1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
5 * Development of this code funded by Astaro AG (http://www.astaro.com/)
8 #include <linux/module.h>
9 #include <linux/init.h>
10 #include <linux/list.h>
11 #include <linux/skbuff.h>
12 #include <linux/netlink.h>
13 #include <linux/vmalloc.h>
14 #include <linux/rhashtable.h>
15 #include <linux/audit.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nfnetlink.h>
18 #include <linux/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_flow_table.h>
20 #include <net/netfilter/nf_tables_core.h>
21 #include <net/netfilter/nf_tables.h>
22 #include <net/netfilter/nf_tables_offload.h>
23 #include <net/net_namespace.h>
26 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
28 unsigned int nf_tables_net_id __read_mostly
;
30 static LIST_HEAD(nf_tables_expressions
);
31 static LIST_HEAD(nf_tables_objects
);
32 static LIST_HEAD(nf_tables_flowtables
);
33 static LIST_HEAD(nf_tables_destroy_list
);
34 static LIST_HEAD(nf_tables_gc_list
);
35 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock
);
36 static DEFINE_SPINLOCK(nf_tables_gc_list_lock
);
39 NFT_VALIDATE_SKIP
= 0,
44 static struct rhltable nft_objname_ht
;
46 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
);
47 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
);
48 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*, const void *);
50 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
);
51 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
);
52 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*, const void *);
54 static const struct rhashtable_params nft_chain_ht_params
= {
55 .head_offset
= offsetof(struct nft_chain
, rhlhead
),
56 .key_offset
= offsetof(struct nft_chain
, name
),
57 .hashfn
= nft_chain_hash
,
58 .obj_hashfn
= nft_chain_hash_obj
,
59 .obj_cmpfn
= nft_chain_hash_cmp
,
60 .automatic_shrinking
= true,
63 static const struct rhashtable_params nft_objname_ht_params
= {
64 .head_offset
= offsetof(struct nft_object
, rhlhead
),
65 .key_offset
= offsetof(struct nft_object
, key
),
66 .hashfn
= nft_objname_hash
,
67 .obj_hashfn
= nft_objname_hash_obj
,
68 .obj_cmpfn
= nft_objname_hash_cmp
,
69 .automatic_shrinking
= true,
72 struct nft_audit_data
{
73 struct nft_table
*table
;
76 struct list_head list
;
79 static const u8 nft2audit_op
[NFT_MSG_MAX
] = { // enum nf_tables_msg_types
80 [NFT_MSG_NEWTABLE
] = AUDIT_NFT_OP_TABLE_REGISTER
,
81 [NFT_MSG_GETTABLE
] = AUDIT_NFT_OP_INVALID
,
82 [NFT_MSG_DELTABLE
] = AUDIT_NFT_OP_TABLE_UNREGISTER
,
83 [NFT_MSG_NEWCHAIN
] = AUDIT_NFT_OP_CHAIN_REGISTER
,
84 [NFT_MSG_GETCHAIN
] = AUDIT_NFT_OP_INVALID
,
85 [NFT_MSG_DELCHAIN
] = AUDIT_NFT_OP_CHAIN_UNREGISTER
,
86 [NFT_MSG_NEWRULE
] = AUDIT_NFT_OP_RULE_REGISTER
,
87 [NFT_MSG_GETRULE
] = AUDIT_NFT_OP_INVALID
,
88 [NFT_MSG_DELRULE
] = AUDIT_NFT_OP_RULE_UNREGISTER
,
89 [NFT_MSG_NEWSET
] = AUDIT_NFT_OP_SET_REGISTER
,
90 [NFT_MSG_GETSET
] = AUDIT_NFT_OP_INVALID
,
