2 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/list.h>
14 #include <linux/skbuff.h>
15 #include <linux/netlink.h>
16 #include <linux/vmalloc.h>
17 #include <linux/netfilter.h>
18 #include <linux/netfilter/nfnetlink.h>
19 #include <linux/netfilter/nf_tables.h>
20 #include <net/netfilter/nf_flow_table.h>
21 #include <net/netfilter/nf_tables_core.h>
22 #include <net/netfilter/nf_tables.h>
23 #include <net/net_namespace.h>
26 static LIST_HEAD(nf_tables_expressions);
27 static LIST_HEAD(nf_tables_objects);
28 static LIST_HEAD(nf_tables_flowtables);
29 static u64 table_handle;
32 NFT_VALIDATE_SKIP = 0,
37 static void nft_validate_state_update(struct net *net, u8 new_validate_state)
39 switch (net->nft.validate_state) {
40 case NFT_VALIDATE_SKIP:
41 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
43 case NFT_VALIDATE_NEED:
46 if (new_validate_state == NFT_VALIDATE_NEED)
50 net->nft.validate_state = new_validate_state;
53 static void nft_ctx_init(struct nft_ctx *ctx,
55 const struct sk_buff *skb,
56 const struct nlmsghdr *nlh,
58 struct nft_table *table,
59 struct nft_chain *chain,
60 const struct nlattr * const *nla)
67 ctx->portid = NETLINK_CB(skb).portid;
68 ctx->report = nlmsg_report(nlh);
69 ctx->seq = nlh->nlmsg_seq;
72 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
73 int msg_type, u32 size, gfp_t gfp)
75 struct nft_trans *trans;
77 trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
81 trans->msg_type = msg_type;
87 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
88 int msg_type, u32 size)
90 return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
93 static void nft_trans_destroy(struct nft_trans *trans)
95 list_del(&trans->list);
99 static int nf_tables_register_hook(struct net *net,
100 const struct nft_table *table,
101 struct nft_chain *chain)
103 const struct nft_base_chain *basechain;
104 const struct nf_hook_ops *ops;
106 if (table->flags & NFT_TABLE_F_DORMANT ||
107 !nft_is_base_chain(chain))
110 basechain = nft_base_chain(chain);
111 ops = &basechain->ops;
113 if (basechain->type->ops_register)
114 return basechain->type->ops_register(net, ops);
116 return nf_register_net_hook(net, ops);
119 static void nf_tables_unregister_hook(struct net *net,
120 const struct nft_table *table,
121 struct nft_chain *chain)
123 const struct nft_base_chain *basechain;
124 const struct nf_hook_ops *ops;
126 if (table->flags & NFT_TABLE_F_DORMANT ||
127 !nft_is_base_chain(chain))
129 basechain = nft_base_chain(chain);
130 ops = &basechain->ops;
132 if (basechain->type->ops_unregister)
133 return basechain->type->ops_unregister(net, ops);
135 nf_unregister_net_hook(net, ops);
138 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
140 struct nft_trans *trans;
142 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
146 if (msg_type == NFT_MSG_NEWTABLE)
147 nft_activate_next(ctx->net, ctx->table);
149 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
153 static int nft_deltable(struct nft_ctx *ctx)
157 err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
161 nft_deactivate_next(ctx->net, ctx->table);
165 static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
167 struct nft_trans *trans;
169 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
173 if (msg_type == NFT_MSG_NEWCHAIN)
174 nft_activate_next(ctx->net, ctx->chain);
176 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
180 static int nft_delchain(struct nft_ctx *ctx)
184 err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
189 nft_deactivate_next(ctx->net, ctx->chain);
194 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
195 struct nft_rule *rule)
197 struct nft_expr *expr;
199 expr = nft_expr_first(rule);
200 while (expr != nft_expr_last(rule) && expr->ops) {
201 if (expr->ops->activate)
202 expr->ops->activate(ctx, expr);
204 expr = nft_expr_next(expr);
208 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
209 struct nft_rule *rule)
211 struct nft_expr *expr;
213 expr = nft_expr_first(rule);
214 while (expr != nft_expr_last(rule) && expr->ops) {
215 if (expr->ops->deactivate)
216 expr->ops->deactivate(ctx, expr);
218 expr = nft_expr_next(expr);
223 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
225 /* You cannot delete the same rule twice */
226 if (nft_is_active_next(ctx->net, rule)) {
227 nft_deactivate_next(ctx->net, rule);
234 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
235 struct nft_rule *rule)
237 struct nft_trans *trans;
239 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
243 if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
244 nft_trans_rule_id(trans) =
245 ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
247 nft_trans_rule(trans) = rule;
248 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
253 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
255 struct nft_trans *trans;
258 trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
262 err = nf_tables_delrule_deactivate(ctx, rule);
264 nft_trans_destroy(trans);
267 nft_rule_expr_deactivate(ctx, rule);
272 static int nft_delrule_by_chain(struct nft_ctx *ctx)
274 struct nft_rule *rule;
277 list_for_each_entry(rule, &ctx->chain->rules, list) {
278 err = nft_delrule(ctx, rule);
285 static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
288 struct nft_trans *trans;
290 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
294 if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
295 nft_trans_set_id(trans) =
296 ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
297 nft_activate_next(ctx->net, set);
299 nft_trans_set(trans) = set;
300 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
305 static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
309 err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
313 nft_deactivate_next(ctx->net, set);
319 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
320 struct nft_object *obj)
322 struct nft_trans *trans;
324 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
328 if (msg_type == NFT_MSG_NEWOBJ)
329 nft_activate_next(ctx->net, obj);
331 nft_trans_obj(trans) = obj;
332 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
337 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
341 err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
345 nft_deactivate_next(ctx->net, obj);
351 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
352 struct nft_flowtable *flowtable)
354 struct nft_trans *trans;
356 trans = nft_trans_alloc(ctx, msg_type,
357 sizeof(struct nft_trans_flowtable));
361 if (msg_type == NFT_MSG_NEWFLOWTABLE)
362 nft_activate_next(ctx->net, flowtable);
364 nft_trans_flowtable(trans) = flowtable;
365 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
370 static int nft_delflowtable(struct nft_ctx *ctx,
371 struct nft_flowtable *flowtable)
375 err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
379 nft_deactivate_next(ctx->net, flowtable);
389 static struct nft_table *nft_table_lookup(const struct net *net,
390 const struct nlattr *nla,
391 u8 family, u8 genmask)
393 struct nft_table *table;
396 return ERR_PTR(-EINVAL);
398 list_for_each_entry_rcu(table, &net->nft.tables, list) {
399 if (!nla_strcmp(nla, table->name) &&
400 table->family == family &&
401 nft_active_genmask(table, genmask))
405 return ERR_PTR(-ENOENT);
408 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
409 const struct nlattr *nla,
412 struct nft_table *table;
414 list_for_each_entry(table, &net->nft.tables, list) {
415 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
416 nft_active_genmask(table, genmask))
420 return ERR_PTR(-ENOENT);
423 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
425 return ++table->hgenerator;
428 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
430 static const struct nft_chain_type *
431 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
435 for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
436 if (chain_type[family][i] != NULL &&
437 !nla_strcmp(nla, chain_type[family][i]->name))
438 return chain_type[family][i];
443 static const struct nft_chain_type *
444 nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family, bool autoload)
446 const struct nft_chain_type *type;
448 type = __nf_tables_chain_type_lookup(nla, family);
451 #ifdef CONFIG_MODULES
453 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
454 request_module("nft-chain-%u-%.*s", family,
455 nla_len(nla), (const char *)nla_data(nla));
456 nfnl_lock(NFNL_SUBSYS_NFTABLES);
457 type = __nf_tables_chain_type_lookup(nla, family);
459 return ERR_PTR(-EAGAIN);
462 return ERR_PTR(-ENOENT);
465 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
466 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
467 .len = NFT_TABLE_MAXNAMELEN - 1 },
468 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
469 [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
472 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
473 u32 portid, u32 seq, int event, u32 flags,
474 int family, const struct nft_table *table)
476 struct nlmsghdr *nlh;
477 struct nfgenmsg *nfmsg;
479 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
480 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
482 goto nla_put_failure;
484 nfmsg = nlmsg_data(nlh);
485 nfmsg->nfgen_family = family;
486 nfmsg->version = NFNETLINK_V0;
487 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
489 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
490 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
491 nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
492 nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
494 goto nla_put_failure;
500 nlmsg_trim(skb, nlh);
504 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
510 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
513 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
517 err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
518 event, 0, ctx->family, ctx->table);
524 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
525 ctx->report, GFP_KERNEL);
528 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
531 static int nf_tables_dump_tables(struct sk_buff *skb,
532 struct netlink_callback *cb)
534 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
535 const struct nft_table *table;
536 unsigned int idx = 0, s_idx = cb->args[0];
537 struct net *net = sock_net(skb->sk);
538 int family = nfmsg->nfgen_family;
541 cb->seq = net->nft.base_seq;
543 list_for_each_entry_rcu(table, &net->nft.tables, list) {
544 if (family != NFPROTO_UNSPEC && family != table->family)
550 memset(&cb->args[1], 0,
551 sizeof(cb->args) - sizeof(cb->args[0]));
552 if (!nft_is_active(net, table))
554 if (nf_tables_fill_table_info(skb, net,
555 NETLINK_CB(cb->skb).portid,
557 NFT_MSG_NEWTABLE, NLM_F_MULTI,
558 table->family, table) < 0)
561 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
571 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
572 const struct nlmsghdr *nlh,
573 struct netlink_dump_control *c)
577 if (!try_module_get(THIS_MODULE))
581 err = netlink_dump_start(nlsk, skb, nlh, c);
583 module_put(THIS_MODULE);
588 /* called with rcu_read_lock held */
589 static int nf_tables_gettable(struct net *net, struct sock *nlsk,
590 struct sk_buff *skb, const struct nlmsghdr *nlh,
591 const struct nlattr * const nla[],
592 struct netlink_ext_ack *extack)
594 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
595 u8 genmask = nft_genmask_cur(net);
596 const struct nft_table *table;
597 struct sk_buff *skb2;
598 int family = nfmsg->nfgen_family;
601 if (nlh->nlmsg_flags & NLM_F_DUMP) {
602 struct netlink_dump_control c = {
603 .dump = nf_tables_dump_tables,
604 .module = THIS_MODULE,
607 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
610 table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
612 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
613 return PTR_ERR(table);
616 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
620 err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
621 nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
626 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
633 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
635 struct nft_chain *chain;
638 list_for_each_entry(chain, &table->chains, list) {
639 if (!nft_is_active_next(net, chain))
641 if (!nft_is_base_chain(chain))
644 if (cnt && i++ == cnt)
647 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
651 static int nf_tables_table_enable(struct net *net, struct nft_table *table)
653 struct nft_chain *chain;
656 list_for_each_entry(chain, &table->chains, list) {
657 if (!nft_is_active_next(net, chain))
659 if (!nft_is_base_chain(chain))
662 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
671 nft_table_disable(net, table, i);
675 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
677 nft_table_disable(net, table, 0);
680 static int nf_tables_updtable(struct nft_ctx *ctx)
682 struct nft_trans *trans;
686 if (!ctx->nla[NFTA_TABLE_FLAGS])
689 flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
690 if (flags & ~NFT_TABLE_F_DORMANT)
693 if (flags == ctx->table->flags)
696 trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
697 sizeof(struct nft_trans_table));
701 if ((flags & NFT_TABLE_F_DORMANT) &&
702 !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
703 nft_trans_table_enable(trans) = false;
704 } else if (!(flags & NFT_TABLE_F_DORMANT) &&
705 ctx->table->flags & NFT_TABLE_F_DORMANT) {
706 ret = nf_tables_table_enable(ctx->net, ctx->table);
708 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
709 nft_trans_table_enable(trans) = true;
715 nft_trans_table_update(trans) = true;
716 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
719 nft_trans_destroy(trans);
723 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
724 struct sk_buff *skb, const struct nlmsghdr *nlh,
725 const struct nlattr * const nla[],
726 struct netlink_ext_ack *extack)
728 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
729 u8 genmask = nft_genmask_next(net);
730 int family = nfmsg->nfgen_family;
731 const struct nlattr *attr;
732 struct nft_table *table;
737 attr = nla[NFTA_TABLE_NAME];
738 table = nft_table_lookup(net, attr, family, genmask);
740 if (PTR_ERR(table) != -ENOENT)
741 return PTR_ERR(table);
743 if (nlh->nlmsg_flags & NLM_F_EXCL) {
744 NL_SET_BAD_ATTR(extack, attr);
747 if (nlh->nlmsg_flags & NLM_F_REPLACE)
750 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
751 return nf_tables_updtable(&ctx);
754 if (nla[NFTA_TABLE_FLAGS]) {
755 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
756 if (flags & ~NFT_TABLE_F_DORMANT)
761 table = kzalloc(sizeof(*table), GFP_KERNEL);
765 table->name = nla_strdup(attr, GFP_KERNEL);
766 if (table->name == NULL)
769 INIT_LIST_HEAD(&table->chains);
770 INIT_LIST_HEAD(&table->sets);
771 INIT_LIST_HEAD(&table->objects);
772 INIT_LIST_HEAD(&table->flowtables);
773 table->family = family;
774 table->flags = flags;
775 table->handle = ++table_handle;
777 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
778 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
782 list_add_tail_rcu(&table->list, &net->nft.tables);
792 static int nft_flush_table(struct nft_ctx *ctx)
794 struct nft_flowtable *flowtable, *nft;
795 struct nft_chain *chain, *nc;
796 struct nft_object *obj, *ne;
797 struct nft_set *set, *ns;
800 list_for_each_entry(chain, &ctx->table->chains, list) {
801 if (!nft_is_active_next(ctx->net, chain))
806 err = nft_delrule_by_chain(ctx);
811 list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
812 if (!nft_is_active_next(ctx->net, set))
815 if (nft_set_is_anonymous(set) &&
816 !list_empty(&set->bindings))
819 err = nft_delset(ctx, set);
824 list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
825 err = nft_delflowtable(ctx, flowtable);
830 list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
831 err = nft_delobj(ctx, obj);
836 list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
837 if (!nft_is_active_next(ctx->net, chain))
842 err = nft_delchain(ctx);
847 err = nft_deltable(ctx);
852 static int nft_flush(struct nft_ctx *ctx, int family)
854 struct nft_table *table, *nt;
855 const struct nlattr * const *nla = ctx->nla;
858 list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
859 if (family != AF_UNSPEC && table->family != family)
862 ctx->family = table->family;
864 if (!nft_is_active_next(ctx->net, table))
867 if (nla[NFTA_TABLE_NAME] &&
868 nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
873 err = nft_flush_table(ctx);
881 static int nf_tables_deltable(struct net *net, struct sock *nlsk,
882 struct sk_buff *skb, const struct nlmsghdr *nlh,
883 const struct nlattr * const nla[],
884 struct netlink_ext_ack *extack)
886 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
887 u8 genmask = nft_genmask_next(net);
888 int family = nfmsg->nfgen_family;
889 const struct nlattr *attr;
890 struct nft_table *table;
893 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
894 if (family == AF_UNSPEC ||
895 (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
896 return nft_flush(&ctx, family);
898 if (nla[NFTA_TABLE_HANDLE]) {
899 attr = nla[NFTA_TABLE_HANDLE];
900 table = nft_table_lookup_byhandle(net, attr, genmask);
902 attr = nla[NFTA_TABLE_NAME];
903 table = nft_table_lookup(net, attr, family, genmask);
907 NL_SET_BAD_ATTR(extack, attr);
908 return PTR_ERR(table);
911 if (nlh->nlmsg_flags & NLM_F_NONREC &&
918 return nft_flush_table(&ctx);
921 static void nf_tables_table_destroy(struct nft_ctx *ctx)
923 BUG_ON(ctx->table->use > 0);
925 kfree(ctx->table->name);
929 void nft_register_chain_type(const struct nft_chain_type *ctype)
931 if (WARN_ON(ctype->family >= NFPROTO_NUMPROTO))
934 nfnl_lock(NFNL_SUBSYS_NFTABLES);
935 if (WARN_ON(chain_type[ctype->family][ctype->type] != NULL)) {
936 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
939 chain_type[ctype->family][ctype->type] = ctype;
940 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
942 EXPORT_SYMBOL_GPL(nft_register_chain_type);
944 void nft_unregister_chain_type(const struct nft_chain_type *ctype)
946 nfnl_lock(NFNL_SUBSYS_NFTABLES);
947 chain_type[ctype->family][ctype->type] = NULL;
948 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
950 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
956 static struct nft_chain *
957 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
959 struct nft_chain *chain;
961 list_for_each_entry(chain, &table->chains, list) {
962 if (chain->handle == handle &&
963 nft_active_genmask(chain, genmask))
967 return ERR_PTR(-ENOENT);
970 static struct nft_chain *nft_chain_lookup(const struct nft_table *table,
971 const struct nlattr *nla, u8 genmask)
973 struct nft_chain *chain;
976 return ERR_PTR(-EINVAL);
978 list_for_each_entry_rcu(chain, &table->chains, list) {
979 if (!nla_strcmp(nla, chain->name) &&
980 nft_active_genmask(chain, genmask))
984 return ERR_PTR(-ENOENT);
987 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
988 [NFTA_CHAIN_TABLE] = { .type = NLA_STRING,
989 .len = NFT_TABLE_MAXNAMELEN - 1 },
990 [NFTA_CHAIN_HANDLE] = { .type = NLA_U64 },
991 [NFTA_CHAIN_NAME] = { .type = NLA_STRING,
992 .len = NFT_CHAIN_MAXNAMELEN - 1 },
993 [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
994 [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
995 [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
996 [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
999 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1000 [NFTA_HOOK_HOOKNUM] = { .type = NLA_U32 },
1001 [NFTA_HOOK_PRIORITY] = { .type = NLA_U32 },
1002 [NFTA_HOOK_DEV] = { .type = NLA_STRING,
1003 .len = IFNAMSIZ - 1 },
1006 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1008 struct nft_stats *cpu_stats, total;
1009 struct nlattr *nest;
1014 memset(&total, 0, sizeof(total));
1015 for_each_possible_cpu(cpu) {
1016 cpu_stats = per_cpu_ptr(stats, cpu);
1018 seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1019 pkts = cpu_stats->pkts;
1020 bytes = cpu_stats->bytes;
1021 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1023 total.bytes += bytes;
1025 nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
1027 goto nla_put_failure;
1029 if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1030 NFTA_COUNTER_PAD) ||
1031 nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1033 goto nla_put_failure;
1035 nla_nest_end(skb, nest);
1042 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1043 u32 portid, u32 seq, int event, u32 flags,
1044 int family, const struct nft_table *table,
1045 const struct nft_chain *chain)
1047 struct nlmsghdr *nlh;
1048 struct nfgenmsg *nfmsg;
1050 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1051 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1053 goto nla_put_failure;
1055 nfmsg = nlmsg_data(nlh);
1056 nfmsg->nfgen_family = family;
1057 nfmsg->version = NFNETLINK_V0;
1058 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
1060 if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1061 goto nla_put_failure;
1062 if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1064 goto nla_put_failure;
1065 if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1066 goto nla_put_failure;
1068 if (nft_is_base_chain(chain)) {
1069 const struct nft_base_chain *basechain = nft_base_chain(chain);
1070 const struct nf_hook_ops *ops = &basechain->ops;
1071 struct nlattr *nest;
1073 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
1075 goto nla_put_failure;
1076 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1077 goto nla_put_failure;
1078 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1079 goto nla_put_failure;
1080 if (basechain->dev_name[0] &&
1081 nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1082 goto nla_put_failure;
1083 nla_nest_end(skb, nest);
1085 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1086 htonl(basechain->policy)))
1087 goto nla_put_failure;
1089 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1090 goto nla_put_failure;
1092 if (basechain->stats && nft_dump_stats(skb, basechain->stats))
1093 goto nla_put_failure;
1096 if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1097 goto nla_put_failure;
1099 nlmsg_end(skb, nlh);
1103 nlmsg_trim(skb, nlh);
1107 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1109 struct sk_buff *skb;
1113 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1116 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1120 err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1121 event, 0, ctx->family, ctx->table,
1128 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1129 ctx->report, GFP_KERNEL);
1132 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1135 static int nf_tables_dump_chains(struct sk_buff *skb,
1136 struct netlink_callback *cb)
1138 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1139 const struct nft_table *table;
1140 const struct nft_chain *chain;
1141 unsigned int idx = 0, s_idx = cb->args[0];
1142 struct net *net = sock_net(skb->sk);
1143 int family = nfmsg->nfgen_family;
1146 cb->seq = net->nft.base_seq;
1148 list_for_each_entry_rcu(table, &net->nft.tables, list) {
1149 if (family != NFPROTO_UNSPEC && family != table->family)
1152 list_for_each_entry_rcu(chain, &table->chains, list) {
1156 memset(&cb->args[1], 0,
1157 sizeof(cb->args) - sizeof(cb->args[0]));
1158 if (!nft_is_active(net, chain))
1160 if (nf_tables_fill_chain_info(skb, net,
1161 NETLINK_CB(cb->skb).portid,
1165 table->family, table,
1169 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1180 /* called with rcu_read_lock held */
1181 static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1182 struct sk_buff *skb, const struct nlmsghdr *nlh,
1183 const struct nlattr * const nla[],
1184 struct netlink_ext_ack *extack)
1186 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1187 u8 genmask = nft_genmask_cur(net);
1188 const struct nft_table *table;
1189 const struct nft_chain *chain;
1190 struct sk_buff *skb2;
1191 int family = nfmsg->nfgen_family;
1194 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1195 struct netlink_dump_control c = {
1196 .dump = nf_tables_dump_chains,
1197 .module = THIS_MODULE,
1200 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
1203 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1204 if (IS_ERR(table)) {
1205 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1206 return PTR_ERR(table);
1209 chain = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1210 if (IS_ERR(chain)) {
1211 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
1212 return PTR_ERR(chain);
1215 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1219 err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1220 nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1221 family, table, chain);
1225 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1232 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1233 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 },
1234 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 },
1237 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1239 struct nlattr *tb[NFTA_COUNTER_MAX+1];
1240 struct nft_stats __percpu *newstats;
1241 struct nft_stats *stats;
1244 err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy,
1247 return ERR_PTR(err);
1249 if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1250 return ERR_PTR(-EINVAL);
1252 newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1253 if (newstats == NULL)
1254 return ERR_PTR(-ENOMEM);
1256 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1257 * are not exposed to userspace.
