
7453 static void nft_chain_commit_drop_policy(struct nft_trans *trans)
7454 {
7455         struct nft_base_chain *basechain;
7456
7457         if (nft_trans_chain_policy(trans) != NF_DROP)
7458                 return;
7459
7460         if (!nft_is_base_chain(trans->ctx.chain))
7461                 return;
7462
7463         basechain = nft_base_chain(trans->ctx.chain);
7464         basechain->policy = NF_DROP;
7465 }
7466
7467 static void nft_chain_commit_update(struct nft_trans *trans)
7468 {
7469         struct nft_base_chain *basechain;
7470
7471         if (nft_trans_chain_name(trans)) {
7472                 rhltable_remove(&trans->ctx.table->chains_ht,
7473                                 &trans->ctx.chain->rhlhead,
7474                                 nft_chain_ht_params);
7475                 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
7476                 rhltable_insert_key(&trans->ctx.table->chains_ht,
7477                                     trans->ctx.chain->name,
7478                                     &trans->ctx.chain->rhlhead,
7479                                     nft_chain_ht_params);
7480         }
7481
7482         if (!nft_is_base_chain(trans->ctx.chain))
7483                 return;
7484
7485         nft_chain_stats_replace(trans);
7486
7487         basechain = nft_base_chain(trans->ctx.chain);
7488
7489         switch (nft_trans_chain_policy(trans)) {
7490         case NF_DROP:
7491         case NF_ACCEPT:
7492                 basechain->policy = nft_trans_chain_policy(trans);
7493                 break;
7494         }
7495 }
7496
7497 static void nft_obj_commit_update(struct nft_trans *trans)
7498 {
7499         struct nft_object *newobj;
7500         struct nft_object *obj;
7501
7502         obj = nft_trans_obj(trans);
7503         newobj = nft_trans_obj_newobj(trans);
7504
7505         if (obj->ops->update)
7506                 obj->ops->update(obj, newobj);
7507
7508         kfree(newobj);
7509 }
7510
7511 static void nft_commit_release(struct nft_trans *trans)
7512 {
7513         switch (trans->msg_type) {
7514         case NFT_MSG_DELTABLE:
7515                 nf_tables_table_destroy(&trans->ctx);
7516                 break;
7517         case NFT_MSG_NEWCHAIN:
7518                 free_percpu(nft_trans_chain_stats(trans));
7519                 kfree(nft_trans_chain_name(trans));
7520                 break;
7521         case NFT_MSG_DELCHAIN:
7522                 nf_tables_chain_destroy(&trans->ctx);
7523                 break;
7524         case NFT_MSG_DELRULE:
7525                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
7526                 break;
7527         case NFT_MSG_DELSET:
7528                 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
7529                 break;
7530         case NFT_MSG_DELSETELEM:
7531                 nf_tables_set_elem_destroy(&trans->ctx,
7532                                            nft_trans_elem_set(trans),
7533                                            nft_trans_elem(trans).priv);
7534                 break;
7535         case NFT_MSG_DELOBJ:
7536                 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
7537                 break;
7538         case NFT_MSG_DELFLOWTABLE:
7539                 if (nft_trans_flowtable_update(trans))
7540                         nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
7541                 else
7542                         nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
7543                 break;
7544         }
7545
7546         if (trans->put_net)
7547                 put_net(trans->ctx.net);
7548
7549         kfree(trans);
7550 }
7551
7552 static void nf_tables_trans_destroy_work(struct work_struct *w)
7553 {
7554         struct nft_trans *trans, *next;
7555         LIST_HEAD(head);
7556
7557         spin_lock(&nf_tables_destroy_list_lock);
7558         list_splice_init(&nf_tables_destroy_list, &head);
7559         spin_unlock(&nf_tables_destroy_list_lock);
7560
7561         if (list_empty(&head))
7562                 return;
7563
7564         synchronize_rcu();
7565
7566         list_for_each_entry_safe(trans, next, &head, list) {
7567                 list_del(&trans->list);
7568                 nft_commit_release(trans);
7569         }
7570 }
7571
7572 void nf_tables_trans_destroy_flush_work(void)
7573 {
7574         flush_work(&trans_destroy_work);
7575 }
7576 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
7577
7578 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
7579 {
7580         struct nft_rule *rule;
7581         unsigned int alloc = 0;
7582         int i;
7583
7584         /* already handled or inactive chain? */
7585         if (chain->rules_next || !nft_is_active_next(net, chain))
7586                 return 0;
7587
7588         rule = list_entry(&chain->rules, struct nft_rule, list);
7589         i = 0;
7590
7591         list_for_each_entry_continue(rule, &chain->rules, list) {
7592                 if (nft_is_active_next(net, rule))
7593                         alloc++;
7594         }
7595
7596         chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
7597         if (!chain->rules_next)
7598                 return -ENOMEM;
7599
7600         list_for_each_entry_continue(rule, &chain->rules, list) {
7601                 if (nft_is_active_next(net, rule))
7602                         chain->rules_next[i++] = rule;
7603         }
7604
7605         chain->rules_next[i] = NULL;
7606         return 0;
7607 }
7608
7609 static void nf_tables_commit_chain_prepare_cancel(struct net *net)
7610 {
7611         struct nft_trans *trans, *next;
7612
7613         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7614                 struct nft_chain *chain = trans->ctx.chain;
7615
7616                 if (trans->msg_type == NFT_MSG_NEWRULE ||
7617                     trans->msg_type == NFT_MSG_DELRULE) {
7618                         kvfree(chain->rules_next);
7619                         chain->rules_next = NULL;
7620                 }
7621         }
7622 }
7623
7624 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
7625 {
7626         struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
7627
7628         kvfree(o->start);
7629 }
7630
7631 static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
7632 {
7633         struct nft_rule **r = rules;
7634         struct nft_rules_old *old;
7635
7636         while (*r)
7637                 r++;
7638
7639         r++;    /* rcu_head is after end marker */
7640         old = (void *) r;
7641         old->start = rules;
7642
7643         call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
7644 }
7645
7646 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
7647 {
7648         struct nft_rule **g0, **g1;
7649         bool next_genbit;
7650
7651         next_genbit = nft_gencursor_next(net);
7652
7653         g0 = rcu_dereference_protected(chain->rules_gen_0,
7654                                        lockdep_commit_lock_is_held(net));
7655         g1 = rcu_dereference_protected(chain->rules_gen_1,
7656                                        lockdep_commit_lock_is_held(net));
7657
7658         /* No changes to this chain? */
7659         if (chain->rules_next == NULL) {
7660                 /* chain had no change in last or next generation */
7661                 if (g0 == g1)
7662                         return;
7663                 /*
7664                  * chain had no change in this generation; make sure next
7665                  * one uses same rules as current generation.