91 [NFT_MSG_DELSET
] = AUDIT_NFT_OP_SET_UNREGISTER
,
92 [NFT_MSG_NEWSETELEM
] = AUDIT_NFT_OP_SETELEM_REGISTER
,
93 [NFT_MSG_GETSETELEM
] = AUDIT_NFT_OP_INVALID
,
94 [NFT_MSG_DELSETELEM
] = AUDIT_NFT_OP_SETELEM_UNREGISTER
,
95 [NFT_MSG_NEWGEN
] = AUDIT_NFT_OP_GEN_REGISTER
,
96 [NFT_MSG_GETGEN
] = AUDIT_NFT_OP_INVALID
,
97 [NFT_MSG_TRACE
] = AUDIT_NFT_OP_INVALID
,
98 [NFT_MSG_NEWOBJ
] = AUDIT_NFT_OP_OBJ_REGISTER
,
99 [NFT_MSG_GETOBJ
] = AUDIT_NFT_OP_INVALID
,
100 [NFT_MSG_DELOBJ
] = AUDIT_NFT_OP_OBJ_UNREGISTER
,
101 [NFT_MSG_GETOBJ_RESET
] = AUDIT_NFT_OP_OBJ_RESET
,
102 [NFT_MSG_NEWFLOWTABLE
] = AUDIT_NFT_OP_FLOWTABLE_REGISTER
,
103 [NFT_MSG_GETFLOWTABLE
] = AUDIT_NFT_OP_INVALID
,
104 [NFT_MSG_DELFLOWTABLE
] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER
,
105 [NFT_MSG_GETSETELEM_RESET
] = AUDIT_NFT_OP_SETELEM_RESET
,
108 static void nft_validate_state_update(struct nft_table
*table
, u8 new_validate_state
)
110 switch (table
->validate_state
) {
111 case NFT_VALIDATE_SKIP
:
112 WARN_ON_ONCE(new_validate_state
== NFT_VALIDATE_DO
);
114 case NFT_VALIDATE_NEED
:
116 case NFT_VALIDATE_DO
:
117 if (new_validate_state
== NFT_VALIDATE_NEED
)
121 table
->validate_state
= new_validate_state
;
123 static void nf_tables_trans_destroy_work(struct work_struct
*w
);
124 static DECLARE_WORK(trans_destroy_work
, nf_tables_trans_destroy_work
);
126 static void nft_trans_gc_work(struct work_struct
*work
);
127 static DECLARE_WORK(trans_gc_work
, nft_trans_gc_work
);
129 static void nft_ctx_init(struct nft_ctx
*ctx
,
131 const struct sk_buff
*skb
,
132 const struct nlmsghdr
*nlh
,
134 struct nft_table
*table
,
135 struct nft_chain
*chain
,
136 const struct nlattr
* const *nla
)
139 ctx
->family
= family
;
144 ctx
->portid
= NETLINK_CB(skb
).portid
;
145 ctx
->report
= nlmsg_report(nlh
);
146 ctx
->flags
= nlh
->nlmsg_flags
;
147 ctx
->seq
= nlh
->nlmsg_seq
;
150 static struct nft_trans
*nft_trans_alloc_gfp(const struct nft_ctx
*ctx
,
151 int msg_type
, u32 size
, gfp_t gfp
)
153 struct nft_trans
*trans
;
155 trans
= kzalloc(sizeof(struct nft_trans
) + size
, gfp
);
159 INIT_LIST_HEAD(&trans
->list
);
160 INIT_LIST_HEAD(&trans
->binding_list
);
161 trans
->msg_type
= msg_type
;
167 static struct nft_trans
*nft_trans_alloc(const struct nft_ctx
*ctx
,
168 int msg_type
, u32 size
)
170 return nft_trans_alloc_gfp(ctx
, msg_type
, size
, GFP_KERNEL
);
173 static void nft_trans_list_del(struct nft_trans
*trans
)
175 list_del(&trans
->list
);
176 list_del(&trans
->binding_list
);
179 static void nft_trans_destroy(struct nft_trans
*trans
)
181 nft_trans_list_del(trans
);
185 static void __nft_set_trans_bind(const struct nft_ctx
*ctx
, struct nft_set
*set
,
188 struct nftables_pernet
*nft_net
;
189 struct net
*net
= ctx
->net
;
190 struct nft_trans
*trans
;
192 if (!nft_set_is_anonymous(set
))
195 nft_net
= nft_pernet(net
);
196 list_for_each_entry_reverse(trans
, &nft_net
->commit_list
, list
) {
197 switch (trans