1260 stats = this_cpu_ptr(newstats);
1261 stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1262 stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1268 static void nft_chain_stats_replace(struct nft_base_chain *chain,
1269 struct nft_stats __percpu *newstats)
1271 struct nft_stats __percpu *oldstats;
1273 if (newstats == NULL)
1277 oldstats = nfnl_dereference(chain->stats, NFNL_SUBSYS_NFTABLES);
1278 rcu_assign_pointer(chain->stats, newstats);
1280 free_percpu(oldstats);
1282 rcu_assign_pointer(chain->stats, newstats);
1285 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1287 struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1288 struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1294 /* should be NULL either via abort or via successful commit */
1295 WARN_ON_ONCE(chain->rules_next);
1296 kvfree(chain->rules_next);
1299 static void nf_tables_chain_destroy(struct nft_ctx *ctx)
1301 struct nft_chain *chain = ctx->chain;
1303 BUG_ON(chain->use > 0);
1305 /* no concurrent access possible anymore */
1306 nf_tables_chain_free_chain_rules(chain);
1308 if (nft_is_base_chain(chain)) {
1309 struct nft_base_chain *basechain = nft_base_chain(chain);
1311 module_put(basechain->type->owner);
1312 free_percpu(basechain->stats);
1313 if (basechain->stats)
1314 static_branch_dec(&nft_counters_enabled);
1323 struct nft_chain_hook {
1326 const struct nft_chain_type *type;
1327 struct net_device *dev;
1330 static int nft_chain_parse_hook(struct net *net,
1331 const struct nlattr * const nla[],
1332 struct nft_chain_hook *hook, u8 family,
1335 struct nlattr *ha[NFTA_HOOK_MAX + 1];
1336 const struct nft_chain_type *type;
1337 struct net_device *dev;
1340 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
1341 nft_hook_policy, NULL);
1345 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1346 ha[NFTA_HOOK_PRIORITY] == NULL)
1349 hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1350 hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1352 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
1353 if (nla[NFTA_CHAIN_TYPE]) {
1354 type = nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
1357 return PTR_ERR(type);
1359 if (!(type->hook_mask & (1 << hook->num)))
1362 if (type->type == NFT_CHAIN_T_NAT &&
1363 hook->priority <= NF_IP_PRI_CONNTRACK)
1366 if (!try_module_get(type->owner))
1372 if (family == NFPROTO_NETDEV) {
1373 char ifname[IFNAMSIZ];
1375 if (!ha[NFTA_HOOK_DEV]) {
1376 module_put(type->owner);
1380 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1381 dev = __dev_get_by_name(net, ifname);
1383 module_put(type->owner);
1387 } else if (ha[NFTA_HOOK_DEV]) {
1388 module_put(type->owner);
1395 static void nft_chain_release_hook(struct nft_chain_hook *hook)
1397 module_put(hook->type->owner);
1400 struct nft_rules_old {
1402 struct nft_rule **start;
1405 static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1408 if (alloc > INT_MAX)
1411 alloc += 1; /* NULL, ends rules */
1412 if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1415 alloc *= sizeof(struct nft_rule *);
1416 alloc += sizeof(struct nft_rules_old);
1418 return kvmalloc(alloc, GFP_KERNEL);
1421 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1422 u8 policy, bool create)
1424 const struct nlattr * const *nla = ctx->nla;
1425 struct nft_table *table = ctx->table;
1426 struct nft_base_chain *basechain;
1427 struct nft_stats __percpu *stats;
1428 struct net *net = ctx->net;
1429 struct nft_chain *chain;
1430 struct nft_rule **rules;
1433 if (table->use == UINT_MAX)
1436 if (nla[NFTA_CHAIN_HOOK]) {
1437 struct nft_chain_hook hook;
1438 struct nf_hook_ops *ops;
1440 err = nft_chain_parse_hook(net, nla, &hook, family, create);
1444 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1445 if (basechain == NULL) {
1446 nft_chain_release_hook(&hook);
1450 if (hook.dev != NULL)
1451 strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1453 if (nla[NFTA_CHAIN_COUNTERS]) {
1454 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1455 if (IS_ERR(stats)) {
1456 nft_chain_release_hook(&hook);
1458 return PTR_ERR(stats);
1460 basechain->stats = stats;
1461 static_branch_inc(&nft_counters_enabled);
1464 basechain->type = hook.type;
1465 chain = &basechain->chain;
1467 ops = &basechain->ops;
1469 ops->hooknum = hook.num;
1470 ops->priority = hook.priority;
1472 ops->hook = hook.type->hooks[ops->hooknum];
1473 ops->dev = hook.dev;
1475 chain->flags |= NFT_BASE_CHAIN;
1476 basechain->policy = policy;
1478 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1484 INIT_LIST_HEAD(&chain->rules);
1485 chain->handle = nf_tables_alloc_handle(table);
1486 chain->table = table;
1487 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1493 rules = nf_tables_chain_alloc_rules(chain, 0);
1500 rcu_assign_pointer(chain->rules_gen_0, rules);
1501 rcu_assign_pointer(chain->rules_gen_1, rules);
1503 err = nf_tables_register_hook(net, table, chain);
1507 err = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1512 list_add_tail_rcu(&chain->list, &table->chains);
1516 nf_tables_unregister_hook(net, table, chain);
1518 nf_tables_chain_destroy(ctx);
1523 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1526 const struct nlattr * const *nla = ctx->nla;
1527 struct nft_table *table = ctx->table;
1528 struct nft_chain *chain = ctx->chain;
1529 struct nft_base_chain *basechain;
1530 struct nft_stats *stats = NULL;
1531 struct nft_chain_hook hook;
1532 const struct nlattr *name;
1533 struct nf_hook_ops *ops;
1534 struct nft_trans *trans;
1537 if (nla[NFTA_CHAIN_HOOK]) {
1538 if (!nft_is_base_chain(chain))
1541 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
1546 basechain = nft_base_chain(chain);
1547 if (basechain->type != hook.type) {
1548 nft_chain_release_hook(&hook);
1552 ops = &basechain->ops;
1553 if (ops->hooknum != hook.num ||
1554 ops->priority != hook.priority ||
1555 ops->dev != hook.dev) {
1556 nft_chain_release_hook(&hook);
1559 nft_chain_release_hook(&hook);
1562 if (nla[NFTA_CHAIN_HANDLE] &&
1563 nla[NFTA_CHAIN_NAME]) {
1564 struct nft_chain *chain2;
1566 chain2 = nft_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1567 if (!IS_ERR(chain2))
1571 if (nla[NFTA_CHAIN_COUNTERS]) {
1572 if (!nft_is_base_chain(chain))
1575 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1577 return PTR_ERR(stats);
1580 trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1581 sizeof(struct nft_trans_chain));
1582 if (trans == NULL) {
1587 nft_trans_chain_stats(trans) = stats;
1588 nft_trans_chain_update(trans) = true;
1590 if (nla[NFTA_CHAIN_POLICY])
1591 nft_trans_chain_policy(trans) = policy;
1593 nft_trans_chain_policy(trans) = -1;
1595 name = nla[NFTA_CHAIN_NAME];
1596 if (nla[NFTA_CHAIN_HANDLE] && name) {
1597 nft_trans_chain_name(trans) =
1598 nla_strdup(name, GFP_KERNEL);
1599 if (!nft_trans_chain_name(trans)) {
1605 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1610 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1611 struct sk_buff *skb, const struct nlmsghdr *nlh,
1612 const struct nlattr * const nla[],
1613 struct netlink_ext_ack *extack)
1615 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1616 u8 genmask = nft_genmask_next(net);
1617 int family = nfmsg->nfgen_family;
1618 const struct nlattr *attr;
1619 struct nft_table *table;
1620 struct nft_chain *chain;
1621 u8 policy = NF_ACCEPT;
1626 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1628 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1629 if (IS_ERR(table)) {
1630 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1631 return PTR_ERR(table);
1635 attr = nla[NFTA_CHAIN_NAME];
1637 if (nla[NFTA_CHAIN_HANDLE]) {
1638 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1639 chain = nft_chain_lookup_byhandle(table, handle, genmask);
1640 if (IS_ERR(chain)) {
1641 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
1642 return PTR_ERR(chain);
1644 attr = nla[NFTA_CHAIN_HANDLE];
1646 chain = nft_chain_lookup(table, attr, genmask);
1647 if (IS_ERR(chain)) {
1648 if (PTR_ERR(chain) != -ENOENT) {
1649 NL_SET_BAD_ATTR(extack, attr);
1650 return PTR_ERR(chain);
1656 if (nla[NFTA_CHAIN_POLICY]) {
1657 if (chain != NULL &&
1658 !nft_is_base_chain(chain)) {
1659 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
1663 if (chain == NULL &&
1664 nla[NFTA_CHAIN_HOOK] == NULL) {
1665 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
1669 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
1679 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1681 if (chain != NULL) {
1682 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1683 NL_SET_BAD_ATTR(extack, attr);
1686 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1689 return nf_tables_updchain(&ctx, genmask, policy, create);
1692 return nf_tables_addchain(&ctx, family, genmask, policy, create);
1695 static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1696 struct sk_buff *skb, const struct nlmsghdr *nlh,
1697 const struct nlattr * const nla[],
1698 struct netlink_ext_ack *extack)
1700 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1701 u8 genmask = nft_genmask_next(net);
1702 int family = nfmsg->nfgen_family;
1703 const struct nlattr *attr;
1704 struct nft_table *table;
1705 struct nft_chain *chain;
1706 struct nft_rule *rule;
1712 table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1713 if (IS_ERR(table)) {
1714 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1715 return PTR_ERR(table);
1718 if (nla[NFTA_CHAIN_HANDLE]) {
1719 attr = nla[NFTA_CHAIN_HANDLE];
1720 handle = be64_to_cpu(nla_get_be64(attr));
1721 chain = nft_chain_lookup_byhandle(table, handle, genmask);
1723 attr = nla[NFTA_CHAIN_NAME];
1724 chain = nft_chain_lookup(table, attr, genmask);
1726 if (IS_ERR(chain)) {
1727 NL_SET_BAD_ATTR(extack, attr);
1728 return PTR_ERR(chain);
1731 if (nlh->nlmsg_flags & NLM_F_NONREC &&
1735 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1738 list_for_each_entry(rule, &chain->rules, list) {
1739 if (!nft_is_active_next(net, rule))
1743 err = nft_delrule(&ctx, rule);
1748 /* There are rules and elements that are still holding references to us,
1749 * we cannot do a recursive removal in this case.
1752 NL_SET_BAD_ATTR(extack, attr);
1756 return nft_delchain(&ctx);
1764 * nft_register_expr - register nf_tables expr type
1767 * Registers the expr type for use with nf_tables. Returns zero on
1768 * success or a negative errno code otherwise.
1770 int nft_register_expr(struct nft_expr_type *type)
1772 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1773 if (type->family == NFPROTO_UNSPEC)
1774 list_add_tail_rcu(&type->list, &nf_tables_expressions);
1776 list_add_rcu(&type->list, &nf_tables_expressions);
1777 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1780 EXPORT_SYMBOL_GPL(nft_register_expr);
1783 * nft_unregister_expr - unregister nf_tables expr type
1786 * Unregisters the expr typefor use with nf_tables.