7666                  */
7667                 if (next_genbit) {
7668                         rcu_assign_pointer(chain->rules_gen_1, g0);
7669                         nf_tables_commit_chain_free_rules_old(g1);
7670                 } else {
7671                         rcu_assign_pointer(chain->rules_gen_0, g1);
7672                         nf_tables_commit_chain_free_rules_old(g0);
7673                 }
7674
7675                 return;
7676         }
7677
7678         if (next_genbit)
7679                 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
7680         else
7681                 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
7682
7683         chain->rules_next = NULL;
7684
7685         if (g0 == g1)
7686                 return;
7687
7688         if (next_genbit)
7689                 nf_tables_commit_chain_free_rules_old(g1);
7690         else
7691                 nf_tables_commit_chain_free_rules_old(g0);
7692 }
7693
7694 static void nft_obj_del(struct nft_object *obj)
7695 {
7696         rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
7697         list_del_rcu(&obj->list);
7698 }
7699
7700 void nft_chain_del(struct nft_chain *chain)
7701 {
7702         struct nft_table *table = chain->table;
7703
7704         WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
7705                                      nft_chain_ht_params));
7706         list_del_rcu(&chain->list);
7707 }
7708
7709 static void nft_flowtable_hooks_del(struct nft_flowtable *flowtable,
7710                                     struct list_head *hook_list)
7711 {
7712         struct nft_hook *hook, *next;
7713
7714         list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7715                 if (hook->inactive)
7716                         list_move(&hook->list, hook_list);
7717         }
7718 }
7719
7720 static void nf_tables_module_autoload_cleanup(struct net *net)
7721 {
7722         struct nft_module_request *req, *next;
7723
7724         WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
7725         list_for_each_entry_safe(req, next, &net->nft.module_list, list) {
7726                 WARN_ON_ONCE(!req->done);
7727                 list_del(&req->list);
7728                 kfree(req);
7729         }
7730 }
7731
7732 static void nf_tables_commit_release(struct net *net)
7733 {
7734         struct nft_trans *trans;
7735
7736         /* all side effects have to be made visible.
7737          * For example, if a chain named 'foo' has been deleted, a
7738          * new transaction must not find it anymore.
7739          *
7740          * Memory reclaim happens asynchronously from work queue
7741          * to prevent expensive synchronize_rcu() in commit phase.
7742          */
7743         if (list_empty(&net->nft.commit_list)) {
7744                 nf_tables_module_autoload_cleanup(net);
7745                 mutex_unlock(&net->nft.commit_mutex);
7746                 return;
7747         }
7748
7749         trans = list_last_entry(&net->nft.commit_list,
7750                                 struct nft_trans, list);
7751         get_net(trans->ctx.net);
7752         WARN_ON_ONCE(trans->put_net);
7753
7754         trans->put_net = true;
7755         spin_lock(&nf_tables_destroy_list_lock);
7756         list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
7757         spin_unlock(&nf_tables_destroy_list_lock);
7758
7759         nf_tables_module_autoload_cleanup(net);
7760         schedule_work(&trans_destroy_work);
7761
7762         mutex_unlock(&net->nft.commit_mutex);
7763 }
7764
7765 static void nft_commit_notify(struct net *net, u32 portid)
7766 {
7767         struct sk_buff *batch_skb = NULL, *nskb, *skb;
7768         unsigned char *data;
7769         int len;
7770
7771         list_for_each_entry_safe(skb, nskb, &net->nft.notify_list, list) {
7772                 if (!batch_skb) {
7773 new_batch:
7774                         batch_skb = skb;
7775                         len = NLMSG_GOODSIZE - skb->len;
7776                         list_del(&skb->list);
7777                         continue;
7778                 }
7779                 len -= skb->len;
7780                 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) {
7781                         data = skb_put(batch_skb, skb->len);
7782                         memcpy(data, skb->data, skb->len);
7783                         list_del(&skb->list);
7784                         kfree_skb(skb);
7785                         continue;
7786                 }
7787                 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
7788                                NFT_CB(batch_skb).report, GFP_KERNEL);
7789                 goto new_batch;
7790         }
7791
7792         if (batch_skb) {
7793                 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
7794                                NFT_CB(batch_skb).report, GFP_KERNEL);
7795         }
7796
7797         WARN_ON_ONCE(!list_empty(&net->nft.notify_list));
7798 }
7799
7800 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
7801 {
7802         struct nft_trans *trans, *next;
7803         struct nft_trans_elem *te;
7804         struct nft_chain *chain;
7805         struct nft_table *table;
7806         int err;
7807
7808         if (list_empty(&net->nft.commit_list)) {
7809                 mutex_unlock(&net->nft.commit_mutex);
7810                 return 0;
7811         }
7812
7813         /* 0. Validate ruleset, otherwise roll back for error reporting. */
7814         if (nf_tables_validate(net) < 0)
7815                 return -EAGAIN;
7816
7817         err = nft_flow_rule_offload_commit(net);
7818         if (err < 0)
7819                 return err;
7820
7821         /* 1.  Allocate space for next generation rules_gen_X[] */
7822         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7823                 int ret;
7824
7825                 if (trans->msg_type == NFT_MSG_NEWRULE ||
7826                     trans->msg_type == NFT_MSG_DELRULE) {
7827                         chain = trans->ctx.chain;
7828
7829                         ret = nf_tables_commit_chain_prepare(net, chain);
7830                         if (ret < 0) {
7831                                 nf_tables_commit_chain_prepare_cancel(net);
7832                                 return ret;
7833                         }
7834                 }
7835         }
7836
7837         /* step 2.  Make rules_gen_X visible to packet path */
7838         list_for_each_entry(table, &net->nft.tables, list) {
7839                 list_for_each_entry(chain, &table->chains, list)
7840                         nf_tables_commit_chain(net, chain);
7841         }
7842
7843         /*
7844          * Bump generation counter, invalidate any dump in progress.
7845          * Cannot fail after this point.