->msg_type
) {
199 if (nft_trans_set(trans
) == set
)
200 nft_trans_set_bound(trans
) = bind
;
202 case NFT_MSG_NEWSETELEM
:
203 if (nft_trans_elem_set(trans
) == set
)
204 nft_trans_elem_set_bound(trans
) = bind
;
210 static void nft_set_trans_bind(const struct nft_ctx
*ctx
, struct nft_set
*set
)
212 return __nft_set_trans_bind(ctx
, set
, true);
215 static void nft_set_trans_unbind(const struct nft_ctx
*ctx
, struct nft_set
*set
)
217 return __nft_set_trans_bind(ctx
, set
, false);
220 static void __nft_chain_trans_bind(const struct nft_ctx
*ctx
,
221 struct nft_chain
*chain
, bool bind
)
223 struct nftables_pernet
*nft_net
;
224 struct net
*net
= ctx
->net
;
225 struct nft_trans
*trans
;
227 if (!nft_chain_binding(chain
))
230 nft_net
= nft_pernet(net
);
231 list_for_each_entry_reverse(trans
, &nft_net
->commit_list
, list
) {
232 switch (trans
->msg_type
) {
233 case NFT_MSG_NEWCHAIN
:
234 if (nft_trans_chain(trans
) == chain
)
235 nft_trans_chain_bound(trans
) = bind
;
237 case NFT_MSG_NEWRULE
:
238 if (trans
->ctx
.chain
== chain
)
239 nft_trans_rule_bound(trans
) = bind
;
245 static void nft_chain_trans_bind(const struct nft_ctx
*ctx
,
246 struct nft_chain
*chain
)
248 __nft_chain_trans_bind(ctx
, chain
, true);
251 int nf_tables_bind_chain(const struct nft_ctx
*ctx
, struct nft_chain
*chain
)
253 if (!nft_chain_binding(chain
))
256 if (nft_chain_binding(ctx
->chain
))
262 if (!nft_use_inc(&chain
->use
))
266 nft_chain_trans_bind(ctx
, chain
);
271 void nf_tables_unbind_chain(const struct nft_ctx
*ctx
, struct nft_chain
*chain
)
273 __nft_chain_trans_bind(ctx
, chain
, false);
276 static int nft_netdev_register_hooks(struct net
*net
,
277 struct list_head
*hook_list
)
279 struct nft_hook
*hook
;
283 list_for_each_entry(hook
, hook_list
, list
) {
284 err
= nf_register_net_hook(net
, &hook
->ops
);
293 list_for_each_entry(hook
, hook_list
, list
) {
297 nf_unregister_net_hook(net
, &hook
->ops
);
302 static void nft_netdev_unregister_hooks(struct net
*net
,
303 struct list_head
*hook_list
,
306 struct nft_hook
*hook
, *next
;
308 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
309 nf_unregister_net_hook(net
, &hook
->ops
);
310 if (release_netdev
) {
311 list_del(&hook
->list
);
312 kfree_rcu(hook
, rcu
);
317 static int nf_tables_register_hook(struct net
*net
,
318 const struct nft_table
*table
,
319 struct nft_chain
*chain
)
321 struct nft_base_chain
*basechain
;
322 const struct nf_hook_ops
*ops
;
324 if (table
->flags
& NFT_TABLE_F_DORMANT
||
325 !nft_is_base_chain(chain
))
328 basechain
= nft_base_chain(chain
);
329 ops
= &basechain
->ops
;
331 if (basechain
->type
->ops_register
)
332 return basechain
->type
->ops_register(net
, ops
);
334 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
335 return nft_netdev_register_hooks(net
, &basechain
->hook_list
);
337 return nf_register_net_hook(net
, &basechain
->ops
);
340 static void __nf_tables_unregister_hook(struct net