1788 void nft_unregister_expr(struct nft_expr_type *type)
1790 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1791 list_del_rcu(&type->list);
1792 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1794 EXPORT_SYMBOL_GPL(nft_unregister_expr);
1796 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1799 const struct nft_expr_type *type;
1801 list_for_each_entry(type, &nf_tables_expressions, list) {
1802 if (!nla_strcmp(nla, type->name) &&
1803 (!type->family || type->family == family))
1809 static const struct nft_expr_type *nft_expr_type_get(u8 family,
1812 const struct nft_expr_type *type;
1815 return ERR_PTR(-EINVAL);
1817 type = __nft_expr_type_get(family, nla);
1818 if (type != NULL && try_module_get(type->owner))
1821 #ifdef CONFIG_MODULES
1823 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1824 request_module("nft-expr-%u-%.*s", family,
1825 nla_len(nla), (char *)nla_data(nla));
1826 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1827 if (__nft_expr_type_get(family, nla))
1828 return ERR_PTR(-EAGAIN);
1830 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1831 request_module("nft-expr-%.*s",
1832 nla_len(nla), (char *)nla_data(nla));
1833 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1834 if (__nft_expr_type_get(family, nla))
1835 return ERR_PTR(-EAGAIN);
1838 return ERR_PTR(-ENOENT);
1841 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1842 [NFTA_EXPR_NAME] = { .type = NLA_STRING },
1843 [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
1846 static int nf_tables_fill_expr_info(struct sk_buff *skb,
1847 const struct nft_expr *expr)
1849 if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
1850 goto nla_put_failure;
1852 if (expr->ops->dump) {
1853 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1855 goto nla_put_failure;
1856 if (expr->ops->dump(skb, expr) < 0)
1857 goto nla_put_failure;
1858 nla_nest_end(skb, data);
1867 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
1868 const struct nft_expr *expr)
1870 struct nlattr *nest;
1872 nest = nla_nest_start(skb, attr);
1874 goto nla_put_failure;
1875 if (nf_tables_fill_expr_info(skb, expr) < 0)
1876 goto nla_put_failure;
1877 nla_nest_end(skb, nest);
1884 struct nft_expr_info {
1885 const struct nft_expr_ops *ops;
1886 struct nlattr *tb[NFT_EXPR_MAXATTR + 1];
1889 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1890 const struct nlattr *nla,
1891 struct nft_expr_info *info)
1893 const struct nft_expr_type *type;
1894 const struct nft_expr_ops *ops;
1895 struct nlattr *tb[NFTA_EXPR_MAX + 1];
1898 err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy, NULL);
1902 type = nft_expr_type_get(ctx->family, tb[NFTA_EXPR_NAME]);
1904 return PTR_ERR(type);
1906 if (tb[NFTA_EXPR_DATA]) {
1907 err = nla_parse_nested(info->tb, type->maxattr,
1908 tb[NFTA_EXPR_DATA], type->policy, NULL);
1912 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1914 if (type->select_ops != NULL) {
1915 ops = type->select_ops(ctx,
1916 (const struct nlattr * const *)info->tb);
1928 module_put(type->owner);
1932 static int nf_tables_newexpr(const struct nft_ctx *ctx,
1933 const struct nft_expr_info *info,
1934 struct nft_expr *expr)
1936 const struct nft_expr_ops *ops = info->ops;
1941 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
1952 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1953 struct nft_expr *expr)
1955 if (expr->ops->destroy)
1956 expr->ops->destroy(ctx, expr);
1957 module_put(expr->ops->type->owner);
1960 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
1961 const struct nlattr *nla)
1963 struct nft_expr_info info;
1964 struct nft_expr *expr;
1967 err = nf_tables_expr_parse(ctx, nla, &info);
1972 expr = kzalloc(info.ops->size, GFP_KERNEL);
1976 err = nf_tables_newexpr(ctx, &info, expr);
1984 module_put(info.ops->type->owner);
1986 return ERR_PTR(err);
1989 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
1991 nf_tables_expr_destroy(ctx, expr);
1999 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2002 struct nft_rule *rule;
2004 // FIXME: this sucks
2005 list_for_each_entry_rcu(rule, &chain->rules, list) {
2006 if (handle == rule->handle)
2010 return ERR_PTR(-ENOENT);
2013 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2014 const struct nlattr *nla)
2017 return ERR_PTR(-EINVAL);
2019 return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
2022 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
2023 [NFTA_RULE_TABLE] = { .type = NLA_STRING,
2024 .len = NFT_TABLE_MAXNAMELEN - 1 },
2025 [NFTA_RULE_CHAIN] = { .type = NLA_STRING,
2026 .len = NFT_CHAIN_MAXNAMELEN - 1 },
2027 [NFTA_RULE_HANDLE] = { .type = NLA_U64 },
2028 [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
2029 [NFTA_RULE_COMPAT] = { .type = NLA_NESTED },
2030 [NFTA_RULE_POSITION] = { .type = NLA_U64 },
2031 [NFTA_RULE_USERDATA] = { .type = NLA_BINARY,
2032 .len = NFT_USERDATA_MAXLEN },
2033 [NFTA_RULE_ID] = { .type = NLA_U32 },
2036 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2037 u32 portid, u32 seq, int event,
2038 u32 flags, int family,
2039 const struct nft_table *table,
2040 const struct nft_chain *chain,
2041 const struct nft_rule *rule)
2043 struct nlmsghdr *nlh;
2044 struct nfgenmsg *nfmsg;
2045 const struct nft_expr *expr, *next;
2046 struct nlattr *list;
2047 const struct nft_rule *prule;
2048 u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2050 nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
2052 goto nla_put_failure;
2054 nfmsg = nlmsg_data(nlh);
2055 nfmsg->nfgen_family = family;
2056 nfmsg->version = NFNETLINK_V0;
2057 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
2059 if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2060 goto nla_put_failure;
2061 if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2062 goto nla_put_failure;
2063 if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2065 goto nla_put_failure;
2067 if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
2068 prule = list_prev_entry(rule, list);
2069 if (nla_put_be64(skb, NFTA_RULE_POSITION,
2070 cpu_to_be64(prule->handle),
2072 goto nla_put_failure;
2075 list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
2077 goto nla_put_failure;
2078 nft_rule_for_each_expr(expr, next, rule) {
2079 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
2080 goto nla_put_failure;
2082 nla_nest_end(skb, list);
2085 struct nft_userdata *udata = nft_userdata(rule);
2086 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2088 goto nla_put_failure;
2091 nlmsg_end(skb, nlh);
2095 nlmsg_trim(skb, nlh);
2099 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2100 const struct nft_rule *rule, int event)
2102 struct sk_buff *skb;
2106 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2109 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2113 err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2114 event, 0, ctx->family, ctx->table,
2121 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2122 ctx->report, GFP_KERNEL);
2125 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2128 struct nft_rule_dump_ctx {
2133 static int nf_tables_dump_rules(struct sk_buff *skb,
2134 struct netlink_callback *cb)
2136 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2137 const struct nft_rule_dump_ctx *ctx = cb->data;
2138 const struct nft_table *table;
2139 const struct nft_chain *chain;
2140 const struct nft_rule *rule;
2141 unsigned int idx = 0, s_idx = cb->args[0];
2142 struct net *net = sock_net(skb->sk);
2143 int family = nfmsg->nfgen_family;
2146 cb->seq = net->nft.base_seq;
2148 list_for_each_entry_rcu(table, &net->nft.tables, list) {
2149 if (family != NFPROTO_UNSPEC && family != table->family)
2152 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
2155 list_for_each_entry_rcu(chain, &table->chains, list) {
2156 if (ctx && ctx->chain &&
2157 strcmp(ctx->chain, chain->name) != 0)
2160 list_for_each_entry_rcu(rule, &chain->rules, list) {
2161 if (!nft_is_active(net, rule))
2166 memset(&cb->args[1], 0,
2167 sizeof(cb->args) - sizeof(cb->args[0]));
2168 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2171 NLM_F_MULTI | NLM_F_APPEND,
2173 table, chain, rule) < 0)
2176 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2189 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2191 struct nft_rule_dump_ctx *ctx = cb->data;
2201 /* called with rcu_read_lock held */
2202 static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2203 struct sk_buff *skb, const struct nlmsghdr *nlh,
2204 const struct nlattr * const nla[],
2205 struct netlink_ext_ack *extack)
2207 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2208 u8 genmask = nft_genmask_cur(net);
2209 const struct nft_table *table;
2210 const struct nft_chain *chain;
2211 const struct nft_rule *rule;
2212 struct sk_buff *skb2;
2213 int family = nfmsg->nfgen_family;
2216 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2217 struct netlink_dump_control c = {
2218 .dump = nf_tables_dump_rules,
2219 .done = nf_tables_dump_rules_done,
2220 .module = THIS_MODULE,
2223 if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2224 struct nft_rule_dump_ctx *ctx;
2226 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2230 if (nla[NFTA_RULE_TABLE]) {
2231 ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2238 if (nla[NFTA_RULE_CHAIN]) {
2239 ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2250 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
2253 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2254 if (IS_ERR(table)) {
2255 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2256 return PTR_ERR(table);
2259 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2260 if (IS_ERR(chain)) {
2261 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2262 return PTR_ERR(chain);
2265 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2267 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2268 return PTR_ERR(rule);
2271 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
2275 err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
2276 nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2277 family, table, chain, rule);
2281 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2288 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2289 struct nft_rule *rule)
2291 struct nft_expr *expr;
2294 * Careful: some expressions might not be initialized in case this
2295 * is called on error from nf_tables_newrule().
2297 expr = nft_expr_first(rule);
2298 while (expr != nft_expr_last(rule) && expr->ops) {
2299 nf_tables_expr_destroy(ctx, expr);
2300 expr = nft_expr_next(expr);
2305 static void nf_tables_rule_release(const struct nft_ctx *ctx,
2306 struct nft_rule *rule)
2308 nft_rule_expr_deactivate(ctx, rule);
2309 nf_tables_rule_destroy(ctx, rule);
2312 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2314 struct nft_expr *expr, *last;
2315 const struct nft_data *data;
2316 struct nft_rule *rule;
2319 list_for_each_entry(rule, &chain->rules, list) {
2320 if (!nft_is_active_next(ctx->net, rule))
2323 nft_rule_for_each_expr(expr, last, rule) {
2324 if (!expr->ops->validate)
2327 err = expr->ops->validate(ctx, expr, &data);
2335 EXPORT_SYMBOL_GPL(nft_chain_validate);
2337 static int nft_table_validate(struct net *net, const struct nft_table *table)
2339 struct nft_chain *chain;
2340 struct nft_ctx ctx = {
2342 .family = table->family,
2346 list_for_each_entry(chain, &table->chains, list) {
2347 if (!nft_is_base_chain(chain))
2351 err = nft_chain_validate(&ctx, chain);
2359 #define NFT_RULE_MAXEXPRS 128
2361 static struct nft_expr_info *info;
2363 static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2364 struct sk_buff *skb, const struct nlmsghdr *nlh,
2365 const struct nlattr * const nla[],
2366 struct netlink_ext_ack *extack)
2368 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2369 u8 genmask = nft_genmask_next(net);
2370 int family = nfmsg->nfgen_family;
2371 struct nft_table *table;
2372 struct nft_chain *chain;
2373 struct nft_rule *rule, *old_rule = NULL;
2374 struct nft_userdata *udata;
2375 struct nft_trans *trans = NULL;
2376 struct nft_expr *expr;
2379 unsigned int size, i, n, ulen = 0, usize = 0;
2382 u64 handle, pos_handle;
2384 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2386 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2387 if (IS_ERR(table)) {
2388 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2389 return PTR_ERR(table);
2392 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2393 if (IS_ERR(chain)) {
2394 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2395 return PTR_ERR(chain);
2398 if (nla[NFTA_RULE_HANDLE]) {
2399 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2400 rule = __nft_rule_lookup(chain, handle);
2402 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2403 return PTR_ERR(rule);
2406 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2407 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2410 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2415 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
2417 handle = nf_tables_alloc_handle(table);
2419 if (chain->use == UINT_MAX)
2423 if (nla[NFTA_RULE_POSITION]) {
2424 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2427 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2428 old_rule = __nft_rule_lookup(chain, pos_handle);
2429 if (IS_ERR(old_rule)) {
2430 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
2431 return PTR_ERR(old_rule);
2435 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2439 if (nla[NFTA_RULE_EXPRESSIONS]) {
2440 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2442 if (nla_type(tmp) != NFTA_LIST_ELEM)
2444 if (n == NFT_RULE_MAXEXPRS)
2446 err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
2449 size += info[n].ops->size;
2453 /* Check for overflow of dlen field */
2455 if (size >= 1 << 12)
2458 if (nla[NFTA_RULE_USERDATA]) {
2459 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
2461 usize = sizeof(struct nft_userdata) + ulen;
2465 rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
2469 nft_activate_next(net, rule);
2471 rule->handle = handle;
2473 rule->udata = ulen ? 1 : 0;
2476 udata = nft_userdata(rule);
2477 udata->len = ulen - 1;
2478 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2481 expr = nft_expr_first(rule);
2482 for (i = 0; i < n; i++) {
2483 err = nf_tables_newexpr(&ctx, &info[i], expr);
2487 if (info[i].ops->validate)
2488 nft_validate_state_update(net, NFT_VALIDATE_NEED);
2491 expr = nft_expr_next(expr);
2494 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
2495 if (!nft_is_active_next(net, old_rule)) {
2499 trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
2501 if (trans == NULL) {
2505 nft_deactivate_next(net, old_rule);
2508 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2513 list_add_tail_rcu(&rule->list, &old_rule->list);
2515 if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2520 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2522 list_add_rcu(&rule->list, &old_rule->list);
2524 list_add_tail_rcu(&rule->list, &chain->rules);
2527 list_add_tail_rcu(&rule->list, &old_rule->list);
2529 list_add_rcu(&rule->list, &chain->rules);
2534 if (net->nft.validate_state == NFT_VALIDATE_DO)
2535 return nft_table_validate(net, table);
2539 nf_tables_rule_release(&ctx, rule);
2541 for (i = 0; i < n; i++) {
2542 if (info[i].ops != NULL)
2543 module_put(info[i].ops->type->owner);
2548 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2549 const struct nlattr *nla)
2551 u32 id = ntohl(nla_get_be32(nla));
2552 struct nft_trans *trans;
2554 list_for_each_entry(trans, &net->nft.commit_list, list) {
2555 struct nft_rule *rule = nft_trans_rule(trans);
2557 if (trans->msg_type == NFT_MSG_NEWRULE &&
2558 id == nft_trans_rule_id(trans))
2561 return ERR_PTR(-ENOENT);
2564 static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2565 struct sk_buff *skb, const struct nlmsghdr *nlh,
2566 const struct nlattr * const nla[],
2567 struct netlink_ext_ack *extack)
2569 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2570 u8 genmask = nft_genmask_next(net);
2571 struct nft_table *table;
2572 struct nft_chain *chain = NULL;
2573 struct nft_rule *rule;
2574 int family = nfmsg->nfgen_family, err = 0;
2577 table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2578 if (IS_ERR(table)) {
2579 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2580 return PTR_ERR(table);
2583 if (nla[NFTA_RULE_CHAIN]) {
2584 chain = nft_chain_lookup(table, nla[NFTA_RULE_CHAIN], genmask);
2585 if (IS_ERR(chain)) {
2586 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2587 return PTR_ERR(chain);
2591 nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2594 if (nla[NFTA_RULE_HANDLE]) {
2595 rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2597 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2598 return PTR_ERR(rule);
2601 err = nft_delrule(&ctx, rule);
2602 } else if (nla[NFTA_RULE_ID]) {
2603 rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2605 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
2606 return PTR_ERR(rule);
2609 err = nft_delrule(&ctx, rule);
2611 err = nft_delrule_by_chain(&ctx);
2614 list_for_each_entry(chain, &table->chains, list) {
2615 if (!nft_is_active_next(net, chain))
2619 err = nft_delrule_by_chain(&ctx);
2632 static LIST_HEAD(nf_tables_set_types);
2634 int nft_register_set(struct nft_set_type *type)
2636 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2637 list_add_tail_rcu(&type->list, &nf_tables_set_types);
2638 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2641 EXPORT_SYMBOL_GPL(nft_register_set);
2643 void nft_unregister_set(struct nft_set_type *type)
2645 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2646 list_del_rcu(&type->list);
2647 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2649 EXPORT_SYMBOL_GPL(nft_unregister_set);
2651 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
2652 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
2655 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
2657 return (flags & type->features) == (flags & NFT_SET_FEATURES);
2661 * Select a set implementation based on the data characteristics and the
2662 * given policy. The total memory use might not be known if no size is
2663 * given, in that case the amount of memory per element is used.