7846          */
7847         while (++net->nft.base_seq == 0);
7848
7849         /* step 3. Start new generation, rules_gen_X now in use. */
7850         net->nft.gencursor = nft_gencursor_next(net);
7851
7852         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
7853                 switch (trans->msg_type) {
7854                 case NFT_MSG_NEWTABLE:
7855                         if (nft_trans_table_update(trans)) {
7856                                 if (!nft_trans_table_enable(trans)) {
7857                                         nf_tables_table_disable(net,
7858                                                                 trans->ctx.table);
7859                                         trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7860                                 }
7861                         } else {
7862                                 nft_clear(net, trans->ctx.table);
7863                         }
7864                         nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
7865                         nft_trans_destroy(trans);
7866                         break;
7867                 case NFT_MSG_DELTABLE:
7868                         list_del_rcu(&trans->ctx.table->list);
7869                         nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
7870                         break;
7871                 case NFT_MSG_NEWCHAIN:
7872                         if (nft_trans_chain_update(trans)) {
7873                                 nft_chain_commit_update(trans);
7874                                 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7875                                 /* trans destroyed after rcu grace period */
7876                         } else {
7877                                 nft_chain_commit_drop_policy(trans);
7878                                 nft_clear(net, trans->ctx.chain);
7879                                 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
7880                                 nft_trans_destroy(trans);
7881                         }
7882                         break;
7883                 case NFT_MSG_DELCHAIN:
7884                         nft_chain_del(trans->ctx.chain);
7885                         nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
7886                         nf_tables_unregister_hook(trans->ctx.net,
7887                                                   trans->ctx.table,
7888                                                   trans->ctx.chain);
7889                         break;
7890                 case NFT_MSG_NEWRULE:
7891                         nft_clear(trans->ctx.net, nft_trans_rule(trans));
7892                         nf_tables_rule_notify(&trans->ctx,
7893                                               nft_trans_rule(trans),
7894                                               NFT_MSG_NEWRULE);
7895                         nft_trans_destroy(trans);
7896                         break;
7897                 case NFT_MSG_DELRULE:
7898                         list_del_rcu(&nft_trans_rule(trans)->list);
7899                         nf_tables_rule_notify(&trans->ctx,
7900                                               nft_trans_rule(trans),
7901                                               NFT_MSG_DELRULE);
7902                         nft_rule_expr_deactivate(&trans->ctx,
7903                                                  nft_trans_rule(trans),
7904                                                  NFT_TRANS_COMMIT);
7905                         break;
7906                 case NFT_MSG_NEWSET:
7907                         nft_clear(net, nft_trans_set(trans));
7908                         /* This avoids hitting -EBUSY when deleting the table
7909                          * from the transaction.
7910                          */
7911                         if (nft_set_is_anonymous(nft_trans_set(trans)) &&
7912                             !list_empty(&nft_trans_set(trans)->bindings))
7913                                 trans->ctx.table->use--;
7914
7915                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
7916                                              NFT_MSG_NEWSET, GFP_KERNEL);
7917                         nft_trans_destroy(trans);
7918                         break;
7919                 case NFT_MSG_DELSET:
7920                         list_del_rcu(&nft_trans_set(trans)->list);
7921                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
7922                                              NFT_MSG_DELSET, GFP_KERNEL);
7923                         break;
7924                 case NFT_MSG_NEWSETELEM:
7925                         te = (struct nft_trans_elem *)trans->data;
7926
7927                         te->set->ops->activate(net, te->set, &te->elem);
7928                         nf_tables_setelem_notify(&trans->ctx, te->set,
7929                                                  &te->elem,
7930                                                  NFT_MSG_NEWSETELEM, 0);
7931                         nft_trans_destroy(trans);
7932                         break;
7933                 case NFT_MSG_DELSETELEM:
7934                         te = (struct nft_trans_elem *)trans->data;
7935
7936                         nf_tables_setelem_notify(&trans->ctx, te->set,
7937                                                  &te->elem,
7938                                                  NFT_MSG_DELSETELEM, 0);
7939                         te->set->ops->remove(net, te->set, &te->elem);
7940                         atomic_dec(&te->set->nelems);
7941                         te->set->ndeact--;
7942                         break;
7943                 case NFT_MSG_NEWOBJ:
7944                         if (nft_trans_obj_update(trans)) {
7945                                 nft_obj_commit_update(trans);
7946                                 nf_tables_obj_notify(&trans->ctx,
7947                                                      nft_trans_obj(trans),
7948                                                      NFT_MSG_NEWOBJ);
7949                         } else {
7950                                 nft_clear(net, nft_trans_obj(trans));
7951                                 nf_tables_obj_notify(&trans->ctx,
7952                                                      nft_trans_obj(trans),
7953                                                      NFT_MSG_NEWOBJ);
7954                                 nft_trans_destroy(trans);
7955                         }
7956                         break;
7957                 case NFT_MSG_DELOBJ:
7958                         nft_obj_del(nft_trans_obj(trans));
7959                         nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
7960                                              NFT_MSG_DELOBJ);
7961                         break;
7962                 case NFT_MSG_NEWFLOWTABLE:
7963                         if (nft_trans_flowtable_update(trans)) {
7964                                 nf_tables_flowtable_notify(&trans->ctx,
7965                                                            nft_trans_flowtable(trans),
7966                                                            &nft_trans_flowtable_hooks(trans),
7967                                                            NFT_MSG_NEWFLOWTABLE);
7968                                 list_splice(&nft_trans_flowtable_hooks(trans),