*net
,
341 const struct nft_table
*table
,
342 struct nft_chain
*chain
,
345 struct nft_base_chain
*basechain
;
346 const struct nf_hook_ops
*ops
;
348 if (table
->flags
& NFT_TABLE_F_DORMANT
||
349 !nft_is_base_chain(chain
))
351 basechain
= nft_base_chain(chain
);
352 ops
= &basechain
->ops
;
354 if (basechain
->type
->ops_unregister
)
355 return basechain
->type
->ops_unregister(net
, ops
);
357 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
358 nft_netdev_unregister_hooks(net
, &basechain
->hook_list
,
361 nf_unregister_net_hook(net
, &basechain
->ops
);
364 static void nf_tables_unregister_hook(struct net
*net
,
365 const struct nft_table
*table
,
366 struct nft_chain
*chain
)
368 return __nf_tables_unregister_hook(net
, table
, chain
, false);
371 static void nft_trans_commit_list_add_tail(struct net
*net
, struct nft_trans
*trans
)
373 struct nftables_pernet
*nft_net
= nft_pernet(net
);
375 switch (trans
->msg_type
) {
377 if (!nft_trans_set_update(trans
) &&
378 nft_set_is_anonymous(nft_trans_set(trans
)))
379 list_add_tail(&trans
->binding_list
, &nft_net
->binding_list
);
381 case NFT_MSG_NEWCHAIN
:
382 if (!nft_trans_chain_update(trans
) &&
383 nft_chain_binding(nft_trans_chain(trans
)))
384 list_add_tail(&trans
->binding_list
, &nft_net
->binding_list
);
388 list_add_tail(&trans
->list
, &nft_net
->commit_list
);
391 static int nft_trans_table_add(struct nft_ctx
*ctx
, int msg_type
)
393 struct nft_trans
*trans
;
395 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_table
));
399 if (msg_type
== NFT_MSG_NEWTABLE
)
400 nft_activate_next(ctx
->net
, ctx
->table
);
402 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
406 static int nft_deltable(struct nft_ctx
*ctx
)
410 err
= nft_trans_table_add(ctx
, NFT_MSG_DELTABLE
);
414 nft_deactivate_next(ctx
->net
, ctx
->table
);
418 static struct nft_trans
*nft_trans_chain_add(struct nft_ctx
*ctx
, int msg_type
)
420 struct nft_trans
*trans
;
422 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_chain
));
424 return ERR_PTR(-ENOMEM
);
426 if (msg_type
== NFT_MSG_NEWCHAIN
) {
427 nft_activate_next(ctx
->net
, ctx
->chain
);
429 if (ctx
->nla
[NFTA_CHAIN_ID
]) {
430 nft_trans_chain_id(trans
) =
431 ntohl(nla_get_be32(ctx
->nla
[NFTA_CHAIN_ID
]));
434 nft_trans_chain(trans
) = ctx
->chain
;
435 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
440 static int nft_delchain(struct nft_ctx
*ctx
)
442 struct nft_trans
*trans
;
444 trans
= nft_trans_chain_add(ctx
, NFT_MSG_DELCHAIN
);
446 return PTR_ERR(trans
);
448 nft_use_dec(&ctx
->table
->use
);
449 nft_deactivate_next(ctx
->net
, ctx
->chain
);
454 void nft_rule_expr_activate(const struct nft_ctx
*ctx
, struct nft_rule
*rule
)
456 struct nft_expr
*expr
;
458 expr
= nft_expr_first(rule
);
459 while (nft_expr_more(rule
, expr
)) {
460 if (expr
->ops
->activate
)
461 expr
->ops
->activate(ctx
, expr
);
463 expr
= nft_expr_next(expr
);