2665 static const struct nft_set_ops *
2666 nft_select_set_ops(const struct nft_ctx *ctx,
2667 const struct nlattr * const nla[],
2668 const struct nft_set_desc *desc,
2669 enum nft_set_policies policy)
2671 const struct nft_set_ops *ops, *bops;
2672 struct nft_set_estimate est, best;
2673 const struct nft_set_type *type;
2676 #ifdef CONFIG_MODULES
2677 if (list_empty(&nf_tables_set_types)) {
2678 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2679 request_module("nft-set");
2680 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2681 if (!list_empty(&nf_tables_set_types))
2682 return ERR_PTR(-EAGAIN);
2685 if (nla[NFTA_SET_FLAGS] != NULL)
2686 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2693 list_for_each_entry(type, &nf_tables_set_types, list) {
2696 if (!nft_set_ops_candidate(type, flags))
2698 if (!ops->estimate(desc, flags, &est))
2702 case NFT_SET_POL_PERFORMANCE:
2703 if (est.lookup < best.lookup)
2705 if (est.lookup == best.lookup &&
2706 est.space < best.space)
2709 case NFT_SET_POL_MEMORY:
2711 if (est.space < best.space)
2713 if (est.space == best.space &&
2714 est.lookup < best.lookup)
2716 } else if (est.size < best.size || !bops) {
2724 if (!try_module_get(type->owner))
2727 module_put(to_set_type(bops)->owner);
2736 return ERR_PTR(-EOPNOTSUPP);
2739 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
2740 [NFTA_SET_TABLE] = { .type = NLA_STRING,
2741 .len = NFT_TABLE_MAXNAMELEN - 1 },
2742 [NFTA_SET_NAME] = { .type = NLA_STRING,
2743 .len = NFT_SET_MAXNAMELEN - 1 },
2744 [NFTA_SET_FLAGS] = { .type = NLA_U32 },
2745 [NFTA_SET_KEY_TYPE] = { .type = NLA_U32 },
2746 [NFTA_SET_KEY_LEN] = { .type = NLA_U32 },
2747 [NFTA_SET_DATA_TYPE] = { .type = NLA_U32 },
2748 [NFTA_SET_DATA_LEN] = { .type = NLA_U32 },
2749 [NFTA_SET_POLICY] = { .type = NLA_U32 },
2750 [NFTA_SET_DESC] = { .type = NLA_NESTED },
2751 [NFTA_SET_ID] = { .type = NLA_U32 },
2752 [NFTA_SET_TIMEOUT] = { .type = NLA_U64 },
2753 [NFTA_SET_GC_INTERVAL] = { .type = NLA_U32 },
2754 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
2755 .len = NFT_USERDATA_MAXLEN },
2756 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
2757 [NFTA_SET_HANDLE] = { .type = NLA_U64 },
2760 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2761 [NFTA_SET_DESC_SIZE] = { .type = NLA_U32 },
2764 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
2765 const struct sk_buff *skb,
2766 const struct nlmsghdr *nlh,
2767 const struct nlattr * const nla[],
2768 struct netlink_ext_ack *extack,
2771 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2772 int family = nfmsg->nfgen_family;
2773 struct nft_table *table = NULL;
2775 if (nla[NFTA_SET_TABLE] != NULL) {
2776 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
2778 if (IS_ERR(table)) {
2779 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
2780 return PTR_ERR(table);
2784 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
2788 static struct nft_set *nft_set_lookup(const struct nft_table *table,
2789 const struct nlattr *nla, u8 genmask)
2791 struct nft_set *set;
2794 return ERR_PTR(-EINVAL);
2796 list_for_each_entry_rcu(set, &table->sets, list) {
2797 if (!nla_strcmp(nla, set->name) &&
2798 nft_active_genmask(set, genmask))
2801 return ERR_PTR(-ENOENT);
2804 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
2805 const struct nlattr *nla,
2808 struct nft_set *set;
2810 list_for_each_entry(set, &table->sets, list) {
2811 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2812 nft_active_genmask(set, genmask))
2815 return ERR_PTR(-ENOENT);
2818 static struct nft_set *nft_set_lookup_byid(const struct net *net,
2819 const struct nlattr *nla, u8 genmask)
2821 struct nft_trans *trans;
2822 u32 id = ntohl(nla_get_be32(nla));
2824 list_for_each_entry(trans, &net->nft.commit_list, list) {
2825 struct nft_set *set = nft_trans_set(trans);
2827 if (trans->msg_type == NFT_MSG_NEWSET &&
2828 id == nft_trans_set_id(trans) &&
2829 nft_active_genmask(set, genmask))
2832 return ERR_PTR(-ENOENT);
2835 struct nft_set *nft_set_lookup_global(const struct net *net,
2836 const struct nft_table *table,
2837 const struct nlattr *nla_set_name,
2838 const struct nlattr *nla_set_id,
2841 struct nft_set *set;
2843 set = nft_set_lookup(table, nla_set_name, genmask);
2848 set = nft_set_lookup_byid(net, nla_set_id, genmask);
2852 EXPORT_SYMBOL_GPL(nft_set_lookup_global);
2854 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2857 const struct nft_set *i;
2859 unsigned long *inuse;
2860 unsigned int n = 0, min = 0;
2862 p = strchr(name, '%');
2864 if (p[1] != 'd' || strchr(p + 2, '%'))
2867 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2871 list_for_each_entry(i, &ctx->table->sets, list) {
2874 if (!nft_is_active_next(ctx->net, set))
2876 if (!sscanf(i->name, name, &tmp))
2878 if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
2881 set_bit(tmp - min, inuse);
2884 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
2885 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2886 min += BITS_PER_BYTE * PAGE_SIZE;
2887 memset(inuse, 0, PAGE_SIZE);
2890 free_page((unsigned long)inuse);
2893 set->name = kasprintf(GFP_KERNEL, name, min + n);
2897 list_for_each_entry(i, &ctx->table->sets, list) {
2898 if (!nft_is_active_next(ctx->net, i))
2900 if (!strcmp(set->name, i->name)) {
2908 static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
2910 u64 ms = be64_to_cpu(nla_get_be64(nla));
2911 u64 max = (u64)(~((u64)0));
2913 max = div_u64(max, NSEC_PER_MSEC);
2917 ms *= NSEC_PER_MSEC;
2918 *result = nsecs_to_jiffies64(ms);
2922 static __be64 nf_jiffies64_to_msecs(u64 input)
2924 u64 ms = jiffies64_to_nsecs(input);
2926 return cpu_to_be64(div_u64(ms, NSEC_PER_MSEC));
2929 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2930 const struct nft_set *set, u16 event, u16 flags)
2932 struct nfgenmsg *nfmsg;
2933 struct nlmsghdr *nlh;
2934 struct nlattr *desc;
2935 u32 portid = ctx->portid;
2938 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2939 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2942 goto nla_put_failure;
2944 nfmsg = nlmsg_data(nlh);
2945 nfmsg->nfgen_family = ctx->family;
2946 nfmsg->version = NFNETLINK_V0;
2947 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
2949 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2950 goto nla_put_failure;
2951 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2952 goto nla_put_failure;
2953 if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
2955 goto nla_put_failure;
2956 if (set->flags != 0)
2957 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2958 goto nla_put_failure;
2960 if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2961 goto nla_put_failure;
2962 if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2963 goto nla_put_failure;
2964 if (set->flags & NFT_SET_MAP) {
2965 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2966 goto nla_put_failure;
2967 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2968 goto nla_put_failure;
2970 if (set->flags & NFT_SET_OBJECT &&
2971 nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
2972 goto nla_put_failure;
2975 nla_put_be64(skb, NFTA_SET_TIMEOUT,
2976 nf_jiffies64_to_msecs(set->timeout),
2978 goto nla_put_failure;
2980 nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
2981 goto nla_put_failure;
2983 if (set->policy != NFT_SET_POL_PERFORMANCE) {
2984 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2985 goto nla_put_failure;
2988 if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
2989 goto nla_put_failure;
2991 desc = nla_nest_start(skb, NFTA_SET_DESC);
2993 goto nla_put_failure;
2995 nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2996 goto nla_put_failure;
2997 nla_nest_end(skb, desc);
2999 nlmsg_end(skb, nlh);
3003 nlmsg_trim(skb, nlh);
3007 static void nf_tables_set_notify(const struct nft_ctx *ctx,
3008 const struct nft_set *set, int event,
3011 struct sk_buff *skb;
3012 u32 portid = ctx->portid;
3016 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
3019 skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
3023 err = nf_tables_fill_set(skb, ctx, set, event, 0);
3029 nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3033 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3036 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
3038 const struct nft_set *set;
3039 unsigned int idx, s_idx = cb->args[0];
3040 struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3041 struct net *net = sock_net(skb->sk);
3042 struct nft_ctx *ctx = cb->data, ctx_set;
3048 cb->seq = net->nft.base_seq;
3050 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3051 if (ctx->family != NFPROTO_UNSPEC &&
3052 ctx->family != table->family)
3055 if (ctx->table && ctx->table != table)
3059 if (cur_table != table)
3065 list_for_each_entry_rcu(set, &table->sets, list) {
3068 if (!nft_is_active(net, set))
3072 ctx_set.table = table;
3073 ctx_set.family = table->family;
3075 if (nf_tables_fill_set(skb, &ctx_set, set,
3079 cb->args[2] = (unsigned long) table;
3082 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3095 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
3101 /* called with rcu_read_lock held */
3102 static int nf_tables_getset(struct net *net, struct sock *nlsk,
3103 struct sk_buff *skb, const struct nlmsghdr *nlh,
3104 const struct nlattr * const nla[],
3105 struct netlink_ext_ack *extack)
3107 u8 genmask = nft_genmask_cur(net);
3108 const struct nft_set *set;
3110 struct sk_buff *skb2;
3111 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3114 /* Verify existence before starting dump */
3115 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3120 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3121 struct netlink_dump_control c = {
3122 .dump = nf_tables_dump_sets,
3123 .done = nf_tables_dump_sets_done,
3124 .module = THIS_MODULE,
3126 struct nft_ctx *ctx_dump;
3128 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_ATOMIC);
3129 if (ctx_dump == NULL)
3135 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3138 /* Only accept unspec with dump */
3139 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3140 return -EAFNOSUPPORT;
3141 if (!nla[NFTA_SET_TABLE])
3144 set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
3146 return PTR_ERR(set);
3148 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3152 err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3156 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3163 static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
3164 struct nft_set_desc *desc,
3165 const struct nlattr *nla)
3167 struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3170 err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla,
3171 nft_set_desc_policy, NULL);
3175 if (da[NFTA_SET_DESC_SIZE] != NULL)
3176 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3181 static int nf_tables_newset(struct net *net, struct sock *nlsk,
3182 struct sk_buff *skb, const struct nlmsghdr *nlh,
3183 const struct nlattr * const nla[],
3184 struct netlink_ext_ack *extack)
3186 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3187 u8 genmask = nft_genmask_next(net);
3188 int family = nfmsg->nfgen_family;
3189 const struct nft_set_ops *ops;
3190 struct nft_table *table;
3191 struct nft_set *set;
3197 u32 ktype, dtype, flags, policy, gc_int, objtype;
3198 struct nft_set_desc desc;
3199 unsigned char *udata;
3203 if (nla[NFTA_SET_TABLE] == NULL ||
3204 nla[NFTA_SET_NAME] == NULL ||
3205 nla[NFTA_SET_KEY_LEN] == NULL ||
3206 nla[NFTA_SET_ID] == NULL)
3209 memset(&desc, 0, sizeof(desc));
3211 ktype = NFT_DATA_VALUE;
3212 if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3213 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3214 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3218 desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
3219 if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
3223 if (nla[NFTA_SET_FLAGS] != NULL) {
3224 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3225 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
3226 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
3227 NFT_SET_MAP | NFT_SET_EVAL |
3230 /* Only one of these operations is supported */
3231 if ((flags & (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3232 (NFT_SET_MAP | NFT_SET_EVAL | NFT_SET_OBJECT))
3237 if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3238 if (!(flags & NFT_SET_MAP))
3241 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3242 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3243 dtype != NFT_DATA_VERDICT)
3246 if (dtype != NFT_DATA_VERDICT) {
3247 if (nla[NFTA_SET_DATA_LEN] == NULL)
3249 desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
3250 if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
3253 desc.dlen = sizeof(struct nft_verdict);
3254 } else if (flags & NFT_SET_MAP)
3257 if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3258 if (!(flags & NFT_SET_OBJECT))
3261 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3262 if (objtype == NFT_OBJECT_UNSPEC ||
3263 objtype > NFT_OBJECT_MAX)
3265 } else if (flags & NFT_SET_OBJECT)
3268 objtype = NFT_OBJECT_UNSPEC;
3271 if (nla[NFTA_SET_TIMEOUT] != NULL) {
3272 if (!(flags & NFT_SET_TIMEOUT))
3275 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3280 if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3281 if (!(flags & NFT_SET_TIMEOUT))
3283 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3286 policy = NFT_SET_POL_PERFORMANCE;
3287 if (nla[NFTA_SET_POLICY] != NULL)
3288 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3290 if (nla[NFTA_SET_DESC] != NULL) {
3291 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
3296 create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
3298 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
3299 if (IS_ERR(table)) {
3300 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
3301 return PTR_ERR(table);
3304 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3306 set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
3308 if (PTR_ERR(set) != -ENOENT) {
3309 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
3310 return PTR_ERR(set);
3313 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3314 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
3317 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3323 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3326 ops = nft_select_set_ops(&ctx, nla, &desc, policy);
3328 return PTR_ERR(ops);
3331 if (nla[NFTA_SET_USERDATA])
3332 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3335 if (ops->privsize != NULL)
3336 size = ops->privsize(nla, &desc);
3338 set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3344 name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3350 err = nf_tables_set_alloc_name(&ctx, set, name);
3357 udata = set->data + size;
3358 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3361 INIT_LIST_HEAD(&set->bindings);
3363 write_pnet(&set->net, net);
3366 set->klen = desc.klen;
3368 set->objtype = objtype;
3369 set->dlen = desc.dlen;
3371 set->size = desc.size;
3372 set->policy = policy;
3375 set->timeout = timeout;
3376 set->gc_int = gc_int;
3377 set->handle = nf_tables_alloc_handle(table);
3379 err = ops->init(set, &desc, nla);
3383 err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
3387 list_add_tail_rcu(&set->list, &table->sets);
3398 module_put(to_set_type(ops)->owner);
3402 static void nft_set_destroy(struct nft_set *set)
3404 set->ops->destroy(set);
3405 module_put(to_set_type(set->ops)->owner);
3410 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
3412 list_del_rcu(&set->list);
3413 nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
3414 nft_set_destroy(set);
3417 static int nf_tables_delset(struct net *net, struct sock *nlsk,
3418 struct sk_buff *skb, const struct nlmsghdr *nlh,
3419 const struct nlattr * const nla[],
3420 struct netlink_ext_ack *extack)
3422 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3423 u8 genmask = nft_genmask_next(net);
3424 const struct nlattr *attr;
3425 struct nft_set *set;
3429 if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3430 return -EAFNOSUPPORT;
3431 if (nla[NFTA_SET_TABLE] == NULL)
3434 err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3439 if (nla[NFTA_SET_HANDLE]) {
3440 attr = nla[NFTA_SET_HANDLE];
3441 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3443 attr = nla[NFTA_SET_NAME];
3444 set = nft_set_lookup(ctx.table, attr, genmask);
3448 NL_SET_BAD_ATTR(extack, attr);
3449 return PTR_ERR(set);
3451 if (!list_empty(&set->bindings) ||
3452 (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3453 NL_SET_BAD_ATTR(extack, attr);
3457 return nft_delset(&ctx, set);
3460 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
3461 struct nft_set *set,
3462 const struct nft_set_iter *iter,
3463 struct nft_set_elem *elem)
3465 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3466 enum nft_registers dreg;
3468 dreg = nft_type_to_reg(set->dtype);
3469 return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3470 set->dtype == NFT_DATA_VERDICT ?
3471 NFT_DATA_VERDICT : NFT_DATA_VALUE,
3475 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3476 struct nft_set_binding *binding)
3478 struct nft_set_binding *i;
3479 struct nft_set_iter iter;
3481 if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
3484 if (binding->flags & NFT_SET_MAP) {
3485 /* If the set is already bound to the same chain all
3486 * jumps are already validated for that chain.