7969                                             &nft_trans_flowtable(trans)->hook_list);
7970                         } else {
7971                                 nft_clear(net, nft_trans_flowtable(trans));
7972                                 nf_tables_flowtable_notify(&trans->ctx,
7973                                                            nft_trans_flowtable(trans),
7974                                                            &nft_trans_flowtable(trans)->hook_list,
7975                                                            NFT_MSG_NEWFLOWTABLE);
7976                         }
7977                         nft_trans_destroy(trans);
7978                         break;
7979                 case NFT_MSG_DELFLOWTABLE:
7980                         if (nft_trans_flowtable_update(trans)) {
7981                                 nft_flowtable_hooks_del(nft_trans_flowtable(trans),
7982                                                         &nft_trans_flowtable_hooks(trans));
7983                                 nf_tables_flowtable_notify(&trans->ctx,
7984                                                            nft_trans_flowtable(trans),
7985                                                            &nft_trans_flowtable_hooks(trans),
7986                                                            NFT_MSG_DELFLOWTABLE);
7987                                 nft_unregister_flowtable_net_hooks(net,
7988                                                                    &nft_trans_flowtable_hooks(trans));
7989                         } else {
7990                                 list_del_rcu(&nft_trans_flowtable(trans)->list);
7991                                 nf_tables_flowtable_notify(&trans->ctx,
7992                                                            nft_trans_flowtable(trans),
7993                                                            &nft_trans_flowtable(trans)->hook_list,
7994                                                            NFT_MSG_DELFLOWTABLE);
7995                                 nft_unregister_flowtable_net_hooks(net,
7996                                                 &nft_trans_flowtable(trans)->hook_list);
7997                         }
7998                         break;
7999                 }
8000         }
8001
8002         nft_commit_notify(net, NETLINK_CB(skb).portid);
8003         nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
8004         nf_tables_commit_release(net);
8005
8006         return 0;
8007 }
8008
8009 static void nf_tables_module_autoload(struct net *net)
8010 {
8011         struct nft_module_request *req, *next;
8012         LIST_HEAD(module_list);
8013
8014         list_splice_init(&net->nft.module_list, &module_list);
8015         mutex_unlock(&net->nft.commit_mutex);
8016         list_for_each_entry_safe(req, next, &module_list, list) {
8017                 request_module("%s", req->module);
8018                 req->done = true;
8019         }
8020         mutex_lock(&net->nft.commit_mutex);
8021         list_splice(&module_list, &net->nft.module_list);
8022 }
8023
8024 static void nf_tables_abort_release(struct nft_trans *trans)
8025 {
8026         switch (trans->msg_type) {
8027         case NFT_MSG_NEWTABLE:
8028                 nf_tables_table_destroy(&trans->ctx);
8029                 break;
8030         case NFT_MSG_NEWCHAIN:
8031                 nf_tables_chain_destroy(&trans->ctx);
8032                 break;
8033         case NFT_MSG_NEWRULE:
8034                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
8035                 break;
8036         case NFT_MSG_NEWSET:
8037                 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
8038                 break;
8039         case NFT_MSG_NEWSETELEM:
8040                 nft_set_elem_destroy(nft_trans_elem_set(trans),
8041                                      nft_trans_elem(trans).priv, true);
8042                 break;
8043         case NFT_MSG_NEWOBJ:
8044                 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
8045                 break;
8046         case NFT_MSG_NEWFLOWTABLE:
8047                 if (nft_trans_flowtable_update(trans))
8048                         nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
8049                 else
8050                         nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
8051                 break;
8052         }
8053         kfree(trans);
8054 }
8055
8056 static int __nf_tables_abort(struct net *net, bool autoload)
8057 {
8058         struct nft_trans *trans, *next;
8059         struct nft_trans_elem *te;
8060         struct nft_hook *hook;
8061
8062         list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
8063                                          list) {
8064                 switch (trans->msg_type) {
8065                 case NFT_MSG_NEWTABLE:
8066                         if (nft_trans_table_update(trans)) {
8067                                 if (nft_trans_table_enable(trans)) {
8068                                         nf_tables_table_disable(net,
8069                                                                 trans->ctx.table);
8070                                         trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
8071                                 }
8072                                 nft_trans_destroy(trans);
8073                         } else {
8074                                 list_del_rcu(&trans->ctx.table->list);
8075                         }
8076                         break;
8077                 case NFT_MSG_DELTABLE:
8078                         nft_clear(trans->ctx.net, trans->ctx.table);
8079                         nft_trans_destroy(trans);
8080                         break;
8081                 case NFT_MSG_NEWCHAIN:
8082                         if (nft_trans_chain_update(trans)) {
8083                                 free_percpu(nft_trans_chain_stats(trans));
8084                                 kfree(nft_trans_chain_name(trans));
8085                                 nft_trans_destroy(trans);
8086                         } else {
8087                                 if (nft_chain_is_bound(trans->ctx.chain)) {
8088                                         nft_trans_destroy(trans);
8089                                         break;
8090                                 }
8091                                 trans->ctx.table->use--;
8092                                 nft_chain_del(trans->ctx.chain);
8093                                 nf_tables_unregister_hook(trans->ctx.net,
8094                                                           trans->ctx.table,
8095                                                           trans->ctx.chain);
8096                         }
8097                         break;
8098                 case NFT_MSG_DELCHAIN:
8099                         trans->ctx.table->use++;
8100                         nft_clear(trans->ctx.net, trans->ctx.chain);
8101                         nft_trans_destroy(trans);
8102                         break;
8103                 case NFT_MSG_NEWRULE:
8104                         trans->ctx.chain->use--;
8105                         list_del_rcu(&nft_trans_rule(trans)->list);
8106                         nft_rule_expr_deactivate(&trans->ctx,
8107                                                  nft_trans_rule(trans),