467 void nft_rule_expr_deactivate(const struct nft_ctx
*ctx
, struct nft_rule
*rule
,
468 enum nft_trans_phase phase
)
470 struct nft_expr
*expr
;
472 expr
= nft_expr_first(rule
);
473 while (nft_expr_more(rule
, expr
)) {
474 if (expr
->ops
->deactivate
)
475 expr
->ops
->deactivate(ctx
, expr
, phase
);
477 expr
= nft_expr_next(expr
);
482 nf_tables_delrule_deactivate(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
484 /* You cannot delete the same rule twice */
485 if (nft_is_active_next(ctx
->net
, rule
)) {
486 nft_deactivate_next(ctx
->net
, rule
);
487 nft_use_dec(&ctx
->chain
->use
);
493 static struct nft_trans
*nft_trans_rule_add(struct nft_ctx
*ctx
, int msg_type
,
494 struct nft_rule
*rule
)
496 struct nft_trans
*trans
;
498 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_rule
));
502 if (msg_type
== NFT_MSG_NEWRULE
&& ctx
->nla
[NFTA_RULE_ID
] != NULL
) {
503 nft_trans_rule_id(trans
) =
504 ntohl(nla_get_be32(ctx
->nla
[NFTA_RULE_ID
]));
506 nft_trans_rule(trans
) = rule
;
507 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
512 static int nft_delrule(struct nft_ctx
*ctx
, struct nft_rule
*rule
)
514 struct nft_flow_rule
*flow
;
515 struct nft_trans
*trans
;
518 trans
= nft_trans_rule_add(ctx
, NFT_MSG_DELRULE
, rule
);
522 if (ctx
->chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
523 flow
= nft_flow_rule_create(ctx
->net
, rule
);
525 nft_trans_destroy(trans
);
526 return PTR_ERR(flow
);
529 nft_trans_flow_rule(trans
) = flow
;
532 err
= nf_tables_delrule_deactivate(ctx
, rule
);
534 nft_trans_destroy(trans
);
537 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_PREPARE
);
542 static int nft_delrule_by_chain(struct nft_ctx
*ctx
)
544 struct nft_rule
*rule
;
547 list_for_each_entry(rule
, &ctx
->chain
->rules
, list
) {
548 if (!nft_is_active_next(ctx
->net
, rule
))
551 err
= nft_delrule(ctx
, rule
);
558 static int __nft_trans_set_add(const struct nft_ctx
*ctx
, int msg_type
,
560 const struct nft_set_desc
*desc
)
562 struct nft_trans
*trans
;
564 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_set
));
568 if (msg_type
== NFT_MSG_NEWSET
&& ctx
->nla
[NFTA_SET_ID
] && !desc
) {
569 nft_trans_set_id(trans
) =
570 ntohl(nla_get_be32(ctx
->nla
[NFTA_SET_ID
]));
571 nft_activate_next(ctx
->net
, set
);
573 nft_trans_set(trans
) = set
;
575 nft_trans_set_update(trans
) = true;
576 nft_trans_set_gc_int(trans
) = desc
->gc_int
;
577 nft_trans_set_timeout(trans
) = desc
->timeout
;
578 nft_trans_set_size(trans
) = desc
->size
;
580 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
585 static int nft_trans_set_add(const struct nft_ctx
*ctx
, int msg_type
,
588 return __nft_trans_set_add(ctx
, msg_type
, set
, NULL
);
591 static int nft_mapelem_deactivate(const struct nft_ctx
*ctx
,
593 const struct nft_set_iter
*iter
,
594 struct nft_elem_priv
*elem_priv
)
596 nft_setelem_data_deactivate(ctx
->net
, set
, elem_priv
);
601 struct nft_set_elem_catchall
{
