net/netfilter/nf_tables_api.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
   4  *
   5  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/init.h>
  10 #include <linux/list.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/netlink.h>
  13 #include <linux/vmalloc.h>
  14 #include <linux/rhashtable.h>
  15 #include <linux/audit.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nfnetlink.h>
  18 #include <linux/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_flow_table.h>
  20 #include <net/netfilter/nf_tables_core.h>
  21 #include <net/netfilter/nf_tables.h>
  22 #include <net/netfilter/nf_tables_offload.h>
  23 #include <net/net_namespace.h>
  24 #include <net/sock.h>
  25
  26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
  27
  28 unsigned int nf_tables_net_id __read_mostly;
  29
  30 static LIST_HEAD(nf_tables_expressions);
  31 static LIST_HEAD(nf_tables_objects);
  32 static LIST_HEAD(nf_tables_flowtables);
  33 static LIST_HEAD(nf_tables_destroy_list);
  34 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
  35 static u64 table_handle;
  36
  37 enum {
  38         NFT_VALIDATE_SKIP       = 0,
  39         NFT_VALIDATE_NEED,
  40         NFT_VALIDATE_DO,
  41 };
  42
  43 static struct rhltable nft_objname_ht;
  44
  45 static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
  46 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
  47 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
  48
  49 static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
  50 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
  51 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
  52
  53 static const struct rhashtable_params nft_chain_ht_params = {
  54         .head_offset            = offsetof(struct nft_chain, rhlhead),
  55         .key_offset             = offsetof(struct nft_chain, name),
  56         .hashfn                 = nft_chain_hash,
  57         .obj_hashfn             = nft_chain_hash_obj,
  58         .obj_cmpfn              = nft_chain_hash_cmp,
  59         .automatic_shrinking    = true,
  60 };
  61
  62 static const struct rhashtable_params nft_objname_ht_params = {
  63         .head_offset            = offsetof(struct nft_object, rhlhead),
  64         .key_offset             = offsetof(struct nft_object, key),
  65         .hashfn                 = nft_objname_hash,
  66         .obj_hashfn             = nft_objname_hash_obj,
  67         .obj_cmpfn              = nft_objname_hash_cmp,
  68         .automatic_shrinking    = true,
  69 };
  70
  71 struct nft_audit_data {
  72         struct nft_table *table;
  73         int entries;
  74         int op;
  75         struct list_head list;
  76 };
  77
  78 static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types
  79         [NFT_MSG_NEWTABLE]      = AUDIT_NFT_OP_TABLE_REGISTER,
  80         [NFT_MSG_GETTABLE]      = AUDIT_NFT_OP_INVALID,
  81         [NFT_MSG_DELTABLE]      = AUDIT_NFT_OP_TABLE_UNREGISTER,
  82         [NFT_MSG_NEWCHAIN]      = AUDIT_NFT_OP_CHAIN_REGISTER,
  83         [NFT_MSG_GETCHAIN]      = AUDIT_NFT_OP_INVALID,
  84         [NFT_MSG_DELCHAIN]      = AUDIT_NFT_OP_CHAIN_UNREGISTER,
  85         [NFT_MSG_NEWRULE]       = AUDIT_NFT_OP_RULE_REGISTER,
  86         [NFT_MSG_GETRULE]       = AUDIT_NFT_OP_INVALID,
  87         [NFT_MSG_DELRULE]       = AUDIT_NFT_OP_RULE_UNREGISTER,
  88         [NFT_MSG_NEWSET]        = AUDIT_NFT_OP_SET_REGISTER,
  89         [NFT_MSG_GETSET]        = AUDIT_NFT_OP_INVALID,
  90         [NFT_MSG_DELSET]        = AUDIT_NFT_OP_SET_UNREGISTER,
  91         [NFT_MSG_NEWSETELEM]    = AUDIT_NFT_OP_SETELEM_REGISTER,
  92         [NFT_MSG_GETSETELEM]    = AUDIT_NFT_OP_INVALID,
  93         [NFT_MSG_DELSETELEM]    = AUDIT_NFT_OP_SETELEM_UNREGISTER,
  94         [NFT_MSG_NEWGEN]        = AUDIT_NFT_OP_GEN_REGISTER,
  95         [NFT_MSG_GETGEN]        = AUDIT_NFT_OP_INVALID,
  96         [NFT_MSG_TRACE]         = AUDIT_NFT_OP_INVALID,
  97         [NFT_MSG_NEWOBJ]        = AUDIT_NFT_OP_OBJ_REGISTER,
  98         [NFT_MSG_GETOBJ]        = AUDIT_NFT_OP_INVALID,
  99         [NFT_MSG_DELOBJ]        = AUDIT_NFT_OP_OBJ_UNREGISTER,
 100         [NFT_MSG_GETOBJ_RESET]  = AUDIT_NFT_OP_OBJ_RESET,
 101         [NFT_MSG_NEWFLOWTABLE]  = AUDIT_NFT_OP_FLOWTABLE_REGISTER,
 102         [NFT_MSG_GETFLOWTABLE]  = AUDIT_NFT_OP_INVALID,
 103         [NFT_MSG_DELFLOWTABLE]  = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
 104 };
 105
 106 static void nft_validate_state_update(struct net *net, u8 new_validate_state)
 107 {
 108         struct nftables_pernet *nft_net = nft_pernet(net);
 109
 110         switch (nft_net->validate_state) {
 111         case NFT_VALIDATE_SKIP:
 112                 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
 113                 break;
 114         case NFT_VALIDATE_NEED:
 115                 break;
 116         case NFT_VALIDATE_DO:
 117                 if (new_validate_state == NFT_VALIDATE_NEED)
 118                         return;
 119         }
 120
 121         nft_net->validate_state = new_validate_state;
 122 }
 123 static void nf_tables_trans_destroy_work(struct work_struct *w);
 124 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
 125
 126 static void nft_ctx_init(struct nft_ctx *ctx,
 127                          struct net *net,
 128                          const struct sk_buff *skb,
 129                          const struct nlmsghdr *nlh,
 130                          u8 family,
 131                          struct nft_table *table,
 132                          struct nft_chain *chain,
 133                          const struct nlattr * const *nla)
 134 {
 135         ctx->net        = net;
 136         ctx->family     = family;
 137         ctx->level      = 0;
 138         ctx->table      = table;
 139         ctx->chain      = chain;
 140         ctx->nla        = nla;
 141         ctx->portid     = NETLINK_CB(skb).portid;
 142         ctx->report     = nlmsg_report(nlh);
 143         ctx->flags      = nlh->nlmsg_flags;
 144         ctx->seq        = nlh->nlmsg_seq;
 145 }
 146
 147 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
 148                                              int msg_type, u32 size, gfp_t gfp)
 149 {
 150         struct nft_trans *trans;
 151
 152         trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
 153         if (trans == NULL)
 154                 return NULL;
 155
 156         trans->msg_type = msg_type;
 157         trans->ctx      = *ctx;
 158
 159         return trans;
 160 }
 161
 162 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
 163                                          int msg_type, u32 size)
 164 {
 165         return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
 166 }
 167
 168 static void nft_trans_destroy(struct nft_trans *trans)
 169 {
 170         list_del(&trans->list);
 171         kfree(trans);
 172 }
 173
 174 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
 175 {
 176         struct nftables_pernet *nft_net;
 177         struct net *net = ctx->net;
 178         struct nft_trans *trans;
 179
 180         if (!nft_set_is_anonymous(set))
 181                 return;
 182
 183         nft_net = nft_pernet(net);
 184         list_for_each_entry_reverse(trans, &nft_net->commit_list, list) {
 185                 switch (trans->msg_type) {
 186                 case NFT_MSG_NEWSET:
 187                         if (nft_trans_set(trans) == set)
 188                                 nft_trans_set_bound(trans) = true;
 189                         break;
 190                 case NFT_MSG_NEWSETELEM:
 191                         if (nft_trans_elem_set(trans) == set)
 192                                 nft_trans_elem_set_bound(trans) = true;
 193                         break;
 194                 }
 195         }
 196 }
 197
 198 static int nft_netdev_register_hooks(struct net *net,
 199                                      struct list_head *hook_list)
 200 {
 201         struct nft_hook *hook;
 202         int err, j;
 203
 204         j = 0;
 205         list_for_each_entry(hook, hook_list, list) {
 206                 err = nf_register_net_hook(net, &hook->ops);
 207                 if (err < 0)
 208                         goto err_register;
 209
 210                 j++;
 211         }
 212         return 0;
 213
 214 err_register:
 215         list_for_each_entry(hook, hook_list, list) {
 216                 if (j-- <= 0)
 217                         break;
 218
 219                 nf_unregister_net_hook(net, &hook->ops);
 220         }
 221         return err;
 222 }
 223
 224 static void nft_netdev_unregister_hooks(struct net *net,
 225                                         struct list_head *hook_list)
 226 {
 227         struct nft_hook *hook;
 228
 229         list_for_each_entry(hook, hook_list, list)
 230                 nf_unregister_net_hook(net, &hook->ops);
 231 }
 232
 233 static int nf_tables_register_hook(struct net *net,
 234                                    const struct nft_table *table,
 235                                    struct nft_chain *chain)
 236 {
 237         struct nft_base_chain *basechain;
 238         const struct nf_hook_ops *ops;
 239
 240         if (table->flags & NFT_TABLE_F_DORMANT ||
 241             !nft_is_base_chain(chain))
 242                 return 0;
 243
 244         basechain = nft_base_chain(chain);
 245         ops = &basechain->ops;
 246
 247         if (basechain->type->ops_register)
 248                 return basechain->type->ops_register(net, ops);
 249
 250         if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
 251                 return nft_netdev_register_hooks(net, &basechain->hook_list);
 252
 253         return nf_register_net_hook(net, &basechain->ops);
 254 }
 255
 256 static void nf_tables_unregister_hook(struct net *net,
 257                                       const struct nft_table *table,
 258                                       struct nft_chain *chain)
 259 {
 260         struct nft_base_chain *basechain;
 261         const struct nf_hook_ops *ops;
 262
 263         if (table->flags & NFT_TABLE_F_DORMANT ||
 264             !nft_is_base_chain(chain))
 265                 return;
 266         basechain = nft_base_chain(chain);
 267         ops = &basechain->ops;
 268
 269         if (basechain->type->ops_unregister)
 270                 return basechain->type->ops_unregister(net, ops);
 271
 272         if (nft_base_chain_netdev(table->family, basechain->ops.hooknum))
 273                 nft_netdev_unregister_hooks(net, &basechain->hook_list);
 274         else
 275                 nf_unregister_net_hook(net, &basechain->ops);
 276 }
 277
 278 static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans)
 279 {
 280         struct nftables_pernet *nft_net = nft_pernet(net);
 281
 282         list_add_tail(&trans->list, &nft_net->commit_list);
 283 }
 284
 285 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
 286 {
 287         struct nft_trans *trans;
 288
 289         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
 290         if (trans == NULL)
 291                 return -ENOMEM;
 292
 293         if (msg_type == NFT_MSG_NEWTABLE)
 294                 nft_activate_next(ctx->net, ctx->table);
 295
 296         nft_trans_commit_list_add_tail(ctx->net, trans);
 297         return 0;
 298 }
 299
 300 static int nft_deltable(struct nft_ctx *ctx)
 301 {
 302         int err;
 303
 304         err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
 305         if (err < 0)
 306                 return err;
 307
 308         nft_deactivate_next(ctx->net, ctx->table);
 309         return err;
 310 }
 311
 312 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
 313 {
 314         struct nft_trans *trans;
 315
 316         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
 317         if (trans == NULL)
 318                 return ERR_PTR(-ENOMEM);
 319
 320         if (msg_type == NFT_MSG_NEWCHAIN) {
 321                 nft_activate_next(ctx->net, ctx->chain);
 322
 323                 if (ctx->nla[NFTA_CHAIN_ID]) {
 324                         nft_trans_chain_id(trans) =
 325                                 ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID]));
 326                 }
 327         }
 328
 329         nft_trans_commit_list_add_tail(ctx->net, trans);
 330         return trans;
 331 }
 332
 333 static int nft_delchain(struct nft_ctx *ctx)
 334 {
 335         struct nft_trans *trans;
 336
 337         trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
 338         if (IS_ERR(trans))
 339                 return PTR_ERR(trans);
 340
 341         ctx->table->use--;
 342         nft_deactivate_next(ctx->net, ctx->chain);
 343
 344         return 0;
 345 }
 346
 347 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
 348                                    struct nft_rule *rule)
 349 {
 350         struct nft_expr *expr;
 351
 352         expr = nft_expr_first(rule);
 353         while (nft_expr_more(rule, expr)) {
 354                 if (expr->ops->activate)
 355                         expr->ops->activate(ctx, expr);
 356
 357                 expr = nft_expr_next(expr);
 358         }
 359 }
 360
 361 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
 362                                      struct nft_rule *rule,
 363                                      enum nft_trans_phase phase)
 364 {
 365         struct nft_expr *expr;
 366
 367         expr = nft_expr_first(rule);
 368         while (nft_expr_more(rule, expr)) {
 369                 if (expr->ops->deactivate)
 370                         expr->ops->deactivate(ctx, expr, phase);
 371
 372                 expr = nft_expr_next(expr);
 373         }
 374 }
 375
 376 static int
 377 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
 378 {
 379         /* You cannot delete the same rule twice */
 380         if (nft_is_active_next(ctx->net, rule)) {
 381                 nft_deactivate_next(ctx->net, rule);
 382                 ctx->chain->use--;
 383                 return 0;
 384         }
 385         return -ENOENT;
 386 }
 387
 388 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
 389                                             struct nft_rule *rule)
 390 {
 391         struct nft_trans *trans;
 392
 393         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
 394         if (trans == NULL)
 395                 return NULL;
 396
 397         if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
 398                 nft_trans_rule_id(trans) =
 399                         ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
 400         }
 401         nft_trans_rule(trans) = rule;
 402         nft_trans_commit_list_add_tail(ctx->net, trans);
 403
 404         return trans;
 405 }
 406
 407 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
 408 {
 409         struct nft_flow_rule *flow;
 410         struct nft_trans *trans;
 411         int err;
 412
 413         trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
 414         if (trans == NULL)
 415                 return -ENOMEM;
 416
 417         if (ctx->chain->flags & NFT_CHAIN_HW_OFFLOAD) {
 418                 flow = nft_flow_rule_create(ctx->net, rule);
 419                 if (IS_ERR(flow)) {
 420                         nft_trans_destroy(trans);
 421                         return PTR_ERR(flow);
 422                 }
 423
 424                 nft_trans_flow_rule(trans) = flow;
 425         }
 426
 427         err = nf_tables_delrule_deactivate(ctx, rule);
 428         if (err < 0) {
 429                 nft_trans_destroy(trans);
 430                 return err;
 431         }
 432         nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
 433
 434         return 0;
 435 }
 436
 437 static int nft_delrule_by_chain(struct nft_ctx *ctx)
 438 {
 439         struct nft_rule *rule;
 440         int err;
 441
 442         list_for_each_entry(rule, &ctx->chain->rules, list) {
 443                 if (!nft_is_active_next(ctx->net, rule))
 444                         continue;
 445
 446                 err = nft_delrule(ctx, rule);
 447                 if (err < 0)
 448                         return err;
 449         }
 450         return 0;
 451 }
 452
 453 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
 454                              struct nft_set *set)
 455 {
 456         struct nft_trans *trans;
 457
 458         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
 459         if (trans == NULL)
 460                 return -ENOMEM;
 461
 462         if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
 463                 nft_trans_set_id(trans) =
 464                         ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
 465                 nft_activate_next(ctx->net, set);
 466         }
 467         nft_trans_set(trans) = set;
 468         nft_trans_commit_list_add_tail(ctx->net, trans);
 469
 470         return 0;
 471 }
 472
 473 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
 474 {
 475         int err;
 476
 477         err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
 478         if (err < 0)
 479                 return err;
 480
 481         nft_deactivate_next(ctx->net, set);
 482         ctx->table->use--;
 483
 484         return err;
 485 }
 486
 487 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
 488                              struct nft_object *obj)
 489 {
 490         struct nft_trans *trans;
 491
 492         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
 493         if (trans == NULL)
 494                 return -ENOMEM;
 495
 496         if (msg_type == NFT_MSG_NEWOBJ)
 497                 nft_activate_next(ctx->net, obj);
 498
 499         nft_trans_obj(trans) = obj;
 500         nft_trans_commit_list_add_tail(ctx->net, trans);
 501
 502         return 0;
 503 }
 504
 505 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
 506 {
 507         int err;
 508
 509         err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
 510         if (err < 0)
 511                 return err;
 512
 513         nft_deactivate_next(ctx->net, obj);
 514         ctx->table->use--;
 515
 516         return err;
 517 }
 518
 519 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
 520                                    struct nft_flowtable *flowtable)
 521 {
 522         struct nft_trans *trans;
 523
 524         trans = nft_trans_alloc(ctx, msg_type,
 525                                 sizeof(struct nft_trans_flowtable));
 526         if (trans == NULL)
 527                 return -ENOMEM;
 528
 529         if (msg_type == NFT_MSG_NEWFLOWTABLE)
 530                 nft_activate_next(ctx->net, flowtable);
 531
 532         nft_trans_flowtable(trans) = flowtable;
 533         nft_trans_commit_list_add_tail(ctx->net, trans);
 534
 535         return 0;
 536 }
 537
 538 static int nft_delflowtable(struct nft_ctx *ctx,
 539                             struct nft_flowtable *flowtable)
 540 {
 541         int err;
 542
 543         err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
 544         if (err < 0)
 545                 return err;
 546
 547         nft_deactivate_next(ctx->net, flowtable);
 548         ctx->table->use--;
 549
 550         return err;
 551 }
 552
 553 /*
 554  * Tables
 555  */
 556
 557 static struct nft_table *nft_table_lookup(const struct net *net,
 558                                           const struct nlattr *nla,
 559                                           u8 family, u8 genmask, u32 nlpid)
 560 {
 561         struct nftables_pernet *nft_net;
 562         struct nft_table *table;
 563
 564         if (nla == NULL)
 565                 return ERR_PTR(-EINVAL);
 566
 567         nft_net = nft_pernet(net);
 568         list_for_each_entry_rcu(table, &nft_net->tables, list,
 569                                 lockdep_is_held(&nft_net->commit_mutex)) {
 570                 if (!nla_strcmp(nla, table->name) &&
 571                     table->family == family &&
 572                     nft_active_genmask(table, genmask)) {
 573                         if (nft_table_has_owner(table) &&
 574                             nlpid && table->nlpid != nlpid)
 575                                 return ERR_PTR(-EPERM);
 576
 577                         return table;
 578                 }
 579         }
 580
 581         return ERR_PTR(-ENOENT);
 582 }
 583
 584 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
 585                                                    const struct nlattr *nla,
 586                                                    u8 genmask, u32 nlpid)
 587 {
 588         struct nftables_pernet *nft_net;
 589         struct nft_table *table;
 590
 591         nft_net = nft_pernet(net);
 592         list_for_each_entry(table, &nft_net->tables, list) {
 593                 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
 594                     nft_active_genmask(table, genmask)) {
 595                         if (nft_table_has_owner(table) &&
 596                             nlpid && table->nlpid != nlpid)
 597                                 return ERR_PTR(-EPERM);
 598
 599                         return table;
 600                 }
 601         }
 602
 603         return ERR_PTR(-ENOENT);
 604 }
 605
 606 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
 607 {
 608         return ++table->hgenerator;
 609 }
 610
 611 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
 612
 613 static const struct nft_chain_type *
 614 __nft_chain_type_get(u8 family, enum nft_chain_types type)
 615 {
 616         if (family >= NFPROTO_NUMPROTO ||
 617             type >= NFT_CHAIN_T_MAX)
 618                 return NULL;
 619
 620         return chain_type[family][type];
 621 }
 622
 623 static const struct nft_chain_type *
 624 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
 625 {
 626         const struct nft_chain_type *type;
 627         int i;
 628
 629         for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
 630                 type = __nft_chain_type_get(family, i);
 631                 if (!type)
 632                         continue;
 633                 if (!nla_strcmp(nla, type->name))
 634                         return type;
 635         }
 636         return NULL;
 637 }
 638
 639 struct nft_module_request {
 640         struct list_head        list;
 641         char                    module[MODULE_NAME_LEN];
 642         bool                    done;
 643 };
 644
 645 #ifdef CONFIG_MODULES
 646 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt,
 647                                       ...)
 648 {
 649         char module_name[MODULE_NAME_LEN];
 650         struct nftables_pernet *nft_net;
 651         struct nft_module_request *req;
 652         va_list args;
 653         int ret;
 654
 655         va_start(args, fmt);
 656         ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
 657         va_end(args);
 658         if (ret >= MODULE_NAME_LEN)
 659                 return 0;
 660
 661         nft_net = nft_pernet(net);
 662         list_for_each_entry(req, &nft_net->module_list, list) {
 663                 if (!strcmp(req->module, module_name)) {
 664                         if (req->done)
 665                                 return 0;
 666
 667                         /* A request to load this module already exists. */
 668                         return -EAGAIN;
 669                 }
 670         }
 671
 672         req = kmalloc(sizeof(*req), GFP_KERNEL);
 673         if (!req)
 674                 return -ENOMEM;
 675
 676         req->done = false;
 677         strlcpy(req->module, module_name, MODULE_NAME_LEN);
 678         list_add_tail(&req->list, &nft_net->module_list);
 679
 680         return -EAGAIN;
 681 }
 682 EXPORT_SYMBOL_GPL(nft_request_module);
 683 #endif
 684
 685 static void lockdep_nfnl_nft_mutex_not_held(void)
 686 {
 687 #ifdef CONFIG_PROVE_LOCKING
 688         if (debug_locks)
 689                 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
 690 #endif
 691 }
 692
 693 static const struct nft_chain_type *
 694 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
 695                             u8 family, bool autoload)
 696 {
 697         const struct nft_chain_type *type;
 698
 699         type = __nf_tables_chain_type_lookup(nla, family);
 700         if (type != NULL)
 701                 return type;
 702
 703         lockdep_nfnl_nft_mutex_not_held();
 704 #ifdef CONFIG_MODULES
 705         if (autoload) {
 706                 if (nft_request_module(net, "nft-chain-%u-%.*s", family,
 707                                        nla_len(nla),
 708                                        (const char *)nla_data(nla)) == -EAGAIN)
 709                         return ERR_PTR(-EAGAIN);
 710         }
 711 #endif
 712         return ERR_PTR(-ENOENT);
 713 }
 714
 715 static __be16 nft_base_seq(const struct net *net)
 716 {
 717         struct nftables_pernet *nft_net = nft_pernet(net);
 718
 719         return htons(nft_net->base_seq & 0xffff);
 720 }
 721
 722 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
 723         [NFTA_TABLE_NAME]       = { .type = NLA_STRING,
 724                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
 725         [NFTA_TABLE_FLAGS]      = { .type = NLA_U32 },
 726         [NFTA_TABLE_HANDLE]     = { .type = NLA_U64 },
 727         [NFTA_TABLE_USERDATA]   = { .type = NLA_BINARY,
 728                                     .len = NFT_USERDATA_MAXLEN }
 729 };
 730
 731 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
 732                                      u32 portid, u32 seq, int event, u32 flags,
 733                                      int family, const struct nft_table *table)
 734 {
 735         struct nlmsghdr *nlh;
 736
 737         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
 738         nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
 739                            NFNETLINK_V0, nft_base_seq(net));
 740         if (!nlh)
 741                 goto nla_put_failure;
 742
 743         if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
 744             nla_put_be32(skb, NFTA_TABLE_FLAGS,
 745                          htonl(table->flags & NFT_TABLE_F_MASK)) ||
 746             nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
 747             nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
 748                          NFTA_TABLE_PAD))
 749                 goto nla_put_failure;
 750         if (nft_table_has_owner(table) &&
 751             nla_put_be32(skb, NFTA_TABLE_OWNER, htonl(table->nlpid)))
 752                 goto nla_put_failure;
 753
 754         if (table->udata) {
 755                 if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata))
 756                         goto nla_put_failure;
 757         }
 758
 759         nlmsg_end(skb, nlh);
 760         return 0;
 761
 762 nla_put_failure:
 763         nlmsg_trim(skb, nlh);
 764         return -1;
 765 }
 766
 767 struct nftnl_skb_parms {
 768         bool report;
 769 };
 770 #define NFT_CB(skb)     (*(struct nftnl_skb_parms*)&((skb)->cb))
 771
 772 static void nft_notify_enqueue(struct sk_buff *skb, bool report,
 773                                struct list_head *notify_list)
 774 {
 775         NFT_CB(skb).report = report;
 776         list_add_tail(&skb->list, notify_list);
 777 }
 778
 779 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
 780 {
 781         struct nftables_pernet *nft_net;
 782         struct sk_buff *skb;
 783         int err;
 784
 785         if (!ctx->report &&
 786             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
 787                 return;
 788
 789         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 790         if (skb == NULL)
 791                 goto err;
 792
 793         err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
 794                                         event, 0, ctx->family, ctx->table);
 795         if (err < 0) {
 796                 kfree_skb(skb);
 797                 goto err;
 798         }
 799
 800         nft_net = nft_pernet(ctx->net);
 801         nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
 802         return;
 803 err:
 804         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
 805 }
 806
 807 static int nf_tables_dump_tables(struct sk_buff *skb,
 808                                  struct netlink_callback *cb)
 809 {
 810         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 811         struct nftables_pernet *nft_net;
 812         const struct nft_table *table;
 813         unsigned int idx = 0, s_idx = cb->args[0];
 814         struct net *net = sock_net(skb->sk);
 815         int family = nfmsg->nfgen_family;
 816
 817         rcu_read_lock();
 818         nft_net = nft_pernet(net);
 819         cb->seq = nft_net->base_seq;
 820
 821         list_for_each_entry_rcu(table, &nft_net->tables, list) {
 822                 if (family != NFPROTO_UNSPEC && family != table->family)
 823                         continue;
 824
 825                 if (idx < s_idx)
 826                         goto cont;
 827                 if (idx > s_idx)
 828                         memset(&cb->args[1], 0,
 829                                sizeof(cb->args) - sizeof(cb->args[0]));
 830                 if (!nft_is_active(net, table))
 831                         continue;
 832                 if (nf_tables_fill_table_info(skb, net,
 833                                               NETLINK_CB(cb->skb).portid,
 834                                               cb->nlh->nlmsg_seq,
 835                                               NFT_MSG_NEWTABLE, NLM_F_MULTI,
 836                                               table->family, table) < 0)
 837                         goto done;
 838
 839                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 840 cont:
 841                 idx++;
 842         }
 843 done:
 844         rcu_read_unlock();
 845         cb->args[0] = idx;
 846         return skb->len;
 847 }
 848
 849 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
 850                                       const struct nlmsghdr *nlh,
 851                                       struct netlink_dump_control *c)
 852 {
 853         int err;
 854
 855         if (!try_module_get(THIS_MODULE))
 856                 return -EINVAL;
 857
 858         rcu_read_unlock();
 859         err = netlink_dump_start(nlsk, skb, nlh, c);
 860         rcu_read_lock();
 861         module_put(THIS_MODULE);
 862
 863         return err;
 864 }
 865
 866 /* called with rcu_read_lock held */
 867 static int nf_tables_gettable(struct sk_buff *skb, const struct nfnl_info *info,
 868                               const struct nlattr * const nla[])
 869 {
 870         struct netlink_ext_ack *extack = info->extack;
 871         u8 genmask = nft_genmask_cur(info->net);
 872         u8 family = info->nfmsg->nfgen_family;
 873         const struct nft_table *table;
 874         struct net *net = info->net;
 875         struct sk_buff *skb2;
 876         int err;
 877
 878         if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
 879                 struct netlink_dump_control c = {
 880                         .dump = nf_tables_dump_tables,
 881                         .module = THIS_MODULE,
 882                 };
 883
 884                 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
 885         }
 886
 887         table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask, 0);
 888         if (IS_ERR(table)) {
 889                 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
 890                 return PTR_ERR(table);
 891         }
 892
 893         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
 894         if (!skb2)
 895                 return -ENOMEM;
 896
 897         err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
 898                                         info->nlh->nlmsg_seq, NFT_MSG_NEWTABLE,
 899                                         0, family, table);
 900         if (err < 0)
 901                 goto err_fill_table_info;
 902
 903         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
 904
 905 err_fill_table_info:
 906         kfree_skb(skb2);
 907         return err;
 908 }
 909
 910 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
 911 {
 912         struct nft_chain *chain;
 913         u32 i = 0;
 914
 915         list_for_each_entry(chain, &table->chains, list) {
 916                 if (!nft_is_active_next(net, chain))
 917                         continue;
 918                 if (!nft_is_base_chain(chain))
 919                         continue;
 920
 921                 if (cnt && i++ == cnt)
 922                         break;
 923
 924                 nf_tables_unregister_hook(net, table, chain);
 925         }
 926 }
 927
 928 static int nf_tables_table_enable(struct net *net, struct nft_table *table)
 929 {
 930         struct nft_chain *chain;
 931         int err, i = 0;
 932
 933         list_for_each_entry(chain, &table->chains, list) {
 934                 if (!nft_is_active_next(net, chain))
 935                         continue;
 936                 if (!nft_is_base_chain(chain))
 937                         continue;
 938
 939                 err = nf_tables_register_hook(net, table, chain);
 940                 if (err < 0)
 941                         goto err_register_hooks;
 942
 943                 i++;
 944         }
 945         return 0;
 946
 947 err_register_hooks:
 948         if (i)
 949                 nft_table_disable(net, table, i);
 950         return err;
 951 }
 952
 953 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
 954 {
 955         table->flags &= ~NFT_TABLE_F_DORMANT;
 956         nft_table_disable(net, table, 0);
 957         table->flags |= NFT_TABLE_F_DORMANT;
 958 }
 959
 960 #define __NFT_TABLE_F_INTERNAL          (NFT_TABLE_F_MASK + 1)
 961 #define __NFT_TABLE_F_WAS_DORMANT       (__NFT_TABLE_F_INTERNAL << 0)
 962 #define __NFT_TABLE_F_WAS_AWAKEN        (__NFT_TABLE_F_INTERNAL << 1)
 963 #define __NFT_TABLE_F_UPDATE            (__NFT_TABLE_F_WAS_DORMANT | \
 964                                          __NFT_TABLE_F_WAS_AWAKEN)
 965
 966 static int nf_tables_updtable(struct nft_ctx *ctx)
 967 {
 968         struct nft_trans *trans;
 969         u32 flags;
 970         int ret;
 971
 972         if (!ctx->nla[NFTA_TABLE_FLAGS])
 973                 return 0;
 974
 975         flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
 976         if (flags & ~NFT_TABLE_F_MASK)
 977                 return -EOPNOTSUPP;
 978
 979         if (flags == ctx->table->flags)
 980                 return 0;
 981
 982         if ((nft_table_has_owner(ctx->table) &&
 983              !(flags & NFT_TABLE_F_OWNER)) ||
 984             (!nft_table_has_owner(ctx->table) &&
 985              flags & NFT_TABLE_F_OWNER))
 986                 return -EOPNOTSUPP;
 987
 988         trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
 989                                 sizeof(struct nft_trans_table));
 990         if (trans == NULL)
 991                 return -ENOMEM;
 992
 993         if ((flags & NFT_TABLE_F_DORMANT) &&
 994             !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
 995                 ctx->table->flags |= NFT_TABLE_F_DORMANT;
 996                 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE))
 997                         ctx->table->flags |= __NFT_TABLE_F_WAS_AWAKEN;
 998         } else if (!(flags & NFT_TABLE_F_DORMANT) &&
 999                    ctx->table->flags & NFT_TABLE_F_DORMANT) {
1000                 ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
1001                 if (!(ctx->table->flags & __NFT_TABLE_F_UPDATE)) {
1002                         ret = nf_tables_table_enable(ctx->net, ctx->table);
1003                         if (ret < 0)
1004                                 goto err_register_hooks;
1005
1006                         ctx->table->flags |= __NFT_TABLE_F_WAS_DORMANT;
1007                 }
1008         }
1009
1010         nft_trans_table_update(trans) = true;
1011         nft_trans_commit_list_add_tail(ctx->net, trans);
1012
1013         return 0;
1014
1015 err_register_hooks:
1016         nft_trans_destroy(trans);
1017         return ret;
1018 }
1019
1020 static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
1021 {
1022         const char *name = data;
1023
1024         return jhash(name, strlen(name), seed);
1025 }
1026
1027 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
1028 {
1029         const struct nft_chain *chain = data;
1030
1031         return nft_chain_hash(chain->name, 0, seed);
1032 }
1033
1034 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
1035                               const void *ptr)
1036 {
1037         const struct nft_chain *chain = ptr;
1038         const char *name = arg->key;
1039
1040         return strcmp(chain->name, name);
1041 }
1042
1043 static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
1044 {
1045         const struct nft_object_hash_key *k = data;
1046
1047         seed ^= hash_ptr(k->table, 32);
1048
1049         return jhash(k->name, strlen(k->name), seed);
1050 }
1051
1052 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
1053 {
1054         const struct nft_object *obj = data;
1055
1056         return nft_objname_hash(&obj->key, 0, seed);
1057 }
1058
1059 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
1060                                 const void *ptr)
1061 {
1062         const struct nft_object_hash_key *k = arg->key;
1063         const struct nft_object *obj = ptr;
1064
1065         if (obj->key.table != k->table)
1066                 return -1;
1067
1068         return strcmp(obj->key.name, k->name);
1069 }
1070
1071 static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info,
1072                               const struct nlattr * const nla[])
1073 {
1074         struct nftables_pernet *nft_net = nft_pernet(info->net);
1075         struct netlink_ext_ack *extack = info->extack;
1076         u8 genmask = nft_genmask_next(info->net);
1077         u8 family = info->nfmsg->nfgen_family;
1078         struct net *net = info->net;
1079         const struct nlattr *attr;
1080         struct nft_table *table;
1081         struct nft_ctx ctx;
1082         u32 flags = 0;
1083         int err;
1084
1085         lockdep_assert_held(&nft_net->commit_mutex);
1086         attr = nla[NFTA_TABLE_NAME];
1087         table = nft_table_lookup(net, attr, family, genmask,
1088                                  NETLINK_CB(skb).portid);
1089         if (IS_ERR(table)) {
1090                 if (PTR_ERR(table) != -ENOENT)
1091                         return PTR_ERR(table);
1092         } else {
1093                 if (info->nlh->nlmsg_flags & NLM_F_EXCL) {
1094                         NL_SET_BAD_ATTR(extack, attr);
1095                         return -EEXIST;
1096                 }
1097                 if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
1098                         return -EOPNOTSUPP;
1099
1100                 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
1101
1102                 return nf_tables_updtable(&ctx);
1103         }
1104
1105         if (nla[NFTA_TABLE_FLAGS]) {
1106                 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
1107                 if (flags & ~NFT_TABLE_F_MASK)
1108                         return -EOPNOTSUPP;
1109         }
1110
1111         err = -ENOMEM;
1112         table = kzalloc(sizeof(*table), GFP_KERNEL);
1113         if (table == NULL)
1114                 goto err_kzalloc;
1115
1116         table->name = nla_strdup(attr, GFP_KERNEL);
1117         if (table->name == NULL)
1118                 goto err_strdup;
1119
1120         if (nla[NFTA_TABLE_USERDATA]) {
1121                 table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL);
1122                 if (table->udata == NULL)
1123                         goto err_table_udata;
1124
1125                 table->udlen = nla_len(nla[NFTA_TABLE_USERDATA]);
1126         }
1127
1128         err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
1129         if (err)
1130                 goto err_chain_ht;
1131
1132         INIT_LIST_HEAD(&table->chains);
1133         INIT_LIST_HEAD(&table->sets);
1134         INIT_LIST_HEAD(&table->objects);
1135         INIT_LIST_HEAD(&table->flowtables);
1136         table->family = family;
1137         table->flags = flags;
1138         table->handle = ++table_handle;
1139         if (table->flags & NFT_TABLE_F_OWNER)
1140                 table->nlpid = NETLINK_CB(skb).portid;
1141
1142         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
1143         err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
1144         if (err < 0)
1145                 goto err_trans;
1146
1147         list_add_tail_rcu(&table->list, &nft_net->tables);
1148         return 0;
1149 err_trans:
1150         rhltable_destroy(&table->chains_ht);
1151 err_chain_ht:
1152         kfree(table->udata);
1153 err_table_udata:
1154         kfree(table->name);
1155 err_strdup:
1156         kfree(table);
1157 err_kzalloc:
1158         return err;
1159 }
1160
1161 static int nft_flush_table(struct nft_ctx *ctx)
1162 {
1163         struct nft_flowtable *flowtable, *nft;
1164         struct nft_chain *chain, *nc;
1165         struct nft_object *obj, *ne;
1166         struct nft_set *set, *ns;
1167         int err;
1168
1169         list_for_each_entry(chain, &ctx->table->chains, list) {
1170                 if (!nft_is_active_next(ctx->net, chain))
1171                         continue;
1172
1173                 if (nft_chain_is_bound(chain))
1174                         continue;
1175
1176                 ctx->chain = chain;
1177
1178                 err = nft_delrule_by_chain(ctx);
1179                 if (err < 0)
1180                         goto out;
1181         }
1182
1183         list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
1184                 if (!nft_is_active_next(ctx->net, set))
1185                         continue;
1186
1187                 if (nft_set_is_anonymous(set) &&
1188                     !list_empty(&set->bindings))
1189                         continue;
1190
1191                 err = nft_delset(ctx, set);
1192                 if (err < 0)
1193                         goto out;
1194         }
1195
1196         list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
1197                 if (!nft_is_active_next(ctx->net, flowtable))
1198                         continue;
1199
1200                 err = nft_delflowtable(ctx, flowtable);
1201                 if (err < 0)
1202                         goto out;
1203         }
1204
1205         list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
1206                 if (!nft_is_active_next(ctx->net, obj))
1207                         continue;
1208
1209                 err = nft_delobj(ctx, obj);
1210                 if (err < 0)
1211                         goto out;
1212         }
1213
1214         list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
1215                 if (!nft_is_active_next(ctx->net, chain))
1216                         continue;
1217
1218                 if (nft_chain_is_bound(chain))
1219                         continue;
1220
1221                 ctx->chain = chain;
1222
1223                 err = nft_delchain(ctx);
1224                 if (err < 0)
1225                         goto out;
1226         }
1227
1228         err = nft_deltable(ctx);
1229 out:
1230         return err;
1231 }
1232
1233 static int nft_flush(struct nft_ctx *ctx, int family)
1234 {
1235         struct nftables_pernet *nft_net = nft_pernet(ctx->net);
1236         const struct nlattr * const *nla = ctx->nla;
1237         struct nft_table *table, *nt;
1238         int err = 0;
1239
1240         list_for_each_entry_safe(table, nt, &nft_net->tables, list) {
1241                 if (family != AF_UNSPEC && table->family != family)
1242                         continue;
1243
1244                 ctx->family = table->family;
1245
1246                 if (!nft_is_active_next(ctx->net, table))
1247                         continue;
1248
1249                 if (nft_table_has_owner(table) && table->nlpid != ctx->portid)
1250                         continue;
1251
1252                 if (nla[NFTA_TABLE_NAME] &&
1253                     nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1254                         continue;
1255
1256                 ctx->table = table;
1257
1258                 err = nft_flush_table(ctx);
1259                 if (err < 0)
1260                         goto out;
1261         }
1262 out:
1263         return err;
1264 }
1265
1266 static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info,
1267                               const struct nlattr * const nla[])
1268 {
1269         struct netlink_ext_ack *extack = info->extack;
1270         u8 genmask = nft_genmask_next(info->net);
1271         u8 family = info->nfmsg->nfgen_family;
1272         struct net *net = info->net;
1273         const struct nlattr *attr;
1274         struct nft_table *table;
1275         struct nft_ctx ctx;
1276
1277         nft_ctx_init(&ctx, net, skb, info->nlh, 0, NULL, NULL, nla);
1278         if (family == AF_UNSPEC ||
1279             (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
1280                 return nft_flush(&ctx, family);
1281
1282         if (nla[NFTA_TABLE_HANDLE]) {
1283                 attr = nla[NFTA_TABLE_HANDLE];
1284                 table = nft_table_lookup_byhandle(net, attr, genmask,
1285                                                   NETLINK_CB(skb).portid);
1286         } else {
1287                 attr = nla[NFTA_TABLE_NAME];
1288                 table = nft_table_lookup(net, attr, family, genmask,
1289                                          NETLINK_CB(skb).portid);
1290         }
1291
1292         if (IS_ERR(table)) {
1293                 NL_SET_BAD_ATTR(extack, attr);
1294                 return PTR_ERR(table);
1295         }
1296
1297         if (info->nlh->nlmsg_flags & NLM_F_NONREC &&
1298             table->use > 0)
1299                 return -EBUSY;
1300
1301         ctx.family = family;
1302         ctx.table = table;
1303
1304         return nft_flush_table(&ctx);
1305 }
1306
1307 static void nf_tables_table_destroy(struct nft_ctx *ctx)
1308 {
1309         if (WARN_ON(ctx->table->use > 0))
1310                 return;
1311
1312         rhltable_destroy(&ctx->table->chains_ht);
1313         kfree(ctx->table->name);
1314         kfree(ctx->table->udata);
1315         kfree(ctx->table);