8108                                                  NFT_TRANS_ABORT);
8109                         break;
8110                 case NFT_MSG_DELRULE:
8111                         trans->ctx.chain->use++;
8112                         nft_clear(trans->ctx.net, nft_trans_rule(trans));
8113                         nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
8114                         nft_trans_destroy(trans);
8115                         break;
8116                 case NFT_MSG_NEWSET:
8117                         trans->ctx.table->use--;
8118                         if (nft_trans_set_bound(trans)) {
8119                                 nft_trans_destroy(trans);
8120                                 break;
8121                         }
8122                         list_del_rcu(&nft_trans_set(trans)->list);
8123                         break;
8124                 case NFT_MSG_DELSET:
8125                         trans->ctx.table->use++;
8126                         nft_clear(trans->ctx.net, nft_trans_set(trans));
8127                         nft_trans_destroy(trans);
8128                         break;
8129                 case NFT_MSG_NEWSETELEM:
8130                         if (nft_trans_elem_set_bound(trans)) {
8131                                 nft_trans_destroy(trans);
8132                                 break;
8133                         }
8134                         te = (struct nft_trans_elem *)trans->data;
8135                         te->set->ops->remove(net, te->set, &te->elem);
8136                         atomic_dec(&te->set->nelems);
8137                         break;
8138                 case NFT_MSG_DELSETELEM:
8139                         te = (struct nft_trans_elem *)trans->data;
8140
8141                         nft_set_elem_activate(net, te->set, &te->elem);
8142                         te->set->ops->activate(net, te->set, &te->elem);
8143                         te->set->ndeact--;
8144
8145                         nft_trans_destroy(trans);
8146                         break;
8147                 case NFT_MSG_NEWOBJ:
8148                         if (nft_trans_obj_update(trans)) {
8149                                 kfree(nft_trans_obj_newobj(trans));
8150                                 nft_trans_destroy(trans);
8151                         } else {
8152                                 trans->ctx.table->use--;
8153                                 nft_obj_del(nft_trans_obj(trans));
8154                         }
8155                         break;
8156                 case NFT_MSG_DELOBJ:
8157                         trans->ctx.table->use++;
8158                         nft_clear(trans->ctx.net, nft_trans_obj(trans));
8159                         nft_trans_destroy(trans);
8160                         break;
8161                 case NFT_MSG_NEWFLOWTABLE:
8162                         if (nft_trans_flowtable_update(trans)) {
8163                                 nft_unregister_flowtable_net_hooks(net,
8164                                                 &nft_trans_flowtable_hooks(trans));
8165                         } else {
8166                                 trans->ctx.table->use--;
8167                                 list_del_rcu(&nft_trans_flowtable(trans)->list);
8168                                 nft_unregister_flowtable_net_hooks(net,
8169                                                 &nft_trans_flowtable(trans)->hook_list);
8170                         }
8171                         break;
8172                 case NFT_MSG_DELFLOWTABLE:
8173                         if (nft_trans_flowtable_update(trans)) {
8174                                 list_for_each_entry(hook, &nft_trans_flowtable(trans)->hook_list, list)
8175                                         hook->inactive = false;
8176                         } else {
8177                                 trans->ctx.table->use++;
8178                                 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
8179                         }
8180                         nft_trans_destroy(trans);
8181                         break;
8182                 }
8183         }
8184
8185         synchronize_rcu();
8186
8187         list_for_each_entry_safe_reverse(trans, next,
8188                                          &net->nft.commit_list, list) {
8189                 list_del(&trans->list);
8190                 nf_tables_abort_release(trans);
8191         }
8192
8193         if (autoload)
8194                 nf_tables_module_autoload(net);
8195         else
8196                 nf_tables_module_autoload_cleanup(net);
8197
8198         return 0;
8199 }
8200
8201 static void nf_tables_cleanup(struct net *net)
8202 {
8203         nft_validate_state_update(net, NFT_VALIDATE_SKIP);
8204 }
8205
8206 static int nf_tables_abort(struct net *net, struct sk_buff *skb, bool autoload)
8207 {
8208         int ret = __nf_tables_abort(net, autoload);
8209
8210         mutex_unlock(&net->nft.commit_mutex);
8211
8212         return ret;
8213 }
8214
8215 static bool nf_tables_valid_genid(struct net *net, u32 genid)
8216 {
8217         bool genid_ok;
8218
8219         mutex_lock(&net->nft.commit_mutex);
8220
8221         genid_ok = genid == 0 || net->nft.base_seq == genid;
8222         if (!genid_ok)
8223                 mutex_unlock(&net->nft.commit_mutex);
8224
8225         /* else, commit mutex has to be released by commit or abort function */
8226         return genid_ok;
8227 }
8228
8229 static const struct nfnetlink_subsystem nf_tables_subsys = {
8230         .name           = "nf_tables",
8231         .subsys_id      = NFNL_SUBSYS_NFTABLES,
8232         .cb_count       = NFT_MSG_MAX,
8233         .cb             = nf_tables_cb,
8234         .commit         = nf_tables_commit,
8235         .abort          = nf_tables_abort,
8236         .cleanup        = nf_tables_cleanup,
8237         .valid_genid    = nf_tables_valid_genid,
8238         .owner          = THIS_MODULE,
8239 };
8240
8241 int nft_chain_validate_dependency(const struct nft_chain *chain,
8242                                   enum nft_chain_types type)
8243 {
8244         const struct nft_base_chain *basechain;
8245
8246         if (nft_is_base_chain(chain)) {
8247                 basechain = nft_base_chain(chain);
8248                 if (basechain->type->type != type)
8249                         return -EOPNOTSUPP;
8250         }
8251         return 0;
8252 }
8253 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
8254
8255 int nft_chain_validate_hooks(const struct nft_chain *chain,
8256                              unsigned int hook_flags)
8257 {
8258         struct nft_base_chain *basechain;
8259
8260         if (nft_is_base_chain(chain)) {
8261                 basechain = nft_base_chain(chain);
8262
8263                 if ((1 << basechain->ops.hooknum) & hook_flags)
8264                         return 0;
8265
8266                 return -EOPNOTSUPP;
8267         }
8268
8269         return 0;
8270 }
8271 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
8272
8273 /*
8274  * Loop detection - walk through the ruleset beginning at the destination chain
8275  * of a new jump until either the source chain is reached (loop) or all
8276  * reachable chains have been traversed.
8277  *
8278  * The loop check is performed whenever a new jump verdict is added to an
8279  * expression or verdict map or a verdict map is bound to a new chain.