3488 list_for_each_entry(i, &set->bindings, list) {
3489 if (i->flags & NFT_SET_MAP &&
3490 i->chain == binding->chain)
3494 iter.genmask = nft_genmask_next(ctx->net);
3498 iter.fn = nf_tables_bind_check_setelem;
3500 set->ops->walk(ctx, set, &iter);
3505 binding->chain = ctx->chain;
3506 list_add_tail_rcu(&binding->list, &set->bindings);
3509 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
3511 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3512 struct nft_set_binding *binding)
3514 list_del_rcu(&binding->list);
3516 if (list_empty(&set->bindings) && nft_set_is_anonymous(set) &&
3517 nft_is_active(ctx->net, set))
3518 nf_tables_set_destroy(ctx, set);
3520 EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
3522 const struct nft_set_ext_type nft_set_ext_types[] = {
3523 [NFT_SET_EXT_KEY] = {
3524 .align = __alignof__(u32),
3526 [NFT_SET_EXT_DATA] = {
3527 .align = __alignof__(u32),
3529 [NFT_SET_EXT_EXPR] = {
3530 .align = __alignof__(struct nft_expr),
3532 [NFT_SET_EXT_OBJREF] = {
3533 .len = sizeof(struct nft_object *),
3534 .align = __alignof__(struct nft_object *),
3536 [NFT_SET_EXT_FLAGS] = {
3538 .align = __alignof__(u8),
3540 [NFT_SET_EXT_TIMEOUT] = {
3542 .align = __alignof__(u64),
3544 [NFT_SET_EXT_EXPIRATION] = {
3546 .align = __alignof__(u64),
3548 [NFT_SET_EXT_USERDATA] = {
3549 .len = sizeof(struct nft_userdata),
3550 .align = __alignof__(struct nft_userdata),
3553 EXPORT_SYMBOL_GPL(nft_set_ext_types);
3559 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3560 [NFTA_SET_ELEM_KEY] = { .type = NLA_NESTED },
3561 [NFTA_SET_ELEM_DATA] = { .type = NLA_NESTED },
3562 [NFTA_SET_ELEM_FLAGS] = { .type = NLA_U32 },
3563 [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 },
3564 [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
3565 .len = NFT_USERDATA_MAXLEN },
3566 [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
3567 [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
3570 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
3571 [NFTA_SET_ELEM_LIST_TABLE] = { .type = NLA_STRING,
3572 .len = NFT_TABLE_MAXNAMELEN - 1 },
3573 [NFTA_SET_ELEM_LIST_SET] = { .type = NLA_STRING,
3574 .len = NFT_SET_MAXNAMELEN - 1 },
3575 [NFTA_SET_ELEM_LIST_ELEMENTS] = { .type = NLA_NESTED },
3576 [NFTA_SET_ELEM_LIST_SET_ID] = { .type = NLA_U32 },
3579 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
3580 const struct sk_buff *skb,
3581 const struct nlmsghdr *nlh,
3582 const struct nlattr * const nla[],
3583 struct netlink_ext_ack *extack,
3586 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3587 int family = nfmsg->nfgen_family;
3588 struct nft_table *table;
3590 table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3592 if (IS_ERR(table)) {
3593 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
3594 return PTR_ERR(table);
3597 nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
3601 static int nf_tables_fill_setelem(struct sk_buff *skb,
3602 const struct nft_set *set,
3603 const struct nft_set_elem *elem)
3605 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3606 unsigned char *b = skb_tail_pointer(skb);
3607 struct nlattr *nest;
3609 nest = nla_nest_start(skb, NFTA_LIST_ELEM);
3611 goto nla_put_failure;
3613 if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
3614 NFT_DATA_VALUE, set->klen) < 0)
3615 goto nla_put_failure;
3617 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
3618 nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
3619 set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
3621 goto nla_put_failure;
3623 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
3624 nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
3625 goto nla_put_failure;
3627 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
3628 nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
3629 (*nft_set_ext_obj(ext))->name) < 0)
3630 goto nla_put_failure;
3632 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
3633 nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
3634 htonl(*nft_set_ext_flags(ext))))
3635 goto nla_put_failure;
3637 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
3638 nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
3639 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
3641 goto nla_put_failure;
3643 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
3644 u64 expires, now = get_jiffies_64();
3646 expires = *nft_set_ext_expiration(ext);
3647 if (time_before64(now, expires))
3652 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
3653 nf_jiffies64_to_msecs(expires),
3655 goto nla_put_failure;
3658 if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
3659 struct nft_userdata *udata;
3661 udata = nft_set_ext_userdata(ext);
3662 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
3663 udata->len + 1, udata->data))
3664 goto nla_put_failure;
3667 nla_nest_end(skb, nest);
3675 struct nft_set_dump_args {
3676 const struct netlink_callback *cb;
3677 struct nft_set_iter iter;
3678 struct sk_buff *skb;
3681 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
3682 struct nft_set *set,
3683 const struct nft_set_iter *iter,
3684 struct nft_set_elem *elem)
3686 struct nft_set_dump_args *args;
3688 args = container_of(iter, struct nft_set_dump_args, iter);
3689 return nf_tables_fill_setelem(args->skb, set, elem);
3692 struct nft_set_dump_ctx {
3693 const struct nft_set *set;
3697 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
3699 struct nft_set_dump_ctx *dump_ctx = cb->data;
3700 struct net *net = sock_net(skb->sk);
3701 struct nft_table *table;
3702 struct nft_set *set;
3703 struct nft_set_dump_args args;
3704 bool set_found = false;
3705 struct nfgenmsg *nfmsg;
3706 struct nlmsghdr *nlh;
3707 struct nlattr *nest;
3712 list_for_each_entry_rcu(table, &net->nft.tables, list) {
3713 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
3714 dump_ctx->ctx.family != table->family)
3717 if (table != dump_ctx->ctx.table)
3720 list_for_each_entry_rcu(set, &table->sets, list) {
3721 if (set == dump_ctx->set) {
3734 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
3735 portid = NETLINK_CB(cb->skb).portid;
3736 seq = cb->nlh->nlmsg_seq;
3738 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3741 goto nla_put_failure;
3743 nfmsg = nlmsg_data(nlh);
3744 nfmsg->nfgen_family = table->family;
3745 nfmsg->version = NFNETLINK_V0;
3746 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
3748 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
3749 goto nla_put_failure;
3750 if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
3751 goto nla_put_failure;
3753 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3755 goto nla_put_failure;
3759 args.iter.genmask = nft_genmask_cur(net);
3760 args.iter.skip = cb->args[0];
3761 args.iter.count = 0;
3763 args.iter.fn = nf_tables_dump_setelem;
3764 set->ops->walk(&dump_ctx->ctx, set, &args.iter);
3767 nla_nest_end(skb, nest);
3768 nlmsg_end(skb, nlh);
3770 if (args.iter.err && args.iter.err != -EMSGSIZE)
3771 return args.iter.err;
3772 if (args.iter.count == cb->args[0])
3775 cb->args[0] = args.iter.count;
3783 static int nf_tables_dump_set_done(struct netlink_callback *cb)
3789 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3790 const struct nft_ctx *ctx, u32 seq,
3791 u32 portid, int event, u16 flags,
3792 const struct nft_set *set,
3793 const struct nft_set_elem *elem)
3795 struct nfgenmsg *nfmsg;
3796 struct nlmsghdr *nlh;
3797 struct nlattr *nest;
3800 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3801 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3804 goto nla_put_failure;
3806 nfmsg = nlmsg_data(nlh);
3807 nfmsg->nfgen_family = ctx->family;
3808 nfmsg->version = NFNETLINK_V0;
3809 nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
3811 if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3812 goto nla_put_failure;
3813 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3814 goto nla_put_failure;
3816 nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3818 goto nla_put_failure;
3820 err = nf_tables_fill_setelem(skb, set, elem);
3822 goto nla_put_failure;
3824 nla_nest_end(skb, nest);
3826 nlmsg_end(skb, nlh);
3830 nlmsg_trim(skb, nlh);
3834 static int nft_setelem_parse_flags(const struct nft_set *set,
3835 const struct nlattr *attr, u32 *flags)
3840 *flags = ntohl(nla_get_be32(attr));
3841 if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
3843 if (!(set->flags & NFT_SET_INTERVAL) &&
3844 *flags & NFT_SET_ELEM_INTERVAL_END)
3850 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3851 const struct nlattr *attr)
3853 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3854 const struct nft_set_ext *ext;
3855 struct nft_data_desc desc;
3856 struct nft_set_elem elem;
3857 struct sk_buff *skb;
3862 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3863 nft_set_elem_policy, NULL);
3867 if (!nla[NFTA_SET_ELEM_KEY])
3870 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
3874 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
3875 nla[NFTA_SET_ELEM_KEY]);
3880 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3883 priv = set->ops->get(ctx->net, set, &elem, flags);
3885 return PTR_ERR(priv);
3888 ext = nft_set_elem_ext(set, &elem);
3891 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3895 err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
3896 NFT_MSG_NEWSETELEM, 0, set, &elem);
3900 err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
3901 /* This avoids a loop in nfnetlink. */
3909 /* this avoids a loop in nfnetlink. */
3910 return err == -EAGAIN ? -ENOBUFS : err;
3913 /* called with rcu_read_lock held */
3914 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
3915 struct sk_buff *skb, const struct nlmsghdr *nlh,
3916 const struct nlattr * const nla[],
3917 struct netlink_ext_ack *extack)
3919 u8 genmask = nft_genmask_cur(net);
3920 struct nft_set *set;
3921 struct nlattr *attr;
3925 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
3930 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
3932 return PTR_ERR(set);
3934 if (nlh->nlmsg_flags & NLM_F_DUMP) {
3935 struct netlink_dump_control c = {
3936 .dump = nf_tables_dump_set,
3937 .done = nf_tables_dump_set_done,
3938 .module = THIS_MODULE,
3940 struct nft_set_dump_ctx *dump_ctx;
3942 dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_ATOMIC);
3946 dump_ctx->set = set;
3947 dump_ctx->ctx = ctx;
3950 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3953 if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
3956 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3957 err = nft_get_set_elem(&ctx, set, attr);
3965 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
3966 const struct nft_set *set,
3967 const struct nft_set_elem *elem,
3968 int event, u16 flags)
3970 struct net *net = ctx->net;
3971 u32 portid = ctx->portid;
3972 struct sk_buff *skb;
3975 if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
3978 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3982 err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3989 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3993 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3996 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3998 struct nft_set *set)
4000 struct nft_trans *trans;
4002 trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4006 nft_trans_elem_set(trans) = set;
4010 void *nft_set_elem_init(const struct nft_set *set,
4011 const struct nft_set_ext_tmpl *tmpl,
4012 const u32 *key, const u32 *data,
4013 u64 timeout, gfp_t gfp)
4015 struct nft_set_ext *ext;
4018 elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4022 ext = nft_set_elem_ext(set, elem);
4023 nft_set_ext_init(ext, tmpl);
4025 memcpy(nft_set_ext_key(ext), key, set->klen);
4026 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4027 memcpy(nft_set_ext_data(ext), data, set->dlen);
4028 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
4029 *nft_set_ext_expiration(ext) =
4030 get_jiffies_64() + timeout;
4031 if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4032 *nft_set_ext_timeout(ext) = timeout;
4037 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4040 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4041 struct nft_ctx ctx = {
4042 .net = read_pnet(&set->net),
4043 .family = set->table->family,
4046 nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
4047 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4048 nft_data_release(nft_set_ext_data(ext), set->dtype);
4049 if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4050 struct nft_expr *expr = nft_set_ext_expr(ext);
4052 if (expr->ops->destroy_clone) {
4053 expr->ops->destroy_clone(&ctx, expr);
4054 module_put(expr->ops->type->owner);
4056 nf_tables_expr_destroy(&ctx, expr);
4059 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4060 (*nft_set_ext_obj(ext))->use--;
4063 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4065 /* Only called from commit path, nft_set_elem_deactivate() already deals with
4066 * the refcounting from the preparation phase.
4068 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4069 const struct nft_set *set, void *elem)
4071 struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4073 if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
4074 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
4078 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4079 const struct nlattr *attr, u32 nlmsg_flags)
4081 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4082 u8 genmask = nft_genmask_next(ctx->net);
4083 struct nft_data_desc d1, d2;
4084 struct nft_set_ext_tmpl tmpl;
4085 struct nft_set_ext *ext, *ext2;
4086 struct nft_set_elem elem;
4087 struct nft_set_binding *binding;
4088 struct nft_object *obj = NULL;
4089 struct nft_userdata *udata;
4090 struct nft_data data;
4091 enum nft_registers dreg;
4092 struct nft_trans *trans;
4098 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4099 nft_set_elem_policy, NULL);
4103 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4106 nft_set_ext_prepare(&tmpl);
4108 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4112 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4114 if (set->flags & NFT_SET_MAP) {
4115 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
4116 !(flags & NFT_SET_ELEM_INTERVAL_END))
4118 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
4119 flags & NFT_SET_ELEM_INTERVAL_END)
4122 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4127 if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4128 if (!(set->flags & NFT_SET_TIMEOUT))
4130 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4134 } else if (set->flags & NFT_SET_TIMEOUT) {
4135 timeout = set->timeout;
4138 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
4139 nla[NFTA_SET_ELEM_KEY]);
4143 if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4146 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
4148 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4149 if (timeout != set->timeout)
4150 nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4153 if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4154 if (!(set->flags & NFT_SET_OBJECT)) {
4158 obj = nft_obj_lookup(ctx->table, nla[NFTA_SET_ELEM_OBJREF],
4159 set->objtype, genmask);
4164 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4167 if (nla[NFTA_SET_ELEM_DATA] != NULL) {
4168 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4169 nla[NFTA_SET_ELEM_DATA]);
4174 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4177 dreg = nft_type_to_reg(set->dtype);
4178 list_for_each_entry(binding, &set->bindings, list) {
4179 struct nft_ctx bind_ctx = {
4181 .family = ctx->family,
4182 .table = ctx->table,
4183 .chain = (struct nft_chain *)binding->chain,
4186 if (!(binding->flags & NFT_SET_MAP))
4189 err = nft_validate_register_store(&bind_ctx, dreg,
4195 if (d2.type == NFT_DATA_VERDICT &&
4196 (data.verdict.code == NFT_GOTO ||
4197 data.verdict.code == NFT_JUMP))
4198 nft_validate_state_update(ctx->net,
4202 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
4205 /* The full maximum length of userdata can exceed the maximum
4206 * offset value (U8_MAX) for following extensions, therefor it
4207 * must be the last extension added.
4210 if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4211 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4213 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4218 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
4219 timeout, GFP_KERNEL);
4220 if (elem.priv == NULL)
4223 ext = nft_set_elem_ext(set, elem.priv);
4225 *nft_set_ext_flags(ext) = flags;
4227 udata = nft_set_ext_userdata(ext);
4228 udata->len = ulen - 1;
4229 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4232 *nft_set_ext_obj(ext) = obj;
4236 trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4240 ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
4241 err = set->ops->insert(ctx->net, set, &elem, &ext2);
4243 if (err == -EEXIST) {
4244 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4245 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4246 nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4247 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4251 if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4252 nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4253 memcmp(nft_set_ext_data(ext),
4254 nft_set_ext_data(ext2), set->dlen) != 0) ||
4255 (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4256 nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4257 *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
4259 else if (!(nlmsg_flags & NLM_F_EXCL))
4266 !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4271 nft_trans_elem(trans) = elem;
4272 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4276 set->ops->remove(ctx->net, set, &elem);
4282 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4283 nft_data_release(&data, d2.type);
4285 nft_data_release(&elem.key.val, d1.type);
4290 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4291 struct sk_buff *skb, const struct nlmsghdr *nlh,
4292 const struct nlattr * const nla[],
4293 struct netlink_ext_ack *extack)
4295 u8 genmask = nft_genmask_next(net);
4296 const struct nlattr *attr;
4297 struct nft_set *set;
4301 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4304 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4309 set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4310 nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4312 return PTR_ERR(set);
4314 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4317 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4318 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
4323 if (net->nft.validate_state == NFT_VALIDATE_DO)
4324 return nft_table_validate(net, ctx.table);
4330 * nft_data_hold - hold a nft_data item
4332 * @data: struct nft_data to release
4333 * @type: type of data
4335 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4336 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4337 * NFT_GOTO verdicts. This function must be called on active data objects
4338 * from the second phase of the commit protocol.
4340 void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4342 if (type == NFT_DATA_VERDICT) {
4343 switch (data->verdict.code) {
4346 data->verdict.chain->use++;
4352 static void nft_set_elem_activate(const struct net *net,
4353 const struct nft_set *set,
4354 struct nft_set_elem *elem)
4356 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4358 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4359 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4360 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4361 (*nft_set_ext_obj(ext))->use++;
4364 static void nft_set_elem_deactivate(const struct net *net,
4365 const struct nft_set *set,
4366 struct nft_set_elem *elem)
4368 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4370 if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4371 nft_data_release(nft_set_ext_data(ext), set->dtype);
4372 if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4373 (*nft_set_ext_obj(ext))->use--;
4376 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
4377 const struct nlattr *attr)
4379 struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4380 struct nft_set_ext_tmpl tmpl;
4381 struct nft_data_desc desc;
4382 struct nft_set_elem elem;
4383 struct nft_set_ext *ext;
4384 struct nft_trans *trans;
4389 err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
4390 nft_set_elem_policy, NULL);
4395 if (nla[NFTA_SET_ELEM_KEY] == NULL)
4398 nft_set_ext_prepare(&tmpl);
4400 err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4404 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4406 err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4407 nla[NFTA_SET_ELEM_KEY]);
4412 if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4415 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4418 elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4420 if (elem.priv == NULL)
4423 ext = nft_set_elem_ext(set, elem.priv);
4425 *nft_set_ext_flags(ext) = flags;
4427 trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
4428 if (trans == NULL) {
4433 priv = set->ops->deactivate(ctx->net, set, &elem);
4441 nft_set_elem_deactivate(ctx->net, set, &elem);
4443 nft_trans_elem(trans) = elem;
4444 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4452 nft_data_release(&elem.key.val, desc.type);
4457 static int nft_flush_set(const struct nft_ctx *ctx,
4458 struct nft_set *set,
4459 const struct nft_set_iter *iter,
4460 struct nft_set_elem *elem)
4462 struct nft_trans *trans;
4465 trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4466 sizeof(struct nft_trans_elem), GFP_ATOMIC);
4470 if (!set->ops->flush(ctx->net, set, elem->priv)) {
4476 nft_trans_elem_set(trans) = set;
4477 nft_trans_elem(trans) = *elem;
4478 list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4486 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4487 struct sk_buff *skb, const struct nlmsghdr *nlh,
4488 const struct nlattr * const nla[],
4489 struct netlink_ext_ack *extack)
4491 u8 genmask = nft_genmask_next(net);
4492 const struct nlattr *attr;
4493 struct nft_set *set;
4497 err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4502 set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
4504 return PTR_ERR(set);
4505 if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4508 if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
4509 struct nft_set_iter iter = {
4511 .fn = nft_flush_set,
4513 set->ops->walk(&ctx, set, &iter);
4518 nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4519 err = nft_del_setelem(&ctx, set, attr);
4528 void nft_set_gc_batch_release(struct rcu_head *rcu)
4530 struct nft_set_gc_batch *gcb;
4533 gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4534 for (i = 0; i < gcb->head.cnt; i++)
4535 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
4538 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4540 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4543 struct nft_set_gc_batch *gcb;
4545 gcb = kzalloc(sizeof(*gcb), gfp);
4548 gcb->head.set = set;
4551 EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4558 * nft_register_obj- register nf_tables stateful object type
4561 * Registers the object type for use with nf_tables. Returns zero on
4562 * success or a negative errno code otherwise.
4564 int nft_register_obj(struct nft_object_type *obj_type)
4566 if (obj_type->type == NFT_OBJECT_UNSPEC)
4569 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4570 list_add_rcu(&obj_type->list, &nf_tables_objects);
4571 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4574 EXPORT_SYMBOL_GPL(nft_register_obj);
4577 * nft_unregister_obj - unregister nf_tables object type
4580 * Unregisters the object type for use with nf_tables.