1316 }
1317
1318 void nft_register_chain_type(const struct nft_chain_type *ctype)
1319 {
1320         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1321         if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
1322                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1323                 return;
1324         }
1325         chain_type[ctype->family][ctype->type] = ctype;
1326         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1327 }
1328 EXPORT_SYMBOL_GPL(nft_register_chain_type);
1329
1330 void nft_unregister_chain_type(const struct nft_chain_type *ctype)
1331 {
1332         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1333         chain_type[ctype->family][ctype->type] = NULL;
1334         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1335 }
1336 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
1337
1338 /*
1339  * Chains
1340  */
1341
1342 static struct nft_chain *
1343 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
1344 {
1345         struct nft_chain *chain;
1346
1347         list_for_each_entry(chain, &table->chains, list) {
1348                 if (chain->handle == handle &&
1349                     nft_active_genmask(chain, genmask))
1350                         return chain;
1351         }
1352
1353         return ERR_PTR(-ENOENT);
1354 }
1355
1356 static bool lockdep_commit_lock_is_held(const struct net *net)
1357 {
1358 #ifdef CONFIG_PROVE_LOCKING
1359         struct nftables_pernet *nft_net = nft_pernet(net);
1360
1361         return lockdep_is_held(&nft_net->commit_mutex);
1362 #else
1363         return true;
1364 #endif
1365 }
1366
1367 static struct nft_chain *nft_chain_lookup(struct net *net,
1368                                           struct nft_table *table,
1369                                           const struct nlattr *nla, u8 genmask)
1370 {
1371         char search[NFT_CHAIN_MAXNAMELEN + 1];
1372         struct rhlist_head *tmp, *list;
1373         struct nft_chain *chain;
1374
1375         if (nla == NULL)
1376                 return ERR_PTR(-EINVAL);
1377
1378         nla_strscpy(search, nla, sizeof(search));
1379
1380         WARN_ON(!rcu_read_lock_held() &&
1381                 !lockdep_commit_lock_is_held(net));
1382
1383         chain = ERR_PTR(-ENOENT);
1384         rcu_read_lock();
1385         list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1386         if (!list)
1387                 goto out_unlock;
1388
1389         rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1390                 if (nft_active_genmask(chain, genmask))
1391                         goto out_unlock;
1392         }
1393         chain = ERR_PTR(-ENOENT);
1394 out_unlock:
1395         rcu_read_unlock();
1396         return chain;
1397 }
1398
1399 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
1400         [NFTA_CHAIN_TABLE]      = { .type = NLA_STRING,
1401                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
1402         [NFTA_CHAIN_HANDLE]     = { .type = NLA_U64 },
1403         [NFTA_CHAIN_NAME]       = { .type = NLA_STRING,
1404                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
1405         [NFTA_CHAIN_HOOK]       = { .type = NLA_NESTED },
1406         [NFTA_CHAIN_POLICY]     = { .type = NLA_U32 },
1407         [NFTA_CHAIN_TYPE]       = { .type = NLA_STRING,
1408                                     .len = NFT_MODULE_AUTOLOAD_LIMIT },
1409         [NFTA_CHAIN_COUNTERS]   = { .type = NLA_NESTED },
1410         [NFTA_CHAIN_FLAGS]      = { .type = NLA_U32 },
1411         [NFTA_CHAIN_ID]         = { .type = NLA_U32 },
1412         [NFTA_CHAIN_USERDATA]   = { .type = NLA_BINARY,
1413                                     .len = NFT_USERDATA_MAXLEN },
1414 };
1415
1416 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1417         [NFTA_HOOK_HOOKNUM]     = { .type = NLA_U32 },
1418         [NFTA_HOOK_PRIORITY]    = { .type = NLA_U32 },
1419         [NFTA_HOOK_DEV]         = { .type = NLA_STRING,
1420                                     .len = IFNAMSIZ - 1 },
1421 };
1422
1423 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1424 {
1425         struct nft_stats *cpu_stats, total;
1426         struct nlattr *nest;
1427         unsigned int seq;
1428         u64 pkts, bytes;
1429         int cpu;
1430
1431         if (!stats)
1432                 return 0;
1433
1434         memset(&total, 0, sizeof(total));
1435         for_each_possible_cpu(cpu) {
1436                 cpu_stats = per_cpu_ptr(stats, cpu);
1437                 do {
1438                         seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1439                         pkts = cpu_stats->pkts;
1440                         bytes = cpu_stats->bytes;
1441                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1442                 total.pkts += pkts;
1443                 total.bytes += bytes;
1444         }
1445         nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
1446         if (nest == NULL)
1447                 goto nla_put_failure;
1448
1449         if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1450                          NFTA_COUNTER_PAD) ||
1451             nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1452                          NFTA_COUNTER_PAD))
1453                 goto nla_put_failure;
1454
1455         nla_nest_end(skb, nest);
1456         return 0;
1457
1458 nla_put_failure:
1459         return -ENOSPC;
1460 }
1461
1462 static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
1463                                    const struct nft_base_chain *basechain)
1464 {
1465         const struct nf_hook_ops *ops = &basechain->ops;
1466         struct nft_hook *hook, *first = NULL;
1467         struct nlattr *nest, *nest_devs;
1468         int n = 0;
1469
1470         nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1471         if (nest == NULL)
1472                 goto nla_put_failure;
1473         if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1474                 goto nla_put_failure;
1475         if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1476                 goto nla_put_failure;
1477
1478         if (nft_base_chain_netdev(family, ops->hooknum)) {
1479                 nest_devs = nla_nest_start_noflag(skb, NFTA_HOOK_DEVS);
1480                 list_for_each_entry(hook, &basechain->hook_list, list) {
1481                         if (!first)
1482                                 first = hook;
1483
1484                         if (nla_put_string(skb, NFTA_DEVICE_NAME,
1485                                            hook->ops.dev->name))
1486                                 goto nla_put_failure;
1487                         n++;
1488                 }
1489                 nla_nest_end(skb, nest_devs);
1490
1491                 if (n == 1 &&
1492                     nla_put_string(skb, NFTA_HOOK_DEV, first->ops.dev->name))
1493                         goto nla_put_failure;
1494         }
1495         nla_nest_end(skb, nest);
1496
1497         return 0;
1498 nla_put_failure:
1499         return -1;
1500 }
1501
1502 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1503                                      u32 portid, u32 seq, int event, u32 flags,
1504                                      int family, const struct nft_table *table,
1505                                      const struct nft_chain *chain)
1506 {
1507         struct nlmsghdr *nlh;
1508
1509         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1510         nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
1511                            NFNETLINK_V0, nft_base_seq(net));
1512         if (!nlh)
1513                 goto nla_put_failure;
1514
1515         if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1516                 goto nla_put_failure;
1517         if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1518                          NFTA_CHAIN_PAD))
1519                 goto nla_put_failure;
1520         if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1521                 goto nla_put_failure;
1522
1523         if (nft_is_base_chain(chain)) {
1524                 const struct nft_base_chain *basechain = nft_base_chain(chain);
1525                 struct nft_stats __percpu *stats;
1526
1527                 if (nft_dump_basechain_hook(skb, family, basechain))
1528                         goto nla_put_failure;
1529
1530                 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1531                                  htonl(basechain->policy)))
1532                         goto nla_put_failure;
1533
1534                 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1535                         goto nla_put_failure;
1536
1537                 stats = rcu_dereference_check(basechain->stats,
1538                                               lockdep_commit_lock_is_held(net));
1539                 if (nft_dump_stats(skb, stats))
1540                         goto nla_put_failure;
1541         }
1542
1543         if (chain->flags &&
1544             nla_put_be32(skb, NFTA_CHAIN_FLAGS, htonl(chain->flags)))
1545                 goto nla_put_failure;
1546
1547         if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1548                 goto nla_put_failure;
1549
1550         if (chain->udata &&
1551             nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata))
1552                 goto nla_put_failure;
1553
1554         nlmsg_end(skb, nlh);
1555         return 0;
1556
1557 nla_put_failure:
1558         nlmsg_trim(skb, nlh);
1559         return -1;
1560 }
1561
1562 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1563 {
1564         struct nftables_pernet *nft_net;
1565         struct sk_buff *skb;
1566         int err;
1567
1568         if (!ctx->report &&
1569             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1570                 return;
1571
1572         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1573         if (skb == NULL)
1574                 goto err;
1575
1576         err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1577                                         event, 0, ctx->family, ctx->table,
1578                                         ctx->chain);
1579         if (err < 0) {
1580                 kfree_skb(skb);
1581                 goto err;
1582         }
1583
1584         nft_net = nft_pernet(ctx->net);
1585         nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
1586         return;
1587 err:
1588         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1589 }
1590
1591 static int nf_tables_dump_chains(struct sk_buff *skb,
1592                                  struct netlink_callback *cb)
1593 {
1594         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1595         unsigned int idx = 0, s_idx = cb->args[0];
1596         struct net *net = sock_net(skb->sk);
1597         int family = nfmsg->nfgen_family;
1598         struct nftables_pernet *nft_net;
1599         const struct nft_table *table;
1600         const struct nft_chain *chain;
1601
1602         rcu_read_lock();
1603         nft_net = nft_pernet(net);
1604         cb->seq = nft_net->base_seq;
1605
1606         list_for_each_entry_rcu(table, &nft_net->tables, list) {
1607                 if (family != NFPROTO_UNSPEC && family != table->family)
1608                         continue;
1609
1610                 list_for_each_entry_rcu(chain, &table->chains, list) {
1611                         if (idx < s_idx)
1612                                 goto cont;
1613                         if (idx > s_idx)
1614                                 memset(&cb->args[1], 0,
1615                                        sizeof(cb->args) - sizeof(cb->args[0]));
1616                         if (!nft_is_active(net, chain))
1617                                 continue;
1618                         if (nf_tables_fill_chain_info(skb, net,
1619                                                       NETLINK_CB(cb->skb).portid,
1620                                                       cb->nlh->nlmsg_seq,
1621                                                       NFT_MSG_NEWCHAIN,
1622                                                       NLM_F_MULTI,
1623                                                       table->family, table,
1624                                                       chain) < 0)
1625                                 goto done;
1626
1627                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1628 cont:
1629                         idx++;
1630                 }
1631         }
1632 done:
1633         rcu_read_unlock();
1634         cb->args[0] = idx;
1635         return skb->len;
1636 }
1637
1638 /* called with rcu_read_lock held */
1639 static int nf_tables_getchain(struct sk_buff *skb, const struct nfnl_info *info,
1640                               const struct nlattr * const nla[])
1641 {
1642         struct netlink_ext_ack *extack = info->extack;
1643         u8 genmask = nft_genmask_cur(info->net);
1644         u8 family = info->nfmsg->nfgen_family;
1645         const struct nft_chain *chain;
1646         struct net *net = info->net;
1647         struct nft_table *table;
1648         struct sk_buff *skb2;
1649         int err;
1650
1651         if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
1652                 struct netlink_dump_control c = {
1653                         .dump = nf_tables_dump_chains,
1654                         .module = THIS_MODULE,
1655                 };
1656
1657                 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
1658         }
1659
1660         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask, 0);
1661         if (IS_ERR(table)) {
1662                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1663                 return PTR_ERR(table);
1664         }
1665
1666         chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
1667         if (IS_ERR(chain)) {
1668                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
1669                 return PTR_ERR(chain);
1670         }
1671
1672         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1673         if (!skb2)
1674                 return -ENOMEM;
1675
1676         err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1677                                         info->nlh->nlmsg_seq, NFT_MSG_NEWCHAIN,
1678                                         0, family, table, chain);
1679         if (err < 0)
1680                 goto err_fill_chain_info;
1681
1682         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
1683
1684 err_fill_chain_info:
1685         kfree_skb(skb2);
1686         return err;
1687 }
1688
1689 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1690         [NFTA_COUNTER_PACKETS]  = { .type = NLA_U64 },
1691         [NFTA_COUNTER_BYTES]    = { .type = NLA_U64 },
1692 };
1693
1694 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1695 {
1696         struct nlattr *tb[NFTA_COUNTER_MAX+1];
1697         struct nft_stats __percpu *newstats;
1698         struct nft_stats *stats;
1699         int err;
1700
1701         err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1702                                           nft_counter_policy, NULL);
1703         if (err < 0)
1704                 return ERR_PTR(err);
1705
1706         if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1707                 return ERR_PTR(-EINVAL);
1708
1709         newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1710         if (newstats == NULL)
1711                 return ERR_PTR(-ENOMEM);
1712
1713         /* Restore old counters on this cpu, no problem. Per-cpu statistics
1714          * are not exposed to userspace.
1715          */
1716         preempt_disable();
1717         stats = this_cpu_ptr(newstats);
1718         stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1719         stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1720         preempt_enable();
1721
1722         return newstats;
1723 }
1724
1725 static void nft_chain_stats_replace(struct nft_trans *trans)
1726 {
1727         struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
1728
1729         if (!nft_trans_chain_stats(trans))
1730                 return;
1731
1732         nft_trans_chain_stats(trans) =
1733                 rcu_replace_pointer(chain->stats, nft_trans_chain_stats(trans),
1734                                     lockdep_commit_lock_is_held(trans->ctx.net));
1735
1736         if (!nft_trans_chain_stats(trans))
1737                 static_branch_inc(&nft_counters_enabled);
1738 }
1739
1740 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1741 {
1742         struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1743         struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1744
1745         if (g0 != g1)
1746                 kvfree(g1);
1747         kvfree(g0);
1748
1749         /* should be NULL either via abort or via successful commit */
1750         WARN_ON_ONCE(chain->rules_next);
1751         kvfree(chain->rules_next);
1752 }
1753
1754 void nf_tables_chain_destroy(struct nft_ctx *ctx)
1755 {
1756         struct nft_chain *chain = ctx->chain;
1757         struct nft_hook *hook, *next;
1758
1759         if (WARN_ON(chain->use > 0))
1760                 return;
1761
1762         /* no concurrent access possible anymore */
1763         nf_tables_chain_free_chain_rules(chain);
1764
1765         if (nft_is_base_chain(chain)) {
1766                 struct nft_base_chain *basechain = nft_base_chain(chain);
1767
1768                 if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
1769                         list_for_each_entry_safe(hook, next,
1770                                                  &basechain->hook_list, list) {
1771                                 list_del_rcu(&hook->list);
1772                                 kfree_rcu(hook, rcu);
1773                         }
1774                 }
1775                 module_put(basechain->type->owner);
1776                 if (rcu_access_pointer(basechain->stats)) {
1777                         static_branch_dec(&nft_counters_enabled);
1778                         free_percpu(rcu_dereference_raw(basechain->stats));
1779                 }
1780                 kfree(chain->name);
1781                 kfree(chain->udata);
1782                 kfree(basechain);
1783         } else {
1784                 kfree(chain->name);
1785                 kfree(chain->udata);
1786                 kfree(chain);
1787         }
1788 }
1789
1790 static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
1791                                               const struct nlattr *attr)
1792 {
1793         struct net_device *dev;
1794         char ifname[IFNAMSIZ];
1795         struct nft_hook *hook;
1796         int err;
1797
1798         hook = kmalloc(sizeof(struct nft_hook), GFP_KERNEL);
1799         if (!hook) {
1800                 err = -ENOMEM;
1801                 goto err_hook_alloc;
1802         }
1803
1804         nla_strscpy(ifname, attr, IFNAMSIZ);
1805         /* nf_tables_netdev_event() is called under rtnl_mutex, this is
1806          * indirectly serializing all the other holders of the commit_mutex with
1807          * the rtnl_mutex.
1808          */
1809         dev = __dev_get_by_name(net, ifname);
1810         if (!dev) {
1811                 err = -ENOENT;
1812                 goto err_hook_dev;
1813         }
1814         hook->ops.dev = dev;
1815         hook->inactive = false;
1816
1817         return hook;
1818
1819 err_hook_dev:
1820         kfree(hook);
1821 err_hook_alloc:
1822         return ERR_PTR(err);
1823 }
1824
1825 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,
1826                                            const struct nft_hook *this)
1827 {
1828         struct nft_hook *hook;
1829
1830         list_for_each_entry(hook, hook_list, list) {
1831                 if (this->ops.dev == hook->ops.dev)
1832                         return hook;
1833         }
1834
1835         return NULL;
1836 }
1837
1838 static int nf_tables_parse_netdev_hooks(struct net *net,
1839                                         const struct nlattr *attr,
1840                                         struct list_head *hook_list)
1841 {
1842         struct nft_hook *hook, *next;
1843         const struct nlattr *tmp;
1844         int rem, n = 0, err;
1845
1846         nla_for_each_nested(tmp, attr, rem) {
1847                 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
1848                         err = -EINVAL;
1849                         goto err_hook;
1850                 }
1851
1852                 hook = nft_netdev_hook_alloc(net, tmp);
1853                 if (IS_ERR(hook)) {
1854                         err = PTR_ERR(hook);
1855                         goto err_hook;
1856                 }
1857                 if (nft_hook_list_find(hook_list, hook)) {
1858                         kfree(hook);
1859                         err = -EEXIST;
1860                         goto err_hook;
1861                 }
1862                 list_add_tail(&hook->list, hook_list);
1863                 n++;
1864
1865                 if (n == NFT_NETDEVICE_MAX) {
1866                         err = -EFBIG;
1867                         goto err_hook;
1868                 }
1869         }
1870
1871         return 0;
1872
1873 err_hook:
1874         list_for_each_entry_safe(hook, next, hook_list, list) {
1875                 list_del(&hook->list);
1876                 kfree(hook);
1877         }
1878         return err;
1879 }
1880
1881 struct nft_chain_hook {
1882         u32                             num;
1883         s32                             priority;
1884         const struct nft_chain_type     *type;
1885         struct list_head                list;
1886 };
1887
1888 static int nft_chain_parse_netdev(struct net *net,
1889                                   struct nlattr *tb[],
1890                                   struct list_head *hook_list)
1891 {
1892         struct nft_hook *hook;
1893         int err;
1894
1895         if (tb[NFTA_HOOK_DEV]) {
1896                 hook = nft_netdev_hook_alloc(net, tb[NFTA_HOOK_DEV]);
1897                 if (IS_ERR(hook))
1898                         return PTR_ERR(hook);
1899
1900                 list_add_tail(&hook->list, hook_list);
1901         } else if (tb[NFTA_HOOK_DEVS]) {
1902                 err = nf_tables_parse_netdev_hooks(net, tb[NFTA_HOOK_DEVS],
1903                                                    hook_list);
1904                 if (err < 0)
1905                         return err;
1906
1907                 if (list_empty(hook_list))
1908                         return -EINVAL;
1909         } else {
1910                 return -EINVAL;
1911         }
1912
1913         return 0;
1914 }
1915
1916 static int nft_chain_parse_hook(struct net *net,
1917                                 const struct nlattr * const nla[],
1918                                 struct nft_chain_hook *hook, u8 family,
1919                                 struct netlink_ext_ack *extack, bool autoload)
1920 {
1921         struct nftables_pernet *nft_net = nft_pernet(net);
1922         struct nlattr *ha[NFTA_HOOK_MAX + 1];
1923         const struct nft_chain_type *type;
1924         int err;
1925
1926         lockdep_assert_held(&nft_net->commit_mutex);
1927         lockdep_nfnl_nft_mutex_not_held();
1928
1929         err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
1930                                           nla[NFTA_CHAIN_HOOK],
1931                                           nft_hook_policy, NULL);
1932         if (err < 0)
1933                 return err;
1934
1935         if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1936             ha[NFTA_HOOK_PRIORITY] == NULL)
1937                 return -EINVAL;
1938
1939         hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1940         hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1941
1942         type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
1943         if (!type)
1944                 return -EOPNOTSUPP;
1945
1946         if (nla[NFTA_CHAIN_TYPE]) {
1947                 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
1948                                                    family, autoload);
1949                 if (IS_ERR(type)) {
1950                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]);
1951                         return PTR_ERR(type);
1952                 }
1953         }
1954         if (hook->num >= NFT_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
1955                 return -EOPNOTSUPP;
1956
1957         if (type->type == NFT_CHAIN_T_NAT &&
1958             hook->priority <= NF_IP_PRI_CONNTRACK)
1959                 return -EOPNOTSUPP;
1960
1961         if (!try_module_get(type->owner)) {
1962                 if (nla[NFTA_CHAIN_TYPE])
1963                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]);
1964                 return -ENOENT;
1965         }
1966
1967         hook->type = type;
1968
1969         INIT_LIST_HEAD(&hook->list);
1970         if (nft_base_chain_netdev(family, hook->num)) {
1971                 err = nft_chain_parse_netdev(net, ha, &hook->list);
1972                 if (err < 0) {
1973                         module_put(type->owner);
1974                         return err;
1975                 }
1976         } else if (ha[NFTA_HOOK_DEV] || ha[NFTA_HOOK_DEVS]) {
1977                 module_put(type->owner);
1978                 return -EOPNOTSUPP;
1979         }
1980
1981         return 0;
1982 }
1983
1984 static void nft_chain_release_hook(struct nft_chain_hook *hook)
1985 {
1986         struct nft_hook *h, *next;
1987
1988         list_for_each_entry_safe(h, next, &hook->list, list) {
1989                 list_del(&h->list);
1990                 kfree(h);
1991         }
1992         module_put(hook->type->owner);
1993 }
1994
1995 struct nft_rules_old {
1996         struct rcu_head h;
1997         struct nft_rule **start;
1998 };
1999
2000 static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
2001                                                      unsigned int alloc)
2002 {
2003         if (alloc > INT_MAX)
2004                 return NULL;
2005
2006         alloc += 1;     /* NULL, ends rules */
2007         if (sizeof(struct nft_rule *) > INT_MAX / alloc)
2008                 return NULL;
2009
2010         alloc *= sizeof(struct nft_rule *);
2011         alloc += sizeof(struct nft_rules_old);
2012
2013         return kvmalloc(alloc, GFP_KERNEL);
2014 }
2015
2016 static void nft_basechain_hook_init(struct nf_hook_ops *ops, u8 family,
2017                                     const struct nft_chain_hook *hook,
2018                                     struct nft_chain *chain)
2019 {
2020         ops->pf                 = family;
2021         ops->hooknum            = hook->num;
2022         ops->priority           = hook->priority;
2023         ops->priv               = chain;
2024         ops->hook               = hook->type->hooks[ops->hooknum];
2025         ops->hook_ops_type      = NF_HOOK_OP_NF_TABLES;
2026 }
2027
2028 static int nft_basechain_init(struct nft_base_chain *basechain, u8 family,
2029                               struct nft_chain_hook *hook, u32 flags)
2030 {
2031         struct nft_chain *chain;
2032         struct nft_hook *h;
2033
2034         basechain->type = hook->type;
2035         INIT_LIST_HEAD(&basechain->hook_list);
2036         chain = &basechain->chain;
2037
2038         if (nft_base_chain_netdev(family, hook->num)) {
2039                 list_splice_init(&hook->list, &basechain->hook_list);
2040                 list_for_each_entry(h, &basechain->hook_list, list)
2041                         nft_basechain_hook_init(&h->ops, family, hook, chain);
2042
2043                 basechain->ops.hooknum  = hook->num;
2044                 basechain->ops.priority = hook->priority;
2045         } else {
2046                 nft_basechain_hook_init(&basechain->ops, family, hook, chain);
2047         }
2048
2049         chain->flags |= NFT_CHAIN_BASE | flags;
2050         basechain->policy = NF_ACCEPT;
2051         if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
2052             nft_chain_offload_priority(basechain) < 0)
2053                 return -EOPNOTSUPP;
2054
2055         flow_block_init(&basechain->flow_block);
2056
2057         return 0;
2058 }
2059
2060 static int nft_chain_add(struct nft_table *table, struct nft_chain *chain)
2061 {
2062         int err;
2063
2064         err = rhltable_insert_key(&table->chains_ht, chain->name,
2065                                   &chain->rhlhead, nft_chain_ht_params);
2066         if (err)
2067                 return err;
2068
2069         list_add_tail_rcu(&chain->list, &table->chains);
2070
2071         return 0;
2072 }
2073
2074 static u64 chain_id;
2075
2076 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
2077                               u8 policy, u32 flags,
2078                               struct netlink_ext_ack *extack)
2079 {
2080         const struct nlattr * const *nla = ctx->nla;
2081         struct nft_table *table = ctx->table;
2082         struct nft_base_chain *basechain;
2083         struct nft_stats __percpu *stats;
2084         struct net *net = ctx->net;
2085         char name[NFT_NAME_MAXLEN];
2086         struct nft_trans *trans;
2087         struct nft_chain *chain;
2088         struct nft_rule **rules;
2089         int err;
2090
2091         if (table->use == UINT_MAX)
2092                 return -EOVERFLOW;
2093
2094         if (nla[NFTA_CHAIN_HOOK]) {
2095                 struct nft_chain_hook hook;
2096
2097                 if (flags & NFT_CHAIN_BINDING)
2098                         return -EOPNOTSUPP;
2099
2100                 err = nft_chain_parse_hook(net, nla, &hook, family, extack,
2101                                            true);
2102                 if (err < 0)
2103                         return err;
2104
2105                 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
2106                 if (basechain == NULL) {
2107                         nft_chain_release_hook(&hook);
2108                         return -ENOMEM;
2109                 }
2110                 chain = &basechain->chain;
2111
2112                 if (nla[NFTA_CHAIN_COUNTERS]) {
2113                         stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2114                         if (IS_ERR(stats)) {
2115                                 nft_chain_release_hook(&hook);
2116                                 kfree(basechain);
2117                                 return PTR_ERR(stats);
2118                         }
2119                         rcu_assign_pointer(basechain->stats, stats);
2120                         static_branch_inc(&nft_counters_enabled);
2121                 }
2122
2123                 err = nft_basechain_init(basechain, family, &hook, flags);
2124                 if (err < 0) {
2125                         nft_chain_release_hook(&hook);
2126                         kfree(basechain);
2127                         return err;
2128                 }
2129         } else {
2130                 if (flags & NFT_CHAIN_BASE)
2131                         return -EINVAL;
2132                 if (flags & NFT_CHAIN_HW_OFFLOAD)
2133                         return -EOPNOTSUPP;
2134
2135                 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
2136                 if (chain == NULL)
2137                         return -ENOMEM;
2138
2139                 chain->flags = flags;
2140         }
2141         ctx->chain = chain;
2142
2143         INIT_LIST_HEAD(&chain->rules);
2144         chain->handle = nf_tables_alloc_handle(table);
2145         chain->table = table;
2146
2147         if (nla[NFTA_CHAIN_NAME]) {
2148                 chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2149         } else {
2150                 if (!(flags & NFT_CHAIN_BINDING)) {
2151                         err = -EINVAL;
2152                         goto err_destroy_chain;
2153                 }
2154
2155                 snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
2156                 chain->name = kstrdup(name, GFP_KERNEL);
2157         }
2158
2159         if (!chain->name) {
2160                 err = -ENOMEM;
2161                 goto err_destroy_chain;
2162         }
2163
2164         if (nla[NFTA_CHAIN_USERDATA]) {
2165                 chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);
2166                 if (chain->udata == NULL) {
2167                         err = -ENOMEM;
2168                         goto err_destroy_chain;
2169                 }
2170                 chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]);
2171         }
2172
2173         rules = nf_tables_chain_alloc_rules(chain, 0);
2174         if (!rules) {
2175                 err = -ENOMEM;
2176                 goto err_destroy_chain;
2177         }
2178
2179         *rules = NULL;
2180         rcu_assign_pointer(chain->rules_gen_0, rules);
2181         rcu_assign_pointer(chain->rules_gen_1, rules);
2182
2183         err = nf_tables_register_hook(net, table, chain);
2184         if (err < 0)
2185                 goto err_destroy_chain;
2186
2187         trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
2188         if (IS_ERR(trans)) {
2189                 err = PTR_ERR(trans);
2190                 goto err_unregister_hook;
2191         }
2192
2193         nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
2194         if (nft_is_base_chain(chain))
2195                 nft_trans_chain_policy(trans) = policy;
2196
2197         err = nft_chain_add(table, chain);
2198         if (err < 0) {
2199                 nft_trans_destroy(trans);
2200                 goto err_unregister_hook;
2201         }
2202
2203         table->use++;
2204
2205         return 0;
2206 err_unregister_hook:
2207         nf_tables_unregister_hook(net, table, chain);
2208 err_destroy_chain:
2209         nf_tables_chain_destroy(ctx);
2210
2211         return err;
2212 }
2213
2214 static bool nft_hook_list_equal(struct list_head *hook_list1,
2215                                 struct list_head *hook_list2)
2216 {
2217         struct nft_hook *hook;
2218         int n = 0, m = 0;
2219
2220         n = 0;
2221         list_for_each_entry(hook, hook_list2, list) {
2222                 if (!nft_hook_list_find(hook_list1, hook))
2223                         return false;
2224
2225                 n++;
2226         }
2227         list_for_each_entry(hook, hook_list1, list)
2228                 m++;
2229
2230         return n == m;
2231 }
2232
2233 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
2234                               u32 flags, const struct nlattr *attr,
2235                               struct netlink_ext_ack *extack)
2236 {
2237         const struct nlattr * const *nla = ctx->nla;
2238         struct nft_table *table = ctx->table;
2239         struct nft_chain *chain = ctx->chain;
2240         struct nft_base_chain *basechain;
2241         struct nft_stats *stats = NULL;
2242         struct nft_chain_hook hook;
2243         struct nf_hook_ops *ops;
2244         struct nft_trans *trans;
2245         int err;
2246
2247         if (chain->flags ^ flags)
2248                 return -EOPNOTSUPP;
2249
2250         if (nla[NFTA_CHAIN_HOOK]) {
2251                 if (!nft_is_base_chain(chain)) {
2252                         NL_SET_BAD_ATTR(extack, attr);
2253                         return -EEXIST;
2254                 }
2255                 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
2256                                            extack, false);
2257                 if (err < 0)
2258                         return err;
2259
2260                 basechain = nft_base_chain(chain);
2261                 if (basechain->type != hook.type) {
2262                         nft_chain_release_hook(&hook);
2263                         NL_SET_BAD_ATTR(extack, attr);
2264                         return -EEXIST;
2265                 }
2266
2267                 if (nft_base_chain_netdev(ctx->family, hook.num)) {
2268                         if (!nft_hook_list_equal(&basechain->hook_list,
2269                                                  &hook.list)) {
2270                                 nft_chain_release_hook(&hook);
2271                                 NL_SET_BAD_ATTR(extack, attr);
2272                                 return -EEXIST;
2273                         }
2274                 } else {
2275                         ops = &basechain->ops;
2276                         if (ops->hooknum != hook.num ||
2277                             ops->priority != hook.priority) {
2278                                 nft_chain_release_hook(&hook);
2279                                 NL_SET_BAD_ATTR(extack, attr);
2280                                 return -EEXIST;
2281                         }
2282                 }
2283                 nft_chain_release_hook(&hook);
2284         }
2285
2286         if (nla[NFTA_CHAIN_HANDLE] &&
2287             nla[NFTA_CHAIN_NAME]) {
2288                 struct nft_chain *chain2;
2289
2290                 chain2 = nft_chain_lookup(ctx->net, table,
2291                                           nla[NFTA_CHAIN_NAME], genmask);
2292                 if (!IS_ERR(chain2)) {
2293                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2294                         return -EEXIST;
2295                 }
2296         }
2297
2298         if (nla[NFTA_CHAIN_COUNTERS]) {
2299                 if (!nft_is_base_chain(chain))
2300                         return -EOPNOTSUPP;
2301
2302                 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
2303                 if (IS_ERR(stats))
2304                         return PTR_ERR(stats);
2305         }
2306
2307         err = -ENOMEM;
2308         trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
2309                                 sizeof(struct nft_trans_chain));
2310         if (trans == NULL)
2311                 goto err;
2312
2313         nft_trans_chain_stats(trans) = stats;
2314         nft_trans_chain_update(trans) = true;
2315
2316         if (nla[NFTA_CHAIN_POLICY])
2317                 nft_trans_chain_policy(trans) = policy;
2318         else
2319                 nft_trans_chain_policy(trans) = -1;
2320
2321         if (nla[NFTA_CHAIN_HANDLE] &&
2322             nla[NFTA_CHAIN_NAME]) {
2323                 struct nftables_pernet *nft_net = nft_pernet(ctx->net);
2324                 struct nft_trans *tmp;
2325                 char *name;
2326
2327                 err = -ENOMEM;
2328                 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
2329                 if (!name)
2330                         goto err;
2331
2332                 err = -EEXIST;
2333                 list_for_each_entry(tmp, &nft_net->commit_list, list) {
2334                         if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
2335                             tmp->ctx.table == table &&
2336                             nft_trans_chain_update(tmp) &&
2337                             nft_trans_chain_name(tmp) &&
2338                             strcmp(name, nft_trans_chain_name(tmp)) == 0) {
2339                                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2340                                 kfree(name);
2341                                 goto err;
2342                         }
2343                 }
2344
2345                 nft_trans_chain_name(trans) = name;
2346         }
2347         nft_trans_commit_list_add_tail(ctx->net, trans);
2348
2349         return 0;
2350 err:
2351         free_percpu(stats);
2352         kfree(trans);
2353         return err;
2354 }
2355
2356 static struct nft_chain *nft_chain_lookup_byid(const struct net *net,
2357                                                const struct nlattr *nla)
2358 {
2359         struct nftables_pernet *nft_net = nft_pernet(net);
2360         u32 id = ntohl(nla_get_be32(nla));
2361         struct nft_trans *trans;
2362
2363         list_for_each_entry(trans, &nft_net->commit_list, list) {
2364                 struct nft_chain *chain = trans->ctx.chain;
2365
2366                 if (trans->msg_type == NFT_MSG_NEWCHAIN &&
2367                     id == nft_trans_chain_id(trans))
2368                         return chain;
2369         }
2370         return ERR_PTR(-ENOENT);
2371 }
2372
2373 static int nf_tables_newchain(struct sk_buff *skb, const struct nfnl_info *info,
2374                               const struct nlattr * const nla[])
2375 {
2376         struct nftables_pernet *nft_net = nft_pernet(info->net);
2377         struct netlink_ext_ack *extack = info->extack;
2378         u8 genmask = nft_genmask_next(info->net);
2379         u8 family = info->nfmsg->nfgen_family;
2380         struct nft_chain *chain = NULL;
2381         struct net *net = info->net;
2382         const struct nlattr *attr;
2383         struct nft_table *table;
2384         u8 policy = NF_ACCEPT;
2385         struct nft_ctx ctx;
2386         u64 handle = 0;
2387         u32 flags = 0;
2388
2389         lockdep_assert_held(&nft_net->commit_mutex);
2390
2391         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask,
2392                                  NETLINK_CB(skb).portid);
2393         if (IS_ERR(table)) {
2394                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2395                 return PTR_ERR(table);
2396         }
2397
2398         chain = NULL;
2399         attr = nla[NFTA_CHAIN_NAME];
2400
2401         if (nla[NFTA_CHAIN_HANDLE]) {
2402                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
2403                 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2404                 if (IS_ERR(chain)) {
2405                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
2406                         return PTR_ERR(chain);
2407                 }
2408                 attr = nla[NFTA_CHAIN_HANDLE];
2409         } else if (nla[NFTA_CHAIN_NAME]) {
2410                 chain = nft_chain_lookup(net, table, attr, genmask);
2411                 if (IS_ERR(chain)) {
2412                         if (PTR_ERR(chain) != -ENOENT) {
2413                                 NL_SET_BAD_ATTR(extack, attr);
2414                                 return PTR_ERR(chain);
2415                         }
2416                         chain = NULL;
2417                 }
2418         } else if (!nla[NFTA_CHAIN_ID]) {
2419                 return -EINVAL;
2420         }
2421
2422         if (nla[NFTA_CHAIN_POLICY]) {
2423                 if (chain != NULL &&
2424                     !nft_is_base_chain(chain)) {
2425                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2426                         return -EOPNOTSUPP;
2427                 }
2428
2429                 if (chain == NULL &&
2430                     nla[NFTA_CHAIN_HOOK] == NULL) {
2431                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
2432                         return -EOPNOTSUPP;
2433                 }
2434
2435                 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
2436                 switch (policy) {
2437                 case NF_DROP:
2438                 case NF_ACCEPT:
2439                         break;
2440                 default:
2441                         return -EINVAL;
2442                 }
2443         }
2444
2445         if (nla[NFTA_CHAIN_FLAGS])
2446                 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
2447         else if (chain)
2448                 flags = chain->flags;
2449
2450         if (flags & ~NFT_CHAIN_FLAGS)
2451                 return -EOPNOTSUPP;
2452
2453         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla);
2454
2455         if (chain != NULL) {
2456                 if (info->nlh->nlmsg_flags & NLM_F_EXCL) {
2457                         NL_SET_BAD_ATTR(extack, attr);
2458                         return -EEXIST;
2459                 }
2460                 if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
2461                         return -EOPNOTSUPP;
2462
2463                 flags |= chain->flags & NFT_CHAIN_BASE;
2464                 return nf_tables_updchain(&ctx, genmask, policy, flags, attr,
2465                                           extack);
2466         }
2467
2468         return nf_tables_addchain(&ctx, family, genmask, policy, flags, extack);
2469 }
2470
2471 static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info,
2472                               const struct nlattr * const nla[])
2473 {
2474         struct netlink_ext_ack *extack = info->extack;
2475         u8 genmask = nft_genmask_next(info->net);
2476         u8 family = info->nfmsg->nfgen_family;
2477         struct net *net = info->net;
2478         const struct nlattr *attr;
2479         struct nft_table *table;
2480         struct nft_chain *chain;
2481         struct nft_rule *rule;
2482         struct nft_ctx ctx;
2483         u64 handle;
2484         u32 use;
2485         int err;
2486
2487         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask,
2488                                  NETLINK_CB(skb).portid);
2489         if (IS_ERR(table)) {
2490                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
2491                 return PTR_ERR(table);
2492         }
2493
2494         if (nla[NFTA_CHAIN_HANDLE]) {
2495                 attr = nla[NFTA_CHAIN_HANDLE];
2496                 handle = be64_to_cpu(nla_get_be64(attr));
2497                 chain = nft_chain_lookup_byhandle(table, handle, genmask);
2498         } else {
2499                 attr = nla[NFTA_CHAIN_NAME];
2500                 chain = nft_chain_lookup(net, table, attr, genmask);
2501         }
2502         if (IS_ERR(chain)) {
2503                 NL_SET_BAD_ATTR(extack, attr);
2504                 return PTR_ERR(chain);
2505         }
2506
2507         if (info->nlh->nlmsg_flags & NLM_F_NONREC &&
2508             chain->use > 0)
2509                 return -EBUSY;
2510
2511         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla);
2512
2513         use = chain->use;
2514         list_for_each_entry(rule, &chain->rules, list) {
2515                 if (!nft_is_active_next(net, rule))
2516                         continue;
2517                 use--;
2518
2519                 err = nft_delrule(&ctx, rule);
2520                 if (err < 0)
2521                         return err;
2522         }
2523
2524         /* There are rules and elements that are still holding references to us,
2525          * we cannot do a recursive removal in this case.