8280  */
8281
8282 static int nf_tables_check_loops(const struct nft_ctx *ctx,
8283                                  const struct nft_chain *chain);
8284
8285 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
8286                                         struct nft_set *set,
8287                                         const struct nft_set_iter *iter,
8288                                         struct nft_set_elem *elem)
8289 {
8290         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
8291         const struct nft_data *data;
8292
8293         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
8294             *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
8295                 return 0;
8296
8297         data = nft_set_ext_data(ext);
8298         switch (data->verdict.code) {
8299         case NFT_JUMP:
8300         case NFT_GOTO:
8301                 return nf_tables_check_loops(ctx, data->verdict.chain);
8302         default:
8303                 return 0;
8304         }
8305 }
8306
8307 static int nf_tables_check_loops(const struct nft_ctx *ctx,
8308                                  const struct nft_chain *chain)
8309 {
8310         const struct nft_rule *rule;
8311         const struct nft_expr *expr, *last;
8312         struct nft_set *set;
8313         struct nft_set_binding *binding;
8314         struct nft_set_iter iter;
8315
8316         if (ctx->chain == chain)
8317                 return -ELOOP;
8318
8319         list_for_each_entry(rule, &chain->rules, list) {
8320                 nft_rule_for_each_expr(expr, last, rule) {
8321                         struct nft_immediate_expr *priv;
8322                         const struct nft_data *data;
8323                         int err;
8324
8325                         if (strcmp(expr->ops->type->name, "immediate"))
8326                                 continue;
8327
8328                         priv = nft_expr_priv(expr);
8329                         if (priv->dreg != NFT_REG_VERDICT)
8330                                 continue;
8331
8332                         data = &priv->data;
8333                         switch (data->verdict.code) {
8334                         case NFT_JUMP:
8335                         case NFT_GOTO:
8336                                 err = nf_tables_check_loops(ctx,
8337                                                         data->verdict.chain);
8338                                 if (err < 0)
8339                                         return err;
8340                         default:
8341                                 break;
8342                         }
8343                 }
8344         }
8345
8346         list_for_each_entry(set, &ctx->table->sets, list) {
8347                 if (!nft_is_active_next(ctx->net, set))
8348                         continue;
8349                 if (!(set->flags & NFT_SET_MAP) ||
8350                     set->dtype != NFT_DATA_VERDICT)
8351                         continue;
8352
8353                 list_for_each_entry(binding, &set->bindings, list) {
8354                         if (!(binding->flags & NFT_SET_MAP) ||
8355                             binding->chain != chain)
8356                                 continue;
8357
8358                         iter.genmask    = nft_genmask_next(ctx->net);
8359                         iter.skip       = 0;
8360                         iter.count      = 0;
8361                         iter.err        = 0;
8362                         iter.fn         = nf_tables_loop_check_setelem;
8363
8364                         set->ops->walk(ctx, set, &iter);
8365                         if (iter.err < 0)
8366                                 return iter.err;
8367                 }
8368         }
8369
8370         return 0;
8371 }
8372
8373 /**
8374  *      nft_parse_u32_check - fetch u32 attribute and check for maximum value
8375  *
8376  *      @attr: netlink attribute to fetch value from
8377  *      @max: maximum value to be stored in dest
8378  *      @dest: pointer to the variable
8379  *
8380  *      Parse, check and store a given u32 netlink attribute into variable.
8381  *      This function returns -ERANGE if the value goes over maximum value.
8382  *      Otherwise a 0 is returned and the attribute value is stored in the
8383  *      destination variable.
8384  */
8385 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
8386 {
8387         u32 val;
8388
8389         val = ntohl(nla_get_be32(attr));
8390         if (val > max)
8391                 return -ERANGE;
8392
8393         *dest = val;
8394         return 0;
8395 }
8396 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
8397
8398 /**
8399  *      nft_parse_register - parse a register value from a netlink attribute
8400  *
8401  *      @attr: netlink attribute
8402  *
8403  *      Parse and translate a register value from a netlink attribute.
8404  *      Registers used to be 128 bit wide, these register numbers will be
8405  *      mapped to the corresponding 32 bit register numbers.
8406  */
8407 unsigned int nft_parse_register(const struct nlattr *attr)
8408 {
8409         unsigned int reg;
8410
8411         reg = ntohl(nla_get_be32(attr));
8412         switch (reg) {
8413         case NFT_REG_VERDICT...NFT_REG_4:
8414                 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
8415         default:
8416                 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
8417         }
8418 }
8419 EXPORT_SYMBOL_GPL(nft_parse_register);
8420
8421 /**
8422  *      nft_dump_register - dump a register value to a netlink attribute
8423  *
8424  *      @skb: socket buffer
8425  *      @attr: attribute number
8426  *      @reg: register number
8427  *
8428  *      Construct a netlink attribute containing the register number. For
8429  *      compatibility reasons, register numbers being a multiple of 4 are
8430  *      translated to the corresponding 128 bit register numbers.
8431  */
8432 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
8433 {
8434         if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
8435                 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
8436         else
8437                 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
8438
8439         return nla_put_be32(skb, attr, htonl(reg));
8440 }
8441 EXPORT_SYMBOL_GPL(nft_dump_register);
8442
8443 /**
8444  *      nft_validate_register_load - validate a load from a register
8445  *
8446  *      @reg: the register number
8447  *      @len: the length of the data
8448  *
8449  *      Validate that the input register is one of the general purpose
8450  *      registers and that the length of the load is within the bounds.
8451  */
8452 int nft_validate_register_load(enum nft_registers reg, unsigned int len)
8453 {
8454         if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
8455                 return -EINVAL;
8456         if (len == 0)
8457                 return -EINVAL;
8458         if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data))
8459                 return -ERANGE;
8460
8461         return 0;
8462 }
8463 EXPORT_SYMBOL_GPL(nft_validate_register_load);
8464
8465 /**
8466  *      nft_validate_register_store - validate an expressions' register store
8467  *
8468  *      @ctx: context of the expression performing the load
8469  *      @reg: the destination register number
8470  *      @data: the data to load
8471  *      @type: the data type
8472  *      @len: the length of the data
8473  *
8474  *      Validate that a data load uses the appropriate data type for
8475  *      the destination register and the length is within the bounds.
8476  *      A value of NULL for the data means that its runtime gathered
8477  *      data.