602 struct list_head list
;
604 struct nft_elem_priv
*elem
;
607 static void nft_map_catchall_deactivate(const struct nft_ctx
*ctx
,
610 u8 genmask
= nft_genmask_next(ctx
->net
);
611 struct nft_set_elem_catchall
*catchall
;
612 struct nft_set_ext
*ext
;
614 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
615 ext
= nft_set_elem_ext(set
, catchall
->elem
);
616 if (!nft_set_elem_active(ext
, genmask
))
619 nft_setelem_data_deactivate(ctx
->net
, set
, catchall
->elem
);
624 static void nft_map_deactivate(const struct nft_ctx
*ctx
, struct nft_set
*set
)
626 struct nft_set_iter iter
= {
627 .genmask
= nft_genmask_next(ctx
->net
),
628 .fn
= nft_mapelem_deactivate
,
631 set
->ops
->walk(ctx
, set
, &iter
);
632 WARN_ON_ONCE(iter
.err
);
634 nft_map_catchall_deactivate(ctx
, set
);
637 static int nft_delset(const struct nft_ctx
*ctx
, struct nft_set
*set
)
641 err
= nft_trans_set_add(ctx
, NFT_MSG_DELSET
, set
);
645 if (set
->flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
))
646 nft_map_deactivate(ctx
, set
);
648 nft_deactivate_next(ctx
->net
, set
);
649 nft_use_dec(&ctx
->table
->use
);
654 static int nft_trans_obj_add(struct nft_ctx
*ctx
, int msg_type
,
655 struct nft_object
*obj
)
657 struct nft_trans
*trans
;
659 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_obj
));
663 if (msg_type
== NFT_MSG_NEWOBJ
)
664 nft_activate_next(ctx
->net
, obj
);
666 nft_trans_obj(trans
) = obj
;
667 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
672 static int nft_delobj(struct nft_ctx
*ctx
, struct nft_object
*obj
)
676 err
= nft_trans_obj_add(ctx
, NFT_MSG_DELOBJ
, obj
);
680 nft_deactivate_next(ctx
->net
, obj
);
681 nft_use_dec(&ctx
->table
->use
);
686 static int nft_trans_flowtable_add(struct nft_ctx
*ctx
, int msg_type
,
687 struct nft_flowtable
*flowtable
)
689 struct nft_trans
*trans
;
691 trans
= nft_trans_alloc(ctx
, msg_type
,
692 sizeof(struct nft_trans_flowtable
));
696 if (msg_type
== NFT_MSG_NEWFLOWTABLE
)
697 nft_activate_next(ctx
->net
, flowtable
);
699 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
700 nft_trans_flowtable(trans
) = flowtable
;
701 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
706 static int nft_delflowtable(struct nft_ctx
*ctx
,
707 struct nft_flowtable
*flowtable
)
711 err
= nft_trans_flowtable_add(ctx
, NFT_MSG_DELFLOWTABLE
, flowtable
);
715 nft_deactivate_next(ctx
->net
, flowtable
);
716 nft_use_dec(&ctx
->table
->use
);
721 static void __nft_reg_track_clobber(struct nft_regs_track
*track
, u8 dreg
)
725 for (i
= track
->regs
[dreg
].num_reg
; i
> 0; i
--)
726 __nft_reg_track_cancel(track
, dreg
- i
);
729 static void __nft_reg_track_update(struct nft_regs_track
*track
,
730 const struct nft_expr
*expr
,
733 track
->regs
[dreg
].selector
= expr
;
734 track
->regs
[dreg
].bitwise
= NULL
;
735 track
->regs
[dreg
].num_reg
= num_reg
;
738 void nft_reg_track_update(struct nft_regs_track
*track
,
739 const struct nft_expr
*expr
, u8 dreg