2526          */
2527         if (use > 0) {
2528                 NL_SET_BAD_ATTR(extack, attr);
2529                 return -EBUSY;
2530         }
2531
2532         return nft_delchain(&ctx);
2533 }
2534
2535 /*
2536  * Expressions
2537  */
2538
2539 /**
2540  *      nft_register_expr - register nf_tables expr type
2541  *      @type: expr type
2542  *
2543  *      Registers the expr type for use with nf_tables. Returns zero on
2544  *      success or a negative errno code otherwise.
2545  */
2546 int nft_register_expr(struct nft_expr_type *type)
2547 {
2548         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2549         if (type->family == NFPROTO_UNSPEC)
2550                 list_add_tail_rcu(&type->list, &nf_tables_expressions);
2551         else
2552                 list_add_rcu(&type->list, &nf_tables_expressions);
2553         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2554         return 0;
2555 }
2556 EXPORT_SYMBOL_GPL(nft_register_expr);
2557
2558 /**
2559  *      nft_unregister_expr - unregister nf_tables expr type
2560  *      @type: expr type
2561  *
2562  *      Unregisters the expr typefor use with nf_tables.
2563  */
2564 void nft_unregister_expr(struct nft_expr_type *type)
2565 {
2566         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2567         list_del_rcu(&type->list);
2568         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2569 }
2570 EXPORT_SYMBOL_GPL(nft_unregister_expr);
2571
2572 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2573                                                        struct nlattr *nla)
2574 {
2575         const struct nft_expr_type *type, *candidate = NULL;
2576
2577         list_for_each_entry(type, &nf_tables_expressions, list) {
2578                 if (!nla_strcmp(nla, type->name)) {
2579                         if (!type->family && !candidate)
2580                                 candidate = type;
2581                         else if (type->family == family)
2582                                 candidate = type;
2583                 }
2584         }
2585         return candidate;
2586 }
2587
2588 #ifdef CONFIG_MODULES
2589 static int nft_expr_type_request_module(struct net *net, u8 family,
2590                                         struct nlattr *nla)
2591 {
2592         if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2593                                nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
2594                 return -EAGAIN;
2595
2596         return 0;
2597 }
2598 #endif
2599
2600 static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2601                                                      u8 family,
2602                                                      struct nlattr *nla)
2603 {
2604         const struct nft_expr_type *type;
2605
2606         if (nla == NULL)
2607                 return ERR_PTR(-EINVAL);
2608
2609         type = __nft_expr_type_get(family, nla);
2610         if (type != NULL && try_module_get(type->owner))
2611                 return type;
2612
2613         lockdep_nfnl_nft_mutex_not_held();
2614 #ifdef CONFIG_MODULES
2615         if (type == NULL) {
2616                 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
2617                         return ERR_PTR(-EAGAIN);
2618
2619                 if (nft_request_module(net, "nft-expr-%.*s",
2620                                        nla_len(nla),
2621                                        (char *)nla_data(nla)) == -EAGAIN)
2622                         return ERR_PTR(-EAGAIN);
2623         }
2624 #endif
2625         return ERR_PTR(-ENOENT);
2626 }
2627
2628 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2629         [NFTA_EXPR_NAME]        = { .type = NLA_STRING,
2630                                     .len = NFT_MODULE_AUTOLOAD_LIMIT },
2631         [NFTA_EXPR_DATA]        = { .type = NLA_NESTED },
2632 };
2633
2634 static int nf_tables_fill_expr_info(struct sk_buff *skb,
2635                                     const struct nft_expr *expr)
2636 {
2637         if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
2638                 goto nla_put_failure;
2639
2640         if (expr->ops->dump) {
2641                 struct nlattr *data = nla_nest_start_noflag(skb,
2642                                                             NFTA_EXPR_DATA);
2643                 if (data == NULL)
2644                         goto nla_put_failure;
2645                 if (expr->ops->dump(skb, expr) < 0)
2646                         goto nla_put_failure;
2647                 nla_nest_end(skb, data);
2648         }
2649
2650         return skb->len;
2651
2652 nla_put_failure:
2653         return -1;
2654 };
2655
2656 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2657                   const struct nft_expr *expr)
2658 {
2659         struct nlattr *nest;
2660
2661         nest = nla_nest_start_noflag(skb, attr);
2662         if (!nest)
2663                 goto nla_put_failure;
2664         if (nf_tables_fill_expr_info(skb, expr) < 0)
2665                 goto nla_put_failure;
2666         nla_nest_end(skb, nest);
2667         return 0;
2668
2669 nla_put_failure:
2670         return -1;
2671 }
2672
2673 struct nft_expr_info {
2674         const struct nft_expr_ops       *ops;
2675         const struct nlattr             *attr;
2676         struct nlattr                   *tb[NFT_EXPR_MAXATTR + 1];
2677 };
2678
2679 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2680                                 const struct nlattr *nla,
2681                                 struct nft_expr_info *info)
2682 {
2683         const struct nft_expr_type *type;
2684         const struct nft_expr_ops *ops;
2685         struct nlattr *tb[NFTA_EXPR_MAX + 1];
2686         int err;
2687
2688         err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2689                                           nft_expr_policy, NULL);
2690         if (err < 0)
2691                 return err;
2692
2693         type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
2694         if (IS_ERR(type))
2695                 return PTR_ERR(type);
2696
2697         if (tb[NFTA_EXPR_DATA]) {
2698                 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2699                                                   tb[NFTA_EXPR_DATA],
2700                                                   type->policy, NULL);
2701                 if (err < 0)
2702                         goto err1;
2703         } else
2704                 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2705
2706         if (type->select_ops != NULL) {
2707                 ops = type->select_ops(ctx,
2708                                        (const struct nlattr * const *)info->tb);
2709                 if (IS_ERR(ops)) {
2710                         err = PTR_ERR(ops);
2711 #ifdef CONFIG_MODULES
2712                         if (err == -EAGAIN)
2713                                 if (nft_expr_type_request_module(ctx->net,
2714                                                                  ctx->family,
2715                                                                  tb[NFTA_EXPR_NAME]) != -EAGAIN)
2716                                         err = -ENOENT;
2717 #endif
2718                         goto err1;
2719                 }
2720         } else
2721                 ops = type->ops;
2722
2723         info->attr = nla;
2724         info->ops = ops;
2725
2726         return 0;
2727
2728 err1:
2729         module_put(type->owner);
2730         return err;
2731 }
2732
2733 static int nf_tables_newexpr(const struct nft_ctx *ctx,
2734                              const struct nft_expr_info *expr_info,
2735                              struct nft_expr *expr)
2736 {
2737         const struct nft_expr_ops *ops = expr_info->ops;
2738         int err;
2739
2740         expr->ops = ops;
2741         if (ops->init) {
2742                 err = ops->init(ctx, expr, (const struct nlattr **)expr_info->tb);
2743                 if (err < 0)
2744                         goto err1;
2745         }
2746
2747         return 0;
2748 err1:
2749         expr->ops = NULL;
2750         return err;
2751 }
2752
2753 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2754                                    struct nft_expr *expr)
2755 {
2756         const struct nft_expr_type *type = expr->ops->type;
2757
2758         if (expr->ops->destroy)
2759                 expr->ops->destroy(ctx, expr);
2760         module_put(type->owner);
2761 }
2762
2763 static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2764                                       const struct nlattr *nla)
2765 {
2766         struct nft_expr_info expr_info;
2767         struct nft_expr *expr;
2768         struct module *owner;
2769         int err;
2770
2771         err = nf_tables_expr_parse(ctx, nla, &expr_info);
2772         if (err < 0)
2773                 goto err1;
2774
2775         err = -ENOMEM;
2776         expr = kzalloc(expr_info.ops->size, GFP_KERNEL);
2777         if (expr == NULL)
2778                 goto err2;
2779
2780         err = nf_tables_newexpr(ctx, &expr_info, expr);
2781         if (err < 0)
2782                 goto err3;
2783
2784         return expr;
2785 err3:
2786         kfree(expr);
2787 err2:
2788         owner = expr_info.ops->type->owner;
2789         if (expr_info.ops->type->release_ops)
2790                 expr_info.ops->type->release_ops(expr_info.ops);
2791
2792         module_put(owner);
2793 err1:
2794         return ERR_PTR(err);
2795 }
2796
2797 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
2798 {
2799         int err;
2800
2801         if (src->ops->clone) {
2802                 dst->ops = src->ops;
2803                 err = src->ops->clone(dst, src);
2804                 if (err < 0)
2805                         return err;
2806         } else {
2807                 memcpy(dst, src, src->ops->size);
2808         }
2809
2810         __module_get(src->ops->type->owner);
2811
2812         return 0;
2813 }
2814
2815 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2816 {
2817         nf_tables_expr_destroy(ctx, expr);
2818         kfree(expr);
2819 }
2820
2821 /*
2822  * Rules
2823  */
2824
2825 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2826                                           u64 handle)
2827 {
2828         struct nft_rule *rule;
2829
2830         // FIXME: this sucks
2831         list_for_each_entry_rcu(rule, &chain->rules, list) {
2832                 if (handle == rule->handle)
2833                         return rule;
2834         }
2835
2836         return ERR_PTR(-ENOENT);
2837 }
2838
2839 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2840                                         const struct nlattr *nla)
2841 {
2842         if (nla == NULL)
2843                 return ERR_PTR(-EINVAL);
2844
2845         return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
2846 }
2847
2848 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
2849         [NFTA_RULE_TABLE]       = { .type = NLA_STRING,
2850                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
2851         [NFTA_RULE_CHAIN]       = { .type = NLA_STRING,
2852                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
2853         [NFTA_RULE_HANDLE]      = { .type = NLA_U64 },
2854         [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
2855         [NFTA_RULE_COMPAT]      = { .type = NLA_NESTED },
2856         [NFTA_RULE_POSITION]    = { .type = NLA_U64 },
2857         [NFTA_RULE_USERDATA]    = { .type = NLA_BINARY,
2858                                     .len = NFT_USERDATA_MAXLEN },
2859         [NFTA_RULE_ID]          = { .type = NLA_U32 },
2860         [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
2861         [NFTA_RULE_CHAIN_ID]    = { .type = NLA_U32 },
2862 };
2863
2864 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2865                                     u32 portid, u32 seq, int event,
2866                                     u32 flags, int family,
2867                                     const struct nft_table *table,
2868                                     const struct nft_chain *chain,
2869                                     const struct nft_rule *rule,
2870                                     const struct nft_rule *prule)
2871 {
2872         struct nlmsghdr *nlh;
2873         const struct nft_expr *expr, *next;
2874         struct nlattr *list;
2875         u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2876
2877         nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0,
2878                            nft_base_seq(net));
2879         if (!nlh)
2880                 goto nla_put_failure;
2881
2882         if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2883                 goto nla_put_failure;
2884         if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2885                 goto nla_put_failure;
2886         if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2887                          NFTA_RULE_PAD))
2888                 goto nla_put_failure;
2889
2890         if (event != NFT_MSG_DELRULE && prule) {
2891                 if (nla_put_be64(skb, NFTA_RULE_POSITION,
2892                                  cpu_to_be64(prule->handle),
2893                                  NFTA_RULE_PAD))
2894                         goto nla_put_failure;
2895         }
2896
2897         if (chain->flags & NFT_CHAIN_HW_OFFLOAD)
2898                 nft_flow_rule_stats(chain, rule);
2899
2900         list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
2901         if (list == NULL)
2902                 goto nla_put_failure;
2903         nft_rule_for_each_expr(expr, next, rule) {
2904                 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
2905                         goto nla_put_failure;
2906         }
2907         nla_nest_end(skb, list);
2908
2909         if (rule->udata) {
2910                 struct nft_userdata *udata = nft_userdata(rule);
2911                 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2912                             udata->data) < 0)
2913                         goto nla_put_failure;
2914         }
2915
2916         nlmsg_end(skb, nlh);
2917         return 0;
2918
2919 nla_put_failure:
2920         nlmsg_trim(skb, nlh);
2921         return -1;
2922 }
2923
2924 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2925                                   const struct nft_rule *rule, int event)
2926 {
2927         struct nftables_pernet *nft_net = nft_pernet(ctx->net);
2928         struct sk_buff *skb;
2929         int err;
2930
2931         if (!ctx->report &&
2932             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2933                 return;
2934
2935         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2936         if (skb == NULL)
2937                 goto err;
2938
2939         err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2940                                        event, 0, ctx->family, ctx->table,
2941                                        ctx->chain, rule, NULL);
2942         if (err < 0) {
2943                 kfree_skb(skb);
2944                 goto err;
2945         }
2946
2947         nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
2948         return;
2949 err:
2950         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2951 }
2952
2953 struct nft_rule_dump_ctx {
2954         char *table;
2955         char *chain;
2956 };
2957
2958 static int __nf_tables_dump_rules(struct sk_buff *skb,
2959                                   unsigned int *idx,
2960                                   struct netlink_callback *cb,
2961                                   const struct nft_table *table,
2962                                   const struct nft_chain *chain)
2963 {
2964         struct net *net = sock_net(skb->sk);
2965         const struct nft_rule *rule, *prule;
2966         unsigned int s_idx = cb->args[0];
2967
2968         prule = NULL;
2969         list_for_each_entry_rcu(rule, &chain->rules, list) {
2970                 if (!nft_is_active(net, rule))
2971                         goto cont_skip;
2972                 if (*idx < s_idx)
2973                         goto cont;
2974                 if (*idx > s_idx) {
2975                         memset(&cb->args[1], 0,
2976                                         sizeof(cb->args) - sizeof(cb->args[0]));
2977                 }
2978                 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2979                                         cb->nlh->nlmsg_seq,
2980                                         NFT_MSG_NEWRULE,
2981                                         NLM_F_MULTI | NLM_F_APPEND,
2982                                         table->family,
2983                                         table, chain, rule, prule) < 0)
2984                         return 1;
2985
2986                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2987 cont:
2988                 prule = rule;
2989 cont_skip:
2990                 (*idx)++;
2991         }
2992         return 0;
2993 }
2994
2995 static int nf_tables_dump_rules(struct sk_buff *skb,
2996                                 struct netlink_callback *cb)
2997 {
2998         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2999         const struct nft_rule_dump_ctx *ctx = cb->data;
3000         struct nft_table *table;
3001         const struct nft_chain *chain;
3002         unsigned int idx = 0;
3003         struct net *net = sock_net(skb->sk);
3004         int family = nfmsg->nfgen_family;
3005         struct nftables_pernet *nft_net;
3006
3007         rcu_read_lock();
3008         nft_net = nft_pernet(net);
3009         cb->seq = nft_net->base_seq;
3010
3011         list_for_each_entry_rcu(table, &nft_net->tables, list) {
3012                 if (family != NFPROTO_UNSPEC && family != table->family)
3013                         continue;
3014
3015                 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
3016                         continue;
3017
3018                 if (ctx && ctx->table && ctx->chain) {
3019                         struct rhlist_head *list, *tmp;
3020
3021                         list = rhltable_lookup(&table->chains_ht, ctx->chain,
3022                                                nft_chain_ht_params);
3023                         if (!list)
3024                                 goto done;
3025
3026                         rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
3027                                 if (!nft_is_active(net, chain))
3028                                         continue;
3029                                 __nf_tables_dump_rules(skb, &idx,
3030                                                        cb, table, chain);
3031                                 break;
3032                         }
3033                         goto done;
3034                 }
3035
3036                 list_for_each_entry_rcu(chain, &table->chains, list) {
3037                         if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
3038                                 goto done;
3039                 }
3040
3041                 if (ctx && ctx->table)
3042                         break;
3043         }
3044 done:
3045         rcu_read_unlock();
3046
3047         cb->args[0] = idx;
3048         return skb->len;
3049 }
3050
3051 static int nf_tables_dump_rules_start(struct netlink_callback *cb)
3052 {
3053         const struct nlattr * const *nla = cb->data;
3054         struct nft_rule_dump_ctx *ctx = NULL;
3055
3056         if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
3057                 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
3058                 if (!ctx)
3059                         return -ENOMEM;
3060
3061                 if (nla[NFTA_RULE_TABLE]) {
3062                         ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
3063                                                         GFP_ATOMIC);
3064                         if (!ctx->table) {
3065                                 kfree(ctx);
3066                                 return -ENOMEM;
3067                         }
3068                 }
3069                 if (nla[NFTA_RULE_CHAIN]) {
3070                         ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
3071                                                 GFP_ATOMIC);
3072                         if (!ctx->chain) {
3073                                 kfree(ctx->table);
3074                                 kfree(ctx);
3075                                 return -ENOMEM;
3076                         }
3077                 }
3078         }
3079
3080         cb->data = ctx;
3081         return 0;
3082 }
3083
3084 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
3085 {
3086         struct nft_rule_dump_ctx *ctx = cb->data;
3087
3088         if (ctx) {
3089                 kfree(ctx->table);
3090                 kfree(ctx->chain);
3091                 kfree(ctx);
3092         }
3093         return 0;
3094 }
3095
3096 /* called with rcu_read_lock held */
3097 static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info,
3098                              const struct nlattr * const nla[])
3099 {
3100         struct netlink_ext_ack *extack = info->extack;
3101         u8 genmask = nft_genmask_cur(info->net);
3102         u8 family = info->nfmsg->nfgen_family;
3103         const struct nft_chain *chain;
3104         const struct nft_rule *rule;
3105         struct net *net = info->net;
3106         struct nft_table *table;
3107         struct sk_buff *skb2;
3108         int err;
3109
3110         if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
3111                 struct netlink_dump_control c = {
3112                         .start= nf_tables_dump_rules_start,
3113                         .dump = nf_tables_dump_rules,
3114                         .done = nf_tables_dump_rules_done,
3115                         .module = THIS_MODULE,
3116                         .data = (void *)nla,
3117                 };
3118
3119                 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
3120         }
3121
3122         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask, 0);
3123         if (IS_ERR(table)) {
3124                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3125                 return PTR_ERR(table);
3126         }
3127
3128         chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
3129         if (IS_ERR(chain)) {
3130                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3131                 return PTR_ERR(chain);
3132         }
3133
3134         rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3135         if (IS_ERR(rule)) {
3136                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3137                 return PTR_ERR(rule);
3138         }
3139
3140         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3141         if (!skb2)
3142                 return -ENOMEM;
3143
3144         err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
3145                                        info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
3146                                        family, table, chain, rule, NULL);
3147         if (err < 0)
3148                 goto err_fill_rule_info;
3149
3150         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
3151
3152 err_fill_rule_info:
3153         kfree_skb(skb2);
3154         return err;
3155 }
3156
3157 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
3158                                    struct nft_rule *rule)
3159 {
3160         struct nft_expr *expr, *next;
3161
3162         /*
3163          * Careful: some expressions might not be initialized in case this
3164          * is called on error from nf_tables_newrule().
3165          */
3166         expr = nft_expr_first(rule);
3167         while (nft_expr_more(rule, expr)) {
3168                 next = nft_expr_next(expr);
3169                 nf_tables_expr_destroy(ctx, expr);
3170                 expr = next;
3171         }
3172         kfree(rule);
3173 }
3174
3175 void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)
3176 {
3177         nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
3178         nf_tables_rule_destroy(ctx, rule);
3179 }
3180
3181 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
3182 {
3183         struct nft_expr *expr, *last;
3184         const struct nft_data *data;
3185         struct nft_rule *rule;
3186         int err;
3187
3188         if (ctx->level == NFT_JUMP_STACK_SIZE)
3189                 return -EMLINK;
3190
3191         list_for_each_entry(rule, &chain->rules, list) {
3192                 if (!nft_is_active_next(ctx->net, rule))
3193                         continue;
3194
3195                 nft_rule_for_each_expr(expr, last, rule) {
3196                         if (!expr->ops->validate)
3197                                 continue;
3198
3199                         err = expr->ops->validate(ctx, expr, &data);
3200                         if (err < 0)
3201                                 return err;
3202                 }
3203         }
3204
3205         return 0;
3206 }
3207 EXPORT_SYMBOL_GPL(nft_chain_validate);
3208
3209 static int nft_table_validate(struct net *net, const struct nft_table *table)
3210 {
3211         struct nft_chain *chain;
3212         struct nft_ctx ctx = {
3213                 .net    = net,
3214                 .family = table->family,
3215         };
3216         int err;
3217
3218         list_for_each_entry(chain, &table->chains, list) {
3219                 if (!nft_is_base_chain(chain))
3220                         continue;
3221
3222                 ctx.chain = chain;
3223                 err = nft_chain_validate(&ctx, chain);
3224                 if (err < 0)
3225                         return err;
3226         }
3227
3228         return 0;
3229 }
3230
3231 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3232                                              const struct nlattr *nla);
3233
3234 #define NFT_RULE_MAXEXPRS       128
3235
3236 static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
3237                              const struct nlattr * const nla[])
3238 {
3239         struct nftables_pernet *nft_net = nft_pernet(info->net);
3240         struct netlink_ext_ack *extack = info->extack;
3241         unsigned int size, i, n, ulen = 0, usize = 0;
3242         u8 genmask = nft_genmask_next(info->net);
3243         struct nft_rule *rule, *old_rule = NULL;
3244         struct nft_expr_info *expr_info = NULL;
3245         u8 family = info->nfmsg->nfgen_family;
3246         struct nft_flow_rule *flow = NULL;
3247         struct net *net = info->net;
3248         struct nft_userdata *udata;
3249         struct nft_table *table;
3250         struct nft_chain *chain;
3251         struct nft_trans *trans;
3252         u64 handle, pos_handle;
3253         struct nft_expr *expr;
3254         struct nft_ctx ctx;
3255         struct nlattr *tmp;
3256         int err, rem;
3257
3258         lockdep_assert_held(&nft_net->commit_mutex);
3259
3260         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask,
3261                                  NETLINK_CB(skb).portid);
3262         if (IS_ERR(table)) {
3263                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3264                 return PTR_ERR(table);
3265         }
3266
3267         if (nla[NFTA_RULE_CHAIN]) {
3268                 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3269                                          genmask);
3270                 if (IS_ERR(chain)) {
3271                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3272                         return PTR_ERR(chain);
3273                 }
3274                 if (nft_chain_is_bound(chain))
3275                         return -EOPNOTSUPP;
3276
3277         } else if (nla[NFTA_RULE_CHAIN_ID]) {
3278                 chain = nft_chain_lookup_byid(net, nla[NFTA_RULE_CHAIN_ID]);
3279                 if (IS_ERR(chain)) {
3280                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);
3281                         return PTR_ERR(chain);
3282                 }
3283         } else {
3284                 return -EINVAL;
3285         }
3286
3287         if (nla[NFTA_RULE_HANDLE]) {
3288                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
3289                 rule = __nft_rule_lookup(chain, handle);
3290                 if (IS_ERR(rule)) {
3291                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3292                         return PTR_ERR(rule);
3293                 }
3294
3295                 if (info->nlh->nlmsg_flags & NLM_F_EXCL) {
3296                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3297                         return -EEXIST;
3298                 }
3299                 if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
3300                         old_rule = rule;
3301                 else
3302                         return -EOPNOTSUPP;
3303         } else {
3304                 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE) ||
3305                     info->nlh->nlmsg_flags & NLM_F_REPLACE)
3306                         return -EINVAL;
3307                 handle = nf_tables_alloc_handle(table);
3308
3309                 if (chain->use == UINT_MAX)
3310                         return -EOVERFLOW;
3311
3312                 if (nla[NFTA_RULE_POSITION]) {
3313                         pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
3314                         old_rule = __nft_rule_lookup(chain, pos_handle);
3315                         if (IS_ERR(old_rule)) {
3316                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
3317                                 return PTR_ERR(old_rule);
3318                         }
3319                 } else if (nla[NFTA_RULE_POSITION_ID]) {
3320                         old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
3321                         if (IS_ERR(old_rule)) {
3322                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
3323                                 return PTR_ERR(old_rule);
3324                         }
3325                 }
3326         }
3327
3328         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla);
3329
3330         n = 0;
3331         size = 0;
3332         if (nla[NFTA_RULE_EXPRESSIONS]) {
3333                 expr_info = kvmalloc_array(NFT_RULE_MAXEXPRS,
3334                                            sizeof(struct nft_expr_info),
3335                                            GFP_KERNEL);
3336                 if (!expr_info)
3337                         return -ENOMEM;
3338
3339                 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
3340                         err = -EINVAL;
3341                         if (nla_type(tmp) != NFTA_LIST_ELEM)
3342                                 goto err_release_expr;
3343                         if (n == NFT_RULE_MAXEXPRS)
3344                                 goto err_release_expr;
3345                         err = nf_tables_expr_parse(&ctx, tmp, &expr_info[n]);
3346                         if (err < 0) {
3347                                 NL_SET_BAD_ATTR(extack, tmp);
3348                                 goto err_release_expr;
3349                         }
3350                         size += expr_info[n].ops->size;
3351                         n++;
3352                 }
3353         }
3354         /* Check for overflow of dlen field */
3355         err = -EFBIG;
3356         if (size >= 1 << 12)
3357                 goto err_release_expr;
3358
3359         if (nla[NFTA_RULE_USERDATA]) {
3360                 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
3361                 if (ulen > 0)
3362                         usize = sizeof(struct nft_userdata) + ulen;
3363         }
3364
3365         err = -ENOMEM;
3366         rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
3367         if (rule == NULL)
3368                 goto err_release_expr;
3369
3370         nft_activate_next(net, rule);
3371
3372         rule->handle = handle;
3373         rule->dlen   = size;
3374         rule->udata  = ulen ? 1 : 0;
3375
3376         if (ulen) {
3377                 udata = nft_userdata(rule);
3378                 udata->len = ulen - 1;
3379                 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
3380         }
3381
3382         expr = nft_expr_first(rule);
3383         for (i = 0; i < n; i++) {
3384                 err = nf_tables_newexpr(&ctx, &expr_info[i], expr);
3385                 if (err < 0) {
3386                         NL_SET_BAD_ATTR(extack, expr_info[i].attr);
3387                         goto err_release_rule;
3388                 }
3389
3390                 if (expr_info[i].ops->validate)
3391                         nft_validate_state_update(net, NFT_VALIDATE_NEED);
3392
3393                 expr_info[i].ops = NULL;
3394                 expr = nft_expr_next(expr);
3395         }
3396
3397         if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
3398                 flow = nft_flow_rule_create(net, rule);
3399                 if (IS_ERR(flow)) {
3400                         err = PTR_ERR(flow);
3401                         goto err_release_rule;
3402                 }
3403         }
3404
3405         if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
3406                 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3407                 if (trans == NULL) {
3408                         err = -ENOMEM;
3409                         goto err_destroy_flow_rule;
3410                 }
3411                 err = nft_delrule(&ctx, old_rule);
3412                 if (err < 0) {
3413                         nft_trans_destroy(trans);
3414                         goto err_destroy_flow_rule;
3415                 }
3416
3417                 list_add_tail_rcu(&rule->list, &old_rule->list);
3418         } else {
3419                 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
3420                 if (!trans) {
3421                         err = -ENOMEM;
3422                         goto err_destroy_flow_rule;
3423                 }
3424
3425                 if (info->nlh->nlmsg_flags & NLM_F_APPEND) {
3426                         if (old_rule)
3427                                 list_add_rcu(&rule->list, &old_rule->list);
3428                         else
3429                                 list_add_tail_rcu(&rule->list, &chain->rules);
3430                  } else {
3431                         if (old_rule)
3432                                 list_add_tail_rcu(&rule->list, &old_rule->list);
3433                         else
3434                                 list_add_rcu(&rule->list, &chain->rules);
3435                 }
3436         }
3437         kvfree(expr_info);
3438         chain->use++;
3439
3440         if (flow)
3441                 nft_trans_flow_rule(trans) = flow;
3442
3443         if (nft_net->validate_state == NFT_VALIDATE_DO)
3444                 return nft_table_validate(net, table);
3445
3446         return 0;
3447
3448 err_destroy_flow_rule:
3449         if (flow)
3450                 nft_flow_rule_destroy(flow);
3451 err_release_rule:
3452         nf_tables_rule_release(&ctx, rule);
3453 err_release_expr:
3454         for (i = 0; i < n; i++) {
3455                 if (expr_info[i].ops) {
3456                         module_put(expr_info[i].ops->type->owner);
3457                         if (expr_info[i].ops->type->release_ops)
3458                                 expr_info[i].ops->type->release_ops(expr_info[i].ops);
3459                 }
3460         }
3461         kvfree(expr_info);
3462
3463         return err;
3464 }
3465
3466 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
3467                                              const struct nlattr *nla)
3468 {
3469         struct nftables_pernet *nft_net = nft_pernet(net);
3470         u32 id = ntohl(nla_get_be32(nla));
3471         struct nft_trans *trans;
3472
3473         list_for_each_entry(trans, &nft_net->commit_list, list) {
3474                 struct nft_rule *rule = nft_trans_rule(trans);
3475
3476                 if (trans->msg_type == NFT_MSG_NEWRULE &&
3477                     id == nft_trans_rule_id(trans))
3478                         return rule;
3479         }
3480         return ERR_PTR(-ENOENT);
3481 }
3482
3483 static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,
3484                              const struct nlattr * const nla[])
3485 {
3486         struct netlink_ext_ack *extack = info->extack;
3487         u8 genmask = nft_genmask_next(info->net);
3488         u8 family = info->nfmsg->nfgen_family;
3489         struct nft_chain *chain = NULL;
3490         struct net *net = info->net;
3491         struct nft_table *table;
3492         struct nft_rule *rule;
3493         struct nft_ctx ctx;
3494         int err = 0;
3495
3496         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask,
3497                                  NETLINK_CB(skb).portid);
3498         if (IS_ERR(table)) {
3499                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
3500                 return PTR_ERR(table);
3501         }
3502
3503         if (nla[NFTA_RULE_CHAIN]) {
3504                 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
3505                                          genmask);
3506                 if (IS_ERR(chain)) {
3507                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
3508                         return PTR_ERR(chain);
3509                 }
3510                 if (nft_chain_is_bound(chain))
3511                         return -EOPNOTSUPP;
3512         }
3513
3514         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla);
3515
3516         if (chain) {
3517                 if (nla[NFTA_RULE_HANDLE]) {
3518                         rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
3519                         if (IS_ERR(rule)) {
3520                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
3521                                 return PTR_ERR(rule);
3522                         }
3523
3524                         err = nft_delrule(&ctx, rule);
3525                 } else if (nla[NFTA_RULE_ID]) {
3526                         rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
3527                         if (IS_ERR(rule)) {
3528                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
3529                                 return PTR_ERR(rule);
3530                         }
3531
3532                         err = nft_delrule(&ctx, rule);
3533                 } else {
3534                         err = nft_delrule_by_chain(&ctx);
3535                 }
3536         } else {
3537                 list_for_each_entry(chain, &table->chains, list) {
3538                         if (!nft_is_active_next(net, chain))
3539                                 continue;
3540
3541                         ctx.chain = chain;
3542                         err = nft_delrule_by_chain(&ctx);
3543                         if (err < 0)
3544                                 break;
3545                 }
3546         }
3547
3548         return err;
3549 }
3550
3551 /*
3552  * Sets
3553  */
3554 static const struct nft_set_type *nft_set_types[] = {
3555         &nft_set_hash_fast_type,
3556         &nft_set_hash_type,
3557         &nft_set_rhash_type,
3558         &nft_set_bitmap_type,
3559         &nft_set_rbtree_type,
3560 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
3561         &nft_set_pipapo_avx2_type,
3562 #endif
3563         &nft_set_pipapo_type,
3564 };
3565
3566 #define NFT_SET_FEATURES        (NFT_SET_INTERVAL | NFT_SET_MAP | \
3567                                  NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3568                                  NFT_SET_EVAL)
3569
3570 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
3571 {
3572         return (flags & type->features) == (flags & NFT_SET_FEATURES);
3573 }
3574
3575 /*
3576  * Select a set implementation based on the data characteristics and the
3577  * given policy. The total memory use might not be known if no size is
3578  * given, in that case the amount of memory per element is used.