8478  */
8479 int nft_validate_register_store(const struct nft_ctx *ctx,
8480                                 enum nft_registers reg,
8481                                 const struct nft_data *data,
8482                                 enum nft_data_types type, unsigned int len)
8483 {
8484         int err;
8485
8486         switch (reg) {
8487         case NFT_REG_VERDICT:
8488                 if (type != NFT_DATA_VERDICT)
8489                         return -EINVAL;
8490
8491                 if (data != NULL &&
8492                     (data->verdict.code == NFT_GOTO ||
8493                      data->verdict.code == NFT_JUMP)) {
8494                         err = nf_tables_check_loops(ctx, data->verdict.chain);
8495                         if (err < 0)
8496                                 return err;
8497                 }
8498
8499                 return 0;
8500         default:
8501                 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
8502                         return -EINVAL;
8503                 if (len == 0)
8504                         return -EINVAL;
8505                 if (reg * NFT_REG32_SIZE + len >
8506                     sizeof_field(struct nft_regs, data))
8507                         return -ERANGE;
8508
8509                 if (data != NULL && type != NFT_DATA_VALUE)
8510                         return -EINVAL;
8511                 return 0;
8512         }
8513 }
8514 EXPORT_SYMBOL_GPL(nft_validate_register_store);
8515
8516 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
8517         [NFTA_VERDICT_CODE]     = { .type = NLA_U32 },
8518         [NFTA_VERDICT_CHAIN]    = { .type = NLA_STRING,
8519                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
8520         [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 },
8521 };
8522
8523 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
8524                             struct nft_data_desc *desc, const struct nlattr *nla)
8525 {
8526         u8 genmask = nft_genmask_next(ctx->net);
8527         struct nlattr *tb[NFTA_VERDICT_MAX + 1];
8528         struct nft_chain *chain;
8529         int err;
8530
8531         err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
8532                                           nft_verdict_policy, NULL);
8533         if (err < 0)
8534                 return err;
8535
8536         if (!tb[NFTA_VERDICT_CODE])
8537                 return -EINVAL;
8538         data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
8539
8540         switch (data->verdict.code) {
8541         default:
8542                 switch (data->verdict.code & NF_VERDICT_MASK) {
8543                 case NF_ACCEPT:
8544                 case NF_DROP:
8545                 case NF_QUEUE:
8546                         break;
8547                 default:
8548                         return -EINVAL;
8549                 }
8550                 fallthrough;
8551         case NFT_CONTINUE:
8552         case NFT_BREAK:
8553         case NFT_RETURN:
8554                 break;
8555         case NFT_JUMP:
8556         case NFT_GOTO:
8557                 if (tb[NFTA_VERDICT_CHAIN]) {
8558                         chain = nft_chain_lookup(ctx->net, ctx->table,
8559                                                  tb[NFTA_VERDICT_CHAIN],
8560                                                  genmask);
8561                 } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
8562                         chain = nft_chain_lookup_byid(ctx->net,
8563                                                       tb[NFTA_VERDICT_CHAIN_ID]);
8564                         if (IS_ERR(chain))
8565                                 return PTR_ERR(chain);
8566                 } else {
8567                         return -EINVAL;
8568                 }
8569
8570                 if (IS_ERR(chain))
8571                         return PTR_ERR(chain);
8572                 if (nft_is_base_chain(chain))
8573                         return -EOPNOTSUPP;
8574
8575                 chain->use++;
8576                 data->verdict.chain = chain;
8577                 break;
8578         }
8579
8580         desc->len = sizeof(data->verdict);
8581         desc->type = NFT_DATA_VERDICT;
8582         return 0;
8583 }
8584
8585 static void nft_verdict_uninit(const struct nft_data *data)
8586 {
8587         struct nft_chain *chain;
8588         struct nft_rule *rule;
8589
8590         switch (data->verdict.code) {
8591         case NFT_JUMP:
8592         case NFT_GOTO:
8593                 chain = data->verdict.chain;
8594                 chain->use--;
8595
8596                 if (!nft_chain_is_bound(chain))
8597                         break;
8598
8599                 chain->table->use--;
8600                 list_for_each_entry(rule, &chain->rules, list)
8601                         chain->use--;
8602
8603                 nft_chain_del(chain);
8604                 break;
8605         }
8606 }
8607
8608 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
8609 {
8610         struct nlattr *nest;
8611
8612         nest = nla_nest_start_noflag(skb, type);
8613         if (!nest)
8614                 goto nla_put_failure;
8615
8616         if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
8617                 goto nla_put_failure;
8618
8619         switch (v->code) {
8620         case NFT_JUMP:
8621         case NFT_GOTO:
8622                 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
8623                                    v->chain->name))
8624                         goto nla_put_failure;
8625         }
8626         nla_nest_end(skb, nest);
8627         return 0;
8628
8629 nla_put_failure:
8630         return -1;
8631 }
8632
8633 static int nft_value_init(const struct nft_ctx *ctx,
8634                           struct nft_data *data, unsigned int size,
8635                           struct nft_data_desc *desc, const struct nlattr *nla)
8636 {
8637         unsigned int len;
8638
8639         len = nla_len(nla);
8640         if (len == 0)
8641                 return -EINVAL;
8642         if (len > size)
8643                 return -EOVERFLOW;
8644
8645         nla_memcpy(data->data, nla, len);
8646         desc->type = NFT_DATA_VALUE;
8647         desc->len  = len;
8648         return 0;
8649 }
8650
8651 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
8652                           unsigned int len)
8653 {
8654         return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
8655 }
8656
8657 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
8658         [NFTA_DATA_VALUE]       = { .type = NLA_BINARY },
8659         [NFTA_DATA_VERDICT]     = { .type = NLA_NESTED },
8660 };
8661
8662 /**
8663  *      nft_data_init - parse nf_tables data netlink attributes
8664  *
8665  *      @ctx: context of the expression using the data
8666  *      @data: destination struct nft_data
8667  *      @size: maximum data length
8668  *      @desc: data description
8669  *      @nla: netlink attribute containing data
8670  *
8671  *      Parse the netlink data attributes and initialize a struct nft_data.
8672  *      The type and length of data are returned in the data description.
8673  *
8674  *      The caller can indicate that it only wants to accept data of type
8675  *      NFT_DATA_VALUE by passing NULL for the ctx argument.
8676  */
8677 int nft_data_init(const struct nft_ctx *ctx,
8678                   struct nft_data *data, unsigned int size,
8679                   struct nft_data_desc *desc, const struct nlattr *nla)
8680 {
8681         struct nlattr *tb[NFTA_DATA_MAX + 1];
8682         int err;
8683
8684         err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
8685                                           nft_data_policy, NULL);
8686         if (err < 0)
8687                 return err;
8688
8689         if (tb[NFTA_DATA_VALUE])
8690                 return nft_value_init(ctx, data, size, desc,
8691                                       tb[NFTA_DATA_VALUE]);
8692         if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
8693                 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
8694         return -EINVAL;
8695 }
8696 EXPORT_SYMBOL_GPL(nft_data_init);
8697
8698 /**
8699  *      nft_data_release - release a nft_data item
8700  *
8701  *      @data: struct nft_data to release
8702  *      @type: type of data
8703  *
8704  *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
8705  *      all others need to be released by calling this function.