4582 void nft_unregister_obj(struct nft_object_type *obj_type)
4584 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4585 list_del_rcu(&obj_type->list);
4586 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4588 EXPORT_SYMBOL_GPL(nft_unregister_obj);
4590 struct nft_object *nft_obj_lookup(const struct nft_table *table,
4591 const struct nlattr *nla, u32 objtype,
4594 struct nft_object *obj;
4596 list_for_each_entry_rcu(obj, &table->objects, list) {
4597 if (!nla_strcmp(nla, obj->name) &&
4598 objtype == obj->ops->type->type &&
4599 nft_active_genmask(obj, genmask))
4602 return ERR_PTR(-ENOENT);
4604 EXPORT_SYMBOL_GPL(nft_obj_lookup);
4606 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
4607 const struct nlattr *nla,
4608 u32 objtype, u8 genmask)
4610 struct nft_object *obj;
4612 list_for_each_entry(obj, &table->objects, list) {
4613 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4614 objtype == obj->ops->type->type &&
4615 nft_active_genmask(obj, genmask))
4618 return ERR_PTR(-ENOENT);
4621 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
4622 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
4623 .len = NFT_TABLE_MAXNAMELEN - 1 },
4624 [NFTA_OBJ_NAME] = { .type = NLA_STRING,
4625 .len = NFT_OBJ_MAXNAMELEN - 1 },
4626 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
4627 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4628 [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
4631 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
4632 const struct nft_object_type *type,
4633 const struct nlattr *attr)
4636 const struct nft_object_ops *ops;
4637 struct nft_object *obj;
4640 tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
4645 err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
4650 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
4653 if (type->select_ops) {
4654 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
4664 obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
4668 err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
4681 return ERR_PTR(err);
4684 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
4685 struct nft_object *obj, bool reset)
4687 struct nlattr *nest;
4689 nest = nla_nest_start(skb, attr);
4691 goto nla_put_failure;
4692 if (obj->ops->dump(skb, obj, reset) < 0)
4693 goto nla_put_failure;
4694 nla_nest_end(skb, nest);
4701 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
4703 const struct nft_object_type *type;
4705 list_for_each_entry(type, &nf_tables_objects, list) {
4706 if (objtype == type->type)
4712 static const struct nft_object_type *nft_obj_type_get(u32 objtype)
4714 const struct nft_object_type *type;
4716 type = __nft_obj_type_get(objtype);
4717 if (type != NULL && try_module_get(type->owner))
4720 #ifdef CONFIG_MODULES
4722 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
4723 request_module("nft-obj-%u", objtype);
4724 nfnl_lock(NFNL_SUBSYS_NFTABLES);
4725 if (__nft_obj_type_get(objtype))
4726 return ERR_PTR(-EAGAIN);
4729 return ERR_PTR(-ENOENT);
4732 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
4733 struct sk_buff *skb, const struct nlmsghdr *nlh,
4734 const struct nlattr * const nla[],
4735 struct netlink_ext_ack *extack)
4737 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4738 const struct nft_object_type *type;
4739 u8 genmask = nft_genmask_next(net);
4740 int family = nfmsg->nfgen_family;
4741 struct nft_table *table;
4742 struct nft_object *obj;
4747 if (!nla[NFTA_OBJ_TYPE] ||
4748 !nla[NFTA_OBJ_NAME] ||
4749 !nla[NFTA_OBJ_DATA])
4752 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
4753 if (IS_ERR(table)) {
4754 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
4755 return PTR_ERR(table);
4758 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4759 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4762 if (err != -ENOENT) {
4763 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
4767 if (nlh->nlmsg_flags & NLM_F_EXCL) {
4768 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
4774 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
4776 type = nft_obj_type_get(objtype);
4778 return PTR_ERR(type);
4780 obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
4786 obj->handle = nf_tables_alloc_handle(table);
4788 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
4794 err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
4798 list_add_tail_rcu(&obj->list, &table->objects);
4804 if (obj->ops->destroy)
4805 obj->ops->destroy(&ctx, obj);
4808 module_put(type->owner);
4812 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
4813 u32 portid, u32 seq, int event, u32 flags,
4814 int family, const struct nft_table *table,
4815 struct nft_object *obj, bool reset)
4817 struct nfgenmsg *nfmsg;
4818 struct nlmsghdr *nlh;
4820 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4821 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
4823 goto nla_put_failure;
4825 nfmsg = nlmsg_data(nlh);
4826 nfmsg->nfgen_family = family;
4827 nfmsg->version = NFNETLINK_V0;
4828 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
4830 if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
4831 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
4832 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
4833 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
4834 nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
4835 nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
4837 goto nla_put_failure;
4839 nlmsg_end(skb, nlh);
4843 nlmsg_trim(skb, nlh);
4847 struct nft_obj_filter {
4852 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
4854 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
4855 const struct nft_table *table;
4856 unsigned int idx = 0, s_idx = cb->args[0];
4857 struct nft_obj_filter *filter = cb->data;
4858 struct net *net = sock_net(skb->sk);
4859 int family = nfmsg->nfgen_family;
4860 struct nft_object *obj;
4863 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
4867 cb->seq = net->nft.base_seq;
4869 list_for_each_entry_rcu(table, &net->nft.tables, list) {
4870 if (family != NFPROTO_UNSPEC && family != table->family)
4873 list_for_each_entry_rcu(obj, &table->objects, list) {
4874 if (!nft_is_active(net, obj))
4879 memset(&cb->args[1], 0,
4880 sizeof(cb->args) - sizeof(cb->args[0]));
4881 if (filter && filter->table[0] &&
4882 strcmp(filter->table, table->name))
4885 filter->type != NFT_OBJECT_UNSPEC &&
4886 obj->ops->type->type != filter->type)
4889 if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
4892 NLM_F_MULTI | NLM_F_APPEND,
4893 table->family, table,
4897 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4909 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
4911 struct nft_obj_filter *filter = cb->data;
4914 kfree(filter->table);
4921 static struct nft_obj_filter *
4922 nft_obj_filter_alloc(const struct nlattr * const nla[])
4924 struct nft_obj_filter *filter;
4926 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
4928 return ERR_PTR(-ENOMEM);
4930 if (nla[NFTA_OBJ_TABLE]) {
4931 filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
4932 if (!filter->table) {
4934 return ERR_PTR(-ENOMEM);
4937 if (nla[NFTA_OBJ_TYPE])
4938 filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4943 /* called with rcu_read_lock held */
4944 static int nf_tables_getobj(struct net *net, struct sock *nlsk,
4945 struct sk_buff *skb, const struct nlmsghdr *nlh,
4946 const struct nlattr * const nla[],
4947 struct netlink_ext_ack *extack)
4949 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
4950 u8 genmask = nft_genmask_cur(net);
4951 int family = nfmsg->nfgen_family;
4952 const struct nft_table *table;
4953 struct nft_object *obj;
4954 struct sk_buff *skb2;
4959 if (nlh->nlmsg_flags & NLM_F_DUMP) {
4960 struct netlink_dump_control c = {
4961 .dump = nf_tables_dump_obj,
4962 .done = nf_tables_dump_obj_done,
4963 .module = THIS_MODULE,
4966 if (nla[NFTA_OBJ_TABLE] ||
4967 nla[NFTA_OBJ_TYPE]) {
4968 struct nft_obj_filter *filter;
4970 filter = nft_obj_filter_alloc(nla);
4976 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4979 if (!nla[NFTA_OBJ_NAME] ||
4980 !nla[NFTA_OBJ_TYPE])
4983 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
4984 if (IS_ERR(table)) {
4985 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
4986 return PTR_ERR(table);
4989 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4990 obj = nft_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4992 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
4993 return PTR_ERR(obj);
4996 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
5000 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5003 err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5004 nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
5005 family, table, obj, reset);
5009 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5015 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
5017 if (obj->ops->destroy)
5018 obj->ops->destroy(ctx, obj);
5020 module_put(obj->ops->type->owner);
5025 static int nf_tables_delobj(struct net *net, struct sock *nlsk,
5026 struct sk_buff *skb, const struct nlmsghdr *nlh,
5027 const struct nlattr * const nla[],
5028 struct netlink_ext_ack *extack)
5030 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5031 u8 genmask = nft_genmask_next(net);
5032 int family = nfmsg->nfgen_family;
5033 const struct nlattr *attr;
5034 struct nft_table *table;
5035 struct nft_object *obj;
5039 if (!nla[NFTA_OBJ_TYPE] ||
5040 (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
5043 table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
5044 if (IS_ERR(table)) {
5045 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
5046 return PTR_ERR(table);
5049 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5050 if (nla[NFTA_OBJ_HANDLE]) {
5051 attr = nla[NFTA_OBJ_HANDLE];
5052 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5054 attr = nla[NFTA_OBJ_NAME];
5055 obj = nft_obj_lookup(table, attr, objtype, genmask);
5059 NL_SET_BAD_ATTR(extack, attr);
5060 return PTR_ERR(obj);
5063 NL_SET_BAD_ATTR(extack, attr);
5067 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5069 return nft_delobj(&ctx, obj);
5072 void nft_obj_notify(struct net *net, struct nft_table *table,
5073 struct nft_object *obj, u32 portid, u32 seq, int event,
5074 int family, int report, gfp_t gfp)
5076 struct sk_buff *skb;
5080 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5083 skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
5087 err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5094 nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5097 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
5099 EXPORT_SYMBOL_GPL(nft_obj_notify);
5101 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5102 struct nft_object *obj, int event)
5104 nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
5105 ctx->family, ctx->report, GFP_KERNEL);
5111 void nft_register_flowtable_type(struct nf_flowtable_type *type)
5113 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5114 list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5115 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5117 EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5119 void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5121 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5122 list_del_rcu(&type->list);
5123 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5125 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5127 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5128 [NFTA_FLOWTABLE_TABLE] = { .type = NLA_STRING,
5129 .len = NFT_NAME_MAXLEN - 1 },
5130 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
5131 .len = NFT_NAME_MAXLEN - 1 },
5132 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
5133 [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
5136 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5137 const struct nlattr *nla, u8 genmask)
5139 struct nft_flowtable *flowtable;
5141 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5142 if (!nla_strcmp(nla, flowtable->name) &&
5143 nft_active_genmask(flowtable, genmask))
5146 return ERR_PTR(-ENOENT);
5148 EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
5150 static struct nft_flowtable *
5151 nft_flowtable_lookup_byhandle(const struct nft_table *table,
5152 const struct nlattr *nla, u8 genmask)
5154 struct nft_flowtable *flowtable;
5156 list_for_each_entry(flowtable, &table->flowtables, list) {
5157 if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5158 nft_active_genmask(flowtable, genmask))
5161 return ERR_PTR(-ENOENT);
5164 static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5165 const struct nlattr *attr,
5166 struct net_device *dev_array[], int *len)
5168 const struct nlattr *tmp;
5169 struct net_device *dev;
5170 char ifname[IFNAMSIZ];
5171 int rem, n = 0, err;
5173 nla_for_each_nested(tmp, attr, rem) {
5174 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5179 nla_strlcpy(ifname, tmp, IFNAMSIZ);
5180 dev = __dev_get_by_name(ctx->net, ifname);
5186 dev_array[n++] = dev;
5187 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5201 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5202 [NFTA_FLOWTABLE_HOOK_NUM] = { .type = NLA_U32 },
5203 [NFTA_FLOWTABLE_HOOK_PRIORITY] = { .type = NLA_U32 },
5204 [NFTA_FLOWTABLE_HOOK_DEVS] = { .type = NLA_NESTED },
5207 static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5208 const struct nlattr *attr,
5209 struct nft_flowtable *flowtable)
5211 struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5212 struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5213 struct nf_hook_ops *ops;
5214 int hooknum, priority;
5217 err = nla_parse_nested(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5218 nft_flowtable_hook_policy, NULL);
5222 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5223 !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5224 !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5227 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
5228 if (hooknum != NF_NETDEV_INGRESS)
5231 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5233 err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5238 ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
5242 flowtable->hooknum = hooknum;
5243 flowtable->priority = priority;
5244 flowtable->ops = ops;
5245 flowtable->ops_len = n;
5247 for (i = 0; i < n; i++) {
5248 flowtable->ops[i].pf = NFPROTO_NETDEV;
5249 flowtable->ops[i].hooknum = hooknum;
5250 flowtable->ops[i].priority = priority;
5251 flowtable->ops[i].priv = &flowtable->data;
5252 flowtable->ops[i].hook = flowtable->data.type->hook;
5253 flowtable->ops[i].dev = dev_array[i];
5254 flowtable->dev_name[i] = kstrdup(dev_array[i]->name,
5261 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
5263 const struct nf_flowtable_type *type;
5265 list_for_each_entry(type, &nf_tables_flowtables, list) {
5266 if (family == type->family)
5272 static const struct nf_flowtable_type *nft_flowtable_type_get(u8 family)
5274 const struct nf_flowtable_type *type;
5276 type = __nft_flowtable_type_get(family);
5277 if (type != NULL && try_module_get(type->owner))
5280 #ifdef CONFIG_MODULES
5282 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5283 request_module("nf-flowtable-%u", family);
5284 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5285 if (__nft_flowtable_type_get(family))
5286 return ERR_PTR(-EAGAIN);
5289 return ERR_PTR(-ENOENT);
5292 static void nft_unregister_flowtable_net_hooks(struct net *net,
5293 struct nft_flowtable *flowtable)
5297 for (i = 0; i < flowtable->ops_len; i++) {
5298 if (!flowtable->ops[i].dev)
5301 nf_unregister_net_hook(net, &flowtable->ops[i]);
5305 static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5306 struct sk_buff *skb,
5307 const struct nlmsghdr *nlh,
5308 const struct nlattr * const nla[],
5309 struct netlink_ext_ack *extack)
5311 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5312 const struct nf_flowtable_type *type;
5313 struct nft_flowtable *flowtable, *ft;
5314 u8 genmask = nft_genmask_next(net);
5315 int family = nfmsg->nfgen_family;
5316 struct nft_table *table;
5320 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5321 !nla[NFTA_FLOWTABLE_NAME] ||
5322 !nla[NFTA_FLOWTABLE_HOOK])
5325 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5327 if (IS_ERR(table)) {
5328 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
5329 return PTR_ERR(table);
5332 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5334 if (IS_ERR(flowtable)) {
5335 err = PTR_ERR(flowtable);
5336 if (err != -ENOENT) {
5337 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
5341 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5342 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
5349 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5351 flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5355 flowtable->table = table;
5356 flowtable->handle = nf_tables_alloc_handle(table);
5358 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5359 if (!flowtable->name) {
5364 type = nft_flowtable_type_get(family);
5366 err = PTR_ERR(type);
5370 flowtable->data.type = type;
5371 err = type->init(&flowtable->data);
5375 err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5380 for (i = 0; i < flowtable->ops_len; i++) {
5381 if (!flowtable->ops[i].dev)
5384 list_for_each_entry(ft, &table->flowtables, list) {
5385 for (k = 0; k < ft->ops_len; k++) {
5386 if (!ft->ops[k].dev)
5389 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5390 flowtable->ops[i].pf == ft->ops[k].pf) {
5397 err = nf_register_net_hook(net, &flowtable->ops[i]);
5402 err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5406 list_add_tail_rcu(&flowtable->list, &table->flowtables);
5411 i = flowtable->ops_len;
5413 for (k = i - 1; k >= 0; k--) {
5414 kfree(flowtable->dev_name[k]);
5415 nf_unregister_net_hook(net, &flowtable->ops[k]);
5418 kfree(flowtable->ops);
5420 flowtable->data.type->free(&flowtable->data);
5422 module_put(type->owner);
5424 kfree(flowtable->name);
5430 static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5431 struct sk_buff *skb,
5432 const struct nlmsghdr *nlh,
5433 const struct nlattr * const nla[],
5434 struct netlink_ext_ack *extack)
5436 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5437 u8 genmask = nft_genmask_next(net);
5438 int family = nfmsg->nfgen_family;
5439 struct nft_flowtable *flowtable;
5440 const struct nlattr *attr;
5441 struct nft_table *table;
5444 if (!nla[NFTA_FLOWTABLE_TABLE] ||