3579  */
3580 static const struct nft_set_ops *
3581 nft_select_set_ops(const struct nft_ctx *ctx,
3582                    const struct nlattr * const nla[],
3583                    const struct nft_set_desc *desc,
3584                    enum nft_set_policies policy)
3585 {
3586         struct nftables_pernet *nft_net = nft_pernet(ctx->net);
3587         const struct nft_set_ops *ops, *bops;
3588         struct nft_set_estimate est, best;
3589         const struct nft_set_type *type;
3590         u32 flags = 0;
3591         int i;
3592
3593         lockdep_assert_held(&nft_net->commit_mutex);
3594         lockdep_nfnl_nft_mutex_not_held();
3595
3596         if (nla[NFTA_SET_FLAGS] != NULL)
3597                 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3598
3599         bops        = NULL;
3600         best.size   = ~0;
3601         best.lookup = ~0;
3602         best.space  = ~0;
3603
3604         for (i = 0; i < ARRAY_SIZE(nft_set_types); i++) {
3605                 type = nft_set_types[i];
3606                 ops = &type->ops;
3607
3608                 if (!nft_set_ops_candidate(type, flags))
3609                         continue;
3610                 if (!ops->estimate(desc, flags, &est))
3611                         continue;
3612
3613                 switch (policy) {
3614                 case NFT_SET_POL_PERFORMANCE:
3615                         if (est.lookup < best.lookup)
3616                                 break;
3617                         if (est.lookup == best.lookup &&
3618                             est.space < best.space)
3619                                 break;
3620                         continue;
3621                 case NFT_SET_POL_MEMORY:
3622                         if (!desc->size) {
3623                                 if (est.space < best.space)
3624                                         break;
3625                                 if (est.space == best.space &&
3626                                     est.lookup < best.lookup)
3627                                         break;
3628                         } else if (est.size < best.size || !bops) {
3629                                 break;
3630                         }
3631                         continue;
3632                 default:
3633                         break;
3634                 }
3635
3636                 bops = ops;
3637                 best = est;
3638         }
3639
3640         if (bops != NULL)
3641                 return bops;
3642
3643         return ERR_PTR(-EOPNOTSUPP);
3644 }
3645
3646 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
3647         [NFTA_SET_TABLE]                = { .type = NLA_STRING,
3648                                             .len = NFT_TABLE_MAXNAMELEN - 1 },
3649         [NFTA_SET_NAME]                 = { .type = NLA_STRING,
3650                                             .len = NFT_SET_MAXNAMELEN - 1 },
3651         [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
3652         [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
3653         [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
3654         [NFTA_SET_DATA_TYPE]            = { .type = NLA_U32 },
3655         [NFTA_SET_DATA_LEN]             = { .type = NLA_U32 },
3656         [NFTA_SET_POLICY]               = { .type = NLA_U32 },
3657         [NFTA_SET_DESC]                 = { .type = NLA_NESTED },
3658         [NFTA_SET_ID]                   = { .type = NLA_U32 },
3659         [NFTA_SET_TIMEOUT]              = { .type = NLA_U64 },
3660         [NFTA_SET_GC_INTERVAL]          = { .type = NLA_U32 },
3661         [NFTA_SET_USERDATA]             = { .type = NLA_BINARY,
3662                                             .len  = NFT_USERDATA_MAXLEN },
3663         [NFTA_SET_OBJ_TYPE]             = { .type = NLA_U32 },
3664         [NFTA_SET_HANDLE]               = { .type = NLA_U64 },
3665         [NFTA_SET_EXPR]                 = { .type = NLA_NESTED },
3666         [NFTA_SET_EXPRESSIONS]          = { .type = NLA_NESTED },
3667 };
3668
3669 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3670         [NFTA_SET_DESC_SIZE]            = { .type = NLA_U32 },
3671         [NFTA_SET_DESC_CONCAT]          = { .type = NLA_NESTED },
3672 };
3673
3674 static struct nft_set *nft_set_lookup(const struct nft_table *table,
3675                                       const struct nlattr *nla, u8 genmask)
3676 {
3677         struct nft_set *set;
3678
3679         if (nla == NULL)
3680                 return ERR_PTR(-EINVAL);
3681
3682         list_for_each_entry_rcu(set, &table->sets, list) {
3683                 if (!nla_strcmp(nla, set->name) &&
3684                     nft_active_genmask(set, genmask))
3685                         return set;
3686         }
3687         return ERR_PTR(-ENOENT);
3688 }
3689
3690 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3691                                                const struct nlattr *nla,
3692                                                u8 genmask)
3693 {
3694         struct nft_set *set;
3695
3696         list_for_each_entry(set, &table->sets, list) {
3697                 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3698                     nft_active_genmask(set, genmask))
3699                         return set;
3700         }
3701         return ERR_PTR(-ENOENT);
3702 }
3703
3704 static struct nft_set *nft_set_lookup_byid(const struct net *net,
3705                                            const struct nlattr *nla, u8 genmask)
3706 {
3707         struct nftables_pernet *nft_net = nft_pernet(net);
3708         u32 id = ntohl(nla_get_be32(nla));
3709         struct nft_trans *trans;
3710
3711         list_for_each_entry(trans, &nft_net->commit_list, list) {
3712                 if (trans->msg_type == NFT_MSG_NEWSET) {
3713                         struct nft_set *set = nft_trans_set(trans);
3714
3715                         if (id == nft_trans_set_id(trans) &&
3716                             nft_active_genmask(set, genmask))
3717                                 return set;
3718                 }
3719         }
3720         return ERR_PTR(-ENOENT);
3721 }
3722
3723 struct nft_set *nft_set_lookup_global(const struct net *net,
3724                                       const struct nft_table *table,
3725                                       const struct nlattr *nla_set_name,
3726                                       const struct nlattr *nla_set_id,
3727                                       u8 genmask)
3728 {
3729         struct nft_set *set;
3730
3731         set = nft_set_lookup(table, nla_set_name, genmask);
3732         if (IS_ERR(set)) {
3733                 if (!nla_set_id)
3734                         return set;
3735
3736                 set = nft_set_lookup_byid(net, nla_set_id, genmask);
3737         }
3738         return set;
3739 }
3740 EXPORT_SYMBOL_GPL(nft_set_lookup_global);
3741
3742 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3743                                     const char *name)
3744 {
3745         const struct nft_set *i;
3746         const char *p;
3747         unsigned long *inuse;
3748         unsigned int n = 0, min = 0;
3749
3750         p = strchr(name, '%');
3751         if (p != NULL) {
3752                 if (p[1] != 'd' || strchr(p + 2, '%'))
3753                         return -EINVAL;
3754
3755                 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3756                 if (inuse == NULL)
3757                         return -ENOMEM;
3758 cont:
3759                 list_for_each_entry(i, &ctx->table->sets, list) {
3760                         int tmp;
3761
3762                         if (!nft_is_active_next(ctx->net, set))
3763                                 continue;
3764                         if (!sscanf(i->name, name, &tmp))
3765                                 continue;
3766                         if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
3767                                 continue;
3768
3769                         set_bit(tmp - min, inuse);
3770                 }
3771
3772                 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
3773                 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3774                         min += BITS_PER_BYTE * PAGE_SIZE;
3775                         memset(inuse, 0, PAGE_SIZE);
3776                         goto cont;
3777                 }
3778                 free_page((unsigned long)inuse);
3779         }
3780
3781         set->name = kasprintf(GFP_KERNEL, name, min + n);
3782         if (!set->name)
3783                 return -ENOMEM;
3784
3785         list_for_each_entry(i, &ctx->table->sets, list) {
3786                 if (!nft_is_active_next(ctx->net, i))
3787                         continue;
3788                 if (!strcmp(set->name, i->name)) {
3789                         kfree(set->name);
3790                         set->name = NULL;
3791                         return -ENFILE;
3792                 }
3793         }
3794         return 0;
3795 }
3796
3797 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3798 {
3799         u64 ms = be64_to_cpu(nla_get_be64(nla));
3800         u64 max = (u64)(~((u64)0));
3801
3802         max = div_u64(max, NSEC_PER_MSEC);
3803         if (ms >= max)
3804                 return -ERANGE;
3805
3806         ms *= NSEC_PER_MSEC;
3807         *result = nsecs_to_jiffies64(ms);
3808         return 0;
3809 }
3810
3811 __be64 nf_jiffies64_to_msecs(u64 input)
3812 {
3813         return cpu_to_be64(jiffies64_to_msecs(input));
3814 }
3815
3816 static int nf_tables_fill_set_concat(struct sk_buff *skb,
3817                                      const struct nft_set *set)
3818 {
3819         struct nlattr *concat, *field;
3820         int i;
3821
3822         concat = nla_nest_start_noflag(skb, NFTA_SET_DESC_CONCAT);
3823         if (!concat)
3824                 return -ENOMEM;
3825
3826         for (i = 0; i < set->field_count; i++) {
3827                 field = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
3828                 if (!field)
3829                         return -ENOMEM;
3830
3831                 if (nla_put_be32(skb, NFTA_SET_FIELD_LEN,
3832                                  htonl(set->field_len[i])))
3833                         return -ENOMEM;
3834
3835                 nla_nest_end(skb, field);
3836         }
3837
3838         nla_nest_end(skb, concat);
3839
3840         return 0;
3841 }
3842
3843 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3844                               const struct nft_set *set, u16 event, u16 flags)
3845 {
3846         struct nlmsghdr *nlh;
3847         u32 portid = ctx->portid;
3848         struct nlattr *nest;
3849         u32 seq = ctx->seq;
3850         int i;
3851
3852         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3853         nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
3854                            NFNETLINK_V0, nft_base_seq(ctx->net));
3855         if (!nlh)
3856                 goto nla_put_failure;
3857
3858         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3859                 goto nla_put_failure;
3860         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3861                 goto nla_put_failure;
3862         if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3863                          NFTA_SET_PAD))
3864                 goto nla_put_failure;
3865         if (set->flags != 0)
3866                 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3867                         goto nla_put_failure;
3868
3869         if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3870                 goto nla_put_failure;
3871         if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3872                 goto nla_put_failure;
3873         if (set->flags & NFT_SET_MAP) {
3874                 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3875                         goto nla_put_failure;
3876                 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3877                         goto nla_put_failure;
3878         }
3879         if (set->flags & NFT_SET_OBJECT &&
3880             nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3881                 goto nla_put_failure;
3882
3883         if (set->timeout &&
3884             nla_put_be64(skb, NFTA_SET_TIMEOUT,
3885                          nf_jiffies64_to_msecs(set->timeout),
3886                          NFTA_SET_PAD))
3887                 goto nla_put_failure;
3888         if (set->gc_int &&
3889             nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3890                 goto nla_put_failure;
3891
3892         if (set->policy != NFT_SET_POL_PERFORMANCE) {
3893                 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3894                         goto nla_put_failure;
3895         }
3896
3897         if (set->udata &&
3898             nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3899                 goto nla_put_failure;
3900
3901         nest = nla_nest_start_noflag(skb, NFTA_SET_DESC);
3902         if (!nest)
3903                 goto nla_put_failure;
3904         if (set->size &&
3905             nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3906                 goto nla_put_failure;
3907
3908         if (set->field_count > 1 &&
3909             nf_tables_fill_set_concat(skb, set))
3910                 goto nla_put_failure;
3911
3912         nla_nest_end(skb, nest);
3913
3914         if (set->num_exprs == 1) {
3915                 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPR);
3916                 if (nf_tables_fill_expr_info(skb, set->exprs[0]) < 0)
3917                         goto nla_put_failure;
3918
3919                 nla_nest_end(skb, nest);
3920         } else if (set->num_exprs > 1) {
3921                 nest = nla_nest_start_noflag(skb, NFTA_SET_EXPRESSIONS);
3922                 if (nest == NULL)
3923                         goto nla_put_failure;
3924
3925                 for (i = 0; i < set->num_exprs; i++) {
3926                         if (nft_expr_dump(skb, NFTA_LIST_ELEM,
3927                                           set->exprs[i]) < 0)
3928                                 goto nla_put_failure;
3929                 }
3930                 nla_nest_end(skb, nest);
3931         }
3932
3933         nlmsg_end(skb, nlh);
3934         return 0;
3935
3936 nla_put_failure:
3937         nlmsg_trim(skb, nlh);
3938         return -1;
3939 }
3940
3941 static void nf_tables_set_notify(const struct nft_ctx *ctx,
3942                                  const struct nft_set *set, int event,
3943                                  gfp_t gfp_flags)
3944 {
3945         struct nftables_pernet *nft_net = nft_pernet(ctx->net);
3946         struct sk_buff *skb;
3947         u32 portid = ctx->portid;
3948         int err;
3949
3950         if (!ctx->report &&
3951             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
3952                 return;
3953
3954         skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
3955         if (skb == NULL)
3956                 goto err;
3957
3958         err = nf_tables_fill_set(skb, ctx, set, event, 0);
3959         if (err < 0) {
3960                 kfree_skb(skb);
3961                 goto err;
3962         }
3963
3964         nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
3965         return;
3966 err:
3967         nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3968 }
3969
3970 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
3971 {
3972         const struct nft_set *set;
3973         unsigned int idx, s_idx = cb->args[0];
3974         struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3975         struct net *net = sock_net(skb->sk);
3976         struct nft_ctx *ctx = cb->data, ctx_set;
3977         struct nftables_pernet *nft_net;
3978
3979         if (cb->args[1])
3980                 return skb->len;
3981
3982         rcu_read_lock();
3983         nft_net = nft_pernet(net);
3984         cb->seq = nft_net->base_seq;
3985
3986         list_for_each_entry_rcu(table, &nft_net->tables, list) {
3987                 if (ctx->family != NFPROTO_UNSPEC &&
3988                     ctx->family != table->family)
3989                         continue;
3990
3991                 if (ctx->table && ctx->table != table)
3992                         continue;
3993
3994                 if (cur_table) {
3995                         if (cur_table != table)
3996                                 continue;
3997
3998                         cur_table = NULL;
3999                 }
4000                 idx = 0;
4001                 list_for_each_entry_rcu(set, &table->sets, list) {
4002                         if (idx < s_idx)
4003                                 goto cont;
4004                         if (!nft_is_active(net, set))
4005                                 goto cont;
4006
4007                         ctx_set = *ctx;
4008                         ctx_set.table = table;
4009                         ctx_set.family = table->family;
4010
4011                         if (nf_tables_fill_set(skb, &ctx_set, set,
4012                                                NFT_MSG_NEWSET,
4013                                                NLM_F_MULTI) < 0) {
4014                                 cb->args[0] = idx;
4015                                 cb->args[2] = (unsigned long) table;
4016                                 goto done;
4017                         }
4018                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
4019 cont:
4020                         idx++;
4021                 }
4022                 if (s_idx)
4023                         s_idx = 0;
4024         }
4025         cb->args[1] = 1;
4026 done:
4027         rcu_read_unlock();
4028         return skb->len;
4029 }
4030
4031 static int nf_tables_dump_sets_start(struct netlink_callback *cb)
4032 {
4033         struct nft_ctx *ctx_dump = NULL;
4034
4035         ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
4036         if (ctx_dump == NULL)
4037                 return -ENOMEM;
4038
4039         cb->data = ctx_dump;
4040         return 0;
4041 }
4042
4043 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
4044 {
4045         kfree(cb->data);
4046         return 0;
4047 }
4048
4049 /* called with rcu_read_lock held */
4050 static int nf_tables_getset(struct sk_buff *skb, const struct nfnl_info *info,
4051                             const struct nlattr * const nla[])
4052 {
4053         struct netlink_ext_ack *extack = info->extack;
4054         u8 genmask = nft_genmask_cur(info->net);
4055         u8 family = info->nfmsg->nfgen_family;
4056         struct nft_table *table = NULL;
4057         struct net *net = info->net;
4058         const struct nft_set *set;
4059         struct sk_buff *skb2;
4060         struct nft_ctx ctx;
4061         int err;
4062
4063         if (nla[NFTA_SET_TABLE]) {
4064                 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
4065                                          genmask, 0);
4066                 if (IS_ERR(table)) {
4067                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
4068                         return PTR_ERR(table);
4069                 }
4070         }
4071
4072         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
4073
4074         if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
4075                 struct netlink_dump_control c = {
4076                         .start = nf_tables_dump_sets_start,
4077                         .dump = nf_tables_dump_sets,
4078                         .done = nf_tables_dump_sets_done,
4079                         .data = &ctx,
4080                         .module = THIS_MODULE,
4081                 };
4082
4083                 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
4084         }
4085
4086         /* Only accept unspec with dump */
4087         if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC)
4088                 return -EAFNOSUPPORT;
4089         if (!nla[NFTA_SET_TABLE])
4090                 return -EINVAL;
4091
4092         set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
4093         if (IS_ERR(set))
4094                 return PTR_ERR(set);
4095
4096         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
4097         if (skb2 == NULL)
4098                 return -ENOMEM;
4099
4100         err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
4101         if (err < 0)
4102                 goto err_fill_set_info;
4103
4104         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
4105
4106 err_fill_set_info:
4107         kfree_skb(skb2);
4108         return err;
4109 }
4110
4111 static const struct nla_policy nft_concat_policy[NFTA_SET_FIELD_MAX + 1] = {
4112         [NFTA_SET_FIELD_LEN]    = { .type = NLA_U32 },
4113 };
4114
4115 static int nft_set_desc_concat_parse(const struct nlattr *attr,
4116                                      struct nft_set_desc *desc)
4117 {
4118         struct nlattr *tb[NFTA_SET_FIELD_MAX + 1];
4119         u32 len;
4120         int err;
4121
4122         err = nla_parse_nested_deprecated(tb, NFTA_SET_FIELD_MAX, attr,
4123                                           nft_concat_policy, NULL);
4124         if (err < 0)
4125                 return err;
4126
4127         if (!tb[NFTA_SET_FIELD_LEN])
4128                 return -EINVAL;
4129
4130         len = ntohl(nla_get_be32(tb[NFTA_SET_FIELD_LEN]));
4131
4132         if (len * BITS_PER_BYTE / 32 > NFT_REG32_COUNT)
4133                 return -E2BIG;
4134
4135         desc->field_len[desc->field_count++] = len;
4136
4137         return 0;
4138 }
4139
4140 static int nft_set_desc_concat(struct nft_set_desc *desc,
4141                                const struct nlattr *nla)
4142 {
4143         struct nlattr *attr;
4144         int rem, err;
4145
4146         nla_for_each_nested(attr, nla, rem) {
4147                 if (nla_type(attr) != NFTA_LIST_ELEM)
4148                         return -EINVAL;
4149
4150                 err = nft_set_desc_concat_parse(attr, desc);
4151                 if (err < 0)
4152                         return err;
4153         }
4154
4155         return 0;
4156 }
4157
4158 static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
4159                                     const struct nlattr *nla)
4160 {
4161         struct nlattr *da[NFTA_SET_DESC_MAX + 1];
4162         int err;
4163
4164         err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
4165                                           nft_set_desc_policy, NULL);
4166         if (err < 0)
4167                 return err;
4168
4169         if (da[NFTA_SET_DESC_SIZE] != NULL)
4170                 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
4171         if (da[NFTA_SET_DESC_CONCAT])
4172                 err = nft_set_desc_concat(desc, da[NFTA_SET_DESC_CONCAT]);
4173
4174         return err;
4175 }
4176
4177 static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
4178                             const struct nlattr * const nla[])
4179 {
4180         u32 ktype, dtype, flags, policy, gc_int, objtype;
4181         struct netlink_ext_ack *extack = info->extack;
4182         u8 genmask = nft_genmask_next(info->net);
4183         u8 family = info->nfmsg->nfgen_family;
4184         const struct nft_set_ops *ops;
4185         struct nft_expr *expr = NULL;
4186         struct net *net = info->net;
4187         struct nft_set_desc desc;
4188         struct nft_table *table;
4189         unsigned char *udata;
4190         struct nft_set *set;
4191         struct nft_ctx ctx;
4192         size_t alloc_size;
4193         u64 timeout;
4194         char *name;
4195         int err, i;
4196         u16 udlen;
4197         u64 size;
4198
4199         if (nla[NFTA_SET_TABLE] == NULL ||
4200             nla[NFTA_SET_NAME] == NULL ||
4201             nla[NFTA_SET_KEY_LEN] == NULL ||
4202             nla[NFTA_SET_ID] == NULL)
4203                 return -EINVAL;
4204
4205         memset(&desc, 0, sizeof(desc));
4206
4207         ktype = NFT_DATA_VALUE;
4208         if (nla[NFTA_SET_KEY_TYPE] != NULL) {
4209                 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
4210                 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
4211                         return -EINVAL;
4212         }
4213
4214         desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
4215         if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
4216                 return -EINVAL;
4217
4218         flags = 0;
4219         if (nla[NFTA_SET_FLAGS] != NULL) {
4220                 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
4221                 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
4222                               NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
4223                               NFT_SET_MAP | NFT_SET_EVAL |
4224                               NFT_SET_OBJECT | NFT_SET_CONCAT | NFT_SET_EXPR))
4225                         return -EOPNOTSUPP;
4226                 /* Only one of these operations is supported */
4227                 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
4228                              (NFT_SET_MAP | NFT_SET_OBJECT))
4229                         return -EOPNOTSUPP;
4230                 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
4231                              (NFT_SET_EVAL | NFT_SET_OBJECT))
4232                         return -EOPNOTSUPP;
4233         }
4234
4235         dtype = 0;
4236         if (nla[NFTA_SET_DATA_TYPE] != NULL) {
4237                 if (!(flags & NFT_SET_MAP))
4238                         return -EINVAL;
4239
4240                 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
4241                 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
4242                     dtype != NFT_DATA_VERDICT)
4243                         return -EINVAL;
4244
4245                 if (dtype != NFT_DATA_VERDICT) {
4246                         if (nla[NFTA_SET_DATA_LEN] == NULL)
4247                                 return -EINVAL;
4248                         desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
4249                         if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
4250                                 return -EINVAL;
4251                 } else
4252                         desc.dlen = sizeof(struct nft_verdict);
4253         } else if (flags & NFT_SET_MAP)
4254                 return -EINVAL;
4255
4256         if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
4257                 if (!(flags & NFT_SET_OBJECT))
4258                         return -EINVAL;
4259
4260                 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
4261                 if (objtype == NFT_OBJECT_UNSPEC ||
4262                     objtype > NFT_OBJECT_MAX)
4263                         return -EOPNOTSUPP;
4264         } else if (flags & NFT_SET_OBJECT)
4265                 return -EINVAL;
4266         else
4267                 objtype = NFT_OBJECT_UNSPEC;
4268
4269         timeout = 0;
4270         if (nla[NFTA_SET_TIMEOUT] != NULL) {
4271                 if (!(flags & NFT_SET_TIMEOUT))
4272                         return -EINVAL;
4273
4274                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
4275                 if (err)
4276                         return err;
4277         }
4278         gc_int = 0;
4279         if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
4280                 if (!(flags & NFT_SET_TIMEOUT))
4281                         return -EINVAL;
4282                 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
4283         }
4284
4285         policy = NFT_SET_POL_PERFORMANCE;
4286         if (nla[NFTA_SET_POLICY] != NULL)
4287                 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
4288
4289         if (nla[NFTA_SET_DESC] != NULL) {
4290                 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
4291                 if (err < 0)
4292                         return err;
4293         }
4294
4295         if (nla[NFTA_SET_EXPR] || nla[NFTA_SET_EXPRESSIONS])
4296                 desc.expr = true;
4297
4298         table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask,
4299                                  NETLINK_CB(skb).portid);
4300         if (IS_ERR(table)) {
4301                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
4302                 return PTR_ERR(table);
4303         }
4304
4305         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
4306
4307         set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
4308         if (IS_ERR(set)) {
4309                 if (PTR_ERR(set) != -ENOENT) {
4310                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4311                         return PTR_ERR(set);
4312                 }
4313         } else {
4314                 if (info->nlh->nlmsg_flags & NLM_F_EXCL) {
4315                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
4316                         return -EEXIST;
4317                 }
4318                 if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
4319                         return -EOPNOTSUPP;
4320
4321                 return 0;
4322         }
4323
4324         if (!(info->nlh->nlmsg_flags & NLM_F_CREATE))
4325                 return -ENOENT;
4326
4327         ops = nft_select_set_ops(&ctx, nla, &desc, policy);
4328         if (IS_ERR(ops))
4329                 return PTR_ERR(ops);
4330
4331         udlen = 0;
4332         if (nla[NFTA_SET_USERDATA])
4333                 udlen = nla_len(nla[NFTA_SET_USERDATA]);
4334
4335         size = 0;
4336         if (ops->privsize != NULL)
4337                 size = ops->privsize(nla, &desc);
4338         alloc_size = sizeof(*set) + size + udlen;
4339         if (alloc_size < size)
4340                 return -ENOMEM;
4341         set = kvzalloc(alloc_size, GFP_KERNEL);
4342         if (!set)
4343                 return -ENOMEM;
4344
4345         name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
4346         if (!name) {
4347                 err = -ENOMEM;
4348                 goto err_set_name;
4349         }
4350
4351         err = nf_tables_set_alloc_name(&ctx, set, name);
4352         kfree(name);
4353         if (err < 0)
4354                 goto err_set_name;
4355
4356         udata = NULL;
4357         if (udlen) {
4358                 udata = set->data + size;
4359                 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
4360         }
4361
4362         INIT_LIST_HEAD(&set->bindings);
4363         INIT_LIST_HEAD(&set->catchall_list);
4364         set->table = table;
4365         write_pnet(&set->net, net);
4366         set->ops = ops;
4367         set->ktype = ktype;
4368         set->klen = desc.klen;
4369         set->dtype = dtype;
4370         set->objtype = objtype;
4371         set->dlen = desc.dlen;
4372         set->flags = flags;
4373         set->size = desc.size;
4374         set->policy = policy;
4375         set->udlen = udlen;
4376         set->udata = udata;
4377         set->timeout = timeout;
4378         set->gc_int = gc_int;
4379
4380         set->field_count = desc.field_count;
4381         for (i = 0; i < desc.field_count; i++)
4382                 set->field_len[i] = desc.field_len[i];
4383
4384         err = ops->init(set, &desc, nla);
4385         if (err < 0)
4386                 goto err_set_init;
4387
4388         if (nla[NFTA_SET_EXPR]) {
4389                 expr = nft_set_elem_expr_alloc(&ctx, set, nla[NFTA_SET_EXPR]);
4390                 if (IS_ERR(expr)) {
4391                         err = PTR_ERR(expr);
4392                         goto err_set_expr_alloc;
4393                 }
4394                 set->exprs[0] = expr;
4395                 set->num_exprs++;
4396         } else if (nla[NFTA_SET_EXPRESSIONS]) {
4397                 struct nft_expr *expr;
4398                 struct nlattr *tmp;
4399                 int left;
4400
4401                 if (!(flags & NFT_SET_EXPR)) {
4402                         err = -EINVAL;
4403                         goto err_set_expr_alloc;
4404                 }
4405                 i = 0;
4406                 nla_for_each_nested(tmp, nla[NFTA_SET_EXPRESSIONS], left) {
4407                         if (i == NFT_SET_EXPR_MAX) {
4408                                 err = -E2BIG;
4409                                 goto err_set_expr_alloc;
4410                         }
4411                         if (nla_type(tmp) != NFTA_LIST_ELEM) {
4412                                 err = -EINVAL;
4413                                 goto err_set_expr_alloc;
4414                         }
4415                         expr = nft_set_elem_expr_alloc(&ctx, set, tmp);
4416                         if (IS_ERR(expr)) {
4417                                 err = PTR_ERR(expr);
4418                                 goto err_set_expr_alloc;
4419                         }
4420                         set->exprs[i++] = expr;
4421                         set->num_exprs++;
4422                 }
4423         }
4424
4425         set->handle = nf_tables_alloc_handle(table);
4426
4427         err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
4428         if (err < 0)
4429                 goto err_set_expr_alloc;
4430
4431         list_add_tail_rcu(&set->list, &table->sets);
4432         table->use++;
4433         return 0;
4434
4435 err_set_expr_alloc:
4436         for (i = 0; i < set->num_exprs; i++)
4437                 nft_expr_destroy(&ctx, set->exprs[i]);
4438
4439         ops->destroy(set);
4440 err_set_init:
4441         kfree(set->name);
4442 err_set_name:
4443         kvfree(set);
4444         return err;
4445 }
4446
4447 struct nft_set_elem_catchall {
4448         struct list_head        list;
4449         struct rcu_head         rcu;
4450         void                    *elem;
4451 };
4452
4453 static void nft_set_catchall_destroy(const struct nft_ctx *ctx,
4454                                      struct nft_set *set)
4455 {
4456         struct nft_set_elem_catchall *catchall;
4457
4458         list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
4459                 list_del_rcu(&catchall->list);
4460                 nft_set_elem_destroy(set, catchall->elem, true);
4461                 kfree_rcu(catchall);
4462         }
4463 }
4464
4465 static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
4466 {
4467         int i;
4468
4469         if (WARN_ON(set->use > 0))
4470                 return;
4471
4472         for (i = 0; i < set->num_exprs; i++)
4473                 nft_expr_destroy(ctx, set->exprs[i]);
4474
4475         set->ops->destroy(set);
4476         nft_set_catchall_destroy(ctx, set);
4477         kfree(set->name);
4478         kvfree(set);
4479 }
4480
4481 static int nf_tables_delset(struct sk_buff *skb, const struct nfnl_info *info,
4482                             const struct nlattr * const nla[])
4483 {
4484         struct netlink_ext_ack *extack = info->extack;
4485         u8 genmask = nft_genmask_next(info->net);
4486         u8 family = info->nfmsg->nfgen_family;
4487         struct net *net = info->net;
4488         const struct nlattr *attr;
4489         struct nft_table *table;
4490         struct nft_set *set;
4491         struct nft_ctx ctx;
4492
4493         if (info->nfmsg->nfgen_family == NFPROTO_UNSPEC)
4494                 return -EAFNOSUPPORT;
4495
4496         table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
4497                                  genmask, NETLINK_CB(skb).portid);
4498         if (IS_ERR(table)) {
4499                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
4500                 return PTR_ERR(table);
4501         }
4502
4503         if (nla[NFTA_SET_HANDLE]) {
4504                 attr = nla[NFTA_SET_HANDLE];
4505                 set = nft_set_lookup_byhandle(table, attr, genmask);
4506         } else {
4507                 attr = nla[NFTA_SET_NAME];
4508                 set = nft_set_lookup(table, attr, genmask);
4509         }
4510
4511         if (IS_ERR(set)) {
4512                 NL_SET_BAD_ATTR(extack, attr);
4513                 return PTR_ERR(set);
4514         }
4515         if (set->use ||
4516             (info->nlh->nlmsg_flags & NLM_F_NONREC &&
4517              atomic_read(&set->nelems) > 0)) {
4518                 NL_SET_BAD_ATTR(extack, attr);
4519                 return -EBUSY;
4520         }
4521
4522         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
4523
4524         return nft_delset(&ctx, set);
4525 }
4526
4527 static int nft_validate_register_store(const struct nft_ctx *ctx,
4528                                        enum nft_registers reg,
4529                                        const struct nft_data *data,
4530                                        enum nft_data_types type,
4531                                        unsigned int len);
4532
4533 static int nft_setelem_data_validate(const struct nft_ctx *ctx,
4534                                      struct nft_set *set,
4535                                      struct nft_set_elem *elem)
4536 {
4537         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4538         enum nft_registers dreg;
4539
4540         dreg = nft_type_to_reg(set->dtype);
4541         return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
4542                                            set->dtype == NFT_DATA_VERDICT ?
4543                                            NFT_DATA_VERDICT : NFT_DATA_VALUE,
4544                                            set->dlen);
4545 }
4546
4547 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
4548                                         struct nft_set *set,
4549                                         const struct nft_set_iter *iter,
4550                                         struct nft_set_elem *elem)
4551 {
4552         return nft_setelem_data_validate(ctx, set, elem);
4553 }
4554
4555 static int nft_set_catchall_bind_check(const struct nft_ctx *ctx,
4556                                        struct nft_set *set)
4557 {
4558         u8 genmask = nft_genmask_next(ctx->net);
4559         struct nft_set_elem_catchall *catchall;
4560         struct nft_set_elem elem;
4561         struct nft_set_ext *ext;
4562         int ret = 0;
4563
4564         list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
4565                 ext = nft_set_elem_ext(set, catchall->elem);
4566                 if (!nft_set_elem_active(ext, genmask))
4567                         continue;
4568
4569                 elem.priv = catchall->elem;
4570                 ret = nft_setelem_data_validate(ctx, set, &elem);
4571                 if (ret < 0)
4572                         break;
4573         }
4574
4575         return ret;
4576 }
4577
4578 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
4579                        struct nft_set_binding *binding)
4580 {
4581         struct nft_set_binding *i;
4582         struct nft_set_iter iter;
4583
4584         if (set->use == UINT_MAX)
4585                 return -EOVERFLOW;
4586
4587         if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
4588                 return -EBUSY;
4589
4590         if (binding->flags & NFT_SET_MAP) {
4591                 /* If the set is already bound to the same chain all
4592                  * jumps are already validated for that chain.
4593                  */
4594                 list_for_each_entry(i, &set->bindings, list) {
4595                         if (i->flags & NFT_SET_MAP &&
4596                             i->chain == binding->chain)
4597                                 goto bind;
4598                 }
4599
4600                 iter.genmask    = nft_genmask_next(ctx->net);
4601                 iter.skip       = 0;
4602                 iter.count      = 0;
4603                 iter.err        = 0;
4604                 iter.fn         = nf_tables_bind_check_setelem;
4605
4606                 set->ops->walk(ctx, set, &iter);
4607                 if (!iter.err)
4608                         iter.err = nft_set_catchall_bind_check(ctx, set);
4609
4610                 if (iter.err < 0)
4611                         return iter.err;
4612         }
4613 bind:
4614         binding->chain = ctx->chain;
4615         list_add_tail_rcu(&binding->list, &set->bindings);
4616         nft_set_trans_bind(ctx, set);
4617         set->use++;
4618
4619         return 0;
4620 }
4621 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
4622
4623 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
4624                                  struct nft_set_binding *binding, bool event)
4625 {
4626         list_del_rcu(&binding->list);
4627
4628         if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
4629                 list_del_rcu(&set->list);
4630                 if (event)
4631                         nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
4632                                              GFP_KERNEL);
4633         }
4634 }
4635
4636 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
4637                               struct nft_set_binding *binding,
4638                               enum nft_trans_phase phase)
4639 {
4640         switch (phase) {
4641         case NFT_TRANS_PREPARE:
4642                 set->use--;
4643                 return;
4644         case NFT_TRANS_ABORT:
4645         case NFT_TRANS_RELEASE:
4646                 set->use--;
4647                 fallthrough;
4648         default:
4649                 nf_tables_unbind_set(ctx, set, binding,
4650                                      phase == NFT_TRANS_COMMIT);
4651         }
4652 }
4653 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
4654
4655 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
4656 {
4657         if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
4658                 nft_set_destroy(ctx, set);
4659 }
4660 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
4661
4662 const struct nft_set_ext_type nft_set_ext_types[] = {
4663         [NFT_SET_EXT_KEY]               = {
4664                 .align  = __alignof__(u32),
4665         },
4666         [NFT_SET_EXT_DATA]              = {
4667                 .align  = __alignof__(u32),
4668         },
4669         [NFT_SET_EXT_EXPRESSIONS]       = {
4670                 .align  = __alignof__(struct nft_set_elem_expr),
4671         },
4672         [NFT_SET_EXT_OBJREF]            = {
4673                 .len    = sizeof(struct nft_object *),
4674                 .align  = __alignof__(struct nft_object *),
4675         },
4676         [NFT_SET_EXT_FLAGS]             = {
4677                 .len    = sizeof(u8),
4678                 .align  = __alignof__(u8),
4679         },
4680         [NFT_SET_EXT_TIMEOUT]           = {
4681                 .len    = sizeof(u64),
4682                 .align  = __alignof__(u64),
4683         },
4684         [NFT_SET_EXT_EXPIRATION]        = {
4685                 .len    = sizeof(u64),
4686                 .align  = __alignof__(u64),
4687         },
4688         [NFT_SET_EXT_USERDATA]          = {
4689                 .len    = sizeof(struct nft_userdata),
4690                 .align  = __alignof__(struct nft_userdata),
4691         },
4692         [NFT_SET_EXT_KEY_END]           = {
4693                 .align  = __alignof__(u32),
4694         },
4695 };
4696
4697 /*
4698  * Set elements
4699  */
4700
4701 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
4702         [NFTA_SET_ELEM_KEY]             = { .type = NLA_NESTED },
4703         [NFTA_SET_ELEM_DATA]            = { .type = NLA_NESTED },
4704         [NFTA_SET_ELEM_FLAGS]           = { .type = NLA_U32 },
4705         [NFTA_SET_ELEM_TIMEOUT]         = { .type = NLA_U64 },
4706         [NFTA_SET_ELEM_EXPIRATION]      = { .type = NLA_U64 },
4707         [NFTA_SET_ELEM_USERDATA]        = { .type = NLA_BINARY,
4708                                             .len = NFT_USERDATA_MAXLEN },
4709         [NFTA_SET_ELEM_EXPR]            = { .type = NLA_NESTED },
4710         [NFTA_SET_ELEM_OBJREF]          = { .type = NLA_STRING,
4711                                             .len = NFT_OBJ_MAXNAMELEN - 1 },
4712         [NFTA_SET_ELEM_KEY_END]         = { .type = NLA_NESTED },
4713         [NFTA_SET_ELEM_EXPRESSIONS]     = { .type = NLA_NESTED },
4714 };
4715
4716 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
4717         [NFTA_SET_ELEM_LIST_TABLE]      = { .type = NLA_STRING,
4718                                             .len = NFT_TABLE_MAXNAMELEN - 1 },
4719         [NFTA_SET_ELEM_LIST_SET]        = { .type = NLA_STRING,
4720                                             .len = NFT_SET_MAXNAMELEN - 1 },
4721         [NFTA_SET_ELEM_LIST_ELEMENTS]   = { .type = NLA_NESTED },
4722         [NFTA_SET_ELEM_LIST_SET_ID]     = { .type = NLA_U32 },
4723 };
4724
4725 static int nft_set_elem_expr_dump(struct sk_buff *skb,
4726                                   const struct nft_set *set,
4727                                   const struct nft_set_ext *ext)
4728 {
4729         struct nft_set_elem_expr *elem_expr;
4730         u32 size, num_exprs = 0;
4731         struct nft_expr *expr;
4732         struct nlattr *nest;
4733
4734         elem_expr = nft_set_ext_expr(ext);
4735         nft_setelem_expr_foreach(expr, elem_expr, size)
4736                 num_exprs++;
4737
4738         if (num_exprs == 1) {
4739                 expr = nft_setelem_expr_at(elem_expr, 0);
4740                 if (nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, expr) < 0)
4741                         return -1;
4742
4743                 return 0;
4744         } else if (num_exprs > 1) {
4745                 nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_EXPRESSIONS);
4746                 if (nest == NULL)
4747                         goto nla_put_failure;
4748
4749                 nft_setelem_expr_foreach(expr, elem_expr, size) {
4750                         expr = nft_setelem_expr_at(elem_expr, size);
4751                         if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
4752                                 goto nla_put_failure;
4753                 }
4754                 nla_nest_end(skb, nest);
4755         }
4756         return 0;
4757
4758 nla_put_failure:
4759         return -1;
4760 }
4761
4762 static int nf_tables_fill_setelem(struct sk_buff *skb,
4763                                   const struct nft_set *set,
4764                                   const struct nft_set_elem *elem)
4765 {
4766         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4767         unsigned char *b = skb_tail_pointer(skb);
4768         struct nlattr *nest;
4769
4770         nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
4771         if (nest == NULL)
4772                 goto nla_put_failure;
4773
4774         if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY) &&
4775             nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4776                           NFT_DATA_VALUE, set->klen) < 0)
4777                 goto nla_put_failure;
4778
4779         if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END) &&
4780             nft_data_dump(skb, NFTA_SET_ELEM_KEY_END, nft_set_ext_key_end(ext),
4781                           NFT_DATA_VALUE, set->klen) < 0)
4782                 goto nla_put_failure;
4783
4784         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4785             nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
4786                           set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4787                           set->dlen) < 0)
4788                 goto nla_put_failure;
4789
4790         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) &&
4791             nft_set_elem_expr_dump(skb, set, ext))
4792                 goto nla_put_failure;
4793
4794         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4795             nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
4796                            (*nft_set_ext_obj(ext))->key.name) < 0)
4797                 goto nla_put_failure;
4798
4799         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4800             nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4801                          htonl(*nft_set_ext_flags(ext))))
4802                 goto nla_put_failure;
4803
4804         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4805             nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
4806                          nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
4807                          NFTA_SET_ELEM_PAD))
4808                 goto nla_put_failure;
4809
4810         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4811                 u64 expires, now = get_jiffies_64();
4812
4813                 expires = *nft_set_ext_expiration(ext);
4814                 if (time_before64(now, expires))
4815                         expires -= now;
4816                 else
4817                         expires = 0;
4818
4819                 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
4820                                  nf_jiffies64_to_msecs(expires),
4821                                  NFTA_SET_ELEM_PAD))
4822                         goto nla_put_failure;
4823         }
4824
4825         if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4826                 struct nft_userdata *udata;
4827
4828                 udata = nft_set_ext_userdata(ext);
4829                 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4830                             udata->len + 1, udata->data))
4831                         goto nla_put_failure;
4832         }
4833
4834         nla_nest_end(skb, nest);
4835         return 0;
4836
4837 nla_put_failure:
4838         nlmsg_trim(skb, b);
4839         return -EMSGSIZE;
4840 }
4841
4842 struct nft_set_dump_args {
4843         const struct netlink_callback   *cb;
4844         struct nft_set_iter             iter;
4845         struct sk_buff                  *skb;
4846 };
4847
4848 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
4849                                   struct nft_set *set,
4850                                   const struct nft_set_iter *iter,
4851                                   struct nft_set_elem *elem)
4852 {
4853         struct nft_set_dump_args *args;
4854
4855         args = container_of(iter, struct nft_set_dump_args, iter);
4856         return nf_tables_fill_setelem(args->skb, set, elem);
4857 }
4858
4859 struct nft_set_dump_ctx {
4860         const struct nft_set    *set;
4861         struct nft_ctx          ctx;
4862 };
4863
4864 static int nft_set_catchall_dump(struct net *net, struct sk_buff *skb,
4865                                  const struct nft_set *set)
4866 {
4867         struct nft_set_elem_catchall *catchall;
4868         u8 genmask = nft_genmask_cur(net);
4869         struct nft_set_elem elem;
4870         struct nft_set_ext *ext;
4871         int ret = 0;
4872
4873         list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
4874                 ext = nft_set_elem_ext(set, catchall->elem);
4875                 if (!nft_set_elem_active(ext, genmask) ||
4876                     nft_set_elem_expired(ext))
4877                         continue;
4878
4879                 elem.priv = catchall->elem;
4880                 ret = nf_tables_fill_setelem(skb, set, &elem);
4881                 break;
4882         }
4883
4884         return ret;
4885 }
4886
4887 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4888 {
4889         struct nft_set_dump_ctx *dump_ctx = cb->data;
4890         struct net *net = sock_net(skb->sk);
4891         struct nftables_pernet *nft_net;
4892         struct nft_table *table;
4893         struct nft_set *set;
4894         struct nft_set_dump_args args;
4895         bool set_found = false;
4896         struct nlmsghdr *nlh;
4897         struct nlattr *nest;
4898         u32 portid, seq;
4899         int event;
4900
4901         rcu_read_lock();
4902         nft_net = nft_pernet(net);
4903         list_for_each_entry_rcu(table, &nft_net->tables, list) {
4904                 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
4905                     dump_ctx->ctx.family != table->family)
4906                         continue;
4907
4908                 if (table != dump_ctx->ctx.table)
4909                         continue;
4910
4911                 list_for_each_entry_rcu(set, &table->sets, list) {
4912                         if (set == dump_ctx->set) {
4913                                 set_found = true;
4914                                 break;
4915                         }
4916                 }
4917                 break;
4918         }
4919
4920         if (!set_found) {
4921                 rcu_read_unlock();
4922                 return -ENOENT;
4923         }
4924
4925         event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
4926         portid = NETLINK_CB(cb->skb).portid;
4927         seq    = cb->nlh->nlmsg_seq;
4928
4929         nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI,
4930                            table->family, NFNETLINK_V0, nft_base_seq(net));
4931         if (!nlh)