, u8 len
)
741 unsigned int regcount
;
744 __nft_reg_track_clobber(track
, dreg
);
746 regcount
= DIV_ROUND_UP(len
, NFT_REG32_SIZE
);
747 for (i
= 0; i
< regcount
; i
++, dreg
++)
748 __nft_reg_track_update(track
, expr
, dreg
, i
);
750 EXPORT_SYMBOL_GPL(nft_reg_track_update
);
752 void nft_reg_track_cancel(struct nft_regs_track
*track
, u8 dreg
, u8 len
)
754 unsigned int regcount
;
757 __nft_reg_track_clobber(track
, dreg
);
759 regcount
= DIV_ROUND_UP(len
, NFT_REG32_SIZE
);
760 for (i
= 0; i
< regcount
; i
++, dreg
++)
761 __nft_reg_track_cancel(track
, dreg
);
763 EXPORT_SYMBOL_GPL(nft_reg_track_cancel
);
765 void __nft_reg_track_cancel(struct nft_regs_track
*track
, u8 dreg
)
767 track
->regs
[dreg
].selector
= NULL
;
768 track
->regs
[dreg
].bitwise
= NULL
;
769 track
->regs
[dreg
].num_reg
= 0;
771 EXPORT_SYMBOL_GPL(__nft_reg_track_cancel
);
777 static struct nft_table
*nft_table_lookup(const struct net
*net
,
778 const struct nlattr
*nla
,
779 u8 family
, u8 genmask
, u32 nlpid
)
781 struct nftables_pernet
*nft_net
;
782 struct nft_table
*table
;
785 return ERR_PTR(-EINVAL
);
787 nft_net
= nft_pernet(net
);
788 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
,
789 lockdep_is_held(&nft_net
->commit_mutex
)) {
790 if (!nla_strcmp(nla
, table
->name
) &&
791 table
->family
== family
&&
792 nft_active_genmask(table
, genmask
)) {
793 if (nft_table_has_owner(table
) &&
794 nlpid
&& table
->nlpid
!= nlpid
)
795 return ERR_PTR(-EPERM
);
801 return ERR_PTR(-ENOENT
);
804 static struct nft_table
*nft_table_lookup_byhandle(const struct net
*net
,
805 const struct nlattr
*nla
,
806 int family
, u8 genmask
, u32 nlpid
)
808 struct nftables_pernet
*nft_net
;
809 struct nft_table
*table
;
811 nft_net
= nft_pernet(net
);
812 list_for_each_entry(table
, &nft_net
->tables
, list
) {
813 if (be64_to_cpu(nla_get_be64(nla
)) == table
->handle
&&
814 table
->family
== family
&&
815 nft_active_genmask(table
, genmask
)) {
816 if (nft_table_has_owner(table
) &&
817 nlpid
&& table
->nlpid
!= nlpid
)
818 return ERR_PTR(-EPERM
);
824 return ERR_PTR(-ENOENT
);
827 static inline u64
nf_tables_alloc_handle(struct nft_table
*table
)
829 return ++table
->hgenerator
;
832 static const struct nft_chain_type
*chain_type
[NFPROTO_NUMPROTO
][NFT_CHAIN_T_MAX
];
834 static const struct nft_chain_type
*
835 __nft_chain_type_get(u8 family
, enum nft_chain_types type
)
837 if (family
>= NFPROTO_NUMPROTO
||
838 type
>= NFT_CHAIN_T_MAX
)
841 return chain_type
[family
][type
];
844 static const struct nft_chain_type
*
845 __nf_tables_chain_type_lookup(const struct nlattr
*nla
, u8 family
)
847 const struct nft_chain_type
*type
;
850 for (i
= 0; i
< NFT_CHAIN_T_MAX
; i
++) {
851 type
= __nft_chain_type_get(family
, i
);
854 if (!nla_strcmp(nla
, type
->name
))
860 struct nft_module_request
{
861 struct list_head list
;
862 char module
[MODULE_NAME_LEN
];
866 #ifdef CONFIG_MODULES
867 __printf(2, 3) int nft_request_module(struct net