5445 (!nla[NFTA_FLOWTABLE_NAME] &&
5446 !nla[NFTA_FLOWTABLE_HANDLE]))
5449 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5451 if (IS_ERR(table)) {
5452 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
5453 return PTR_ERR(table);
5456 if (nla[NFTA_FLOWTABLE_HANDLE]) {
5457 attr = nla[NFTA_FLOWTABLE_HANDLE];
5458 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5460 attr = nla[NFTA_FLOWTABLE_NAME];
5461 flowtable = nft_flowtable_lookup(table, attr, genmask);
5464 if (IS_ERR(flowtable)) {
5465 NL_SET_BAD_ATTR(extack, attr);
5466 return PTR_ERR(flowtable);
5468 if (flowtable->use > 0) {
5469 NL_SET_BAD_ATTR(extack, attr);
5473 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5475 return nft_delflowtable(&ctx, flowtable);
5478 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5479 u32 portid, u32 seq, int event,
5480 u32 flags, int family,
5481 struct nft_flowtable *flowtable)
5483 struct nlattr *nest, *nest_devs;
5484 struct nfgenmsg *nfmsg;
5485 struct nlmsghdr *nlh;
5488 event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5489 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5491 goto nla_put_failure;
5493 nfmsg = nlmsg_data(nlh);
5494 nfmsg->nfgen_family = family;
5495 nfmsg->version = NFNETLINK_V0;
5496 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5498 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
5499 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
5500 nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5501 nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5502 NFTA_FLOWTABLE_PAD))
5503 goto nla_put_failure;
5505 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
5506 if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
5507 nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
5508 goto nla_put_failure;
5510 nest_devs = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK_DEVS);
5512 goto nla_put_failure;
5514 for (i = 0; i < flowtable->ops_len; i++) {
5515 if (flowtable->dev_name[i][0] &&
5516 nla_put_string(skb, NFTA_DEVICE_NAME,
5517 flowtable->dev_name[i]))
5518 goto nla_put_failure;
5520 nla_nest_end(skb, nest_devs);
5521 nla_nest_end(skb, nest);
5523 nlmsg_end(skb, nlh);
5527 nlmsg_trim(skb, nlh);
5531 struct nft_flowtable_filter {
5535 static int nf_tables_dump_flowtable(struct sk_buff *skb,
5536 struct netlink_callback *cb)
5538 const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5539 struct nft_flowtable_filter *filter = cb->data;
5540 unsigned int idx = 0, s_idx = cb->args[0];
5541 struct net *net = sock_net(skb->sk);
5542 int family = nfmsg->nfgen_family;
5543 struct nft_flowtable *flowtable;
5544 const struct nft_table *table;
5547 cb->seq = net->nft.base_seq;
5549 list_for_each_entry_rcu(table, &net->nft.tables, list) {
5550 if (family != NFPROTO_UNSPEC && family != table->family)
5553 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5554 if (!nft_is_active(net, flowtable))
5559 memset(&cb->args[1], 0,
5560 sizeof(cb->args) - sizeof(cb->args[0]));
5561 if (filter && filter->table[0] &&
5562 strcmp(filter->table, table->name))
5565 if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
5567 NFT_MSG_NEWFLOWTABLE,
5568 NLM_F_MULTI | NLM_F_APPEND,
5569 table->family, flowtable) < 0)
5572 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
5584 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
5586 struct nft_flowtable_filter *filter = cb->data;
5591 kfree(filter->table);
5597 static struct nft_flowtable_filter *
5598 nft_flowtable_filter_alloc(const struct nlattr * const nla[])
5600 struct nft_flowtable_filter *filter;
5602 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5604 return ERR_PTR(-ENOMEM);
5606 if (nla[NFTA_FLOWTABLE_TABLE]) {
5607 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
5609 if (!filter->table) {
5611 return ERR_PTR(-ENOMEM);
5617 /* called with rcu_read_lock held */
5618 static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
5619 struct sk_buff *skb,
5620 const struct nlmsghdr *nlh,
5621 const struct nlattr * const nla[],
5622 struct netlink_ext_ack *extack)
5624 const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5625 u8 genmask = nft_genmask_cur(net);
5626 int family = nfmsg->nfgen_family;
5627 struct nft_flowtable *flowtable;
5628 const struct nft_table *table;
5629 struct sk_buff *skb2;
5632 if (nlh->nlmsg_flags & NLM_F_DUMP) {
5633 struct netlink_dump_control c = {
5634 .dump = nf_tables_dump_flowtable,
5635 .done = nf_tables_dump_flowtable_done,
5636 .module = THIS_MODULE,
5639 if (nla[NFTA_FLOWTABLE_TABLE]) {
5640 struct nft_flowtable_filter *filter;
5642 filter = nft_flowtable_filter_alloc(nla);
5648 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
5651 if (!nla[NFTA_FLOWTABLE_NAME])
5654 table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5657 return PTR_ERR(table);
5659 flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5661 if (IS_ERR(flowtable))
5662 return PTR_ERR(flowtable);
5664 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
5668 err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
5670 NFT_MSG_NEWFLOWTABLE, 0, family,
5675 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5681 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
5682 struct nft_flowtable *flowtable,
5685 struct sk_buff *skb;
5689 !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
5692 skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5696 err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
5698 ctx->family, flowtable);
5704 nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
5705 ctx->report, GFP_KERNEL);
5708 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
5711 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
5713 kfree(flowtable->ops);
5714 kfree(flowtable->name);
5715 flowtable->data.type->free(&flowtable->data);
5716 module_put(flowtable->data.type->owner);
5719 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
5720 u32 portid, u32 seq)
5722 struct nlmsghdr *nlh;
5723 struct nfgenmsg *nfmsg;
5724 char buf[TASK_COMM_LEN];
5725 int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
5727 nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
5729 goto nla_put_failure;
5731 nfmsg = nlmsg_data(nlh);
5732 nfmsg->nfgen_family = AF_UNSPEC;
5733 nfmsg->version = NFNETLINK_V0;
5734 nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
5736 if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
5737 nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
5738 nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
5739 goto nla_put_failure;
5741 nlmsg_end(skb, nlh);
5745 nlmsg_trim(skb, nlh);
5749 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
5750 struct nft_flowtable *flowtable)
5754 for (i = 0; i < flowtable->ops_len; i++) {
5755 if (flowtable->ops[i].dev != dev)
5758 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
5759 flowtable->dev_name[i][0] = '\0';
5760 flowtable->ops[i].dev = NULL;
5765 static int nf_tables_flowtable_event(struct notifier_block *this,
5766 unsigned long event, void *ptr)
5768 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
5769 struct nft_flowtable *flowtable;
5770 struct nft_table *table;
5772 if (event != NETDEV_UNREGISTER)
5775 nfnl_lock(NFNL_SUBSYS_NFTABLES);
5776 list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
5777 list_for_each_entry(flowtable, &table->flowtables, list) {
5778 nft_flowtable_event(event, dev, flowtable);
5781 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5786 static struct notifier_block nf_tables_flowtable_notifier = {
5787 .notifier_call = nf_tables_flowtable_event,
5790 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
5793 struct nlmsghdr *nlh = nlmsg_hdr(skb);
5794 struct sk_buff *skb2;
5797 if (nlmsg_report(nlh) &&
5798 !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5801 skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5805 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5812 nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5813 nlmsg_report(nlh), GFP_KERNEL);
5816 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
5820 static int nf_tables_getgen(struct net *net, struct sock *nlsk,
5821 struct sk_buff *skb, const struct nlmsghdr *nlh,
5822 const struct nlattr * const nla[],
5823 struct netlink_ext_ack *extack)
5825 struct sk_buff *skb2;
5828 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
5832 err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
5837 return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5843 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
5844 [NFT_MSG_NEWTABLE] = {
5845 .call_batch = nf_tables_newtable,
5846 .attr_count = NFTA_TABLE_MAX,
5847 .policy = nft_table_policy,
5849 [NFT_MSG_GETTABLE] = {
5850 .call_rcu = nf_tables_gettable,
5851 .attr_count = NFTA_TABLE_MAX,
5852 .policy = nft_table_policy,
5854 [NFT_MSG_DELTABLE] = {
5855 .call_batch = nf_tables_deltable,
5856 .attr_count = NFTA_TABLE_MAX,
5857 .policy = nft_table_policy,
5859 [NFT_MSG_NEWCHAIN] = {
5860 .call_batch = nf_tables_newchain,
5861 .attr_count = NFTA_CHAIN_MAX,
5862 .policy = nft_chain_policy,
5864 [NFT_MSG_GETCHAIN] = {
5865 .call_rcu = nf_tables_getchain,
5866 .attr_count = NFTA_CHAIN_MAX,
5867 .policy = nft_chain_policy,
5869 [NFT_MSG_DELCHAIN] = {
5870 .call_batch = nf_tables_delchain,
5871 .attr_count = NFTA_CHAIN_MAX,
5872 .policy = nft_chain_policy,
5874 [NFT_MSG_NEWRULE] = {
5875 .call_batch = nf_tables_newrule,
5876 .attr_count = NFTA_RULE_MAX,
5877 .policy = nft_rule_policy,
5879 [NFT_MSG_GETRULE] = {
5880 .call_rcu = nf_tables_getrule,
5881 .attr_count = NFTA_RULE_MAX,
5882 .policy = nft_rule_policy,
5884 [NFT_MSG_DELRULE] = {
5885 .call_batch = nf_tables_delrule,
5886 .attr_count = NFTA_RULE_MAX,
5887 .policy = nft_rule_policy,
5889 [NFT_MSG_NEWSET] = {
5890 .call_batch = nf_tables_newset,
5891 .attr_count = NFTA_SET_MAX,
5892 .policy = nft_set_policy,
5894 [NFT_MSG_GETSET] = {
5895 .call_rcu = nf_tables_getset,
5896 .attr_count = NFTA_SET_MAX,
5897 .policy = nft_set_policy,
5899 [NFT_MSG_DELSET] = {
5900 .call_batch = nf_tables_delset,
5901 .attr_count = NFTA_SET_MAX,
5902 .policy = nft_set_policy,
5904 [NFT_MSG_NEWSETELEM] = {
5905 .call_batch = nf_tables_newsetelem,
5906 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5907 .policy = nft_set_elem_list_policy,
5909 [NFT_MSG_GETSETELEM] = {
5910 .call_rcu = nf_tables_getsetelem,
5911 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5912 .policy = nft_set_elem_list_policy,
5914 [NFT_MSG_DELSETELEM] = {
5915 .call_batch = nf_tables_delsetelem,
5916 .attr_count = NFTA_SET_ELEM_LIST_MAX,
5917 .policy = nft_set_elem_list_policy,
5919 [NFT_MSG_GETGEN] = {
5920 .call_rcu = nf_tables_getgen,
5922 [NFT_MSG_NEWOBJ] = {
5923 .call_batch = nf_tables_newobj,
5924 .attr_count = NFTA_OBJ_MAX,
5925 .policy = nft_obj_policy,
5927 [NFT_MSG_GETOBJ] = {
5928 .call_rcu = nf_tables_getobj,
5929 .attr_count = NFTA_OBJ_MAX,
5930 .policy = nft_obj_policy,
5932 [NFT_MSG_DELOBJ] = {
5933 .call_batch = nf_tables_delobj,
5934 .attr_count = NFTA_OBJ_MAX,
5935 .policy = nft_obj_policy,
5937 [NFT_MSG_GETOBJ_RESET] = {
5938 .call_rcu = nf_tables_getobj,
5939 .attr_count = NFTA_OBJ_MAX,
5940 .policy = nft_obj_policy,
5942 [NFT_MSG_NEWFLOWTABLE] = {
5943 .call_batch = nf_tables_newflowtable,
5944 .attr_count = NFTA_FLOWTABLE_MAX,
5945 .policy = nft_flowtable_policy,
5947 [NFT_MSG_GETFLOWTABLE] = {
5948 .call_rcu = nf_tables_getflowtable,
5949 .attr_count = NFTA_FLOWTABLE_MAX,
5950 .policy = nft_flowtable_policy,
5952 [NFT_MSG_DELFLOWTABLE] = {
5953 .call_batch = nf_tables_delflowtable,
5954 .attr_count = NFTA_FLOWTABLE_MAX,
5955 .policy = nft_flowtable_policy,
5959 static int nf_tables_validate(struct net *net)
5961 struct nft_table *table;
5963 switch (net->nft.validate_state) {
5964 case NFT_VALIDATE_SKIP:
5966 case NFT_VALIDATE_NEED:
5967 nft_validate_state_update(net, NFT_VALIDATE_DO);
5969 case NFT_VALIDATE_DO:
5970 list_for_each_entry(table, &net->nft.tables, list) {
5971 if (nft_table_validate(net, table) < 0)
5980 static void nft_chain_commit_update(struct nft_trans *trans)
5982 struct nft_base_chain *basechain;
5984 if (nft_trans_chain_name(trans))
5985 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
5987 if (!nft_is_base_chain(trans->ctx.chain))
5990 basechain = nft_base_chain(trans->ctx.chain);
5991 nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
5993 switch (nft_trans_chain_policy(trans)) {
5996 basechain->policy = nft_trans_chain_policy(trans);
6001 static void nft_commit_release(struct nft_trans *trans)
6003 switch (trans->msg_type) {
6004 case NFT_MSG_DELTABLE:
6005 nf_tables_table_destroy(&trans->ctx);
6007 case NFT_MSG_DELCHAIN:
6008 nf_tables_chain_destroy(&trans->ctx);
6010 case NFT_MSG_DELRULE:
6011 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6013 case NFT_MSG_DELSET:
6014 nft_set_destroy(nft_trans_set(trans));
6016 case NFT_MSG_DELSETELEM:
6017 nf_tables_set_elem_destroy(&trans->ctx,
6018 nft_trans_elem_set(trans),
6019 nft_trans_elem(trans).priv);
6021 case NFT_MSG_DELOBJ:
6022 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
6024 case NFT_MSG_DELFLOWTABLE:
6025 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6031 static void nf_tables_commit_release(struct net *net)
6033 struct nft_trans *trans, *next;
6035 if (list_empty(&net->nft.commit_list))
6040 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6041 list_del(&trans->list);
6042 nft_commit_release(trans);
6046 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6048 struct nft_rule *rule;
6049 unsigned int alloc = 0;
6052 /* already handled or inactive chain? */
6053 if (chain->rules_next || !nft_is_active_next(net, chain))
6056 rule = list_entry(&chain->rules, struct nft_rule, list);
6059 list_for_each_entry_continue(rule, &chain->rules, list) {
6060 if (nft_is_active_next(net, rule))
6064 chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6065 if (!chain->rules_next)
6068 list_for_each_entry_continue(rule, &chain->rules, list) {
6069 if (nft_is_active_next(net, rule))
6070 chain->rules_next[i++] = rule;
6073 chain->rules_next[i] = NULL;
6077 static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6079 struct nft_trans *trans, *next;
6081 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6082 struct nft_chain *chain = trans->ctx.chain;
6084 if (trans->msg_type == NFT_MSG_NEWRULE ||
6085 trans->msg_type == NFT_MSG_DELRULE) {
6086 kvfree(chain->rules_next);
6087 chain->rules_next = NULL;
6092 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6094 struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6099 static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6101 struct nft_rule **r = rules;
6102 struct nft_rules_old *old;
6107 r++; /* rcu_head is after end marker */
6111 call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6114 static void nf_tables_commit_chain_active(struct net *net, struct nft_chain *chain)
6116 struct nft_rule **g0, **g1;
6119 next_genbit = nft_gencursor_next(net);
6121 g0 = rcu_dereference_protected(chain->rules_gen_0,
6122 lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
6123 g1 = rcu_dereference_protected(chain->rules_gen_1,
6124 lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
6126 /* No changes to this chain? */
6127 if (chain->rules_next == NULL) {
6128 /* chain had no change in last or next generation */
6132 * chain had no change in this generation; make sure next
6133 * one uses same rules as current generation.
6136 rcu_assign_pointer(chain->rules_gen_1, g0);
6137 nf_tables_commit_chain_free_rules_old(g1);
6139 rcu_assign_pointer(chain->rules_gen_0, g1);
6140 nf_tables_commit_chain_free_rules_old(g0);
6147 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6149 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6151 chain->rules_next = NULL;
6157 nf_tables_commit_chain_free_rules_old(g1);
6159 nf_tables_commit_chain_free_rules_old(g0);
6162 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
6164 struct nft_trans *trans, *next;
6165 struct nft_trans_elem *te;
6166 struct nft_chain *chain;
6167 struct nft_table *table;
6169 /* 0. Validate ruleset, otherwise roll back for error reporting. */
6170 if (nf_tables_validate(net) < 0)
6173 /* 1. Allocate space for next generation rules_gen_X[] */
6174 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6177 if (trans->msg_type == NFT_MSG_NEWRULE ||
6178 trans->msg_type == NFT_MSG_DELRULE) {
6179 chain = trans->ctx.chain;
6181 ret = nf_tables_commit_chain_prepare(net, chain);
6183 nf_tables_commit_chain_prepare_cancel(net);
6189 /* step 2. Make rules_gen_X visible to packet path */
6190 list_for_each_entry(table, &net->nft.tables, list) {
6191 list_for_each_entry(chain, &table->chains, list) {
6192 if (!nft_is_active_next(net, chain))
6194 nf_tables_commit_chain_active(net, chain);
6199 * Bump generation counter, invalidate any dump in progress.
6200 * Cannot fail after this point.
6202 while (++net->nft.base_seq == 0);
6204 /* step 3. Start new generation, rules_gen_X now in use. */
6205 net->nft.gencursor = nft_gencursor_next(net);
6207 list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6208 switch (trans->msg_type) {
6209 case NFT_MSG_NEWTABLE:
6210 if (nft_trans_table_update(trans)) {
6211 if (!nft_trans_table_enable(trans)) {
6212 nf_tables_table_disable(net,
6214 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6217 nft_clear(net, trans->ctx.table);
6219 nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
6220 nft_trans_destroy(trans);
6222 case NFT_MSG_DELTABLE:
6223 list_del_rcu(&trans->ctx.table->list);
6224 nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
6226 case NFT_MSG_NEWCHAIN:
6227 if (nft_trans_chain_update(trans))
6228 nft_chain_commit_update(trans);
6230 nft_clear(net, trans->ctx.chain);
6232 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6233 nft_trans_destroy(trans);
6235 case NFT_MSG_DELCHAIN:
6236 list_del_rcu(&trans->ctx.chain->list);
6237 nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
6238 nf_tables_unregister_hook(trans->ctx.net,
6242 case NFT_MSG_NEWRULE:
6243 nft_clear(trans->ctx.net, nft_trans_rule(trans));
6244 nf_tables_rule_notify(&trans->ctx,
6245 nft_trans_rule(trans),
6247 nft_trans_destroy(trans);
6249 case NFT_MSG_DELRULE:
6250 list_del_rcu(&nft_trans_rule(trans)->list);
6251 nf_tables_rule_notify(&trans->ctx,
6252 nft_trans_rule(trans),
6255 case NFT_MSG_NEWSET:
6256 nft_clear(net, nft_trans_set(trans));
6257 /* This avoids hitting -EBUSY when deleting the table
6258 * from the transaction.