4932                 goto nla_put_failure;
4933
4934         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
4935                 goto nla_put_failure;
4936         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4937                 goto nla_put_failure;
4938
4939         nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4940         if (nest == NULL)
4941                 goto nla_put_failure;
4942
4943         args.cb                 = cb;
4944         args.skb                = skb;
4945         args.iter.genmask       = nft_genmask_cur(net);
4946         args.iter.skip          = cb->args[0];
4947         args.iter.count         = 0;
4948         args.iter.err           = 0;
4949         args.iter.fn            = nf_tables_dump_setelem;
4950         set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4951
4952         if (!args.iter.err && args.iter.count == cb->args[0])
4953                 args.iter.err = nft_set_catchall_dump(net, skb, set);
4954         rcu_read_unlock();
4955
4956         nla_nest_end(skb, nest);
4957         nlmsg_end(skb, nlh);
4958
4959         if (args.iter.err && args.iter.err != -EMSGSIZE)
4960                 return args.iter.err;
4961         if (args.iter.count == cb->args[0])
4962                 return 0;
4963
4964         cb->args[0] = args.iter.count;
4965         return skb->len;
4966
4967 nla_put_failure:
4968         rcu_read_unlock();
4969         return -ENOSPC;
4970 }
4971
4972 static int nf_tables_dump_set_start(struct netlink_callback *cb)
4973 {
4974         struct nft_set_dump_ctx *dump_ctx = cb->data;
4975
4976         cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4977
4978         return cb->data ? 0 : -ENOMEM;
4979 }
4980
4981 static int nf_tables_dump_set_done(struct netlink_callback *cb)
4982 {
4983         kfree(cb->data);
4984         return 0;
4985 }
4986
4987 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4988                                        const struct nft_ctx *ctx, u32 seq,
4989                                        u32 portid, int event, u16 flags,
4990                                        const struct nft_set *set,
4991                                        const struct nft_set_elem *elem)
4992 {
4993         struct nlmsghdr *nlh;
4994         struct nlattr *nest;
4995         int err;
4996
4997         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4998         nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
4999                            NFNETLINK_V0, nft_base_seq(ctx->net));
5000         if (!nlh)
5001                 goto nla_put_failure;
5002
5003         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
5004                 goto nla_put_failure;
5005         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
5006                 goto nla_put_failure;
5007
5008         nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
5009         if (nest == NULL)
5010                 goto nla_put_failure;
5011
5012         err = nf_tables_fill_setelem(skb, set, elem);
5013         if (err < 0)
5014                 goto nla_put_failure;
5015
5016         nla_nest_end(skb, nest);
5017
5018         nlmsg_end(skb, nlh);
5019         return 0;
5020
5021 nla_put_failure:
5022         nlmsg_trim(skb, nlh);
5023         return -1;
5024 }
5025
5026 static int nft_setelem_parse_flags(const struct nft_set *set,
5027                                    const struct nlattr *attr, u32 *flags)
5028 {
5029         if (attr == NULL)
5030                 return 0;
5031
5032         *flags = ntohl(nla_get_be32(attr));
5033         if (*flags & ~(NFT_SET_ELEM_INTERVAL_END | NFT_SET_ELEM_CATCHALL))
5034                 return -EOPNOTSUPP;
5035         if (!(set->flags & NFT_SET_INTERVAL) &&
5036             *flags & NFT_SET_ELEM_INTERVAL_END)
5037                 return -EINVAL;
5038
5039         return 0;
5040 }
5041
5042 static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set,
5043                                  struct nft_data *key, struct nlattr *attr)
5044 {
5045         struct nft_data_desc desc;
5046         int err;
5047
5048         err = nft_data_init(ctx, key, NFT_DATA_VALUE_MAXLEN, &desc, attr);
5049         if (err < 0)
5050                 return err;
5051
5052         if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
5053                 nft_data_release(key, desc.type);
5054                 return -EINVAL;
5055         }
5056
5057         return 0;
5058 }
5059
5060 static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
5061                                   struct nft_data_desc *desc,
5062                                   struct nft_data *data,
5063                                   struct nlattr *attr)
5064 {
5065         int err;
5066
5067         err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr);
5068         if (err < 0)
5069                 return err;
5070
5071         if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) {
5072                 nft_data_release(data, desc->type);
5073                 return -EINVAL;
5074         }
5075
5076         return 0;
5077 }
5078
5079 static void *nft_setelem_catchall_get(const struct net *net,
5080                                       const struct nft_set *set)
5081 {
5082         struct nft_set_elem_catchall *catchall;
5083         u8 genmask = nft_genmask_cur(net);
5084         struct nft_set_ext *ext;
5085         void *priv = NULL;
5086
5087         list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
5088                 ext = nft_set_elem_ext(set, catchall->elem);
5089                 if (!nft_set_elem_active(ext, genmask) ||
5090                     nft_set_elem_expired(ext))
5091                         continue;
5092
5093                 priv = catchall->elem;
5094                 break;
5095         }
5096
5097         return priv;
5098 }
5099
5100 static int nft_setelem_get(struct nft_ctx *ctx, struct nft_set *set,
5101                            struct nft_set_elem *elem, u32 flags)
5102 {
5103         void *priv;
5104
5105         if (!(flags & NFT_SET_ELEM_CATCHALL)) {
5106                 priv = set->ops->get(ctx->net, set, elem, flags);
5107                 if (IS_ERR(priv))
5108                         return PTR_ERR(priv);
5109         } else {
5110                 priv = nft_setelem_catchall_get(ctx->net, set);
5111                 if (!priv)
5112                         return -ENOENT;
5113         }
5114         elem->priv = priv;
5115
5116         return 0;
5117 }
5118
5119 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
5120                             const struct nlattr *attr)
5121 {
5122         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5123         struct nft_set_elem elem;
5124         struct sk_buff *skb;
5125         uint32_t flags = 0;
5126         int err;
5127
5128         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5129                                           nft_set_elem_policy, NULL);
5130         if (err < 0)
5131                 return err;
5132
5133         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5134         if (err < 0)
5135                 return err;
5136
5137         if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL))
5138                 return -EINVAL;
5139
5140         if (nla[NFTA_SET_ELEM_KEY]) {
5141                 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5142                                             nla[NFTA_SET_ELEM_KEY]);
5143                 if (err < 0)
5144                         return err;
5145         }
5146
5147         if (nla[NFTA_SET_ELEM_KEY_END]) {
5148                 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5149                                             nla[NFTA_SET_ELEM_KEY_END]);
5150                 if (err < 0)
5151                         return err;
5152         }
5153
5154         err = nft_setelem_get(ctx, set, &elem, flags);
5155         if (err < 0)
5156                 return err;
5157
5158         err = -ENOMEM;
5159         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
5160         if (skb == NULL)
5161                 return err;
5162
5163         err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
5164                                           NFT_MSG_NEWSETELEM, 0, set, &elem);
5165         if (err < 0)
5166                 goto err_fill_setelem;
5167
5168         return nfnetlink_unicast(skb, ctx->net, ctx->portid);
5169
5170 err_fill_setelem:
5171         kfree_skb(skb);
5172         return err;
5173 }
5174
5175 /* called with rcu_read_lock held */
5176 static int nf_tables_getsetelem(struct sk_buff *skb,
5177                                 const struct nfnl_info *info,
5178                                 const struct nlattr * const nla[])
5179 {
5180         struct netlink_ext_ack *extack = info->extack;
5181         u8 genmask = nft_genmask_cur(info->net);
5182         u8 family = info->nfmsg->nfgen_family;
5183         struct net *net = info->net;
5184         struct nft_table *table;
5185         struct nft_set *set;
5186         struct nlattr *attr;
5187         struct nft_ctx ctx;
5188         int rem, err = 0;
5189
5190         table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
5191                                  genmask, NETLINK_CB(skb).portid);
5192         if (IS_ERR(table)) {
5193                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
5194                 return PTR_ERR(table);
5195         }
5196
5197         set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
5198         if (IS_ERR(set))
5199                 return PTR_ERR(set);
5200
5201         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
5202
5203         if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
5204                 struct netlink_dump_control c = {
5205                         .start = nf_tables_dump_set_start,
5206                         .dump = nf_tables_dump_set,
5207                         .done = nf_tables_dump_set_done,
5208                         .module = THIS_MODULE,
5209                 };
5210                 struct nft_set_dump_ctx dump_ctx = {
5211                         .set = set,
5212                         .ctx = ctx,
5213                 };
5214
5215                 c.data = &dump_ctx;
5216                 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
5217         }
5218
5219         if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
5220                 return -EINVAL;
5221
5222         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
5223                 err = nft_get_set_elem(&ctx, set, attr);
5224                 if (err < 0)
5225                         break;
5226         }
5227
5228         return err;
5229 }
5230
5231 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
5232                                      const struct nft_set *set,
5233                                      const struct nft_set_elem *elem,
5234                                      int event, u16 flags)
5235 {
5236         struct nftables_pernet *nft_net;
5237         struct net *net = ctx->net;
5238         u32 portid = ctx->portid;
5239         struct sk_buff *skb;
5240         int err;
5241
5242         if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5243                 return;
5244
5245         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5246         if (skb == NULL)
5247                 goto err;
5248
5249         err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
5250                                           set, elem);
5251         if (err < 0) {
5252                 kfree_skb(skb);
5253                 goto err;
5254         }
5255
5256         nft_net = nft_pernet(net);
5257         nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
5258         return;
5259 err:
5260         nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
5261 }
5262
5263 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
5264                                               int msg_type,
5265                                               struct nft_set *set)
5266 {
5267         struct nft_trans *trans;
5268
5269         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
5270         if (trans == NULL)
5271                 return NULL;
5272
5273         nft_trans_elem_set(trans) = set;
5274         return trans;
5275 }
5276
5277 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx,
5278                                          const struct nft_set *set,
5279                                          const struct nlattr *attr)
5280 {
5281         struct nft_expr *expr;
5282         int err;
5283
5284         expr = nft_expr_init(ctx, attr);
5285         if (IS_ERR(expr))
5286                 return expr;
5287
5288         err = -EOPNOTSUPP;
5289         if (!(expr->ops->type->flags & NFT_EXPR_STATEFUL))
5290                 goto err_set_elem_expr;
5291
5292         if (expr->ops->type->flags & NFT_EXPR_GC) {
5293                 if (set->flags & NFT_SET_TIMEOUT)
5294                         goto err_set_elem_expr;
5295                 if (!set->ops->gc_init)
5296                         goto err_set_elem_expr;
5297                 set->ops->gc_init(set);
5298         }
5299
5300         return expr;
5301
5302 err_set_elem_expr:
5303         nft_expr_destroy(ctx, expr);
5304         return ERR_PTR(err);
5305 }
5306
5307 void *nft_set_elem_init(const struct nft_set *set,
5308                         const struct nft_set_ext_tmpl *tmpl,
5309                         const u32 *key, const u32 *key_end,
5310                         const u32 *data, u64 timeout, u64 expiration, gfp_t gfp)
5311 {
5312         struct nft_set_ext *ext;
5313         void *elem;
5314
5315         elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
5316         if (elem == NULL)
5317                 return NULL;
5318
5319         ext = nft_set_elem_ext(set, elem);
5320         nft_set_ext_init(ext, tmpl);
5321
5322         if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY))
5323                 memcpy(nft_set_ext_key(ext), key, set->klen);
5324         if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
5325                 memcpy(nft_set_ext_key_end(ext), key_end, set->klen);
5326         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5327                 memcpy(nft_set_ext_data(ext), data, set->dlen);
5328         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
5329                 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
5330                 if (expiration == 0)
5331                         *nft_set_ext_expiration(ext) += timeout;
5332         }
5333         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
5334                 *nft_set_ext_timeout(ext) = timeout;
5335
5336         return elem;
5337 }
5338
5339 static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
5340                                         struct nft_expr *expr)
5341 {
5342         if (expr->ops->destroy_clone) {
5343                 expr->ops->destroy_clone(ctx, expr);
5344                 module_put(expr->ops->type->owner);
5345         } else {
5346                 nf_tables_expr_destroy(ctx, expr);
5347         }
5348 }
5349
5350 static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx,
5351                                       struct nft_set_elem_expr *elem_expr)
5352 {
5353         struct nft_expr *expr;
5354         u32 size;
5355
5356         nft_setelem_expr_foreach(expr, elem_expr, size)
5357                 __nft_set_elem_expr_destroy(ctx, expr);
5358 }
5359
5360 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
5361                           bool destroy_expr)
5362 {
5363         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5364         struct nft_ctx ctx = {
5365                 .net    = read_pnet(&set->net),
5366                 .family = set->table->family,
5367         };
5368
5369         nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
5370         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
5371                 nft_data_release(nft_set_ext_data(ext), set->dtype);
5372         if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))
5373                 nft_set_elem_expr_destroy(&ctx, nft_set_ext_expr(ext));
5374
5375         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
5376                 (*nft_set_ext_obj(ext))->use--;
5377         kfree(elem);
5378 }
5379 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
5380
5381 /* Only called from commit path, nft_setelem_data_deactivate() already deals
5382  * with the refcounting from the preparation phase.
5383  */
5384 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
5385                                        const struct nft_set *set, void *elem)
5386 {
5387         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
5388
5389         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))
5390                 nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));
5391
5392         kfree(elem);
5393 }
5394
5395 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
5396                             struct nft_expr *expr_array[])
5397 {
5398         struct nft_expr *expr;
5399         int err, i, k;
5400
5401         for (i = 0; i < set->num_exprs; i++) {
5402                 expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL);
5403                 if (!expr)
5404                         goto err_expr;
5405
5406                 err = nft_expr_clone(expr, set->exprs[i]);
5407                 if (err < 0) {
5408                         nft_expr_destroy(ctx, expr);
5409                         goto err_expr;
5410                 }
5411                 expr_array[i] = expr;
5412         }
5413
5414         return 0;
5415
5416 err_expr:
5417         for (k = i - 1; k >= 0; k--)
5418                 nft_expr_destroy(ctx, expr_array[k]);
5419
5420         return -ENOMEM;
5421 }
5422
5423 static int nft_set_elem_expr_setup(struct nft_ctx *ctx,
5424                                    const struct nft_set_ext *ext,
5425                                    struct nft_expr *expr_array[],
5426                                    u32 num_exprs)
5427 {
5428         struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext);
5429         struct nft_expr *expr;
5430         int i, err;
5431
5432         for (i = 0; i < num_exprs; i++) {
5433                 expr = nft_setelem_expr_at(elem_expr, elem_expr->size);
5434                 err = nft_expr_clone(expr, expr_array[i]);
5435                 if (err < 0)
5436                         goto err_elem_expr_setup;
5437
5438                 elem_expr->size += expr_array[i]->ops->size;
5439                 nft_expr_destroy(ctx, expr_array[i]);
5440                 expr_array[i] = NULL;
5441         }
5442
5443         return 0;
5444
5445 err_elem_expr_setup:
5446         for (; i < num_exprs; i++) {
5447                 nft_expr_destroy(ctx, expr_array[i]);
5448                 expr_array[i] = NULL;
5449         }
5450
5451         return -ENOMEM;
5452 }
5453
5454 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net,
5455                                             const struct nft_set *set)
5456 {
5457         struct nft_set_elem_catchall *catchall;
5458         u8 genmask = nft_genmask_cur(net);
5459         struct nft_set_ext *ext;
5460
5461         list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
5462                 ext = nft_set_elem_ext(set, catchall->elem);
5463                 if (nft_set_elem_active(ext, genmask) &&
5464                     !nft_set_elem_expired(ext))
5465                         return ext;
5466         }
5467
5468         return NULL;
5469 }
5470 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup);
5471
5472 void *nft_set_catchall_gc(const struct nft_set *set)
5473 {
5474         struct nft_set_elem_catchall *catchall, *next;
5475         struct nft_set_ext *ext;
5476         void *elem = NULL;
5477
5478         list_for_each_entry_safe(catchall, next, &set->catchall_list, list) {
5479                 ext = nft_set_elem_ext(set, catchall->elem);
5480
5481                 if (!nft_set_elem_expired(ext) ||
5482                     nft_set_elem_mark_busy(ext))
5483                         continue;
5484
5485                 elem = catchall->elem;
5486                 list_del_rcu(&catchall->list);
5487                 kfree_rcu(catchall, rcu);
5488                 break;
5489         }
5490
5491         return elem;
5492 }
5493 EXPORT_SYMBOL_GPL(nft_set_catchall_gc);
5494
5495 static int nft_setelem_catchall_insert(const struct net *net,
5496                                        struct nft_set *set,
5497                                        const struct nft_set_elem *elem,
5498                                        struct nft_set_ext **pext)
5499 {
5500         struct nft_set_elem_catchall *catchall;
5501         u8 genmask = nft_genmask_next(net);
5502         struct nft_set_ext *ext;
5503
5504         list_for_each_entry(catchall, &set->catchall_list, list) {
5505                 ext = nft_set_elem_ext(set, catchall->elem);
5506                 if (nft_set_elem_active(ext, genmask)) {
5507                         *pext = ext;
5508                         return -EEXIST;
5509                 }
5510         }
5511
5512         catchall = kmalloc(sizeof(*catchall), GFP_KERNEL);
5513         if (!catchall)
5514                 return -ENOMEM;
5515
5516         catchall->elem = elem->priv;
5517         list_add_tail_rcu(&catchall->list, &set->catchall_list);
5518
5519         return 0;
5520 }
5521
5522 static int nft_setelem_insert(const struct net *net,
5523                               struct nft_set *set,
5524                               const struct nft_set_elem *elem,
5525                               struct nft_set_ext **ext, unsigned int flags)
5526 {
5527         int ret;
5528
5529         if (flags & NFT_SET_ELEM_CATCHALL)
5530                 ret = nft_setelem_catchall_insert(net, set, elem, ext);
5531         else
5532                 ret = set->ops->insert(net, set, elem, ext);
5533
5534         return ret;
5535 }
5536
5537 static bool nft_setelem_is_catchall(const struct nft_set *set,
5538                                     const struct nft_set_elem *elem)
5539 {
5540         struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5541
5542         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
5543             *nft_set_ext_flags(ext) & NFT_SET_ELEM_CATCHALL)
5544                 return true;
5545
5546         return false;
5547 }
5548
5549 static void nft_setelem_activate(struct net *net, struct nft_set *set,
5550                                  struct nft_set_elem *elem)
5551 {
5552         struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
5553
5554         if (nft_setelem_is_catchall(set, elem)) {
5555                 nft_set_elem_change_active(net, set, ext);
5556                 nft_set_elem_clear_busy(ext);
5557         } else {
5558                 set->ops->activate(net, set, elem);
5559         }
5560 }
5561
5562 static int nft_setelem_catchall_deactivate(const struct net *net,
5563                                            struct nft_set *set,
5564                                            struct nft_set_elem *elem)
5565 {
5566         struct nft_set_elem_catchall *catchall;
5567         struct nft_set_ext *ext;
5568
5569         list_for_each_entry(catchall, &set->catchall_list, list) {
5570                 ext = nft_set_elem_ext(set, catchall->elem);
5571                 if (!nft_is_active(net, ext) ||
5572                     nft_set_elem_mark_busy(ext))
5573                         continue;
5574
5575                 kfree(elem->priv);
5576                 elem->priv = catchall->elem;
5577                 nft_set_elem_change_active(net, set, ext);
5578                 return 0;
5579         }
5580
5581         return -ENOENT;
5582 }
5583
5584 static int __nft_setelem_deactivate(const struct net *net,
5585                                     struct nft_set *set,
5586                                     struct nft_set_elem *elem)
5587 {
5588         void *priv;
5589
5590         priv = set->ops->deactivate(net, set, elem);
5591         if (!priv)
5592                 return -ENOENT;
5593
5594         kfree(elem->priv);
5595         elem->priv = priv;
5596         set->ndeact++;
5597
5598         return 0;
5599 }
5600
5601 static int nft_setelem_deactivate(const struct net *net,
5602                                   struct nft_set *set,
5603                                   struct nft_set_elem *elem, u32 flags)
5604 {
5605         int ret;
5606
5607         if (flags & NFT_SET_ELEM_CATCHALL)
5608                 ret = nft_setelem_catchall_deactivate(net, set, elem);
5609         else
5610                 ret = __nft_setelem_deactivate(net, set, elem);
5611
5612         return ret;
5613 }
5614
5615 static void nft_setelem_catchall_remove(const struct net *net,
5616                                         const struct nft_set *set,
5617                                         const struct nft_set_elem *elem)
5618 {
5619         struct nft_set_elem_catchall *catchall, *next;
5620
5621         list_for_each_entry_safe(catchall, next, &set->catchall_list, list) {
5622                 if (catchall->elem == elem->priv) {
5623                         list_del_rcu(&catchall->list);
5624                         kfree_rcu(catchall);
5625                         break;
5626                 }
5627         }
5628 }
5629
5630 static void nft_setelem_remove(const struct net *net,
5631                                const struct nft_set *set,
5632                                const struct nft_set_elem *elem)
5633 {
5634         if (nft_setelem_is_catchall(set, elem))
5635                 nft_setelem_catchall_remove(net, set, elem);
5636         else
5637                 set->ops->remove(net, set, elem);
5638 }
5639
5640 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
5641                             const struct nlattr *attr, u32 nlmsg_flags)
5642 {
5643         struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {};
5644         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
5645         u8 genmask = nft_genmask_next(ctx->net);
5646         u32 flags = 0, size = 0, num_exprs = 0;
5647         struct nft_set_ext_tmpl tmpl;
5648         struct nft_set_ext *ext, *ext2;
5649         struct nft_set_elem elem;
5650         struct nft_set_binding *binding;
5651         struct nft_object *obj = NULL;
5652         struct nft_userdata *udata;
5653         struct nft_data_desc desc;
5654         enum nft_registers dreg;
5655         struct nft_trans *trans;
5656         u64 timeout;
5657         u64 expiration;
5658         int err, i;
5659         u8 ulen;
5660
5661         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
5662                                           nft_set_elem_policy, NULL);
5663         if (err < 0)
5664                 return err;
5665
5666         nft_set_ext_prepare(&tmpl);
5667
5668         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
5669         if (err < 0)
5670                 return err;
5671
5672         if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL))
5673                 return -EINVAL;
5674
5675         if (flags != 0)
5676                 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
5677
5678         if (set->flags & NFT_SET_MAP) {
5679                 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
5680                     !(flags & NFT_SET_ELEM_INTERVAL_END))
5681                         return -EINVAL;
5682         } else {
5683                 if (nla[NFTA_SET_ELEM_DATA] != NULL)
5684                         return -EINVAL;
5685         }
5686
5687         if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
5688              (nla[NFTA_SET_ELEM_DATA] ||
5689               nla[NFTA_SET_ELEM_OBJREF] ||
5690               nla[NFTA_SET_ELEM_TIMEOUT] ||
5691               nla[NFTA_SET_ELEM_EXPIRATION] ||
5692               nla[NFTA_SET_ELEM_USERDATA] ||
5693               nla[NFTA_SET_ELEM_EXPR] ||
5694               nla[NFTA_SET_ELEM_EXPRESSIONS]))
5695                 return -EINVAL;
5696
5697         timeout = 0;
5698         if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
5699                 if (!(set->flags & NFT_SET_TIMEOUT))
5700                         return -EINVAL;
5701                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
5702                                             &timeout);
5703                 if (err)
5704                         return err;
5705         } else if (set->flags & NFT_SET_TIMEOUT) {
5706                 timeout = set->timeout;
5707         }
5708
5709         expiration = 0;
5710         if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
5711                 if (!(set->flags & NFT_SET_TIMEOUT))
5712                         return -EINVAL;
5713                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
5714                                             &expiration);
5715                 if (err)
5716                         return err;
5717         }
5718
5719         if (nla[NFTA_SET_ELEM_EXPR]) {
5720                 struct nft_expr *expr;
5721
5722                 if (set->num_exprs && set->num_exprs != 1)
5723                         return -EOPNOTSUPP;
5724
5725                 expr = nft_set_elem_expr_alloc(ctx, set,
5726                                                nla[NFTA_SET_ELEM_EXPR]);
5727                 if (IS_ERR(expr))
5728                         return PTR_ERR(expr);
5729
5730                 expr_array[0] = expr;
5731                 num_exprs = 1;
5732
5733                 if (set->num_exprs && set->exprs[0]->ops != expr->ops) {
5734                         err = -EOPNOTSUPP;
5735                         goto err_set_elem_expr;
5736                 }
5737         } else if (nla[NFTA_SET_ELEM_EXPRESSIONS]) {
5738                 struct nft_expr *expr;
5739                 struct nlattr *tmp;
5740                 int left;
5741
5742                 i = 0;
5743                 nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) {
5744                         if (i == NFT_SET_EXPR_MAX ||
5745                             (set->num_exprs && set->num_exprs == i)) {
5746                                 err = -E2BIG;
5747                                 goto err_set_elem_expr;
5748                         }
5749                         if (nla_type(tmp) != NFTA_LIST_ELEM) {
5750                                 err = -EINVAL;
5751                                 goto err_set_elem_expr;
5752                         }
5753                         expr = nft_set_elem_expr_alloc(ctx, set, tmp);
5754                         if (IS_ERR(expr)) {
5755                                 err = PTR_ERR(expr);
5756                                 goto err_set_elem_expr;
5757                         }
5758                         expr_array[i] = expr;
5759                         num_exprs++;
5760
5761                         if (set->num_exprs && expr->ops != set->exprs[i]->ops) {
5762                                 err = -EOPNOTSUPP;
5763                                 goto err_set_elem_expr;
5764                         }
5765                         i++;
5766                 }
5767                 if (set->num_exprs && set->num_exprs != i) {
5768                         err = -EOPNOTSUPP;
5769                         goto err_set_elem_expr;
5770                 }
5771         } else if (set->num_exprs > 0) {
5772                 err = nft_set_elem_expr_clone(ctx, set, expr_array);
5773                 if (err < 0)
5774                         goto err_set_elem_expr_clone;
5775
5776                 num_exprs = set->num_exprs;
5777         }
5778
5779         if (nla[NFTA_SET_ELEM_KEY]) {
5780                 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
5781                                             nla[NFTA_SET_ELEM_KEY]);
5782                 if (err < 0)
5783                         goto err_set_elem_expr;
5784
5785                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
5786         }
5787
5788         if (nla[NFTA_SET_ELEM_KEY_END]) {
5789                 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
5790                                             nla[NFTA_SET_ELEM_KEY_END]);
5791                 if (err < 0)
5792                         goto err_parse_key;
5793
5794                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
5795         }
5796
5797         if (timeout > 0) {
5798                 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
5799                 if (timeout != set->timeout)
5800                         nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
5801         }
5802
5803         if (num_exprs) {
5804                 for (i = 0; i < num_exprs; i++)
5805                         size += expr_array[i]->ops->size;
5806
5807                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS,
5808                                        sizeof(struct nft_set_elem_expr) +
5809                                        size);
5810         }
5811
5812         if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
5813                 if (!(set->flags & NFT_SET_OBJECT)) {
5814                         err = -EINVAL;
5815                         goto err_parse_key_end;
5816                 }
5817                 obj = nft_obj_lookup(ctx->net, ctx->table,
5818                                      nla[NFTA_SET_ELEM_OBJREF],
5819                                      set->objtype, genmask);
5820                 if (IS_ERR(obj)) {
5821                         err = PTR_ERR(obj);
5822                         goto err_parse_key_end;
5823                 }
5824                 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
5825         }
5826
5827         if (nla[NFTA_SET_ELEM_DATA] != NULL) {
5828                 err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val,
5829                                              nla[NFTA_SET_ELEM_DATA]);
5830                 if (err < 0)
5831                         goto err_parse_key_end;
5832
5833                 dreg = nft_type_to_reg(set->dtype);
5834                 list_for_each_entry(binding, &set->bindings, list) {
5835                         struct nft_ctx bind_ctx = {
5836                                 .net    = ctx->net,
5837                                 .family = ctx->family,
5838                                 .table  = ctx->table,
5839                                 .chain  = (struct nft_chain *)binding->chain,
5840                         };
5841
5842                         if (!(binding->flags & NFT_SET_MAP))
5843                                 continue;
5844
5845                         err = nft_validate_register_store(&bind_ctx, dreg,
5846                                                           &elem.data.val,
5847                                                           desc.type, desc.len);
5848                         if (err < 0)
5849                                 goto err_parse_data;
5850
5851                         if (desc.type == NFT_DATA_VERDICT &&
5852                             (elem.data.val.verdict.code == NFT_GOTO ||
5853                              elem.data.val.verdict.code == NFT_JUMP))
5854                                 nft_validate_state_update(ctx->net,
5855                                                           NFT_VALIDATE_NEED);
5856                 }
5857
5858                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len);
5859         }
5860
5861         /* The full maximum length of userdata can exceed the maximum
5862          * offset value (U8_MAX) for following extensions, therefor it
5863          * must be the last extension added.
5864          */
5865         ulen = 0;
5866         if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
5867                 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
5868                 if (ulen > 0)
5869                         nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
5870                                                ulen);
5871         }
5872
5873         err = -ENOMEM;
5874         elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
5875                                       elem.key_end.val.data, elem.data.val.data,
5876                                       timeout, expiration, GFP_KERNEL);
5877         if (elem.priv == NULL)
5878                 goto err_parse_data;
5879
5880         ext = nft_set_elem_ext(set, elem.priv);
5881         if (flags)
5882                 *nft_set_ext_flags(ext) = flags;
5883         if (ulen > 0) {
5884                 udata = nft_set_ext_userdata(ext);
5885                 udata->len = ulen - 1;
5886                 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
5887         }
5888         if (obj) {
5889                 *nft_set_ext_obj(ext) = obj;
5890                 obj->use++;
5891         }
5892         err = nft_set_elem_expr_setup(ctx, ext, expr_array, num_exprs);
5893         if (err < 0)
5894                 goto err_elem_expr;
5895
5896         trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
5897         if (trans == NULL) {
5898                 err = -ENOMEM;
5899                 goto err_elem_expr;
5900         }
5901
5902         ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
5903
5904         err = nft_setelem_insert(ctx->net, set, &elem, &ext2, flags);
5905         if (err) {
5906                 if (err == -EEXIST) {
5907                         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
5908                             nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
5909                             nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
5910                             nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF))
5911                                 goto err_element_clash;
5912                         if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
5913                              nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
5914                              memcmp(nft_set_ext_data(ext),
5915                                     nft_set_ext_data(ext2), set->dlen) != 0) ||
5916                             (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
5917                              nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
5918                              *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
5919                                 goto err_element_clash;
5920                         else if (!(nlmsg_flags & NLM_F_EXCL))
5921                                 err = 0;
5922                 } else if (err == -ENOTEMPTY) {
5923                         /* ENOTEMPTY reports overlapping between this element
5924                          * and an existing one.
5925                          */
5926                         err = -EEXIST;
5927                 }
5928                 goto err_element_clash;
5929         }
5930
5931         if (!(flags & NFT_SET_ELEM_CATCHALL) && set->size &&
5932             !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
5933                 err = -ENFILE;
5934                 goto err_set_full;
5935         }
5936
5937         nft_trans_elem(trans) = elem;
5938         nft_trans_commit_list_add_tail(ctx->net, trans);
5939         return 0;
5940
5941 err_set_full:
5942         nft_setelem_remove(ctx->net, set, &elem);
5943 err_element_clash:
5944         kfree(trans);
5945 err_elem_expr:
5946         if (obj)
5947                 obj->use--;
5948
5949         nf_tables_set_elem_destroy(ctx, set, elem.priv);
5950 err_parse_data:
5951         if (nla[NFTA_SET_ELEM_DATA] != NULL)
5952                 nft_data_release(&elem.data.val, desc.type);
5953 err_parse_key_end:
5954         nft_data_release(&elem.key_end.val, NFT_DATA_VALUE);
5955 err_parse_key:
5956         nft_data_release(&elem.key.val, NFT_DATA_VALUE);
5957 err_set_elem_expr:
5958         for (i = 0; i < num_exprs && expr_array[i]; i++)
5959                 nft_expr_destroy(ctx, expr_array[i]);
5960 err_set_elem_expr_clone:
5961         return err;
5962 }
5963
5964 static int nf_tables_newsetelem(struct sk_buff *skb,
5965                                 const struct nfnl_info *info,
5966                                 const struct nlattr * const nla[])
5967 {
5968         struct nftables_pernet *nft_net = nft_pernet(info->net);
5969         struct netlink_ext_ack *extack = info->extack;
5970         u8 genmask = nft_genmask_next(info->net);
5971         u8 family = info->nfmsg->nfgen_family;
5972         struct net *net = info->net;
5973         const struct nlattr *attr;
5974         struct nft_table *table;
5975         struct nft_set *set;
5976         struct nft_ctx ctx;
5977         int rem, err;
5978
5979         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
5980                 return -EINVAL;
5981
5982         table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
5983                                  genmask, NETLINK_CB(skb).portid);
5984         if (IS_ERR(table)) {
5985                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
5986                 return PTR_ERR(table);
5987         }
5988
5989         set = nft_set_lookup_global(net, table, nla[NFTA_SET_ELEM_LIST_SET],
5990                                     nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
5991         if (IS_ERR(set))
5992                 return PTR_ERR(set);
5993
5994         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
5995                 return -EBUSY;
5996
5997         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
5998
5999         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
6000                 err = nft_add_set_elem(&ctx, set, attr, info->nlh->nlmsg_flags);
6001                 if (err < 0)
6002                         return err;
6003         }
6004
6005         if (nft_net->validate_state == NFT_VALIDATE_DO)
6006                 return nft_table_validate(net, table);
6007
6008         return 0;
6009 }
6010
6011 /**
6012  *      nft_data_hold - hold a nft_data item
6013  *
6014  *      @data: struct nft_data to release
6015  *      @type: type of data
6016  *
6017  *      Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
6018  *      NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
6019  *      NFT_GOTO verdicts. This function must be called on active data objects
6020  *      from the second phase of the commit protocol.
6021  */
6022 void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
6023 {
6024         struct nft_chain *chain;
6025         struct nft_rule *rule;
6026
6027         if (type == NFT_DATA_VERDICT) {
6028                 switch (data->verdict.code) {
6029                 case NFT_JUMP:
6030                 case NFT_GOTO:
6031                         chain = data->verdict.chain;
6032                         chain->use++;
6033
6034                         if (!nft_chain_is_bound(chain))
6035                                 break;
6036
6037                         chain->table->use++;
6038                         list_for_each_entry(rule, &chain->rules, list)
6039                                 chain->use++;
6040
6041                         nft_chain_add(chain->table, chain);
6042                         break;
6043                 }
6044         }
6045 }
6046
6047 static void nft_setelem_data_activate(const struct net *net,
6048                                       const struct nft_set *set,
6049                                       struct nft_set_elem *elem)
6050 {
6051         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6052
6053         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
6054                 nft_data_hold(nft_set_ext_data(ext), set->dtype);
6055         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
6056                 (*nft_set_ext_obj(ext))->use++;
6057 }
6058
6059 static void nft_setelem_data_deactivate(const struct net *net,
6060                                         const struct nft_set *set,
6061                                         struct nft_set_elem *elem)
6062 {
6063         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
6064
6065         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
6066                 nft_data_release(nft_set_ext_data(ext), set->dtype);
6067         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
6068                 (*nft_set_ext_obj(ext))->use--;
6069 }
6070
6071 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
6072                            const struct nlattr *attr)
6073 {
6074         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
6075         struct nft_set_ext_tmpl tmpl;
6076         struct nft_set_elem elem;
6077         struct nft_set_ext *ext;
6078         struct nft_trans *trans;
6079         u32 flags = 0;
6080         int err;
6081
6082         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
6083                                           nft_set_elem_policy, NULL);
6084         if (err < 0)
6085                 return err;
6086
6087         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
6088         if (err < 0)
6089                 return err;
6090
6091         if (!nla[NFTA_SET_ELEM_KEY] && !(flags & NFT_SET_ELEM_CATCHALL))
6092                 return -EINVAL;
6093
6094         nft_set_ext_prepare(&tmpl);
6095
6096         if (flags != 0)
6097                 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
6098
6099         if (nla[NFTA_SET_ELEM_KEY]) {
6100                 err = nft_setelem_parse_key(ctx, set, &elem.key.val,
6101                                             nla[NFTA_SET_ELEM_KEY]);
6102                 if (err < 0)
6103                         return err;
6104
6105                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen);
6106         }
6107
6108         if (nla[NFTA_SET_ELEM_KEY_END]) {
6109                 err = nft_setelem_parse_key(ctx, set, &elem.key_end.val,
6110                                             nla[NFTA_SET_ELEM_KEY_END]);
6111                 if (err < 0)
6112                         return err;
6113
6114                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY_END, set->klen);
6115         }
6116
6117         err = -ENOMEM;
6118         elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data,
6119                                       elem.key_end.val.data, NULL, 0, 0,
6120                                       GFP_KERNEL);
6121         if (elem.priv == NULL)
6122                 goto fail_elem;
6123
6124         ext = nft_set_elem_ext(set, elem.priv);
6125         if (flags)
6126                 *nft_set_ext_flags(ext) = flags;
6127
6128         trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
6129         if (trans == NULL)
6130                 goto fail_trans;
6131
6132         err = nft_setelem_deactivate(ctx->net, set, &elem, flags);
6133         if (err < 0)
6134                 goto fail_ops;
6135
6136         nft_setelem_data_deactivate(ctx->net, set, &elem);
6137
6138         nft_trans_elem(trans) = elem;
6139         nft_trans_commit_list_add_tail(ctx->net, trans);
6140         return 0;
6141
6142 fail_ops:
6143         kfree(trans);
6144 fail_trans:
6145         kfree(elem.priv);
6146 fail_elem:
6147         nft_data_release(&elem.key.val, NFT_DATA_VALUE);
6148         return err;
6149 }
6150
6151 static int nft_setelem_flush(const struct nft_ctx *ctx,
6152                              struct nft_set *set,
6153                              const struct nft_set_iter *iter,
6154                              struct nft_set_elem *elem)
6155 {
6156         struct nft_trans *trans;
6157         int err;
6158
6159         trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
6160                                     sizeof(struct nft_trans_elem), GFP_ATOMIC);
6161         if (!trans)
6162                 return -ENOMEM;
6163
6164         if (!set->ops->flush(ctx->net, set, elem->priv)) {
6165                 err = -ENOENT;
6166                 goto err1;
6167         }
6168         set->ndeact++;
6169
6170         nft_setelem_data_deactivate(ctx->net, set, elem);
6171         nft_trans_elem_set(trans) = set;
6172         nft_trans_elem(trans) = *elem;
6173         nft_trans_commit_list_add_tail(ctx->net, trans);
6174
6175         return 0;
6176 err1:
6177         kfree(trans);
6178         return err;
6179 }
6180
6181 static int __nft_set_catchall_flush(const struct nft_ctx *ctx,
6182                                     struct nft_set *set,
6183                                     struct nft_set_elem *elem)
6184 {
6185         struct nft_trans *trans;
6186
6187         trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
6188                                     sizeof(struct nft_trans_elem), GFP_KERNEL);
6189         if (!trans)
6190                 return -ENOMEM;
6191
6192         nft_setelem_data_deactivate(ctx->net, set, elem);
6193         nft_trans_elem_set(trans) = set;
6194         nft_trans_elem(trans) = *elem;
6195         nft_trans_commit_list_add_tail(ctx->net, trans);
6196
6197         return 0;
6198 }
6199
6200 static int nft_set_catchall_flush(const struct nft_ctx *ctx,
6201                                   struct nft_set *set)
6202 {
6203         u8 genmask = nft_genmask_next(ctx->net);
6204         struct nft_set_elem_catchall *catchall;
6205         struct nft_set_elem elem;
6206         struct nft_set_ext *ext;
6207         int ret = 0;
6208
6209         list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
6210                 ext = nft_set_elem_ext(set, catchall->elem);
6211                 if (!nft_set_elem_active(ext, genmask) ||
6212                     nft_set_elem_mark_busy(ext))
6213                         continue;
6214
6215                 elem.priv = catchall->elem;
6216                 ret = __nft_set_catchall_flush(ctx, set, &elem);
6217                 if (ret < 0)
6218                         break;
6219         }
6220
6221         return ret;
6222 }
6223
6224 static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask)
6225 {
6226         struct nft_set_iter iter = {
6227                 .genmask        = genmask,
6228                 .fn             = nft_setelem_flush,
6229         };
6230
6231         set->ops->walk(ctx, set, &iter);
6232         if (!iter.err)
6233                 iter.err = nft_set_catchall_flush(ctx, set);
6234
6235         return iter.err;
6236 }
6237
6238 static int nf_tables_delsetelem(struct sk_buff *skb,
6239                                 const struct nfnl_info *info,
6240                                 const struct nlattr * const nla[])
6241 {
6242         struct netlink_ext_ack *extack = info->extack;
6243         u8 genmask = nft_genmask_next(info->net);
6244         u8 family = info->nfmsg->nfgen_family;
6245         struct net *net = info->net;
6246         const struct nlattr *attr;
6247         struct nft_table *table;
6248         struct nft_set *set;
6249         struct nft_ctx ctx;
6250         int rem, err = 0;
6251
6252         table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
6253                                  genmask, NETLINK_CB(skb).portid);
6254         if (IS_ERR(table)) {
6255                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
6256                 return PTR_ERR(table);
6257         }
6258
6259         set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
6260         if (IS_ERR(set))
6261                 return PTR_ERR(set);
6262         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
6263                 return -EBUSY;
6264
6265         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
6266
6267         if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
6268                 return nft_set_flush(&ctx, set, genmask);
6269
6270         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
6271                 err = nft_del_setelem(&ctx, set, attr);
6272                 if (err < 0)
6273                         break;
6274         }
6275         return err;
6276 }
6277
6278 void nft_set_gc_batch_release(struct rcu_head *rcu)
6279 {
6280         struct nft_set_gc_batch *gcb;
6281         unsigned int i;
6282
6283         gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
6284         for (i = 0; i < gcb->head.cnt; i++)
6285                 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
6286         kfree(gcb);
6287 }
6288
6289 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
6290                                                 gfp_t gfp)
6291 {
6292         struct nft_set_gc_batch *gcb;
6293
6294         gcb = kzalloc(sizeof(*gcb), gfp);
6295         if (gcb == NULL)
6296                 return gcb;
6297         gcb->head.set = set;
6298         return gcb;
6299 }
6300
6301 /*
6302  * Stateful objects
6303  */
6304
6305 /**
6306  *      nft_register_obj- register nf_tables stateful object type
6307  *      @obj_type: object type
6308  *
6309  *      Registers the object type for use with nf_tables. Returns zero on
6310  *      success or a negative errno code otherwise.