8706  */
8707 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
8708 {
8709         if (type < NFT_DATA_VERDICT)
8710                 return;
8711         switch (type) {
8712         case NFT_DATA_VERDICT:
8713                 return nft_verdict_uninit(data);
8714         default:
8715                 WARN_ON(1);
8716         }
8717 }
8718 EXPORT_SYMBOL_GPL(nft_data_release);
8719
8720 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
8721                   enum nft_data_types type, unsigned int len)
8722 {
8723         struct nlattr *nest;
8724         int err;
8725
8726         nest = nla_nest_start_noflag(skb, attr);
8727         if (nest == NULL)
8728                 return -1;
8729
8730         switch (type) {
8731         case NFT_DATA_VALUE:
8732                 err = nft_value_dump(skb, data, len);
8733                 break;
8734         case NFT_DATA_VERDICT:
8735                 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
8736                 break;
8737         default:
8738                 err = -EINVAL;
8739                 WARN_ON(1);
8740         }
8741
8742         nla_nest_end(skb, nest);
8743         return err;
8744 }
8745 EXPORT_SYMBOL_GPL(nft_data_dump);
8746
8747 int __nft_release_basechain(struct nft_ctx *ctx)
8748 {
8749         struct nft_rule *rule, *nr;
8750
8751         if (WARN_ON(!nft_is_base_chain(ctx->chain)))
8752                 return 0;
8753
8754         nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
8755         list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
8756                 list_del(&rule->list);
8757                 ctx->chain->use--;
8758                 nf_tables_rule_release(ctx, rule);
8759         }
8760         nft_chain_del(ctx->chain);
8761         ctx->table->use--;
8762         nf_tables_chain_destroy(ctx);
8763
8764         return 0;
8765 }
8766 EXPORT_SYMBOL_GPL(__nft_release_basechain);
8767
8768 static void __nft_release_tables(struct net *net)
8769 {
8770         struct nft_flowtable *flowtable, *nf;
8771         struct nft_table *table, *nt;
8772         struct nft_chain *chain, *nc;
8773         struct nft_object *obj, *ne;
8774         struct nft_rule *rule, *nr;
8775         struct nft_set *set, *ns;
8776         struct nft_ctx ctx = {
8777                 .net    = net,
8778                 .family = NFPROTO_NETDEV,
8779         };
8780
8781         list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
8782                 ctx.family = table->family;
8783
8784                 list_for_each_entry(chain, &table->chains, list)
8785                         nf_tables_unregister_hook(net, table, chain);
8786                 /* No packets are walking on these chains anymore. */
8787                 ctx.table = table;
8788                 list_for_each_entry(chain, &table->chains, list) {
8789                         ctx.chain = chain;
8790                         list_for_each_entry_safe(rule, nr, &chain->rules, list) {
8791                                 list_del(&rule->list);
8792                                 chain->use--;
8793                                 nf_tables_rule_release(&ctx, rule);
8794                         }
8795                 }
8796                 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
8797                         list_del(&flowtable->list);
8798                         table->use--;
8799                         nf_tables_flowtable_destroy(flowtable);
8800                 }
8801                 list_for_each_entry_safe(set, ns, &table->sets, list) {
8802                         list_del(&set->list);
8803                         table->use--;
8804                         nft_set_destroy(&ctx, set);
8805                 }
8806                 list_for_each_entry_safe(obj, ne, &table->objects, list) {
8807                         nft_obj_del(obj);
8808                         table->use--;
8809                         nft_obj_destroy(&ctx, obj);
8810                 }
8811                 list_for_each_entry_safe(chain, nc, &table->chains, list) {
8812                         ctx.chain = chain;
8813                         nft_chain_del(chain);
8814                         table->use--;
8815                         nf_tables_chain_destroy(&ctx);
8816                 }
8817                 list_del(&table->list);
8818                 nf_tables_table_destroy(&ctx);
8819         }
8820 }
8821
8822 static int __net_init nf_tables_init_net(struct net *net)
8823 {
8824         INIT_LIST_HEAD(&net->nft.tables);
8825         INIT_LIST_HEAD(&net->nft.commit_list);
8826         INIT_LIST_HEAD(&net->nft.module_list);
8827         INIT_LIST_HEAD(&net->nft.notify_list);
8828         mutex_init(&net->nft.commit_mutex);
8829         net->nft.base_seq = 1;
8830         net->nft.validate_state = NFT_VALIDATE_SKIP;
8831
8832         return 0;
8833 }
8834
8835 static void __net_exit nf_tables_exit_net(struct net *net)
8836 {
8837         mutex_lock(&net->nft.commit_mutex);
8838         if (!list_empty(&net->nft.commit_list))
8839                 __nf_tables_abort(net, false);
8840         __nft_release_tables(net);
8841         mutex_unlock(&net->nft.commit_mutex);
8842         WARN_ON_ONCE(!list_empty(&net->nft.tables));
8843         WARN_ON_ONCE(!list_empty(&net->nft.module_list));
8844         WARN_ON_ONCE(!list_empty(&net->nft.notify_list));
8845 }
8846
8847 static struct pernet_operations nf_tables_net_ops = {
8848         .init   = nf_tables_init_net,
8849         .exit   = nf_tables_exit_net,
8850 };
8851
8852 static int __init nf_tables_module_init(void)
8853 {
8854         int err;
8855
8856         spin_lock_init(&nf_tables_destroy_list_lock);
8857         err = register_pernet_subsys(&nf_tables_net_ops);
8858         if (err < 0)
8859                 return err;
8860
8861         err = nft_chain_filter_init();
8862         if (err < 0)
8863                 goto err1;
8864
8865         err = nf_tables_core_module_init();
8866         if (err < 0)
8867                 goto err2;
8868
8869         err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
8870         if (err < 0)
8871                 goto err3;
8872
8873         err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
8874         if (err < 0)
8875                 goto err4;
8876
8877         err = nft_offload_init();
8878         if (err < 0)
8879                 goto err5;
8880
8881         /* must be last */
8882         err = nfnetlink_subsys_register(&nf_tables_subsys);
8883         if (err < 0)
8884                 goto err6;
8885
8886         nft_chain_route_init();
8887
8888         return err;
8889 err6:
8890         nft_offload_exit();
8891 err5:
8892         rhltable_destroy(&nft_objname_ht);
8893 err4:
8894         unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
8895 err3:
8896         nf_tables_core_module_exit();
8897 err2:
8898         nft_chain_filter_fini();
8899 err1:
8900         unregister_pernet_subsys(&nf_tables_net_ops);
8901         return err;
8902 }
8903
8904 static void __exit nf_tables_module_exit(void)
8905 {
8906         nfnetlink_subsys_unregister(&nf_tables_subsys);
8907         nft_offload_exit();
8908         unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
8909         nft_chain_filter_fini();
8910         nft_chain_route_fini();
8911         unregister_pernet_subsys(&nf_tables_net_ops);
8912         cancel_work_sync(&trans_destroy_work);
8913         rcu_barrier();
8914         rhltable_destroy(&nft_objname_ht);
8915         nf_tables_core_module_exit();
8916 }
8917
8918 module_init(nf_tables_module_init);
8919 module_exit(nf_tables_module_exit);
8920
8921 MODULE_LICENSE("GPL");
8922 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
8923 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);