6260 if (nft_set_is_anonymous(nft_trans_set(trans)) &&
6261 !list_empty(&nft_trans_set(trans)->bindings))
6262 trans->ctx.table->use--;
6264 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
6265 NFT_MSG_NEWSET, GFP_KERNEL);
6266 nft_trans_destroy(trans);
6268 case NFT_MSG_DELSET:
6269 list_del_rcu(&nft_trans_set(trans)->list);
6270 nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
6271 NFT_MSG_DELSET, GFP_KERNEL);
6273 case NFT_MSG_NEWSETELEM:
6274 te = (struct nft_trans_elem *)trans->data;
6276 te->set->ops->activate(net, te->set, &te->elem);
6277 nf_tables_setelem_notify(&trans->ctx, te->set,
6279 NFT_MSG_NEWSETELEM, 0);
6280 nft_trans_destroy(trans);
6282 case NFT_MSG_DELSETELEM:
6283 te = (struct nft_trans_elem *)trans->data;
6285 nf_tables_setelem_notify(&trans->ctx, te->set,
6287 NFT_MSG_DELSETELEM, 0);
6288 te->set->ops->remove(net, te->set, &te->elem);
6289 atomic_dec(&te->set->nelems);
6292 case NFT_MSG_NEWOBJ:
6293 nft_clear(net, nft_trans_obj(trans));
6294 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6296 nft_trans_destroy(trans);
6298 case NFT_MSG_DELOBJ:
6299 list_del_rcu(&nft_trans_obj(trans)->list);
6300 nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6303 case NFT_MSG_NEWFLOWTABLE:
6304 nft_clear(net, nft_trans_flowtable(trans));
6305 nf_tables_flowtable_notify(&trans->ctx,
6306 nft_trans_flowtable(trans),
6307 NFT_MSG_NEWFLOWTABLE);
6308 nft_trans_destroy(trans);
6310 case NFT_MSG_DELFLOWTABLE:
6311 list_del_rcu(&nft_trans_flowtable(trans)->list);
6312 nf_tables_flowtable_notify(&trans->ctx,
6313 nft_trans_flowtable(trans),
6314 NFT_MSG_DELFLOWTABLE);
6315 nft_unregister_flowtable_net_hooks(net,
6316 nft_trans_flowtable(trans));
6321 nf_tables_commit_release(net);
6322 nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
6327 static void nf_tables_abort_release(struct nft_trans *trans)
6329 switch (trans->msg_type) {
6330 case NFT_MSG_NEWTABLE:
6331 nf_tables_table_destroy(&trans->ctx);
6333 case NFT_MSG_NEWCHAIN:
6334 nf_tables_chain_destroy(&trans->ctx);
6336 case NFT_MSG_NEWRULE:
6337 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6339 case NFT_MSG_NEWSET:
6340 nft_set_destroy(nft_trans_set(trans));
6342 case NFT_MSG_NEWSETELEM:
6343 nft_set_elem_destroy(nft_trans_elem_set(trans),
6344 nft_trans_elem(trans).priv, true);
6346 case NFT_MSG_NEWOBJ:
6347 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
6349 case NFT_MSG_NEWFLOWTABLE:
6350 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6356 static int nf_tables_abort(struct net *net, struct sk_buff *skb)
6358 struct nft_trans *trans, *next;
6359 struct nft_trans_elem *te;
6361 list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
6363 switch (trans->msg_type) {
6364 case NFT_MSG_NEWTABLE:
6365 if (nft_trans_table_update(trans)) {
6366 if (nft_trans_table_enable(trans)) {
6367 nf_tables_table_disable(net,
6369 trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6371 nft_trans_destroy(trans);
6373 list_del_rcu(&trans->ctx.table->list);
6376 case NFT_MSG_DELTABLE:
6377 nft_clear(trans->ctx.net, trans->ctx.table);
6378 nft_trans_destroy(trans);
6380 case NFT_MSG_NEWCHAIN:
6381 if (nft_trans_chain_update(trans)) {
6382 free_percpu(nft_trans_chain_stats(trans));
6384 nft_trans_destroy(trans);
6386 trans->ctx.table->use--;
6387 list_del_rcu(&trans->ctx.chain->list);
6388 nf_tables_unregister_hook(trans->ctx.net,
6393 case NFT_MSG_DELCHAIN:
6394 trans->ctx.table->use++;
6395 nft_clear(trans->ctx.net, trans->ctx.chain);
6396 nft_trans_destroy(trans);
6398 case NFT_MSG_NEWRULE:
6399 trans->ctx.chain->use--;
6400 list_del_rcu(&nft_trans_rule(trans)->list);
6401 nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans));
6403 case NFT_MSG_DELRULE:
6404 trans->ctx.chain->use++;
6405 nft_clear(trans->ctx.net, nft_trans_rule(trans));
6406 nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
6407 nft_trans_destroy(trans);
6409 case NFT_MSG_NEWSET:
6410 trans->ctx.table->use--;
6411 list_del_rcu(&nft_trans_set(trans)->list);
6413 case NFT_MSG_DELSET:
6414 trans->ctx.table->use++;
6415 nft_clear(trans->ctx.net, nft_trans_set(trans));
6416 nft_trans_destroy(trans);
6418 case NFT_MSG_NEWSETELEM:
6419 te = (struct nft_trans_elem *)trans->data;
6421 te->set->ops->remove(net, te->set, &te->elem);
6422 atomic_dec(&te->set->nelems);
6424 case NFT_MSG_DELSETELEM:
6425 te = (struct nft_trans_elem *)trans->data;
6427 nft_set_elem_activate(net, te->set, &te->elem);
6428 te->set->ops->activate(net, te->set, &te->elem);
6431 nft_trans_destroy(trans);
6433 case NFT_MSG_NEWOBJ:
6434 trans->ctx.table->use--;
6435 list_del_rcu(&nft_trans_obj(trans)->list);
6437 case NFT_MSG_DELOBJ:
6438 trans->ctx.table->use++;
6439 nft_clear(trans->ctx.net, nft_trans_obj(trans));
6440 nft_trans_destroy(trans);
6442 case NFT_MSG_NEWFLOWTABLE:
6443 trans->ctx.table->use--;
6444 list_del_rcu(&nft_trans_flowtable(trans)->list);
6445 nft_unregister_flowtable_net_hooks(net,
6446 nft_trans_flowtable(trans));
6448 case NFT_MSG_DELFLOWTABLE:
6449 trans->ctx.table->use++;
6450 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
6451 nft_trans_destroy(trans);
6458 list_for_each_entry_safe_reverse(trans, next,
6459 &net->nft.commit_list, list) {
6460 list_del(&trans->list);
6461 nf_tables_abort_release(trans);
6467 static void nf_tables_cleanup(struct net *net)
6469 nft_validate_state_update(net, NFT_VALIDATE_SKIP);
6472 static bool nf_tables_valid_genid(struct net *net, u32 genid)
6474 return net->nft.base_seq == genid;
6477 static const struct nfnetlink_subsystem nf_tables_subsys = {
6478 .name = "nf_tables",
6479 .subsys_id = NFNL_SUBSYS_NFTABLES,
6480 .cb_count = NFT_MSG_MAX,
6482 .commit = nf_tables_commit,
6483 .abort = nf_tables_abort,
6484 .cleanup = nf_tables_cleanup,
6485 .valid_genid = nf_tables_valid_genid,
6488 int nft_chain_validate_dependency(const struct nft_chain *chain,
6489 enum nft_chain_types type)
6491 const struct nft_base_chain *basechain;
6493 if (nft_is_base_chain(chain)) {
6494 basechain = nft_base_chain(chain);
6495 if (basechain->type->type != type)
6500 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
6502 int nft_chain_validate_hooks(const struct nft_chain *chain,
6503 unsigned int hook_flags)
6505 struct nft_base_chain *basechain;
6507 if (nft_is_base_chain(chain)) {
6508 basechain = nft_base_chain(chain);
6510 if ((1 << basechain->ops.hooknum) & hook_flags)
6518 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
6521 * Loop detection - walk through the ruleset beginning at the destination chain
6522 * of a new jump until either the source chain is reached (loop) or all
6523 * reachable chains have been traversed.
6525 * The loop check is performed whenever a new jump verdict is added to an
6526 * expression or verdict map or a verdict map is bound to a new chain.
6529 static int nf_tables_check_loops(const struct nft_ctx *ctx,
6530 const struct nft_chain *chain);
6532 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
6533 struct nft_set *set,
6534 const struct nft_set_iter *iter,
6535 struct nft_set_elem *elem)
6537 const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6538 const struct nft_data *data;
6540 if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
6541 *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
6544 data = nft_set_ext_data(ext);
6545 switch (data->verdict.code) {
6548 return nf_tables_check_loops(ctx, data->verdict.chain);
6554 static int nf_tables_check_loops(const struct nft_ctx *ctx,
6555 const struct nft_chain *chain)
6557 const struct nft_rule *rule;
6558 const struct nft_expr *expr, *last;
6559 struct nft_set *set;
6560 struct nft_set_binding *binding;
6561 struct nft_set_iter iter;
6563 if (ctx->chain == chain)
6566 list_for_each_entry(rule, &chain->rules, list) {
6567 nft_rule_for_each_expr(expr, last, rule) {
6568 struct nft_immediate_expr *priv;
6569 const struct nft_data *data;
6572 if (strcmp(expr->ops->type->name, "immediate"))
6575 priv = nft_expr_priv(expr);
6576 if (priv->dreg != NFT_REG_VERDICT)
6580 switch (data->verdict.code) {
6583 err = nf_tables_check_loops(ctx,
6584 data->verdict.chain);
6593 list_for_each_entry(set, &ctx->table->sets, list) {
6594 if (!nft_is_active_next(ctx->net, set))
6596 if (!(set->flags & NFT_SET_MAP) ||
6597 set->dtype != NFT_DATA_VERDICT)
6600 list_for_each_entry(binding, &set->bindings, list) {
6601 if (!(binding->flags & NFT_SET_MAP) ||
6602 binding->chain != chain)
6605 iter.genmask = nft_genmask_next(ctx->net);
6609 iter.fn = nf_tables_loop_check_setelem;
6611 set->ops->walk(ctx, set, &iter);
6621 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
6623 * @attr: netlink attribute to fetch value from
6624 * @max: maximum value to be stored in dest
6625 * @dest: pointer to the variable
6627 * Parse, check and store a given u32 netlink attribute into variable.
6628 * This function returns -ERANGE if the value goes over maximum value.
6629 * Otherwise a 0 is returned and the attribute value is stored in the
6630 * destination variable.
6632 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
6636 val = ntohl(nla_get_be32(attr));
6643 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
6646 * nft_parse_register - parse a register value from a netlink attribute
6648 * @attr: netlink attribute
6650 * Parse and translate a register value from a netlink attribute.
6651 * Registers used to be 128 bit wide, these register numbers will be
6652 * mapped to the corresponding 32 bit register numbers.
6654 unsigned int nft_parse_register(const struct nlattr *attr)
6658 reg = ntohl(nla_get_be32(attr));
6660 case NFT_REG_VERDICT...NFT_REG_4:
6661 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
6663 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
6666 EXPORT_SYMBOL_GPL(nft_parse_register);
6669 * nft_dump_register - dump a register value to a netlink attribute
6671 * @skb: socket buffer
6672 * @attr: attribute number
6673 * @reg: register number
6675 * Construct a netlink attribute containing the register number. For
6676 * compatibility reasons, register numbers being a multiple of 4 are
6677 * translated to the corresponding 128 bit register numbers.
6679 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
6681 if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
6682 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
6684 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
6686 return nla_put_be32(skb, attr, htonl(reg));
6688 EXPORT_SYMBOL_GPL(nft_dump_register);
6691 * nft_validate_register_load - validate a load from a register
6693 * @reg: the register number
6694 * @len: the length of the data
6696 * Validate that the input register is one of the general purpose
6697 * registers and that the length of the load is within the bounds.
6699 int nft_validate_register_load(enum nft_registers reg, unsigned int len)
6701 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
6705 if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
6710 EXPORT_SYMBOL_GPL(nft_validate_register_load);
6713 * nft_validate_register_store - validate an expressions' register store
6715 * @ctx: context of the expression performing the load
6716 * @reg: the destination register number
6717 * @data: the data to load
6718 * @type: the data type
6719 * @len: the length of the data
6721 * Validate that a data load uses the appropriate data type for
6722 * the destination register and the length is within the bounds.
6723 * A value of NULL for the data means that its runtime gathered
6726 int nft_validate_register_store(const struct nft_ctx *ctx,
6727 enum nft_registers reg,
6728 const struct nft_data *data,
6729 enum nft_data_types type, unsigned int len)
6734 case NFT_REG_VERDICT:
6735 if (type != NFT_DATA_VERDICT)
6739 (data->verdict.code == NFT_GOTO ||
6740 data->verdict.code == NFT_JUMP)) {
6741 err = nf_tables_check_loops(ctx, data->verdict.chain);
6745 if (ctx->chain->level + 1 >
6746 data->verdict.chain->level) {
6747 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
6749 data->verdict.chain->level = ctx->chain->level + 1;
6755 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
6759 if (reg * NFT_REG32_SIZE + len >
6760 FIELD_SIZEOF(struct nft_regs, data))
6763 if (data != NULL && type != NFT_DATA_VALUE)
6768 EXPORT_SYMBOL_GPL(nft_validate_register_store);
6770 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
6771 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
6772 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
6773 .len = NFT_CHAIN_MAXNAMELEN - 1 },
6776 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
6777 struct nft_data_desc *desc, const struct nlattr *nla)
6779 u8 genmask = nft_genmask_next(ctx->net);
6780 struct nlattr *tb[NFTA_VERDICT_MAX + 1];
6781 struct nft_chain *chain;
6784 err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy,
6789 if (!tb[NFTA_VERDICT_CODE])
6791 data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
6793 switch (data->verdict.code) {
6795 switch (data->verdict.code & NF_VERDICT_MASK) {
6810 if (!tb[NFTA_VERDICT_CHAIN])
6812 chain = nft_chain_lookup(ctx->table, tb[NFTA_VERDICT_CHAIN],
6815 return PTR_ERR(chain);
6816 if (nft_is_base_chain(chain))
6820 data->verdict.chain = chain;
6824 desc->len = sizeof(data->verdict);
6825 desc->type = NFT_DATA_VERDICT;
6829 static void nft_verdict_uninit(const struct nft_data *data)
6831 switch (data->verdict.code) {
6834 data->verdict.chain->use--;
6839 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
6841 struct nlattr *nest;
6843 nest = nla_nest_start(skb, type);
6845 goto nla_put_failure;
6847 if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
6848 goto nla_put_failure;
6853 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
6855 goto nla_put_failure;
6857 nla_nest_end(skb, nest);
6864 static int nft_value_init(const struct nft_ctx *ctx,
6865 struct nft_data *data, unsigned int size,
6866 struct nft_data_desc *desc, const struct nlattr *nla)
6876 nla_memcpy(data->data, nla, len);
6877 desc->type = NFT_DATA_VALUE;
6882 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
6885 return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
6888 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
6889 [NFTA_DATA_VALUE] = { .type = NLA_BINARY },
6890 [NFTA_DATA_VERDICT] = { .type = NLA_NESTED },
6894 * nft_data_init - parse nf_tables data netlink attributes
6896 * @ctx: context of the expression using the data
6897 * @data: destination struct nft_data
6898 * @size: maximum data length
6899 * @desc: data description
6900 * @nla: netlink attribute containing data
6902 * Parse the netlink data attributes and initialize a struct nft_data.
6903 * The type and length of data are returned in the data description.
6905 * The caller can indicate that it only wants to accept data of type
6906 * NFT_DATA_VALUE by passing NULL for the ctx argument.
6908 int nft_data_init(const struct nft_ctx *ctx,
6909 struct nft_data *data, unsigned int size,
6910 struct nft_data_desc *desc, const struct nlattr *nla)
6912 struct nlattr *tb[NFTA_DATA_MAX + 1];
6915 err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy, NULL);
6919 if (tb[NFTA_DATA_VALUE])
6920 return nft_value_init(ctx, data, size, desc,
6921 tb[NFTA_DATA_VALUE]);
6922 if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
6923 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
6926 EXPORT_SYMBOL_GPL(nft_data_init);
6929 * nft_data_release - release a nft_data item
6931 * @data: struct nft_data to release
6932 * @type: type of data
6934 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6935 * all others need to be released by calling this function.
6937 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
6939 if (type < NFT_DATA_VERDICT)
6942 case NFT_DATA_VERDICT:
6943 return nft_verdict_uninit(data);
6948 EXPORT_SYMBOL_GPL(nft_data_release);
6950 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
6951 enum nft_data_types type, unsigned int len)
6953 struct nlattr *nest;
6956 nest = nla_nest_start(skb, attr);
6961 case NFT_DATA_VALUE:
6962 err = nft_value_dump(skb, data, len);
6964 case NFT_DATA_VERDICT:
6965 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
6972 nla_nest_end(skb, nest);
6975 EXPORT_SYMBOL_GPL(nft_data_dump);
6977 int __nft_release_basechain(struct nft_ctx *ctx)
6979 struct nft_rule *rule, *nr;
6981 BUG_ON(!nft_is_base_chain(ctx->chain));
6983 nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
6984 list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
6985 list_del(&rule->list);
6987 nf_tables_rule_release(ctx, rule);
6989 list_del(&ctx->chain->list);
6991 nf_tables_chain_destroy(ctx);
6995 EXPORT_SYMBOL_GPL(__nft_release_basechain);
6997 static void __nft_release_tables(struct net *net)
6999 struct nft_flowtable *flowtable, *nf;
7000 struct nft_table *table, *nt;
7001 struct nft_chain *chain, *nc;
7002 struct nft_object *obj, *ne;
7003 struct nft_rule *rule, *nr;
7004 struct nft_set *set, *ns;
7005 struct nft_ctx ctx = {
7007 .family = NFPROTO_NETDEV,
7010 list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
7011 ctx.family = table->family;
7013 list_for_each_entry(chain, &table->chains, list)
7014 nf_tables_unregister_hook(net, table, chain);
7015 list_for_each_entry(flowtable, &table->flowtables, list)
7016 nf_unregister_net_hooks(net, flowtable->ops,
7017 flowtable->ops_len);
7018 /* No packets are walking on these chains anymore. */
7020 list_for_each_entry(chain, &table->chains, list) {
7022 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7023 list_del(&rule->list);
7025 nf_tables_rule_release(&ctx, rule);
7028 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7029 list_del(&flowtable->list);
7031 nf_tables_flowtable_destroy(flowtable);
7033 list_for_each_entry_safe(set, ns, &table->sets, list) {
7034 list_del(&set->list);
7036 nft_set_destroy(set);
7038 list_for_each_entry_safe(obj, ne, &table->objects, list) {
7039 list_del(&obj->list);
7041 nft_obj_destroy(&ctx, obj);
7043 list_for_each_entry_safe(chain, nc, &table->chains, list) {
7045 list_del(&chain->list);
7047 nf_tables_chain_destroy(&ctx);
7049 list_del(&table->list);
7050 nf_tables_table_destroy(&ctx);
7054 static int __net_init nf_tables_init_net(struct net *net)
7056 INIT_LIST_HEAD(&net->nft.tables);
7057 INIT_LIST_HEAD(&net->nft.commit_list);
7058 net->nft.base_seq = 1;
7059 net->nft.validate_state = NFT_VALIDATE_SKIP;
7064 static void __net_exit nf_tables_exit_net(struct net *net)
7066 __nft_release_tables(net);
7067 WARN_ON_ONCE(!list_empty(&net->nft.tables));
7068 WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
7071 static struct pernet_operations nf_tables_net_ops = {
7072 .init = nf_tables_init_net,
7073 .exit = nf_tables_exit_net,
7076 static int __init nf_tables_module_init(void)
7080 nft_chain_filter_init();
7082 info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
7089 err = nf_tables_core_module_init();
7093 err = nfnetlink_subsys_register(&nf_tables_subsys);
7097 register_netdevice_notifier(&nf_tables_flowtable_notifier);
7099 return register_pernet_subsys(&nf_tables_net_ops);
7101 nf_tables_core_module_exit();
7108 static void __exit nf_tables_module_exit(void)
7110 unregister_pernet_subsys(&nf_tables_net_ops);
7111 nfnetlink_subsys_unregister(&nf_tables_subsys);
7112 unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7114 nf_tables_core_module_exit();
7116 nft_chain_filter_fini();
7119 module_init(nf_tables_module_init);
7120 module_exit(nf_tables_module_exit);
7122 MODULE_LICENSE("GPL");
7123 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
7124 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);