6311  */
6312 int nft_register_obj(struct nft_object_type *obj_type)
6313 {
6314         if (obj_type->type == NFT_OBJECT_UNSPEC)
6315                 return -EINVAL;
6316
6317         nfnl_lock(NFNL_SUBSYS_NFTABLES);
6318         list_add_rcu(&obj_type->list, &nf_tables_objects);
6319         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6320         return 0;
6321 }
6322 EXPORT_SYMBOL_GPL(nft_register_obj);
6323
6324 /**
6325  *      nft_unregister_obj - unregister nf_tables object type
6326  *      @obj_type: object type
6327  *
6328  *      Unregisters the object type for use with nf_tables.
6329  */
6330 void nft_unregister_obj(struct nft_object_type *obj_type)
6331 {
6332         nfnl_lock(NFNL_SUBSYS_NFTABLES);
6333         list_del_rcu(&obj_type->list);
6334         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6335 }
6336 EXPORT_SYMBOL_GPL(nft_unregister_obj);
6337
6338 struct nft_object *nft_obj_lookup(const struct net *net,
6339                                   const struct nft_table *table,
6340                                   const struct nlattr *nla, u32 objtype,
6341                                   u8 genmask)
6342 {
6343         struct nft_object_hash_key k = { .table = table };
6344         char search[NFT_OBJ_MAXNAMELEN];
6345         struct rhlist_head *tmp, *list;
6346         struct nft_object *obj;
6347
6348         nla_strscpy(search, nla, sizeof(search));
6349         k.name = search;
6350
6351         WARN_ON_ONCE(!rcu_read_lock_held() &&
6352                      !lockdep_commit_lock_is_held(net));
6353
6354         rcu_read_lock();
6355         list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
6356         if (!list)
6357                 goto out;
6358
6359         rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
6360                 if (objtype == obj->ops->type->type &&
6361                     nft_active_genmask(obj, genmask)) {
6362                         rcu_read_unlock();
6363                         return obj;
6364                 }
6365         }
6366 out:
6367         rcu_read_unlock();
6368         return ERR_PTR(-ENOENT);
6369 }
6370 EXPORT_SYMBOL_GPL(nft_obj_lookup);
6371
6372 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
6373                                                   const struct nlattr *nla,
6374                                                   u32 objtype, u8 genmask)
6375 {
6376         struct nft_object *obj;
6377
6378         list_for_each_entry(obj, &table->objects, list) {
6379                 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
6380                     objtype == obj->ops->type->type &&
6381                     nft_active_genmask(obj, genmask))
6382                         return obj;
6383         }
6384         return ERR_PTR(-ENOENT);
6385 }
6386
6387 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
6388         [NFTA_OBJ_TABLE]        = { .type = NLA_STRING,
6389                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
6390         [NFTA_OBJ_NAME]         = { .type = NLA_STRING,
6391                                     .len = NFT_OBJ_MAXNAMELEN - 1 },
6392         [NFTA_OBJ_TYPE]         = { .type = NLA_U32 },
6393         [NFTA_OBJ_DATA]         = { .type = NLA_NESTED },
6394         [NFTA_OBJ_HANDLE]       = { .type = NLA_U64},
6395         [NFTA_OBJ_USERDATA]     = { .type = NLA_BINARY,
6396                                     .len = NFT_USERDATA_MAXLEN },
6397 };
6398
6399 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
6400                                        const struct nft_object_type *type,
6401                                        const struct nlattr *attr)
6402 {
6403         struct nlattr **tb;
6404         const struct nft_object_ops *ops;
6405         struct nft_object *obj;
6406         int err = -ENOMEM;
6407
6408         tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
6409         if (!tb)
6410                 goto err1;
6411
6412         if (attr) {
6413                 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
6414                                                   type->policy, NULL);
6415                 if (err < 0)
6416                         goto err2;
6417         } else {
6418                 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
6419         }
6420
6421         if (type->select_ops) {
6422                 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
6423                 if (IS_ERR(ops)) {
6424                         err = PTR_ERR(ops);
6425                         goto err2;
6426                 }
6427         } else {
6428                 ops = type->ops;
6429         }
6430
6431         err = -ENOMEM;
6432         obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
6433         if (!obj)
6434                 goto err2;
6435
6436         err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
6437         if (err < 0)
6438                 goto err3;
6439
6440         obj->ops = ops;
6441
6442         kfree(tb);
6443         return obj;
6444 err3:
6445         kfree(obj);
6446 err2:
6447         kfree(tb);
6448 err1:
6449         return ERR_PTR(err);
6450 }
6451
6452 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
6453                            struct nft_object *obj, bool reset)
6454 {
6455         struct nlattr *nest;
6456
6457         nest = nla_nest_start_noflag(skb, attr);
6458         if (!nest)
6459                 goto nla_put_failure;
6460         if (obj->ops->dump(skb, obj, reset) < 0)
6461                 goto nla_put_failure;
6462         nla_nest_end(skb, nest);
6463         return 0;
6464
6465 nla_put_failure:
6466         return -1;
6467 }
6468
6469 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
6470 {
6471         const struct nft_object_type *type;
6472
6473         list_for_each_entry(type, &nf_tables_objects, list) {
6474                 if (objtype == type->type)
6475                         return type;
6476         }
6477         return NULL;
6478 }
6479
6480 static const struct nft_object_type *
6481 nft_obj_type_get(struct net *net, u32 objtype)
6482 {
6483         const struct nft_object_type *type;
6484
6485         type = __nft_obj_type_get(objtype);
6486         if (type != NULL && try_module_get(type->owner))
6487                 return type;
6488
6489         lockdep_nfnl_nft_mutex_not_held();
6490 #ifdef CONFIG_MODULES
6491         if (type == NULL) {
6492                 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
6493                         return ERR_PTR(-EAGAIN);
6494         }
6495 #endif
6496         return ERR_PTR(-ENOENT);
6497 }
6498
6499 static int nf_tables_updobj(const struct nft_ctx *ctx,
6500                             const struct nft_object_type *type,
6501                             const struct nlattr *attr,
6502                             struct nft_object *obj)
6503 {
6504         struct nft_object *newobj;
6505         struct nft_trans *trans;
6506         int err;
6507
6508         trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
6509                                 sizeof(struct nft_trans_obj));
6510         if (!trans)
6511                 return -ENOMEM;
6512
6513         newobj = nft_obj_init(ctx, type, attr);
6514         if (IS_ERR(newobj)) {
6515                 err = PTR_ERR(newobj);
6516                 goto err_free_trans;
6517         }
6518
6519         nft_trans_obj(trans) = obj;
6520         nft_trans_obj_update(trans) = true;
6521         nft_trans_obj_newobj(trans) = newobj;
6522         nft_trans_commit_list_add_tail(ctx->net, trans);
6523
6524         return 0;
6525
6526 err_free_trans:
6527         kfree(trans);
6528         return err;
6529 }
6530
6531 static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info,
6532                             const struct nlattr * const nla[])
6533 {
6534         struct netlink_ext_ack *extack = info->extack;
6535         u8 genmask = nft_genmask_next(info->net);
6536         u8 family = info->nfmsg->nfgen_family;
6537         const struct nft_object_type *type;
6538         struct net *net = info->net;
6539         struct nft_table *table;
6540         struct nft_object *obj;
6541         struct nft_ctx ctx;
6542         u32 objtype;
6543         int err;
6544
6545         if (!nla[NFTA_OBJ_TYPE] ||
6546             !nla[NFTA_OBJ_NAME] ||
6547             !nla[NFTA_OBJ_DATA])
6548                 return -EINVAL;
6549
6550         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask,
6551                                  NETLINK_CB(skb).portid);
6552         if (IS_ERR(table)) {
6553                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6554                 return PTR_ERR(table);
6555         }
6556
6557         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6558         obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
6559         if (IS_ERR(obj)) {
6560                 err = PTR_ERR(obj);
6561                 if (err != -ENOENT) {
6562                         NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6563                         return err;
6564                 }
6565         } else {
6566                 if (info->nlh->nlmsg_flags & NLM_F_EXCL) {
6567                         NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6568                         return -EEXIST;
6569                 }
6570                 if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
6571                         return -EOPNOTSUPP;
6572
6573                 type = __nft_obj_type_get(objtype);
6574                 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
6575
6576                 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
6577         }
6578
6579         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
6580
6581         type = nft_obj_type_get(net, objtype);
6582         if (IS_ERR(type))
6583                 return PTR_ERR(type);
6584
6585         obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
6586         if (IS_ERR(obj)) {
6587                 err = PTR_ERR(obj);
6588                 goto err_init;
6589         }
6590         obj->key.table = table;
6591         obj->handle = nf_tables_alloc_handle(table);
6592
6593         obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
6594         if (!obj->key.name) {
6595                 err = -ENOMEM;
6596                 goto err_strdup;
6597         }
6598
6599         if (nla[NFTA_OBJ_USERDATA]) {
6600                 obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL);
6601                 if (obj->udata == NULL)
6602                         goto err_userdata;
6603
6604                 obj->udlen = nla_len(nla[NFTA_OBJ_USERDATA]);
6605         }
6606
6607         err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
6608         if (err < 0)
6609                 goto err_trans;
6610
6611         err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
6612                               nft_objname_ht_params);
6613         if (err < 0)
6614                 goto err_obj_ht;
6615
6616         list_add_tail_rcu(&obj->list, &table->objects);
6617         table->use++;
6618         return 0;
6619 err_obj_ht:
6620         /* queued in transaction log */
6621         INIT_LIST_HEAD(&obj->list);
6622         return err;
6623 err_trans:
6624         kfree(obj->udata);
6625 err_userdata:
6626         kfree(obj->key.name);
6627 err_strdup:
6628         if (obj->ops->destroy)
6629                 obj->ops->destroy(&ctx, obj);
6630         kfree(obj);
6631 err_init:
6632         module_put(type->owner);
6633         return err;
6634 }
6635
6636 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
6637                                    u32 portid, u32 seq, int event, u32 flags,
6638                                    int family, const struct nft_table *table,
6639                                    struct nft_object *obj, bool reset)
6640 {
6641         struct nlmsghdr *nlh;
6642
6643         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
6644         nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
6645                            NFNETLINK_V0, nft_base_seq(net));
6646         if (!nlh)
6647                 goto nla_put_failure;
6648
6649         if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
6650             nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
6651             nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
6652             nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
6653             nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
6654             nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
6655                          NFTA_OBJ_PAD))
6656                 goto nla_put_failure;
6657
6658         if (obj->udata &&
6659             nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata))
6660                 goto nla_put_failure;
6661
6662         nlmsg_end(skb, nlh);
6663         return 0;
6664
6665 nla_put_failure:
6666         nlmsg_trim(skb, nlh);
6667         return -1;
6668 }
6669
6670 struct nft_obj_filter {
6671         char            *table;
6672         u32             type;
6673 };
6674
6675 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
6676 {
6677         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6678         const struct nft_table *table;
6679         unsigned int idx = 0, s_idx = cb->args[0];
6680         struct nft_obj_filter *filter = cb->data;
6681         struct net *net = sock_net(skb->sk);
6682         int family = nfmsg->nfgen_family;
6683         struct nftables_pernet *nft_net;
6684         struct nft_object *obj;
6685         bool reset = false;
6686
6687         if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6688                 reset = true;
6689
6690         rcu_read_lock();
6691         nft_net = nft_pernet(net);
6692         cb->seq = nft_net->base_seq;
6693
6694         list_for_each_entry_rcu(table, &nft_net->tables, list) {
6695                 if (family != NFPROTO_UNSPEC && family != table->family)
6696                         continue;
6697
6698                 list_for_each_entry_rcu(obj, &table->objects, list) {
6699                         if (!nft_is_active(net, obj))
6700                                 goto cont;
6701                         if (idx < s_idx)
6702                                 goto cont;
6703                         if (idx > s_idx)
6704                                 memset(&cb->args[1], 0,
6705                                        sizeof(cb->args) - sizeof(cb->args[0]));
6706                         if (filter && filter->table &&
6707                             strcmp(filter->table, table->name))
6708                                 goto cont;
6709                         if (filter &&
6710                             filter->type != NFT_OBJECT_UNSPEC &&
6711                             obj->ops->type->type != filter->type)
6712                                 goto cont;
6713                         if (reset) {
6714                                 char *buf = kasprintf(GFP_ATOMIC,
6715                                                       "%s:%u",
6716                                                       table->name,
6717                                                       nft_net->base_seq);
6718
6719                                 audit_log_nfcfg(buf,
6720                                                 family,
6721                                                 obj->handle,
6722                                                 AUDIT_NFT_OP_OBJ_RESET,
6723                                                 GFP_ATOMIC);
6724                                 kfree(buf);
6725                         }
6726
6727                         if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
6728                                                     cb->nlh->nlmsg_seq,
6729                                                     NFT_MSG_NEWOBJ,
6730                                                     NLM_F_MULTI | NLM_F_APPEND,
6731                                                     table->family, table,
6732                                                     obj, reset) < 0)
6733                                 goto done;
6734
6735                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
6736 cont:
6737                         idx++;
6738                 }
6739         }
6740 done:
6741         rcu_read_unlock();
6742
6743         cb->args[0] = idx;
6744         return skb->len;
6745 }
6746
6747 static int nf_tables_dump_obj_start(struct netlink_callback *cb)
6748 {
6749         const struct nlattr * const *nla = cb->data;
6750         struct nft_obj_filter *filter = NULL;
6751
6752         if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
6753                 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6754                 if (!filter)
6755                         return -ENOMEM;
6756
6757                 if (nla[NFTA_OBJ_TABLE]) {
6758                         filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
6759                         if (!filter->table) {
6760                                 kfree(filter);
6761                                 return -ENOMEM;
6762                         }
6763                 }
6764
6765                 if (nla[NFTA_OBJ_TYPE])
6766                         filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6767         }
6768
6769         cb->data = filter;
6770         return 0;
6771 }
6772
6773 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
6774 {
6775         struct nft_obj_filter *filter = cb->data;
6776
6777         if (filter) {
6778                 kfree(filter->table);
6779                 kfree(filter);
6780         }
6781
6782         return 0;
6783 }
6784
6785 /* called with rcu_read_lock held */
6786 static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
6787                             const struct nlattr * const nla[])
6788 {
6789         struct netlink_ext_ack *extack = info->extack;
6790         u8 genmask = nft_genmask_cur(info->net);
6791         u8 family = info->nfmsg->nfgen_family;
6792         const struct nft_table *table;
6793         struct net *net = info->net;
6794         struct nft_object *obj;
6795         struct sk_buff *skb2;
6796         bool reset = false;
6797         u32 objtype;
6798         int err;
6799
6800         if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
6801                 struct netlink_dump_control c = {
6802                         .start = nf_tables_dump_obj_start,
6803                         .dump = nf_tables_dump_obj,
6804                         .done = nf_tables_dump_obj_done,
6805                         .module = THIS_MODULE,
6806                         .data = (void *)nla,
6807                 };
6808
6809                 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
6810         }
6811
6812         if (!nla[NFTA_OBJ_NAME] ||
6813             !nla[NFTA_OBJ_TYPE])
6814                 return -EINVAL;
6815
6816         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0);
6817         if (IS_ERR(table)) {
6818                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6819                 return PTR_ERR(table);
6820         }
6821
6822         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6823         obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
6824         if (IS_ERR(obj)) {
6825                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
6826                 return PTR_ERR(obj);
6827         }
6828
6829         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
6830         if (!skb2)
6831                 return -ENOMEM;
6832
6833         if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
6834                 reset = true;
6835
6836         if (reset) {
6837                 const struct nftables_pernet *nft_net;
6838                 char *buf;
6839
6840                 nft_net = nft_pernet(net);
6841                 buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, nft_net->base_seq);
6842
6843                 audit_log_nfcfg(buf,
6844                                 family,
6845                                 obj->handle,
6846                                 AUDIT_NFT_OP_OBJ_RESET,
6847                                 GFP_ATOMIC);
6848                 kfree(buf);
6849         }
6850
6851         err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
6852                                       info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
6853                                       family, table, obj, reset);
6854         if (err < 0)
6855                 goto err_fill_obj_info;
6856
6857         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
6858
6859 err_fill_obj_info:
6860         kfree_skb(skb2);
6861         return err;
6862 }
6863
6864 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
6865 {
6866         if (obj->ops->destroy)
6867                 obj->ops->destroy(ctx, obj);
6868
6869         module_put(obj->ops->type->owner);
6870         kfree(obj->key.name);
6871         kfree(obj->udata);
6872         kfree(obj);
6873 }
6874
6875 static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info,
6876                             const struct nlattr * const nla[])
6877 {
6878         struct netlink_ext_ack *extack = info->extack;
6879         u8 genmask = nft_genmask_next(info->net);
6880         u8 family = info->nfmsg->nfgen_family;
6881         struct net *net = info->net;
6882         const struct nlattr *attr;
6883         struct nft_table *table;
6884         struct nft_object *obj;
6885         struct nft_ctx ctx;
6886         u32 objtype;
6887
6888         if (!nla[NFTA_OBJ_TYPE] ||
6889             (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
6890                 return -EINVAL;
6891
6892         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask,
6893                                  NETLINK_CB(skb).portid);
6894         if (IS_ERR(table)) {
6895                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
6896                 return PTR_ERR(table);
6897         }
6898
6899         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
6900         if (nla[NFTA_OBJ_HANDLE]) {
6901                 attr = nla[NFTA_OBJ_HANDLE];
6902                 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
6903         } else {
6904                 attr = nla[NFTA_OBJ_NAME];
6905                 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
6906         }
6907
6908         if (IS_ERR(obj)) {
6909                 NL_SET_BAD_ATTR(extack, attr);
6910                 return PTR_ERR(obj);
6911         }
6912         if (obj->use > 0) {
6913                 NL_SET_BAD_ATTR(extack, attr);
6914                 return -EBUSY;
6915         }
6916
6917         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
6918
6919         return nft_delobj(&ctx, obj);
6920 }
6921
6922 void nft_obj_notify(struct net *net, const struct nft_table *table,
6923                     struct nft_object *obj, u32 portid, u32 seq, int event,
6924                     int family, int report, gfp_t gfp)
6925 {
6926         struct nftables_pernet *nft_net = nft_pernet(net);
6927         struct sk_buff *skb;
6928         int err;
6929         char *buf = kasprintf(gfp, "%s:%u",
6930                               table->name, nft_net->base_seq);
6931
6932         audit_log_nfcfg(buf,
6933                         family,
6934                         obj->handle,
6935                         event == NFT_MSG_NEWOBJ ?
6936                                  AUDIT_NFT_OP_OBJ_REGISTER :
6937                                  AUDIT_NFT_OP_OBJ_UNREGISTER,
6938                         gfp);
6939         kfree(buf);
6940
6941         if (!report &&
6942             !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
6943                 return;
6944
6945         skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
6946         if (skb == NULL)
6947                 goto err;
6948
6949         err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
6950                                       table, obj, false);
6951         if (err < 0) {
6952                 kfree_skb(skb);
6953                 goto err;
6954         }
6955
6956         nft_notify_enqueue(skb, report, &nft_net->notify_list);
6957         return;
6958 err:
6959         nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
6960 }
6961 EXPORT_SYMBOL_GPL(nft_obj_notify);
6962
6963 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
6964                                  struct nft_object *obj, int event)
6965 {
6966         nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
6967                        ctx->family, ctx->report, GFP_KERNEL);
6968 }
6969
6970 /*
6971  * Flow tables
6972  */
6973 void nft_register_flowtable_type(struct nf_flowtable_type *type)
6974 {
6975         nfnl_lock(NFNL_SUBSYS_NFTABLES);
6976         list_add_tail_rcu(&type->list, &nf_tables_flowtables);
6977         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6978 }
6979 EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
6980
6981 void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
6982 {
6983         nfnl_lock(NFNL_SUBSYS_NFTABLES);
6984         list_del_rcu(&type->list);
6985         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
6986 }
6987 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
6988
6989 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
6990         [NFTA_FLOWTABLE_TABLE]          = { .type = NLA_STRING,
6991                                             .len = NFT_NAME_MAXLEN - 1 },
6992         [NFTA_FLOWTABLE_NAME]           = { .type = NLA_STRING,
6993                                             .len = NFT_NAME_MAXLEN - 1 },
6994         [NFTA_FLOWTABLE_HOOK]           = { .type = NLA_NESTED },
6995         [NFTA_FLOWTABLE_HANDLE]         = { .type = NLA_U64 },
6996         [NFTA_FLOWTABLE_FLAGS]          = { .type = NLA_U32 },
6997 };
6998
6999 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
7000                                            const struct nlattr *nla, u8 genmask)
7001 {
7002         struct nft_flowtable *flowtable;
7003
7004         list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
7005                 if (!nla_strcmp(nla, flowtable->name) &&
7006                     nft_active_genmask(flowtable, genmask))
7007                         return flowtable;
7008         }
7009         return ERR_PTR(-ENOENT);
7010 }
7011 EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
7012
7013 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
7014                                     struct nft_flowtable *flowtable,
7015                                     enum nft_trans_phase phase)
7016 {
7017         switch (phase) {
7018         case NFT_TRANS_PREPARE:
7019         case NFT_TRANS_ABORT:
7020         case NFT_TRANS_RELEASE:
7021                 flowtable->use--;
7022                 fallthrough;
7023         default:
7024                 return;
7025         }
7026 }
7027 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
7028
7029 static struct nft_flowtable *
7030 nft_flowtable_lookup_byhandle(const struct nft_table *table,
7031                               const struct nlattr *nla, u8 genmask)
7032 {
7033        struct nft_flowtable *flowtable;
7034
7035        list_for_each_entry(flowtable, &table->flowtables, list) {
7036                if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
7037                    nft_active_genmask(flowtable, genmask))
7038                        return flowtable;
7039        }
7040        return ERR_PTR(-ENOENT);
7041 }
7042
7043 struct nft_flowtable_hook {
7044         u32                     num;
7045         int                     priority;
7046         struct list_head        list;
7047 };
7048
7049 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
7050         [NFTA_FLOWTABLE_HOOK_NUM]       = { .type = NLA_U32 },
7051         [NFTA_FLOWTABLE_HOOK_PRIORITY]  = { .type = NLA_U32 },
7052         [NFTA_FLOWTABLE_HOOK_DEVS]      = { .type = NLA_NESTED },
7053 };
7054
7055 static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
7056                                     const struct nlattr *attr,
7057                                     struct nft_flowtable_hook *flowtable_hook,
7058                                     struct nft_flowtable *flowtable, bool add)
7059 {
7060         struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
7061         struct nft_hook *hook;
7062         int hooknum, priority;
7063         int err;
7064
7065         INIT_LIST_HEAD(&flowtable_hook->list);
7066
7067         err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
7068                                           nft_flowtable_hook_policy, NULL);
7069         if (err < 0)
7070                 return err;
7071
7072         if (add) {
7073                 if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
7074                     !tb[NFTA_FLOWTABLE_HOOK_PRIORITY])
7075                         return -EINVAL;
7076
7077                 hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
7078                 if (hooknum != NF_NETDEV_INGRESS)
7079                         return -EOPNOTSUPP;
7080
7081                 priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
7082
7083                 flowtable_hook->priority        = priority;
7084                 flowtable_hook->num             = hooknum;
7085         } else {
7086                 if (tb[NFTA_FLOWTABLE_HOOK_NUM]) {
7087                         hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
7088                         if (hooknum != flowtable->hooknum)
7089                                 return -EOPNOTSUPP;
7090                 }
7091
7092                 if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
7093                         priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
7094                         if (priority != flowtable->data.priority)
7095                                 return -EOPNOTSUPP;
7096                 }
7097
7098                 flowtable_hook->priority        = flowtable->data.priority;
7099                 flowtable_hook->num             = flowtable->hooknum;
7100         }
7101
7102         if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
7103                 err = nf_tables_parse_netdev_hooks(ctx->net,
7104                                                    tb[NFTA_FLOWTABLE_HOOK_DEVS],
7105                                                    &flowtable_hook->list);
7106                 if (err < 0)
7107                         return err;
7108         }
7109
7110         list_for_each_entry(hook, &flowtable_hook->list, list) {
7111                 hook->ops.pf            = NFPROTO_NETDEV;
7112                 hook->ops.hooknum       = flowtable_hook->num;
7113                 hook->ops.priority      = flowtable_hook->priority;
7114                 hook->ops.priv          = &flowtable->data;
7115                 hook->ops.hook          = flowtable->data.type->hook;
7116         }
7117
7118         return err;
7119 }
7120
7121 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
7122 {
7123         const struct nf_flowtable_type *type;
7124
7125         list_for_each_entry(type, &nf_tables_flowtables, list) {
7126                 if (family == type->family)
7127                         return type;
7128         }
7129         return NULL;
7130 }
7131
7132 static const struct nf_flowtable_type *
7133 nft_flowtable_type_get(struct net *net, u8 family)
7134 {
7135         const struct nf_flowtable_type *type;
7136
7137         type = __nft_flowtable_type_get(family);
7138         if (type != NULL && try_module_get(type->owner))
7139                 return type;
7140
7141         lockdep_nfnl_nft_mutex_not_held();
7142 #ifdef CONFIG_MODULES
7143         if (type == NULL) {
7144                 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
7145                         return ERR_PTR(-EAGAIN);
7146         }
7147 #endif
7148         return ERR_PTR(-ENOENT);
7149 }
7150
7151 /* Only called from error and netdev event paths. */
7152 static void nft_unregister_flowtable_hook(struct net *net,
7153                                           struct nft_flowtable *flowtable,
7154                                           struct nft_hook *hook)
7155 {
7156         nf_unregister_net_hook(net, &hook->ops);
7157         flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
7158                                     FLOW_BLOCK_UNBIND);
7159 }
7160
7161 static void nft_unregister_flowtable_net_hooks(struct net *net,
7162                                                struct list_head *hook_list)
7163 {
7164         struct nft_hook *hook;
7165
7166         list_for_each_entry(hook, hook_list, list)
7167                 nf_unregister_net_hook(net, &hook->ops);
7168 }
7169
7170 static int nft_register_flowtable_net_hooks(struct net *net,
7171                                             struct nft_table *table,
7172                                             struct list_head *hook_list,
7173                                             struct nft_flowtable *flowtable)
7174 {
7175         struct nft_hook *hook, *hook2, *next;
7176         struct nft_flowtable *ft;
7177         int err, i = 0;
7178
7179         list_for_each_entry(hook, hook_list, list) {
7180                 list_for_each_entry(ft, &table->flowtables, list) {
7181                         if (!nft_is_active_next(net, ft))
7182                                 continue;
7183
7184                         list_for_each_entry(hook2, &ft->hook_list, list) {
7185                                 if (hook->ops.dev == hook2->ops.dev &&
7186                                     hook->ops.pf == hook2->ops.pf) {
7187                                         err = -EEXIST;
7188                                         goto err_unregister_net_hooks;
7189                                 }
7190                         }
7191                 }
7192
7193                 err = flowtable->data.type->setup(&flowtable->data,
7194                                                   hook->ops.dev,
7195                                                   FLOW_BLOCK_BIND);
7196                 if (err < 0)
7197                         goto err_unregister_net_hooks;
7198
7199                 err = nf_register_net_hook(net, &hook->ops);
7200                 if (err < 0) {
7201                         flowtable->data.type->setup(&flowtable->data,
7202                                                     hook->ops.dev,
7203                                                     FLOW_BLOCK_UNBIND);
7204                         goto err_unregister_net_hooks;
7205                 }
7206
7207                 i++;
7208         }
7209
7210         return 0;
7211
7212 err_unregister_net_hooks:
7213         list_for_each_entry_safe(hook, next, hook_list, list) {
7214                 if (i-- <= 0)
7215                         break;
7216
7217                 nft_unregister_flowtable_hook(net, flowtable, hook);
7218                 list_del_rcu(&hook->list);
7219                 kfree_rcu(hook, rcu);
7220         }
7221
7222         return err;
7223 }
7224
7225 static void nft_flowtable_hooks_destroy(struct list_head *hook_list)
7226 {
7227         struct nft_hook *hook, *next;
7228
7229         list_for_each_entry_safe(hook, next, hook_list, list) {
7230                 list_del_rcu(&hook->list);
7231                 kfree_rcu(hook, rcu);
7232         }
7233 }
7234
7235 static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
7236                                 struct nft_flowtable *flowtable)
7237 {
7238         const struct nlattr * const *nla = ctx->nla;
7239         struct nft_flowtable_hook flowtable_hook;
7240         struct nft_hook *hook, *next;
7241         struct nft_trans *trans;
7242         bool unregister = false;
7243         u32 flags;
7244         int err;
7245
7246         err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
7247                                        &flowtable_hook, flowtable, false);
7248         if (err < 0)
7249                 return err;
7250
7251         list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
7252                 if (nft_hook_list_find(&flowtable->hook_list, hook)) {
7253                         list_del(&hook->list);
7254                         kfree(hook);
7255                 }
7256         }
7257
7258         if (nla[NFTA_FLOWTABLE_FLAGS]) {
7259                 flags = ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
7260                 if (flags & ~NFT_FLOWTABLE_MASK)
7261                         return -EOPNOTSUPP;
7262                 if ((flowtable->data.flags & NFT_FLOWTABLE_HW_OFFLOAD) ^
7263                     (flags & NFT_FLOWTABLE_HW_OFFLOAD))
7264                         return -EOPNOTSUPP;
7265         } else {
7266                 flags = flowtable->data.flags;
7267         }
7268
7269         err = nft_register_flowtable_net_hooks(ctx->net, ctx->table,
7270                                                &flowtable_hook.list, flowtable);
7271         if (err < 0)
7272                 goto err_flowtable_update_hook;
7273
7274         trans = nft_trans_alloc(ctx, NFT_MSG_NEWFLOWTABLE,
7275                                 sizeof(struct nft_trans_flowtable));
7276         if (!trans) {
7277                 unregister = true;
7278                 err = -ENOMEM;
7279                 goto err_flowtable_update_hook;
7280         }
7281
7282         nft_trans_flowtable_flags(trans) = flags;
7283         nft_trans_flowtable(trans) = flowtable;
7284         nft_trans_flowtable_update(trans) = true;
7285         INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
7286         list_splice(&flowtable_hook.list, &nft_trans_flowtable_hooks(trans));
7287
7288         nft_trans_commit_list_add_tail(ctx->net, trans);
7289
7290         return 0;
7291
7292 err_flowtable_update_hook:
7293         list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
7294                 if (unregister)
7295                         nft_unregister_flowtable_hook(ctx->net, flowtable, hook);
7296                 list_del_rcu(&hook->list);
7297                 kfree_rcu(hook, rcu);
7298         }
7299
7300         return err;
7301
7302 }
7303
7304 static int nf_tables_newflowtable(struct sk_buff *skb,
7305                                   const struct nfnl_info *info,
7306                                   const struct nlattr * const nla[])
7307 {
7308         struct netlink_ext_ack *extack = info->extack;
7309         struct nft_flowtable_hook flowtable_hook;
7310         u8 genmask = nft_genmask_next(info->net);
7311         u8 family = info->nfmsg->nfgen_family;
7312         const struct nf_flowtable_type *type;
7313         struct nft_flowtable *flowtable;
7314         struct nft_hook *hook, *next;
7315         struct net *net = info->net;
7316         struct nft_table *table;
7317         struct nft_ctx ctx;
7318         int err;
7319
7320         if (!nla[NFTA_FLOWTABLE_TABLE] ||
7321             !nla[NFTA_FLOWTABLE_NAME] ||
7322             !nla[NFTA_FLOWTABLE_HOOK])
7323                 return -EINVAL;
7324
7325         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7326                                  genmask, NETLINK_CB(skb).portid);
7327         if (IS_ERR(table)) {
7328                 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
7329                 return PTR_ERR(table);
7330         }
7331
7332         flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
7333                                          genmask);
7334         if (IS_ERR(flowtable)) {
7335                 err = PTR_ERR(flowtable);
7336                 if (err != -ENOENT) {
7337                         NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
7338                         return err;
7339                 }
7340         } else {
7341                 if (info->nlh->nlmsg_flags & NLM_F_EXCL) {
7342                         NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
7343                         return -EEXIST;
7344                 }
7345
7346                 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
7347
7348                 return nft_flowtable_update(&ctx, info->nlh, flowtable);
7349         }
7350
7351         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
7352
7353         flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
7354         if (!flowtable)
7355                 return -ENOMEM;
7356
7357         flowtable->table = table;
7358         flowtable->handle = nf_tables_alloc_handle(table);
7359         INIT_LIST_HEAD(&flowtable->hook_list);
7360
7361         flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
7362         if (!flowtable->name) {
7363                 err = -ENOMEM;
7364                 goto err1;
7365         }
7366
7367         type = nft_flowtable_type_get(net, family);
7368         if (IS_ERR(type)) {
7369                 err = PTR_ERR(type);
7370                 goto err2;
7371         }
7372
7373         if (nla[NFTA_FLOWTABLE_FLAGS]) {
7374                 flowtable->data.flags =
7375                         ntohl(nla_get_be32(nla[NFTA_FLOWTABLE_FLAGS]));
7376                 if (flowtable->data.flags & ~NFT_FLOWTABLE_MASK) {
7377                         err = -EOPNOTSUPP;
7378                         goto err3;
7379                 }
7380         }
7381
7382         write_pnet(&flowtable->data.net, net);
7383         flowtable->data.type = type;
7384         err = type->init(&flowtable->data);
7385         if (err < 0)
7386                 goto err3;
7387
7388         err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
7389                                        &flowtable_hook, flowtable, true);
7390         if (err < 0)
7391                 goto err4;
7392
7393         list_splice(&flowtable_hook.list, &flowtable->hook_list);
7394         flowtable->data.priority = flowtable_hook.priority;
7395         flowtable->hooknum = flowtable_hook.num;
7396
7397         err = nft_register_flowtable_net_hooks(ctx.net, table,
7398                                                &flowtable->hook_list,
7399                                                flowtable);
7400         if (err < 0) {
7401                 nft_flowtable_hooks_destroy(&flowtable->hook_list);
7402                 goto err4;
7403         }
7404
7405         err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
7406         if (err < 0)
7407                 goto err5;
7408
7409         list_add_tail_rcu(&flowtable->list, &table->flowtables);
7410         table->use++;
7411
7412         return 0;
7413 err5:
7414         list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7415                 nft_unregister_flowtable_hook(net, flowtable, hook);
7416                 list_del_rcu(&hook->list);
7417                 kfree_rcu(hook, rcu);
7418         }
7419 err4:
7420         flowtable->data.type->free(&flowtable->data);
7421 err3:
7422         module_put(type->owner);
7423 err2:
7424         kfree(flowtable->name);
7425 err1:
7426         kfree(flowtable);
7427         return err;
7428 }
7429
7430 static void nft_flowtable_hook_release(struct nft_flowtable_hook *flowtable_hook)
7431 {
7432         struct nft_hook *this, *next;
7433
7434         list_for_each_entry_safe(this, next, &flowtable_hook->list, list) {
7435                 list_del(&this->list);
7436                 kfree(this);
7437         }
7438 }
7439
7440 static int nft_delflowtable_hook(struct nft_ctx *ctx,
7441                                  struct nft_flowtable *flowtable)
7442 {
7443         const struct nlattr * const *nla = ctx->nla;
7444         struct nft_flowtable_hook flowtable_hook;
7445         struct nft_hook *this, *hook;
7446         struct nft_trans *trans;
7447         int err;
7448
7449         err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
7450                                        &flowtable_hook, flowtable, false);
7451         if (err < 0)
7452                 return err;
7453
7454         list_for_each_entry(this, &flowtable_hook.list, list) {
7455                 hook = nft_hook_list_find(&flowtable->hook_list, this);
7456                 if (!hook) {
7457                         err = -ENOENT;
7458                         goto err_flowtable_del_hook;
7459                 }
7460                 hook->inactive = true;
7461         }
7462
7463         trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
7464                                 sizeof(struct nft_trans_flowtable));
7465         if (!trans) {
7466                 err = -ENOMEM;
7467                 goto err_flowtable_del_hook;
7468         }
7469
7470         nft_trans_flowtable(trans) = flowtable;
7471         nft_trans_flowtable_update(trans) = true;
7472         INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
7473         nft_flowtable_hook_release(&flowtable_hook);
7474
7475         nft_trans_commit_list_add_tail(ctx->net, trans);
7476
7477         return 0;
7478
7479 err_flowtable_del_hook:
7480         list_for_each_entry(this, &flowtable_hook.list, list) {
7481                 hook = nft_hook_list_find(&flowtable->hook_list, this);
7482                 if (!hook)
7483                         break;
7484
7485                 hook->inactive = false;
7486         }
7487         nft_flowtable_hook_release(&flowtable_hook);
7488
7489         return err;
7490 }
7491
7492 static int nf_tables_delflowtable(struct sk_buff *skb,
7493                                   const struct nfnl_info *info,
7494                                   const struct nlattr * const nla[])
7495 {
7496         struct netlink_ext_ack *extack = info->extack;
7497         u8 genmask = nft_genmask_next(info->net);
7498         u8 family = info->nfmsg->nfgen_family;
7499         struct nft_flowtable *flowtable;
7500         struct net *net = info->net;
7501         const struct nlattr *attr;
7502         struct nft_table *table;
7503         struct nft_ctx ctx;
7504
7505         if (!nla[NFTA_FLOWTABLE_TABLE] ||
7506             (!nla[NFTA_FLOWTABLE_NAME] &&
7507              !nla[NFTA_FLOWTABLE_HANDLE]))
7508                 return -EINVAL;
7509
7510         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7511                                  genmask, NETLINK_CB(skb).portid);
7512         if (IS_ERR(table)) {
7513                 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
7514                 return PTR_ERR(table);
7515         }
7516
7517         if (nla[NFTA_FLOWTABLE_HANDLE]) {
7518                 attr = nla[NFTA_FLOWTABLE_HANDLE];
7519                 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
7520         } else {
7521                 attr = nla[NFTA_FLOWTABLE_NAME];
7522                 flowtable = nft_flowtable_lookup(table, attr, genmask);
7523         }
7524
7525         if (IS_ERR(flowtable)) {
7526                 NL_SET_BAD_ATTR(extack, attr);
7527                 return PTR_ERR(flowtable);
7528         }
7529
7530         nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
7531
7532         if (nla[NFTA_FLOWTABLE_HOOK])
7533                 return nft_delflowtable_hook(&ctx, flowtable);
7534
7535         if (flowtable->use > 0) {
7536                 NL_SET_BAD_ATTR(extack, attr);
7537                 return -EBUSY;
7538         }
7539
7540         return nft_delflowtable(&ctx, flowtable);
7541 }
7542
7543 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
7544                                          u32 portid, u32 seq, int event,
7545                                          u32 flags, int family,
7546                                          struct nft_flowtable *flowtable,
7547                                          struct list_head *hook_list)
7548 {
7549         struct nlattr *nest, *nest_devs;
7550         struct nft_hook *hook;
7551         struct nlmsghdr *nlh;
7552
7553         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
7554         nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
7555                            NFNETLINK_V0, nft_base_seq(net));
7556         if (!nlh)
7557                 goto nla_put_failure;
7558
7559         if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
7560             nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
7561             nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
7562             nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
7563                          NFTA_FLOWTABLE_PAD) ||
7564             nla_put_be32(skb, NFTA_FLOWTABLE_FLAGS, htonl(flowtable->data.flags)))
7565                 goto nla_put_failure;
7566
7567         nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
7568         if (!nest)
7569                 goto nla_put_failure;
7570         if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
7571             nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->data.priority)))
7572                 goto nla_put_failure;
7573
7574         nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
7575         if (!nest_devs)
7576                 goto nla_put_failure;
7577
7578         list_for_each_entry_rcu(hook, hook_list, list) {
7579                 if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))
7580                         goto nla_put_failure;
7581         }
7582         nla_nest_end(skb, nest_devs);
7583         nla_nest_end(skb, nest);
7584
7585         nlmsg_end(skb, nlh);
7586         return 0;
7587
7588 nla_put_failure:
7589         nlmsg_trim(skb, nlh);
7590         return -1;
7591 }
7592
7593 struct nft_flowtable_filter {
7594         char            *table;
7595 };
7596
7597 static int nf_tables_dump_flowtable(struct sk_buff *skb,
7598                                     struct netlink_callback *cb)
7599 {
7600         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
7601         struct nft_flowtable_filter *filter = cb->data;
7602         unsigned int idx = 0, s_idx = cb->args[0];
7603         struct net *net = sock_net(skb->sk);
7604         int family = nfmsg->nfgen_family;
7605         struct nft_flowtable *flowtable;
7606         struct nftables_pernet *nft_net;
7607         const struct nft_table *table;
7608
7609         rcu_read_lock();
7610         nft_net = nft_pernet(net);
7611         cb->seq = nft_net->base_seq;
7612
7613         list_for_each_entry_rcu(table, &nft_net->tables, list) {
7614                 if (family != NFPROTO_UNSPEC && family != table->family)
7615                         continue;
7616
7617                 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
7618                         if (!nft_is_active(net, flowtable))
7619                                 goto cont;
7620                         if (idx < s_idx)
7621                                 goto cont;
7622                         if (idx > s_idx)
7623                                 memset(&cb->args[1], 0,
7624                                        sizeof(cb->args) - sizeof(cb->args[0]));
7625                         if (filter && filter->table &&
7626                             strcmp(filter->table, table->name))
7627                                 goto cont;
7628
7629                         if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
7630                                                           cb->nlh->nlmsg_seq,
7631                                                           NFT_MSG_NEWFLOWTABLE,
7632                                                           NLM_F_MULTI | NLM_F_APPEND,
7633                                                           table->family,
7634                                                           flowtable,
7635                                                           &flowtable->hook_list) < 0)
7636                                 goto done;
7637
7638                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
7639 cont:
7640                         idx++;
7641                 }
7642         }
7643 done:
7644         rcu_read_unlock();
7645
7646         cb->args[0] = idx;
7647         return skb->len;
7648 }
7649
7650 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
7651 {
7652         const struct nlattr * const *nla = cb->data;
7653         struct nft_flowtable_filter *filter = NULL;
7654
7655         if (nla[NFTA_FLOWTABLE_TABLE]) {
7656                 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
7657                 if (!filter)
7658                         return -ENOMEM;
7659
7660                 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
7661                                            GFP_ATOMIC);
7662                 if (!filter->table) {
7663                         kfree(filter);
7664                         return -ENOMEM;
7665                 }
7666         }
7667
7668         cb->data = filter;
7669         return 0;
7670 }
7671
7672 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
7673 {
7674         struct nft_flowtable_filter *filter = cb->data;
7675
7676         if (!filter)
7677                 return 0;
7678
7679         kfree(filter->table);
7680         kfree(filter);
7681
7682         return 0;
7683 }
7684
7685 /* called with rcu_read_lock held */
7686 static int nf_tables_getflowtable(struct sk_buff *skb,
7687                                   const struct nfnl_info *info,
7688                                   const struct nlattr * const nla[])
7689 {
7690         u8 genmask = nft_genmask_cur(info->net);
7691         u8 family = info->nfmsg->nfgen_family;
7692         struct nft_flowtable *flowtable;
7693         const struct nft_table *table;
7694         struct net *net = info->net;
7695         struct sk_buff *skb2;
7696         int err;
7697
7698         if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
7699                 struct netlink_dump_control c = {
7700                         .start = nf_tables_dump_flowtable_start,
7701                         .dump = nf_tables_dump_flowtable,
7702                         .done = nf_tables_dump_flowtable_done,
7703                         .module = THIS_MODULE,
7704                         .data = (void *)nla,
7705                 };
7706
7707                 return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
7708         }
7709
7710         if (!nla[NFTA_FLOWTABLE_NAME])
7711                 return -EINVAL;
7712
7713         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
7714                                  genmask, 0);
7715         if (IS_ERR(table))
7716                 return PTR_ERR(table);
7717
7718         flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
7719                                          genmask);
7720         if (IS_ERR(flowtable))
7721                 return PTR_ERR(flowtable);
7722
7723         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7724         if (!skb2)
7725                 return -ENOMEM;
7726
7727         err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
7728                                             info->nlh->nlmsg_seq,
7729                                             NFT_MSG_NEWFLOWTABLE, 0, family,
7730                                             flowtable, &flowtable->hook_list);
7731         if (err < 0)
7732                 goto err_fill_flowtable_info;
7733
7734         return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
7735
7736 err_fill_flowtable_info:
7737         kfree_skb(skb2);
7738         return err;
7739 }
7740
7741 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
7742                                        struct nft_flowtable *flowtable,
7743                                        struct list_head *hook_list,
7744                                        int event)
7745 {
7746         struct nftables_pernet *nft_net = nft_pernet(ctx->net);
7747         struct sk_buff *skb;
7748         int err;
7749
7750         if (!ctx->report &&
7751             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
7752                 return;
7753
7754         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7755         if (skb == NULL)
7756                 goto err;
7757
7758         err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
7759                                             ctx->seq, event, 0,
7760                                             ctx->family, flowtable, hook_list);
7761         if (err < 0) {
7762                 kfree_skb(skb);
7763                 goto err;
7764         }
7765
7766         nft_notify_enqueue(skb, ctx->report, &nft_net->notify_list);
7767         return;
7768 err:
7769         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
7770 }
7771
7772 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
7773 {
7774         struct nft_hook *hook, *next;
7775
7776         flowtable->data.type->free(&flowtable->data);
7777         list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
7778                 flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
7779                                             FLOW_BLOCK_UNBIND);
7780                 list_del_rcu(&hook->list);
7781                 kfree(hook);
7782         }
7783         kfree(flowtable->name);
7784         module_put(flowtable->data.type->owner);
7785         kfree(flowtable);
7786 }
7787
7788 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
7789                                    u32 portid, u32 seq)
7790 {
7791         struct nftables_pernet *nft_net = nft_pernet(net);
7792         struct nlmsghdr *nlh;
7793         char buf[TASK_COMM_LEN];
7794         int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
7795
7796         nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC,
7797                            NFNETLINK_V0, nft_base_seq(net));
7798         if (!nlh)
7799                 goto nla_put_failure;
7800
7801         if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) ||
7802             nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
7803             nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
7804                 goto nla_put_failure;
7805
7806         nlmsg_end(skb, nlh);
7807         return 0;
7808
7809 nla_put_failure:
7810         nlmsg_trim(skb, nlh);
7811         return -EMSGSIZE;
7812 }
7813
7814 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
7815                                 struct nft_flowtable *flowtable)
7816 {
7817         struct nft_hook *hook;
7818
7819         list_for_each_entry(hook, &flowtable->hook_list, list) {
7820                 if (hook->ops.dev != dev)
7821                         continue;
7822
7823                 /* flow_offload_netdev_event() cleans up entries for us. */
7824                 nft_unregister_flowtable_hook(dev_net(dev), flowtable, hook);
7825                 list_del_rcu(&hook->list);
7826                 kfree_rcu(hook, rcu);
7827                 break;
7828         }
7829 }
7830
7831 static int nf_tables_flowtable_event(struct notifier_block *this,
7832                                      unsigned long event, void *ptr)
7833 {
7834         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
7835         struct nft_flowtable *flowtable;
7836         struct nftables_pernet *nft_net;
7837         struct nft_table *table;
7838         struct net *net;
7839
7840         if (event != NETDEV_UNREGISTER)
7841                 return 0;
7842
7843         net = dev_net(dev);
7844         nft_net = nft_pernet(net);
7845         mutex_lock(&nft_net->commit_mutex);
7846         list_for_each_entry(table, &nft_net->tables, list) {
7847                 list_for_each_entry(flowtable, &table->flowtables, list) {
7848                         nft_flowtable_event(event, dev, flowtable);
7849                 }
7850         }
7851         mutex_unlock(&nft_net->commit_mutex);
7852
7853         return NOTIFY_DONE;
7854 }
7855
7856 static struct notifier_block nf_tables_flowtable_notifier = {
7857         .notifier_call  = nf_tables_flowtable_event,
7858 };
7859
7860 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
7861                                  int event)
7862 {
7863         struct nlmsghdr *nlh = nlmsg_hdr(skb);
7864         struct sk_buff *skb2;
7865         int err;
7866
7867         if (!nlmsg_report(nlh) &&
7868             !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
7869                 return;
7870
7871         skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
7872         if (skb2 == NULL)
7873                 goto err;
7874
7875         err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
7876                                       nlh->nlmsg_seq);
7877         if (err < 0) {
7878                 kfree_skb(skb2);
7879                 goto err;
7880         }
7881
7882         nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7883                        nlmsg_report(nlh), GFP_KERNEL);
7884         return;
7885 err:
7886         nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
7887                           -ENOBUFS);
7888 }
7889
7890 static int nf_tables_getgen(struct sk_buff *skb, const struct nfnl_info *info,
7891                             const struct nlattr * const nla[])
7892 {
7893         struct sk_buff *skb2;
7894         int err;
7895
7896         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
7897         if (skb2 == NULL)
7898                 return -ENOMEM;
7899
7900         err = nf_tables_fill_gen_info(skb2, info->net, NETLINK_CB(skb).portid,
7901                                       info->nlh->nlmsg_seq);
7902         if (err < 0)
7903                 goto err_fill_gen_info;
7904
7905         return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid);
7906
7907 err_fill_gen_info:
7908         kfree_skb(skb2);
7909         return err;
7910 }
7911
7912 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
7913         [NFT_MSG_NEWTABLE] = {
7914                 .call           = nf_tables_newtable,
7915                 .type           = NFNL_CB_BATCH,
7916                 .attr_count     = NFTA_TABLE_MAX,
7917                 .policy         = nft_table_policy,
7918         },
7919         [NFT_MSG_GETTABLE] = {
7920                 .call           = nf_tables_gettable,
7921                 .type           = NFNL_CB_RCU,
7922                 .attr_count     = NFTA_TABLE_MAX,
7923                 .policy         = nft_table_policy,
7924         },
7925         [NFT_MSG_DELTABLE] = {
7926                 .call           = nf_tables_deltable,
7927                 .type           = NFNL_CB_BATCH,
7928                 .attr_count     = NFTA_TABLE_MAX,
7929                 .policy         = nft_table_policy,
7930         },
7931         [NFT_MSG_NEWCHAIN] = {
7932                 .call           = nf_tables_newchain,
7933                 .type           = NFNL_CB_BATCH,
7934                 .attr_count     = NFTA_CHAIN_MAX,
7935                 .policy         = nft_chain_policy,
7936         },
7937         [NFT_MSG_GETCHAIN] = {
7938                 .call           = nf_tables_getchain,
7939                 .type           = NFNL_CB_RCU,
7940                 .attr_count     = NFTA_CHAIN_MAX,
7941                 .policy         = nft_chain_policy,
7942         },
7943         [NFT_MSG_DELCHAIN] = {
7944                 .call           = nf_tables_delchain,
7945                 .type           = NFNL_CB_BATCH,
7946                 .attr_count     = NFTA_CHAIN_MAX,
7947                 .policy         = nft_chain_policy,
7948         },
7949         [NFT_MSG_NEWRULE] = {
7950                 .call           = nf_tables_newrule,
7951                 .type           = NFNL_CB_BATCH,
7952                 .attr_count     = NFTA_RULE_MAX,
7953                 .policy         = nft_rule_policy,
7954         },
7955         [NFT_MSG_GETRULE] = {
7956                 .call           = nf_tables_getrule,
7957                 .type           = NFNL_CB_RCU,
7958                 .attr_count     = NFTA_RULE_MAX,
7959                 .policy         = nft_rule_policy,
7960         },
7961         [NFT_MSG_DELRULE] = {
7962                 .call           = nf_tables_delrule,
7963                 .type           = NFNL_CB_BATCH,
7964                 .attr_count     = NFTA_RULE_MAX,
7965                 .policy         = nft_rule_policy,
7966         },
7967         [NFT_MSG_NEWSET] = {
7968                 .call           = nf_tables_newset,
7969                 .type           = NFNL_CB_BATCH,
7970                 .attr_count     = NFTA_SET_MAX,
7971                 .policy         = nft_set_policy,
7972         },
7973         [NFT_MSG_GETSET] = {
7974                 .call           = nf_tables_getset,
7975                 .type           = NFNL_CB_RCU,
7976                 .attr_count     = NFTA_SET_MAX,
7977                 .policy         = nft_set_policy,
7978         },
7979         [NFT_MSG_DELSET] = {
7980                 .call           = nf_tables_delset,
7981                 .type           = NFNL_CB_BATCH,
7982                 .attr_count     = NFTA_SET_MAX,
7983                 .policy         = nft_set_policy,
7984         },
7985         [NFT_MSG_NEWSETELEM] = {
7986                 .call           = nf_tables_newsetelem,
7987                 .type           = NFNL_CB_BATCH,
7988                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
7989                 .policy         = nft_set_elem_list_policy,
7990         },
7991         [NFT_MSG_GETSETELEM] = {
7992                 .call           = nf_tables_getsetelem,
7993                 .type           = NFNL_CB_RCU,
7994                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
7995                 .policy         = nft_set_elem_list_policy,
7996         },
7997         [NFT_MSG_DELSETELEM] = {
7998                 .call           = nf_tables_delsetelem,
7999                 .type           = NFNL_CB_BATCH,
8000                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
8001                 .policy         = nft_set_elem_list_policy,
8002         },
8003         [NFT_MSG_GETGEN] = {
8004                 .call           = nf_tables_getgen,
8005                 .type           = NFNL_CB_RCU,
8006         },
8007         [NFT_MSG_NEWOBJ] = {
8008                 .call           = nf_tables_newobj,
8009                 .type           = NFNL_CB_BATCH,
8010                 .attr_count     = NFTA_OBJ_MAX,
8011                 .policy         = nft_obj_policy,
8012         },
8013         [NFT_MSG_GETOBJ] = {
8014                 .call           = nf_tables_getobj,
8015                 .type           = NFNL_CB_RCU,
8016                 .attr_count     = NFTA_OBJ_MAX,
8017                 .policy         = nft_obj_policy,
8018         },
8019         [NFT_MSG_DELOBJ] = {
8020                 .call           = nf_tables_delobj,
8021                 .type           = NFNL_CB_BATCH,
8022                 .attr_count     = NFTA_OBJ_MAX,
8023                 .policy         = nft_obj_policy,
8024         },
8025         [NFT_MSG_GETOBJ_RESET] = {
8026                 .call           = nf_tables_getobj,
8027                 .type           = NFNL_CB_RCU,
8028                 .attr_count     = NFTA_OBJ_MAX,
8029                 .policy         = nft_obj_policy,
8030         },
8031         [NFT_MSG_NEWFLOWTABLE] = {
8032                 .call           = nf_tables_newflowtable,
8033                 .type           = NFNL_CB_BATCH,
8034                 .attr_count     = NFTA_FLOWTABLE_MAX,
8035                 .policy         = nft_flowtable_policy,
8036         },
8037         [NFT_MSG_GETFLOWTABLE] = {
8038                 .call           = nf_tables_getflowtable,
8039                 .type           = NFNL_CB_RCU,
8040                 .attr_count     = NFTA_FLOWTABLE_MAX,
8041                 .policy         = nft_flowtable_policy,
8042         },
8043         [NFT_MSG_DELFLOWTABLE] = {
8044                 .call           = nf_tables_delflowtable,
8045                 .type           = NFNL_CB_BATCH,
8046                 .attr_count     = NFTA_FLOWTABLE_MAX,
8047                 .policy         = nft_flowtable_policy,
8048         },
8049 };
8050
8051 static int nf_tables_validate(struct net *net)
8052 {
8053         struct nftables_pernet *nft_net = nft_pernet(net);
8054         struct nft_table *table;
8055
8056         switch (nft_net->validate_state) {
8057         case NFT_VALIDATE_SKIP:
8058                 break;
8059         case NFT_VALIDATE_NEED:
8060                 nft_validate_state_update(net, NFT_VALIDATE_DO);
8061                 fallthrough;
8062         case NFT_VALIDATE_DO:
8063                 list_for_each_entry(table, &nft_net->tables, list) {
8064                         if (nft_table_validate(net, table) < 0)
8065                                 return -EAGAIN;
8066                 }
8067                 break;
8068         }
8069
8070         return 0;
8071 }
8072
8073 /* a drop policy has to be deferred until all rules have been activated,
8074  * otherwise a large ruleset that contains a drop-policy base chain will
8075  * cause all packets to get dropped until the full transaction has been
8076  * processed.
8077  *
8078  * We defer the drop policy until the transaction has been finalized.
8079  */
8080 static void nft_chain_commit_drop_policy(struct nft_trans *trans)
8081 {
8082         struct nft_base_chain *basechain;
8083
8084         if (nft_trans_chain_policy(trans) != NF_DROP)
8085                 return;
8086
8087         if (!nft_is_base_chain(trans->ctx.chain))
8088                 return;
8089
8090         basechain = nft_base_chain(trans->ctx.chain);
8091         basechain->policy = NF_DROP;
8092 }
8093
8094 static void nft_chain_commit_update(struct nft_trans *trans)
8095 {
8096         struct nft_base_chain *basechain;
8097
8098         if (nft_trans_chain_name(trans)) {
8099                 rhltable_remove(&trans->ctx.table->chains_ht,
8100                                 &trans->ctx.chain->rhlhead,
8101                                 nft_chain_ht_params);
8102                 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
8103                 rhltable_insert_key(&trans->ctx.table->chains_ht,
8104                                     trans->ctx.chain->name,
8105                                     &trans->ctx.chain->rhlhead,
8106                                     nft_chain_ht_params);
8107         }
8108
8109         if (!nft_is_base_chain(trans->ctx.chain))
8110                 return;
8111
8112         nft_chain_stats_replace(trans);
8113
8114         basechain = nft_base_chain(trans->ctx.chain);
8115
8116         switch (nft_trans_chain_policy(trans)) {
8117         case NF_DROP:
8118         case NF_ACCEPT:
8119                 basechain->policy = nft_trans_chain_policy(trans);
8120                 break;
8121         }
8122 }
8123
8124 static void nft_obj_commit_update(struct nft_trans *trans)
8125 {
8126         struct nft_object *newobj;
8127         struct nft_object *obj;
8128
8129         obj = nft_trans_obj(trans);
8130         newobj = nft_trans_obj_newobj(trans);
8131
8132         if (obj->ops->update)
8133                 obj->ops->update(obj, newobj);
8134
8135         kfree(newobj);
8136 }
8137
8138 static void nft_commit_release(struct nft_trans *trans)
8139 {
8140         switch (trans->msg_type) {
8141         case NFT_MSG_DELTABLE:
8142                 nf_tables_table_destroy(&trans->ctx);
8143                 break;
8144         case NFT_MSG_NEWCHAIN:
8145                 free_percpu(nft_trans_chain_stats(trans));
8146                 kfree(nft_trans_chain_name(trans));
8147                 break;
8148         case NFT_MSG_DELCHAIN:
8149                 nf_tables_chain_destroy(&trans->ctx);
8150                 break;
8151         case NFT_MSG_DELRULE:
8152                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
8153                 break;
8154         case NFT_MSG_DELSET:
8155                 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
8156                 break;
8157         case NFT_MSG_DELSETELEM:
8158                 nf_tables_set_elem_destroy(&trans->ctx,
8159                                            nft_trans_elem_set(trans),
8160                                            nft_trans_elem(trans).priv);
8161                 break;
8162         case NFT_MSG_DELOBJ:
8163                 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
8164                 break;
8165         case NFT_MSG_DELFLOWTABLE:
8166                 if (nft_trans_flowtable_update(trans))
8167                         nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
8168                 else
8169                         nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
8170                 break;
8171         }
8172
8173         if (trans->put_net)
8174                 put_net(trans->ctx.net);
8175
8176         kfree(trans);
8177 }
8178
8179 static void nf_tables_trans_destroy_work(struct work_struct *w)
8180 {
8181         struct nft_trans *trans, *next;
8182         LIST_HEAD(head);
8183
8184         spin_lock(&nf_tables_destroy_list_lock);
8185         list_splice_init(&nf_tables_destroy_list, &head);
8186         spin_unlock(&nf_tables_destroy_list_lock);
8187
8188         if (list_empty(&head))
8189                 return;
8190
8191         synchronize_rcu();
8192
8193         list_for_each_entry_safe(trans, next, &head, list) {
8194                 list_del(&trans->list);
8195                 nft_commit_release(trans);
8196         }
8197 }
8198
8199 void nf_tables_trans_destroy_flush_work(void)
8200 {
8201         flush_work(&trans_destroy_work);
8202 }
8203 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
8204
8205 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
8206 {
8207         struct nft_rule *rule;
8208         unsigned int alloc = 0;
8209         int i;
8210
8211         /* already handled or inactive chain? */
8212         if (chain->rules_next || !nft_is_active_next(net, chain))
8213                 return 0;
8214
8215         rule = list_entry(&chain->rules, struct nft_rule, list);
8216         i = 0;
8217
8218         list_for_each_entry_continue(rule, &chain->rules, list) {
8219                 if (nft_is_active_next(net, rule))
8220                         alloc++;
8221         }
8222
8223         chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
8224         if (!chain->rules_next)
8225                 return -ENOMEM;
8226
8227         list_for_each_entry_continue(rule, &chain->rules, list) {
8228                 if (nft_is_active_next(net, rule))
8229                         chain->rules_next[i++] = rule;
8230         }
8231
8232         chain->rules_next[i] = NULL;
8233         return 0;
8234 }
8235
8236 static void nf_tables_commit_chain_prepare_cancel(struct net *net)
8237 {
8238         struct nftables_pernet *nft_net = nft_pernet(net);
8239         struct nft_trans *trans, *next;
8240
8241         list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
8242                 struct nft_chain *chain = trans->ctx.chain;
8243
8244                 if (trans->msg_type == NFT_MSG_NEWRULE ||
8245                     trans->msg_type == NFT_MSG_DELRULE) {
8246                         kvfree(chain->rules_next);
8247                         chain->rules_next = NULL;
8248                 }
8249         }
8250 }
8251
8252 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
8253 {
8254         struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
8255
8256         kvfree(o->start);
8257 }
8258
8259 static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
8260 {
8261         struct nft_rule **r = rules;
8262         struct nft_rules_old *old;
8263
8264         while (*r)
8265                 r++;
8266
8267         r++;    /* rcu_head is after end marker */
8268         old = (void *) r;
8269         old->start = rules;
8270
8271         call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
8272 }
8273
8274 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
8275 {
8276         struct nft_rule **g0, **g1;
8277         bool next_genbit;
8278
8279         next_genbit = nft_gencursor_next(net);
8280
8281         g0 = rcu_dereference_protected(chain->rules_gen_0,
8282                                        lockdep_commit_lock_is_held(net));
8283         g1 = rcu_dereference_protected(chain->rules_gen_1,
8284                                        lockdep_commit_lock_is_held(net));
8285
8286         /* No changes to this chain? */
8287         if (chain->rules_next == NULL) {
8288                 /* chain had no change in last or next generation */
8289                 if (g0 == g1)
8290                         return;
8291                 /*
8292                  * chain had no change in this generation; make sure next
8293                  * one uses same rules as current generation.
8294                  */
8295                 if (next_genbit) {
8296                         rcu_assign_pointer(chain->rules_gen_1, g0);
8297                         nf_tables_commit_chain_free_rules_old(g1);
8298                 } else {
8299                         rcu_assign_pointer(chain->rules_gen_0, g1);
8300                         nf_tables_commit_chain_free_rules_old(g0);
8301                 }
8302
8303                 return;
8304         }
8305
8306         if (next_genbit)
8307                 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
8308         else
8309                 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
8310
8311         chain->rules_next = NULL;
8312
8313         if (g0 == g1)
8314                 return;
8315
8316         if (next_genbit)
8317                 nf_tables_commit_chain_free_rules_old(g1);
8318         else
8319                 nf_tables_commit_chain_free_rules_old(g0);
8320 }
8321
8322 static void nft_obj_del(struct nft_object *obj)
8323 {
8324         rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
8325         list_del_rcu(&obj->list);
8326 }
8327
8328 void nft_chain_del(struct nft_chain *chain)
8329 {
8330         struct nft_table *table = chain->table;
8331
8332         WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
8333                                      nft_chain_ht_params));
8334         list_del_rcu(&chain->list);
8335 }
8336
8337 static void nft_flowtable_hooks_del(struct nft_flowtable *flowtable,
8338                                     struct list_head *hook_list)
8339 {
8340         struct nft_hook *hook, *next;
8341
8342         list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
8343                 if (hook->inactive)
8344                         list_move(&hook->list, hook_list);
8345         }
8346 }
8347
8348 static void nf_tables_module_autoload_cleanup(struct net *net)
8349 {
8350         struct nftables_pernet *nft_net = nft_pernet(net);
8351         struct nft_module_request *req, *next;
8352
8353         WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
8354         list_for_each_entry_safe(req, next, &nft_net->module_list, list) {
8355                 WARN_ON_ONCE(!req->done);
8356                 list_del(&req->list);
8357                 kfree(req);
8358         }
8359 }
8360
8361 static void nf_tables_commit_release(struct net *net)
8362 {
8363         struct nftables_pernet *nft_net = nft_pernet(net);
8364         struct nft_trans *trans;
8365
8366         /* all side effects have to be made visible.
8367          * For example, if a chain named 'foo' has been deleted, a
8368          * new transaction must not find it anymore.
8369          *
8370          * Memory reclaim happens asynchronously from work queue
8371          * to prevent expensive synchronize_rcu() in commit phase.
8372          */
8373         if (list_empty(&nft_net->commit_list)) {
8374                 nf_tables_module_autoload_cleanup(net);
8375                 mutex_unlock(&nft_net->commit_mutex);
8376                 return;
8377         }
8378
8379         trans = list_last_entry(&nft_net->commit_list,
8380                                 struct nft_trans, list);
8381         get_net(trans->ctx.net);
8382         WARN_ON_ONCE(trans->put_net);
8383
8384         trans->put_net = true;
8385         spin_lock(&nf_tables_destroy_list_lock);
8386         list_splice_tail_init(&nft_net->commit_list, &nf_tables_destroy_list);
8387         spin_unlock(&nf_tables_destroy_list_lock);
8388
8389         nf_tables_module_autoload_cleanup(net);
8390         schedule_work(&trans_destroy_work);
8391
8392         mutex_unlock(&nft_net->commit_mutex);
8393 }
8394
8395 static void nft_commit_notify(struct net *net, u32 portid)
8396 {
8397         struct nftables_pernet *nft_net = nft_pernet(net);
8398         struct sk_buff *batch_skb = NULL, *nskb, *skb;
8399         unsigned char *data;
8400         int len;
8401
8402         list_for_each_entry_safe(skb, nskb, &nft_net->notify_list, list) {
8403                 if (!batch_skb) {
8404 new_batch:
8405                         batch_skb = skb;
8406                         len = NLMSG_GOODSIZE - skb->len;
8407                         list_del(&skb->list);
8408                         continue;
8409                 }
8410                 len -= skb->len;
8411                 if (len > 0 && NFT_CB(skb).report == NFT_CB(batch_skb).report) {
8412                         data = skb_put(batch_skb, skb->len);
8413                         memcpy(data, skb->data, skb->len);
8414                         list_del(&skb->list);
8415                         kfree_skb(skb);
8416                         continue;
8417                 }
8418                 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
8419                                NFT_CB(batch_skb).report, GFP_KERNEL);
8420                 goto new_batch;
8421         }
8422
8423         if (batch_skb) {
8424                 nfnetlink_send(batch_skb, net, portid, NFNLGRP_NFTABLES,
8425                                NFT_CB(batch_skb).report, GFP_KERNEL);
8426         }
8427
8428         WARN_ON_ONCE(!list_empty(&nft_net->notify_list));
8429 }
8430
8431 static int nf_tables_commit_audit_alloc(struct list_head *adl,
8432                                         struct nft_table *table)
8433 {
8434         struct nft_audit_data *adp;
8435
8436         list_for_each_entry(adp, adl, list) {
8437                 if (adp->table == table)
8438                         return 0;
8439         }
8440         adp = kzalloc(sizeof(*adp), GFP_KERNEL);
8441         if (!adp)
8442                 return -ENOMEM;
8443         adp->table = table;
8444         list_add(&adp->list, adl);
8445         return 0;
8446 }
8447
8448 static void nf_tables_commit_audit_free(struct list_head *adl)
8449 {
8450         struct nft_audit_data *adp, *adn;
8451
8452         list_for_each_entry_safe(adp, adn, adl, list) {
8453                 list_del(&adp->list);
8454                 kfree(adp);
8455         }
8456 }
8457
8458 static void nf_tables_commit_audit_collect(struct list_head *adl,
8459                                            struct nft_table *table, u32 op)
8460 {
8461         struct nft_audit_data *adp;
8462
8463         list_for_each_entry(adp, adl, list) {
8464                 if (adp->table == table)
8465                         goto found;
8466         }
8467         WARN_ONCE(1, "table=%s not expected in commit list", table->name);
8468         return;
8469 found:
8470         adp->entries++;
8471         if (!adp->op || adp->op > op)
8472                 adp->op = op;
8473 }
8474
8475 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22)
8476
8477 static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation)
8478 {
8479         struct nft_audit_data *adp, *adn;
8480         char aubuf[AUNFTABLENAMELEN];
8481
8482         list_for_each_entry_safe(adp, adn, adl, list) {
8483                 snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name,
8484                          generation);
8485                 audit_log_nfcfg(aubuf, adp->table->family, adp->entries,
8486                                 nft2audit_op[adp->op], GFP_KERNEL);
8487                 list_del(&adp->list);
8488                 kfree(adp);
8489         }
8490 }
8491
8492 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
8493 {
8494         struct nftables_pernet *nft_net = nft_pernet(net);
8495         struct nft_trans *trans, *next;
8496         struct nft_trans_elem *te;
8497         struct nft_chain *chain;
8498         struct nft_table *table;
8499         LIST_HEAD(adl);
8500         int err;
8501
8502         if (list_empty(&nft_net->commit_list)) {
8503                 mutex_unlock(&nft_net->commit_mutex);
8504                 return 0;
8505         }
8506
8507         /* 0. Validate ruleset, otherwise roll back for error reporting. */
8508         if (nf_tables_validate(net) < 0)
8509                 return -EAGAIN;
8510
8511         err = nft_flow_rule_offload_commit(net);
8512         if (err < 0)
8513                 return err;
8514
8515         /* 1.  Allocate space for next generation rules_gen_X[] */
8516         list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
8517                 int ret;
8518
8519                 ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table);
8520                 if (ret) {
8521                         nf_tables_commit_chain_prepare_cancel(net);
8522                         nf_tables_commit_audit_free(&adl);
8523                         return ret;
8524                 }
8525                 if (trans->msg_type == NFT_MSG_NEWRULE ||
8526                     trans->msg_type == NFT_MSG_DELRULE) {
8527                         chain = trans->ctx.chain;
8528
8529                         ret = nf_tables_commit_chain_prepare(net, chain);
8530                         if (ret < 0) {
8531                                 nf_tables_commit_chain_prepare_cancel(net);
8532                                 nf_tables_commit_audit_free(&adl);
8533                                 return ret;
8534                         }
8535                 }
8536         }
8537
8538         /* step 2.  Make rules_gen_X visible to packet path */
8539         list_for_each_entry(table, &nft_net->tables, list) {
8540                 list_for_each_entry(chain, &table->chains, list)
8541                         nf_tables_commit_chain(net, chain);
8542         }
8543
8544         /*
8545          * Bump generation counter, invalidate any dump in progress.
8546          * Cannot fail after this point.
8547          */
8548         while (++nft_net->base_seq == 0)
8549                 ;
8550
8551         /* step 3. Start new generation, rules_gen_X now in use. */
8552         net->nft.gencursor = nft_gencursor_next(net);
8553
8554         list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
8555                 nf_tables_commit_audit_collect(&adl, trans->ctx.table,
8556                                                trans->msg_type);
8557                 switch (trans->msg_type) {
8558                 case NFT_MSG_NEWTABLE:
8559                         if (nft_trans_table_update(trans)) {
8560                                 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {
8561                                         nft_trans_destroy(trans);
8562                                         break;
8563                                 }
8564                                 if (trans->ctx.table->flags & NFT_TABLE_F_DORMANT)
8565                                         nf_tables_table_disable(net, trans->ctx.table);
8566
8567                                 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;
8568                         } else {
8569                                 nft_clear(net, trans->ctx.table);
8570                         }
8571                         nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
8572                         nft_trans_destroy(trans);
8573                         break;
8574                 case NFT_MSG_DELTABLE:
8575                         list_del_rcu(&trans->ctx.table->list);
8576                         nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
8577                         break;
8578                 case NFT_MSG_NEWCHAIN:
8579                         if (nft_trans_chain_update(trans)) {
8580                                 nft_chain_commit_update(trans);
8581                                 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
8582                                 /* trans destroyed after rcu grace period */
8583                         } else {
8584                                 nft_chain_commit_drop_policy(trans);
8585                                 nft_clear(net, trans->ctx.chain);
8586                                 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
8587                                 nft_trans_destroy(trans);
8588                         }
8589                         break;
8590                 case NFT_MSG_DELCHAIN:
8591                         nft_chain_del(trans->ctx.chain);
8592                         nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
8593                         nf_tables_unregister_hook(trans->ctx.net,
8594                                                   trans->ctx.table,
8595                                                   trans->ctx.chain);
8596                         break;
8597                 case NFT_MSG_NEWRULE:
8598                         nft_clear(trans->ctx.net, nft_trans_rule(trans));
8599                         nf_tables_rule_notify(&trans->ctx,
8600                                               nft_trans_rule(trans),
8601                                               NFT_MSG_NEWRULE);
8602                         nft_trans_destroy(trans);
8603                         break;
8604                 case NFT_MSG_DELRULE:
8605                         list_del_rcu(&nft_trans_rule(trans)->list);
8606                         nf_tables_rule_notify(&trans->ctx,
8607                                               nft_trans_rule(trans),
8608                                               NFT_MSG_DELRULE);
8609                         nft_rule_expr_deactivate(&trans->ctx,
8610                                                  nft_trans_rule(trans),
8611                                                  NFT_TRANS_COMMIT);
8612                         break;
8613                 case NFT_MSG_NEWSET:
8614                         nft_clear(net, nft_trans_set(trans));
8615                         /* This avoids hitting -EBUSY when deleting the table
8616                          * from the transaction.
8617                          */
8618                         if (nft_set_is_anonymous(nft_trans_set(trans)) &&
8619                             !list_empty(&nft_trans_set(trans)->bindings))
8620                                 trans->ctx.table->use--;
8621
8622                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
8623                                              NFT_MSG_NEWSET, GFP_KERNEL);
8624                         nft_trans_destroy(trans);
8625                         break;
8626                 case NFT_MSG_DELSET:
8627                         list_del_rcu(&nft_trans_set(trans)->list);
8628                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
8629                                              NFT_MSG_DELSET, GFP_KERNEL);
8630                         break;
8631                 case NFT_MSG_NEWSETELEM:
8632                         te = (struct nft_trans_elem *)trans->data;
8633
8634                         nft_setelem_activate(net, te->set, &te->elem);
8635                         nf_tables_setelem_notify(&trans->ctx, te->set,
8636                                                  &te->elem,
8637                                                  NFT_MSG_NEWSETELEM, 0);
8638                         nft_trans_destroy(trans);
8639                         break;
8640                 case NFT_MSG_DELSETELEM:
8641                         te = (struct nft_trans_elem *)trans->data;
8642
8643                         nf_tables_setelem_notify(&trans->ctx, te->set,
8644                                                  &te->elem,
8645                                                  NFT_MSG_DELSETELEM, 0);
8646                         nft_setelem_remove(net, te->set, &te->elem);
8647                         if (!nft_setelem_is_catchall(te->set, &te->elem)) {
8648                                 atomic_dec(&te->set->nelems);
8649                                 te->set->ndeact--;
8650                         }
8651                         break;
8652                 case NFT_MSG_NEWOBJ:
8653                         if (nft_trans_obj_update(trans)) {
8654                                 nft_obj_commit_update(trans);
8655                                 nf_tables_obj_notify(&trans->ctx,
8656                                                      nft_trans_obj(trans),
8657                                                      NFT_MSG_NEWOBJ);
8658                         } else {
8659                                 nft_clear(net, nft_trans_obj(trans));
8660                                 nf_tables_obj_notify(&trans->ctx,
8661                                                      nft_trans_obj(trans),
8662                                                      NFT_MSG_NEWOBJ);
8663                                 nft_trans_destroy(trans);
8664                         }
8665                         break;
8666                 case NFT_MSG_DELOBJ:
8667                         nft_obj_del(nft_trans_obj(trans));
8668                         nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
8669                                              NFT_MSG_DELOBJ);
8670                         break;
8671                 case NFT_MSG_NEWFLOWTABLE:
8672                         if (nft_trans_flowtable_update(trans)) {
8673                                 nft_trans_flowtable(trans)->data.flags =
8674                                         nft_trans_flowtable_flags(trans);
8675                                 nf_tables_flowtable_notify(&trans->ctx,
8676                                                            nft_trans_flowtable(trans),
8677                                                            &nft_trans_flowtable_hooks(trans),
8678                                                            NFT_MSG_NEWFLOWTABLE);
8679                                 list_splice(&nft_trans_flowtable_hooks(trans),
8680                                             &nft_trans_flowtable(trans)->hook_list);
8681                         } else {
8682                                 nft_clear(net, nft_trans_flowtable(trans));
8683                                 nf_tables_flowtable_notify(&trans->ctx,
8684                                                            nft_trans_flowtable(trans),
8685                                                            &nft_trans_flowtable(trans)->hook_list,
8686                                                            NFT_MSG_NEWFLOWTABLE);
8687                         }
8688                         nft_trans_destroy(trans);
8689                         break;
8690                 case NFT_MSG_DELFLOWTABLE:
8691                         if (nft_trans_flowtable_update(trans)) {
8692                                 nft_flowtable_hooks_del(nft_trans_flowtable(trans),
8693                                                         &nft_trans_flowtable_hooks(trans));
8694                                 nf_tables_flowtable_notify(&trans->ctx,
8695                                                            nft_trans_flowtable(trans),
8696                                                            &nft_trans_flowtable_hooks(trans),
8697                                                            NFT_MSG_DELFLOWTABLE);
8698                                 nft_unregister_flowtable_net_hooks(net,
8699                                                                    &nft_trans_flowtable_hooks(trans));
8700                         } else {
8701                                 list_del_rcu(&nft_trans_flowtable(trans)->list);
8702                                 nf_tables_flowtable_notify(&trans->ctx,
8703                                                            nft_trans_flowtable(trans),
8704                                                            &nft_trans_flowtable(trans)->hook_list,
8705                                                            NFT_MSG_DELFLOWTABLE);
8706                                 nft_unregister_flowtable_net_hooks(net,
8707                                                 &nft_trans_flowtable(trans)->hook_list);
8708                         }
8709                         break;
8710                 }
8711         }
8712
8713         nft_commit_notify(net, NETLINK_CB(skb).portid);
8714         nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
8715         nf_tables_commit_audit_log(&adl, nft_net->base_seq);
8716         nf_tables_commit_release(net);
8717
8718         return 0;
8719 }
8720
8721 static void nf_tables_module_autoload(struct net *net)
8722 {
8723         struct nftables_pernet *nft_net = nft_pernet(net);
8724         struct nft_module_request *req, *next;
8725         LIST_HEAD(module_list);
8726
8727         list_splice_init(&nft_net->module_list, &module_list);
8728         mutex_unlock(&nft_net->commit_mutex);
8729         list_for_each_entry_safe(req, next, &module_list, list) {
8730                 request_module("%s", req->module);
8731                 req->done = true;
8732         }
8733         mutex_lock(&nft_net->commit_mutex);
8734         list_splice(&module_list, &nft_net->module_list);
8735 }
8736
8737 static void nf_tables_abort_release(struct nft_trans *trans)
8738 {
8739         switch (trans->msg_type) {
8740         case NFT_MSG_NEWTABLE:
8741                 nf_tables_table_destroy(&trans->ctx);
8742                 break;
8743         case NFT_MSG_NEWCHAIN:
8744                 nf_tables_chain_destroy(&trans->ctx);
8745                 break;
8746         case NFT_MSG_NEWRULE:
8747                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
8748                 break;
8749         case NFT_MSG_NEWSET:
8750                 nft_set_destroy(&trans->ctx, nft_trans_set(trans));
8751                 break;
8752         case NFT_MSG_NEWSETELEM:
8753                 nft_set_elem_destroy(nft_trans_elem_set(trans),
8754                                      nft_trans_elem(trans).priv, true);
8755                 break;
8756         case NFT_MSG_NEWOBJ:
8757                 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
8758                 break;
8759         case NFT_MSG_NEWFLOWTABLE:
8760                 if (nft_trans_flowtable_update(trans))
8761                         nft_flowtable_hooks_destroy(&nft_trans_flowtable_hooks(trans));
8762                 else
8763                         nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
8764                 break;
8765         }
8766         kfree(trans);
8767 }
8768
8769 static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
8770 {
8771         struct nftables_pernet *nft_net = nft_pernet(net);
8772         struct nft_trans *trans, *next;
8773         struct nft_trans_elem *te;
8774         struct nft_hook *hook;
8775
8776         if (action == NFNL_ABORT_VALIDATE &&
8777             nf_tables_validate(net) < 0)
8778                 return -EAGAIN;
8779
8780         list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list,
8781                                          list) {
8782                 switch (trans->msg_type) {
8783                 case NFT_MSG_NEWTABLE:
8784                         if (nft_trans_table_update(trans)) {
8785                                 if (!(trans->ctx.table->flags & __NFT_TABLE_F_UPDATE)) {
8786                                         nft_trans_destroy(trans);
8787                                         break;
8788                                 }
8789                                 if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_DORMANT) {
8790                                         nf_tables_table_disable(net, trans->ctx.table);
8791                                         trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
8792                                 } else if (trans->ctx.table->flags & __NFT_TABLE_F_WAS_AWAKEN) {
8793                                         trans->ctx.table->flags &= ~NFT_TABLE_F_DORMANT;
8794                                 }
8795                                 trans->ctx.table->flags &= ~__NFT_TABLE_F_UPDATE;
8796                                 nft_trans_destroy(trans);
8797                         } else {
8798                                 list_del_rcu(&trans->ctx.table->list);
8799                         }
8800                         break;
8801                 case NFT_MSG_DELTABLE:
8802                         nft_clear(trans->ctx.net, trans->ctx.table);
8803                         nft_trans_destroy(trans);
8804                         break;
8805                 case NFT_MSG_NEWCHAIN:
8806                         if (nft_trans_chain_update(trans)) {
8807                                 free_percpu(nft_trans_chain_stats(trans));
8808                                 kfree(nft_trans_chain_name(trans));
8809                                 nft_trans_destroy(trans);
8810                         } else {
8811                                 if (nft_chain_is_bound(trans->ctx.chain)) {
8812                                         nft_trans_destroy(trans);
8813                                         break;
8814                                 }
8815                                 trans->ctx.table->use--;
8816                                 nft_chain_del(trans->ctx.chain);
8817                                 nf_tables_unregister_hook(trans->ctx.net,
8818                                                           trans->ctx.table,
8819                                                           trans->ctx.chain);
8820                         }
8821                         break;
8822                 case NFT_MSG_DELCHAIN:
8823                         trans->ctx.table->use++;
8824                         nft_clear(trans->ctx.net, trans->ctx.chain);
8825                         nft_trans_destroy(trans);
8826                         break;
8827                 case NFT_MSG_NEWRULE:
8828                         trans->ctx.chain->use--;
8829                         list_del_rcu(&nft_trans_rule(trans)->list);
8830                         nft_rule_expr_deactivate(&trans->ctx,
8831                                                  nft_trans_rule(trans),
8832                                                  NFT_TRANS_ABORT);
8833                         if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
8834                                 nft_flow_rule_destroy(nft_trans_flow_rule(trans));
8835                         break;
8836                 case NFT_MSG_DELRULE:
8837                         trans->ctx.chain->use++;
8838                         nft_clear(trans->ctx.net, nft_trans_rule(trans));
8839                         nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
8840                         if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)
8841                                 nft_flow_rule_destroy(nft_trans_flow_rule(trans));
8842
8843                         nft_trans_destroy(trans);
8844                         break;
8845                 case NFT_MSG_NEWSET:
8846                         trans->ctx.table->use--;
8847                         if (nft_trans_set_bound(trans)) {
8848                                 nft_trans_destroy(trans);
8849                                 break;
8850                         }
8851                         list_del_rcu(&nft_trans_set(trans)->list);
8852                         break;
8853                 case NFT_MSG_DELSET:
8854                         trans->ctx.table->use++;
8855                         nft_clear(trans->ctx.net, nft_trans_set(trans));
8856                         nft_trans_destroy(trans);
8857                         break;
8858                 case NFT_MSG_NEWSETELEM:
8859                         if (nft_trans_elem_set_bound(trans)) {
8860                                 nft_trans_destroy(trans);
8861                                 break;
8862                         }
8863                         te = (struct nft_trans_elem *)trans->data;
8864                         nft_setelem_remove(net, te->set, &te->elem);
8865                         if (!nft_setelem_is_catchall(te->set, &te->elem))
8866                                 atomic_dec(&te->set->nelems);
8867                         break;
8868                 case NFT_MSG_DELSETELEM:
8869                         te = (struct nft_trans_elem *)trans->data;
8870
8871                         nft_setelem_data_activate(net, te->set, &te->elem);
8872                         nft_setelem_activate(net, te->set, &te->elem);
8873                         if (!nft_setelem_is_catchall(te->set, &te->elem))
8874                                 te->set->ndeact--;
8875
8876                         nft_trans_destroy(trans);
8877                         break;
8878                 case NFT_MSG_NEWOBJ:
8879                         if (nft_trans_obj_update(trans)) {
8880                                 kfree(nft_trans_obj_newobj(trans));
8881                                 nft_trans_destroy(trans);
8882                         } else {
8883                                 trans->ctx.table->use--;
8884                                 nft_obj_del(nft_trans_obj(trans));
8885                         }
8886                         break;
8887                 case NFT_MSG_DELOBJ:
8888                         trans->ctx.table->use++;
8889                         nft_clear(trans->ctx.net, nft_trans_obj(trans));
8890                         nft_trans_destroy(trans);
8891                         break;
8892                 case NFT_MSG_NEWFLOWTABLE:
8893                         if (nft_trans_flowtable_update(trans)) {
8894                                 nft_unregister_flowtable_net_hooks(net,
8895                                                 &nft_trans_flowtable_hooks(trans));
8896                         } else {
8897                                 trans->ctx.table->use--;
8898                                 list_del_rcu(&nft_trans_flowtable(trans)->list);
8899                                 nft_unregister_flowtable_net_hooks(net,
8900                                                 &nft_trans_flowtable(trans)->hook_list);
8901                         }
8902                         break;
8903                 case NFT_MSG_DELFLOWTABLE:
8904                         if (nft_trans_flowtable_update(trans)) {
8905                                 list_for_each_entry(hook, &nft_trans_flowtable(trans)->hook_list, list)
8906                                         hook->inactive = false;
8907                         } else {
8908                                 trans->ctx.table->use++;
8909                                 nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
8910                         }
8911                         nft_trans_destroy(trans);
8912                         break;
8913                 }
8914         }
8915
8916         synchronize_rcu();
8917
8918         list_for_each_entry_safe_reverse(trans, next,
8919                                          &nft_net->commit_list, list) {
8920                 list_del(&trans->list);
8921                 nf_tables_abort_release(trans);
8922         }
8923
8924         if (action == NFNL_ABORT_AUTOLOAD)
8925                 nf_tables_module_autoload(net);
8926         else
8927                 nf_tables_module_autoload_cleanup(net);
8928
8929         return 0;
8930 }
8931
8932 static void nf_tables_cleanup(struct net *net)
8933 {
8934         nft_validate_state_update(net, NFT_VALIDATE_SKIP);
8935 }
8936
8937 static int nf_tables_abort(struct net *net, struct sk_buff *skb,
8938                            enum nfnl_abort_action action)
8939 {
8940         struct nftables_pernet *nft_net = nft_pernet(net);
8941         int ret = __nf_tables_abort(net, action);
8942
8943         mutex_unlock(&nft_net->commit_mutex);
8944
8945         return ret;
8946 }
8947
8948 static bool nf_tables_valid_genid(struct net *net, u32 genid)
8949 {
8950         struct nftables_pernet *nft_net = nft_pernet(net);
8951         bool genid_ok;
8952
8953         mutex_lock(&nft_net->commit_mutex);
8954
8955         genid_ok = genid == 0 || nft_net->base_seq == genid;
8956         if (!genid_ok)
8957                 mutex_unlock(&nft_net->commit_mutex);
8958
8959         /* else, commit mutex has to be released by commit or abort function */
8960         return genid_ok;
8961 }
8962
8963 static const struct nfnetlink_subsystem nf_tables_subsys = {
8964         .name           = "nf_tables",
8965         .subsys_id      = NFNL_SUBSYS_NFTABLES,
8966         .cb_count       = NFT_MSG_MAX,
8967         .cb             = nf_tables_cb,
8968         .commit         = nf_tables_commit,
8969         .abort          = nf_tables_abort,
8970         .cleanup        = nf_tables_cleanup,
8971         .valid_genid    = nf_tables_valid_genid,
8972         .owner          = THIS_MODULE,
8973 };
8974
8975 int nft_chain_validate_dependency(const struct nft_chain *chain,
8976                                   enum nft_chain_types type)
8977 {
8978         const struct nft_base_chain *basechain;
8979
8980         if (nft_is_base_chain(chain)) {
8981                 basechain = nft_base_chain(chain);
8982                 if (basechain->type->type != type)
8983                         return -EOPNOTSUPP;
8984         }
8985         return 0;
8986 }
8987 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
8988
8989 int nft_chain_validate_hooks(const struct nft_chain *chain,
8990                              unsigned int hook_flags)
8991 {
8992         struct nft_base_chain *basechain;
8993
8994         if (nft_is_base_chain(chain)) {
8995                 basechain = nft_base_chain(chain);
8996
8997                 if ((1 << basechain->ops.hooknum) & hook_flags)
8998                         return 0;
8999
9000                 return -EOPNOTSUPP;
9001         }
9002
9003         return 0;
9004 }
9005 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
9006
9007 /*
9008  * Loop detection - walk through the ruleset beginning at the destination chain
9009  * of a new jump until either the source chain is reached (loop) or all
9010  * reachable chains have been traversed.
9011  *
9012  * The loop check is performed whenever a new jump verdict is added to an
9013  * expression or verdict map or a verdict map is bound to a new chain.
9014  */
9015
9016 static int nf_tables_check_loops(const struct nft_ctx *ctx,
9017                                  const struct nft_chain *chain);
9018
9019 static int nft_check_loops(const struct nft_ctx *ctx,
9020                            const struct nft_set_ext *ext)
9021 {
9022         const struct nft_data *data;
9023         int ret;
9024
9025         data = nft_set_ext_data(ext);
9026         switch (data->verdict.code) {
9027         case NFT_JUMP:
9028         case NFT_GOTO:
9029                 ret = nf_tables_check_loops(ctx, data->verdict.chain);
9030                 break;
9031         default:
9032                 ret = 0;
9033                 break;
9034         }
9035
9036         return ret;
9037 }
9038
9039 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
9040                                         struct nft_set *set,
9041                                         const struct nft_set_iter *iter,
9042                                         struct nft_set_elem *elem)
9043 {
9044         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
9045
9046         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
9047             *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
9048                 return 0;
9049
9050         return nft_check_loops(ctx, ext);
9051 }
9052
9053 static int nft_set_catchall_loops(const struct nft_ctx *ctx,
9054                                   struct nft_set *set)
9055 {
9056         u8 genmask = nft_genmask_next(ctx->net);
9057         struct nft_set_elem_catchall *catchall;
9058         struct nft_set_ext *ext;
9059         int ret = 0;
9060
9061         list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
9062                 ext = nft_set_elem_ext(set, catchall->elem);
9063                 if (!nft_set_elem_active(ext, genmask))
9064                         continue;
9065
9066                 ret = nft_check_loops(ctx, ext);
9067                 if (ret < 0)
9068                         return ret;
9069         }
9070
9071         return ret;
9072 }
9073
9074 static int nf_tables_check_loops(const struct nft_ctx *ctx,
9075                                  const struct nft_chain *chain)
9076 {
9077         const struct nft_rule *rule;
9078         const struct nft_expr *expr, *last;
9079         struct nft_set *set;
9080         struct nft_set_binding *binding;
9081         struct nft_set_iter iter;
9082
9083         if (ctx->chain == chain)
9084                 return -ELOOP;
9085
9086         list_for_each_entry(rule, &chain->rules, list) {
9087                 nft_rule_for_each_expr(expr, last, rule) {
9088                         struct nft_immediate_expr *priv;
9089                         const struct nft_data *data;
9090                         int err;
9091
9092                         if (strcmp(expr->ops->type->name, "immediate"))
9093                                 continue;
9094
9095                         priv = nft_expr_priv(expr);
9096                         if (priv->dreg != NFT_REG_VERDICT)
9097                                 continue;
9098
9099                         data = &priv->data;
9100                         switch (data->verdict.code) {
9101                         case NFT_JUMP:
9102                         case NFT_GOTO:
9103                                 err = nf_tables_check_loops(ctx,
9104                                                         data->verdict.chain);
9105                                 if (err < 0)
9106                                         return err;
9107                                 break;
9108                         default:
9109                                 break;
9110                         }
9111                 }
9112         }
9113
9114         list_for_each_entry(set, &ctx->table->sets, list) {
9115                 if (!nft_is_active_next(ctx->net, set))
9116                         continue;
9117                 if (!(set->flags & NFT_SET_MAP) ||
9118                     set->dtype != NFT_DATA_VERDICT)
9119                         continue;
9120
9121                 list_for_each_entry(binding, &set->bindings, list) {
9122                         if (!(binding->flags & NFT_SET_MAP) ||
9123                             binding->chain != chain)
9124                                 continue;
9125
9126                         iter.genmask    = nft_genmask_next(ctx->net);
9127                         iter.skip       = 0;
9128                         iter.count      = 0;
9129                         iter.err        = 0;
9130                         iter.fn         = nf_tables_loop_check_setelem;
9131
9132                         set->ops->walk(ctx, set, &iter);
9133                         if (!iter.err)
9134                                 iter.err = nft_set_catchall_loops(ctx, set);
9135
9136                         if (iter.err < 0)
9137                                 return iter.err;
9138                 }
9139         }
9140
9141         return 0;
9142 }
9143
9144 /**
9145  *      nft_parse_u32_check - fetch u32 attribute and check for maximum value
9146  *
9147  *      @attr: netlink attribute to fetch value from
9148  *      @max: maximum value to be stored in dest
9149  *      @dest: pointer to the variable
9150  *
9151  *      Parse, check and store a given u32 netlink attribute into variable.
9152  *      This function returns -ERANGE if the value goes over maximum value.
9153  *      Otherwise a 0 is returned and the attribute value is stored in the
9154  *      destination variable.
9155  */
9156 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
9157 {
9158         u32 val;
9159
9160         val = ntohl(nla_get_be32(attr));
9161         if (val > max)
9162                 return -ERANGE;
9163
9164         *dest = val;
9165         return 0;
9166 }
9167 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
9168
9169 static unsigned int nft_parse_register(const struct nlattr *attr)
9170 {
9171         unsigned int reg;
9172
9173         reg = ntohl(nla_get_be32(attr));
9174         switch (reg) {
9175         case NFT_REG_VERDICT...NFT_REG_4:
9176                 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
9177         default:
9178                 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
9179         }
9180 }
9181
9182 /**
9183  *      nft_dump_register - dump a register value to a netlink attribute
9184  *
9185  *      @skb: socket buffer
9186  *      @attr: attribute number
9187  *      @reg: register number
9188  *
9189  *      Construct a netlink attribute containing the register number. For
9190  *      compatibility reasons, register numbers being a multiple of 4 are
9191  *      translated to the corresponding 128 bit register numbers.
9192  */
9193 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
9194 {
9195         if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
9196                 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
9197         else
9198                 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
9199
9200         return nla_put_be32(skb, attr, htonl(reg));
9201 }
9202 EXPORT_SYMBOL_GPL(nft_dump_register);
9203
9204 static int nft_validate_register_load(enum nft_registers reg, unsigned int len)
9205 {
9206         if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
9207                 return -EINVAL;
9208         if (len == 0)
9209                 return -EINVAL;
9210         if (reg * NFT_REG32_SIZE + len > sizeof_field(struct nft_regs, data))
9211                 return -ERANGE;
9212
9213         return 0;
9214 }
9215
9216 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len)
9217 {
9218         u32 reg;
9219         int err;
9220
9221         reg = nft_parse_register(attr);
9222         err = nft_validate_register_load(reg, len);
9223         if (err < 0)
9224                 return err;
9225
9226         *sreg = reg;
9227         return 0;
9228 }
9229 EXPORT_SYMBOL_GPL(nft_parse_register_load);
9230
9231 static int nft_validate_register_store(const struct nft_ctx *ctx,
9232                                        enum nft_registers reg,
9233                                        const struct nft_data *data,
9234                                        enum nft_data_types type,
9235                                        unsigned int len)
9236 {
9237         int err;
9238
9239         switch (reg) {
9240         case NFT_REG_VERDICT:
9241                 if (type != NFT_DATA_VERDICT)
9242                         return -EINVAL;
9243
9244                 if (data != NULL &&
9245                     (data->verdict.code == NFT_GOTO ||
9246                      data->verdict.code == NFT_JUMP)) {
9247                         err = nf_tables_check_loops(ctx, data->verdict.chain);
9248                         if (err < 0)
9249                                 return err;
9250                 }
9251
9252                 return 0;
9253         default:
9254                 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
9255                         return -EINVAL;
9256                 if (len == 0)
9257                         return -EINVAL;
9258                 if (reg * NFT_REG32_SIZE + len >
9259                     sizeof_field(struct nft_regs, data))
9260                         return -ERANGE;
9261
9262                 if (data != NULL && type != NFT_DATA_VALUE)
9263                         return -EINVAL;
9264                 return 0;
9265         }
9266 }
9267
9268 int nft_parse_register_store(const struct nft_ctx *ctx,
9269                              const struct nlattr *attr, u8 *dreg,
9270                              const struct nft_data *data,
9271                              enum nft_data_types type, unsigned int len)
9272 {
9273         int err;
9274         u32 reg;
9275
9276         reg = nft_parse_register(attr);
9277         err = nft_validate_register_store(ctx, reg, data, type, len);
9278         if (err < 0)
9279                 return err;
9280
9281         *dreg = reg;
9282         return 0;
9283 }
9284 EXPORT_SYMBOL_GPL(nft_parse_register_store);
9285
9286 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
9287         [NFTA_VERDICT_CODE]     = { .type = NLA_U32 },
9288         [NFTA_VERDICT_CHAIN]    = { .type = NLA_STRING,
9289                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
9290         [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 },
9291 };
9292
9293 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
9294                             struct nft_data_desc *desc, const struct nlattr *nla)
9295 {
9296         u8 genmask = nft_genmask_next(ctx->net);
9297         struct nlattr *tb[NFTA_VERDICT_MAX + 1];
9298         struct nft_chain *chain;
9299         int err;
9300
9301         err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
9302                                           nft_verdict_policy, NULL);
9303         if (err < 0)
9304                 return err;
9305
9306         if (!tb[NFTA_VERDICT_CODE])
9307                 return -EINVAL;
9308         data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
9309
9310         switch (data->verdict.code) {
9311         default:
9312                 switch (data->verdict.code & NF_VERDICT_MASK) {
9313                 case NF_ACCEPT:
9314                 case NF_DROP:
9315                 case NF_QUEUE:
9316                         break;
9317                 default:
9318                         return -EINVAL;
9319                 }
9320                 fallthrough;
9321         case NFT_CONTINUE:
9322         case NFT_BREAK:
9323         case NFT_RETURN:
9324                 break;
9325         case NFT_JUMP:
9326         case NFT_GOTO:
9327                 if (tb[NFTA_VERDICT_CHAIN]) {
9328                         chain = nft_chain_lookup(ctx->net, ctx->table,
9329                                                  tb[NFTA_VERDICT_CHAIN],
9330                                                  genmask);
9331                 } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
9332                         chain = nft_chain_lookup_byid(ctx->net,
9333                                                       tb[NFTA_VERDICT_CHAIN_ID]);
9334                         if (IS_ERR(chain))
9335                                 return PTR_ERR(chain);
9336                 } else {
9337                         return -EINVAL;
9338                 }
9339
9340                 if (IS_ERR(chain))
9341                         return PTR_ERR(chain);
9342                 if (nft_is_base_chain(chain))
9343                         return -EOPNOTSUPP;
9344
9345                 chain->use++;
9346                 data->verdict.chain = chain;
9347                 break;
9348         }
9349
9350         desc->len = sizeof(data->verdict);
9351         desc->type = NFT_DATA_VERDICT;
9352         return 0;
9353 }
9354
9355 static void nft_verdict_uninit(const struct nft_data *data)
9356 {
9357         struct nft_chain *chain;
9358         struct nft_rule *rule;
9359
9360         switch (data->verdict.code) {
9361         case NFT_JUMP:
9362         case NFT_GOTO:
9363                 chain = data->verdict.chain;
9364                 chain->use--;
9365
9366                 if (!nft_chain_is_bound(chain))
9367                         break;
9368
9369                 chain->table->use--;
9370                 list_for_each_entry(rule, &chain->rules, list)
9371                         chain->use--;
9372
9373                 nft_chain_del(chain);
9374                 break;
9375         }
9376 }
9377
9378 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
9379 {
9380         struct nlattr *nest;
9381
9382         nest = nla_nest_start_noflag(skb, type);
9383         if (!nest)
9384                 goto nla_put_failure;
9385
9386         if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
9387                 goto nla_put_failure;
9388
9389         switch (v->code) {
9390         case NFT_JUMP:
9391         case NFT_GOTO:
9392                 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
9393                                    v->chain->name))
9394                         goto nla_put_failure;
9395         }
9396         nla_nest_end(skb, nest);
9397         return 0;
9398
9399 nla_put_failure:
9400         return -1;
9401 }
9402
9403 static int nft_value_init(const struct nft_ctx *ctx,
9404                           struct nft_data *data, unsigned int size,
9405                           struct nft_data_desc *desc, const struct nlattr *nla)
9406 {
9407         unsigned int len;
9408
9409         len = nla_len(nla);
9410         if (len == 0)
9411                 return -EINVAL;
9412         if (len > size)
9413                 return -EOVERFLOW;
9414
9415         nla_memcpy(data->data, nla, len);
9416         desc->type = NFT_DATA_VALUE;
9417         desc->len  = len;
9418         return 0;
9419 }
9420
9421 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
9422                           unsigned int len)
9423 {
9424         return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
9425 }
9426
9427 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
9428         [NFTA_DATA_VALUE]       = { .type = NLA_BINARY },
9429         [NFTA_DATA_VERDICT]     = { .type = NLA_NESTED },
9430 };
9431
9432 /**
9433  *      nft_data_init - parse nf_tables data netlink attributes
9434  *
9435  *      @ctx: context of the expression using the data
9436  *      @data: destination struct nft_data
9437  *      @size: maximum data length
9438  *      @desc: data description
9439  *      @nla: netlink attribute containing data
9440  *
9441  *      Parse the netlink data attributes and initialize a struct nft_data.
9442  *      The type and length of data are returned in the data description.
9443  *
9444  *      The caller can indicate that it only wants to accept data of type
9445  *      NFT_DATA_VALUE by passing NULL for the ctx argument.
9446  */
9447 int nft_data_init(const struct nft_ctx *ctx,
9448                   struct nft_data *data, unsigned int size,
9449                   struct nft_data_desc *desc, const struct nlattr *nla)
9450 {
9451         struct nlattr *tb[NFTA_DATA_MAX + 1];
9452         int err;
9453
9454         err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
9455                                           nft_data_policy, NULL);
9456         if (err < 0)
9457                 return err;
9458
9459         if (tb[NFTA_DATA_VALUE])
9460                 return nft_value_init(ctx, data, size, desc,
9461                                       tb[NFTA_DATA_VALUE]);
9462         if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
9463                 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
9464         return -EINVAL;
9465 }
9466 EXPORT_SYMBOL_GPL(nft_data_init);
9467
9468 /**
9469  *      nft_data_release - release a nft_data item
9470  *
9471  *      @data: struct nft_data to release
9472  *      @type: type of data
9473  *
9474  *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
9475  *      all others need to be released by calling this function.
9476  */
9477 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
9478 {
9479         if (type < NFT_DATA_VERDICT)
9480                 return;
9481         switch (type) {
9482         case NFT_DATA_VERDICT:
9483                 return nft_verdict_uninit(data);
9484         default:
9485                 WARN_ON(1);
9486         }
9487 }
9488 EXPORT_SYMBOL_GPL(nft_data_release);
9489
9490 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
9491                   enum nft_data_types type, unsigned int len)
9492 {
9493         struct nlattr *nest;
9494         int err;
9495
9496         nest = nla_nest_start_noflag(skb, attr);
9497         if (nest == NULL)
9498                 return -1;
9499
9500         switch (type) {
9501         case NFT_DATA_VALUE:
9502                 err = nft_value_dump(skb, data, len);
9503                 break;
9504         case NFT_DATA_VERDICT:
9505                 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
9506                 break;
9507         default:
9508                 err = -EINVAL;
9509                 WARN_ON(1);
9510         }
9511
9512         nla_nest_end(skb, nest);
9513         return err;
9514 }
9515 EXPORT_SYMBOL_GPL(nft_data_dump);
9516
9517 int __nft_release_basechain(struct nft_ctx *ctx)
9518 {
9519         struct nft_rule *rule, *nr;
9520
9521         if (WARN_ON(!nft_is_base_chain(ctx->chain)))
9522                 return 0;
9523
9524         nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
9525         list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
9526                 list_del(&rule->list);
9527                 ctx->chain->use--;
9528                 nf_tables_rule_release(ctx, rule);
9529         }
9530         nft_chain_del(ctx->chain);
9531         ctx->table->use--;
9532         nf_tables_chain_destroy(ctx);
9533
9534         return 0;
9535 }
9536 EXPORT_SYMBOL_GPL(__nft_release_basechain);
9537
9538 static void __nft_release_hook(struct net *net, struct nft_table *table)
9539 {
9540         struct nft_chain *chain;
9541
9542         list_for_each_entry(chain, &table->chains, list)
9543                 nf_tables_unregister_hook(net, table, chain);
9544 }
9545
9546 static void __nft_release_hooks(struct net *net)
9547 {
9548         struct nftables_pernet *nft_net = nft_pernet(net);
9549         struct nft_table *table;
9550
9551         list_for_each_entry(table, &nft_net->tables, list) {
9552                 if (nft_table_has_owner(table))
9553                         continue;
9554
9555                 __nft_release_hook(net, table);
9556         }
9557 }
9558
9559 static void __nft_release_table(struct net *net, struct nft_table *table)
9560 {
9561         struct nft_flowtable *flowtable, *nf;
9562         struct nft_chain *chain, *nc;
9563         struct nft_object *obj, *ne;
9564         struct nft_rule *rule, *nr;
9565         struct nft_set *set, *ns;
9566         struct nft_ctx ctx = {
9567                 .net    = net,
9568                 .family = NFPROTO_NETDEV,
9569         };
9570
9571         ctx.family = table->family;
9572         ctx.table = table;
9573         list_for_each_entry(chain, &table->chains, list) {
9574                 ctx.chain = chain;
9575                 list_for_each_entry_safe(rule, nr, &chain->rules, list) {
9576                         list_del(&rule->list);
9577                         chain->use--;
9578                         nf_tables_rule_release(&ctx, rule);
9579                 }
9580         }
9581         list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
9582                 list_del(&flowtable->list);
9583                 table->use--;
9584                 nf_tables_flowtable_destroy(flowtable);
9585         }
9586         list_for_each_entry_safe(set, ns, &table->sets, list) {
9587                 list_del(&set->list);
9588                 table->use--;
9589                 nft_set_destroy(&ctx, set);
9590         }
9591         list_for_each_entry_safe(obj, ne, &table->objects, list) {
9592                 nft_obj_del(obj);
9593                 table->use--;
9594                 nft_obj_destroy(&ctx, obj);
9595         }
9596         list_for_each_entry_safe(chain, nc, &table->chains, list) {
9597                 ctx.chain = chain;
9598                 nft_chain_del(chain);
9599                 table->use--;
9600                 nf_tables_chain_destroy(&ctx);
9601         }
9602         list_del(&table->list);
9603         nf_tables_table_destroy(&ctx);
9604 }
9605
9606 static void __nft_release_tables(struct net *net)
9607 {
9608         struct nftables_pernet *nft_net = nft_pernet(net);
9609         struct nft_table *table, *nt;
9610
9611         list_for_each_entry_safe(table, nt, &nft_net->tables, list) {
9612                 if (nft_table_has_owner(table))
9613                         continue;
9614
9615                 __nft_release_table(net, table);
9616         }
9617 }
9618
9619 static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,
9620                             void *ptr)
9621 {
9622         struct nftables_pernet *nft_net;
9623         struct netlink_notify *n = ptr;
9624         struct nft_table *table, *nt;
9625         struct net *net = n->net;
9626         bool release = false;
9627
9628         if (event != NETLINK_URELEASE || n->protocol != NETLINK_NETFILTER)
9629                 return NOTIFY_DONE;
9630
9631         nft_net = nft_pernet(net);
9632         mutex_lock(&nft_net->commit_mutex);
9633         list_for_each_entry(table, &nft_net->tables, list) {
9634                 if (nft_table_has_owner(table) &&
9635                     n->portid == table->nlpid) {
9636                         __nft_release_hook(net, table);
9637                         release = true;
9638                 }
9639         }
9640         if (release) {
9641                 synchronize_rcu();
9642                 list_for_each_entry_safe(table, nt, &nft_net->tables, list) {
9643                         if (nft_table_has_owner(table) &&
9644                             n->portid == table->nlpid)
9645                                 __nft_release_table(net, table);
9646                 }
9647         }
9648         mutex_unlock(&nft_net->commit_mutex);
9649
9650         return NOTIFY_DONE;
9651 }
9652
9653 static struct notifier_block nft_nl_notifier = {
9654         .notifier_call  = nft_rcv_nl_event,
9655 };
9656
9657 static int __net_init nf_tables_init_net(struct net *net)
9658 {
9659         struct nftables_pernet *nft_net = nft_pernet(net);
9660
9661         INIT_LIST_HEAD(&nft_net->tables);
9662         INIT_LIST_HEAD(&nft_net->commit_list);
9663         INIT_LIST_HEAD(&nft_net->module_list);
9664         INIT_LIST_HEAD(&nft_net->notify_list);
9665         mutex_init(&nft_net->commit_mutex);
9666         nft_net->base_seq = 1;
9667         nft_net->validate_state = NFT_VALIDATE_SKIP;
9668
9669         return 0;
9670 }
9671
9672 static void __net_exit nf_tables_pre_exit_net(struct net *net)
9673 {
9674         __nft_release_hooks(net);
9675 }
9676
9677 static void __net_exit nf_tables_exit_net(struct net *net)
9678 {
9679         struct nftables_pernet *nft_net = nft_pernet(net);
9680
9681         mutex_lock(&nft_net->commit_mutex);
9682         if (!list_empty(&nft_net->commit_list))
9683                 __nf_tables_abort(net, NFNL_ABORT_NONE);
9684         __nft_release_tables(net);
9685         mutex_unlock(&nft_net->commit_mutex);
9686         WARN_ON_ONCE(!list_empty(&nft_net->tables));
9687         WARN_ON_ONCE(!list_empty(&nft_net->module_list));
9688         WARN_ON_ONCE(!list_empty(&nft_net->notify_list));
9689 }
9690
9691 static struct pernet_operations nf_tables_net_ops = {
9692         .init           = nf_tables_init_net,
9693         .pre_exit       = nf_tables_pre_exit_net,
9694         .exit           = nf_tables_exit_net,
9695         .id             = &nf_tables_net_id,
9696         .size           = sizeof(struct nftables_pernet),
9697 };
9698
9699 static int __init nf_tables_module_init(void)
9700 {
9701         int err;
9702
9703         err = register_pernet_subsys(&nf_tables_net_ops);
9704         if (err < 0)
9705                 return err;
9706
9707         err = nft_chain_filter_init();
9708         if (err < 0)
9709                 goto err_chain_filter;
9710
9711         err = nf_tables_core_module_init();
9712         if (err < 0)
9713                 goto err_core_module;
9714
9715         err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
9716         if (err < 0)
9717                 goto err_netdev_notifier;
9718
9719         err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
9720         if (err < 0)
9721                 goto err_rht_objname;
9722
9723         err = nft_offload_init();
9724         if (err < 0)
9725                 goto err_offload;
9726
9727         err = netlink_register_notifier(&nft_nl_notifier);
9728         if (err < 0)
9729                 goto err_netlink_notifier;
9730
9731         /* must be last */
9732         err = nfnetlink_subsys_register(&nf_tables_subsys);
9733         if (err < 0)
9734                 goto err_nfnl_subsys;
9735
9736         nft_chain_route_init();
9737
9738         return err;
9739
9740 err_nfnl_subsys:
9741         netlink_unregister_notifier(&nft_nl_notifier);
9742 err_netlink_notifier:
9743         nft_offload_exit();
9744 err_offload:
9745         rhltable_destroy(&nft_objname_ht);
9746 err_rht_objname:
9747         unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
9748 err_netdev_notifier:
9749         nf_tables_core_module_exit();
9750 err_core_module:
9751         nft_chain_filter_fini();
9752 err_chain_filter:
9753         unregister_pernet_subsys(&nf_tables_net_ops);
9754         return err;
9755 }
9756
9757 static void __exit nf_tables_module_exit(void)
9758 {
9759         nfnetlink_subsys_unregister(&nf_tables_subsys);
9760         netlink_unregister_notifier(&nft_nl_notifier);
9761         nft_offload_exit();
9762         unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
9763         nft_chain_filter_fini();
9764         nft_chain_route_fini();
9765         unregister_pernet_subsys(&nf_tables_net_ops);
9766         cancel_work_sync(&trans_destroy_work);
9767         rcu_barrier();
9768         rhltable_destroy(&nft_objname_ht);
9769         nf_tables_core_module_exit();
9770 }
9771
9772 module_init(nf_tables_module_init);
9773 module_exit(nf_tables_module_exit);
9774
9775 MODULE_LICENSE("GPL");
9776 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
9777 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);