*net
, const char *fmt
,
870 char module_name
[MODULE_NAME_LEN
];
871 struct nftables_pernet
*nft_net
;
872 struct nft_module_request
*req
;
877 ret
= vsnprintf(module_name
, MODULE_NAME_LEN
, fmt
, args
);
879 if (ret
>= MODULE_NAME_LEN
)
882 nft_net
= nft_pernet(net
);
883 list_for_each_entry(req
, &nft_net
->module_list
, list
) {
884 if (!strcmp(req
->module
, module_name
)) {
888 /* A request to load this module already exists. */
893 req
= kmalloc(sizeof(*req
), GFP_KERNEL
);
898 strscpy(req
->module
, module_name
, MODULE_NAME_LEN
);
899 list_add_tail(&req
->list
, &nft_net
->module_list
);
903 EXPORT_SYMBOL_GPL(nft_request_module
);
906 static void lockdep_nfnl_nft_mutex_not_held(void)
908 #ifdef CONFIG_PROVE_LOCKING
910 WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES
));
914 static const struct nft_chain_type
*
915 nf_tables_chain_type_lookup(struct net
*net
, const struct nlattr
*nla
,
916 u8 family
, bool autoload
)
918 const struct nft_chain_type
*type
;
920 type
= __nf_tables_chain_type_lookup(nla
, family
);
924 lockdep_nfnl_nft_mutex_not_held();
925 #ifdef CONFIG_MODULES
927 if (nft_request_module(net
, "nft-chain-%u-%.*s", family
,
929 (const char *)nla_data(nla
)) == -EAGAIN
)
930 return ERR_PTR(-EAGAIN
);
933 return ERR_PTR(-ENOENT
);
936 static __be16
nft_base_seq(const struct net
*net
)
938 struct nftables_pernet
*nft_net
= nft_pernet(net
);
940 return htons(nft_net
->base_seq
& 0xffff);
943 static const struct nla_policy nft_table_policy
[NFTA_TABLE_MAX
+ 1] = {
944 [NFTA_TABLE_NAME
] = { .type
= NLA_STRING
,
945 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
946 [NFTA_TABLE_FLAGS
] = { .type
= NLA_U32
},
947 [NFTA_TABLE_HANDLE
] = { .type
= NLA_U64
},
948 [NFTA_TABLE_USERDATA
] = { .type
= NLA_BINARY
,
949 .len
= NFT_USERDATA_MAXLEN
}
952 static int nf_tables_fill_table_info(struct sk_buff
*skb
, struct net
*net
,
953 u32 portid
, u32 seq
, int event
, u32 flags
,
954 int family
, const struct nft_table
*table
)
956 struct nlmsghdr
*nlh
;
958 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
959 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
960 NFNETLINK_V0
, nft_base_seq(net
));
962 goto nla_put_failure
;
964 if (nla_put_string(skb
, NFTA_TABLE_NAME
, table
->name
) ||
965 nla_put_be32(skb
, NFTA_TABLE_USE
, htonl(table
->use
)) ||
966 nla_put_be64(skb
, NFTA_TABLE_HANDLE
, cpu_to_be64(table
->handle
),
968 goto nla_put_failure
;
970 if (event
== NFT_MSG_DELTABLE
) {
975 if (nla_put_be32(skb
, NFTA_TABLE_FLAGS
,
976 htonl(table
->flags
& NFT_TABLE_F_MASK
)))
977 goto nla_put_failure
;
979 if (nft_table_has_owner(table
) &&
980 nla_put_be32(skb
, NFTA_TABLE_OWNER
, htonl(table
->nlpid
)))
981 goto nla_put_failure
;
984 if (nla_put(skb
, NFTA_TABLE_USERDATA
, table
->udlen
, table
->udata
))
985 goto nla_put_failure
;
992 nlmsg_trim(skb
, nlh
);
996 struct nftnl_skb_parms
{
999 #define NFT_CB(skb) (*(struct nftnl_skb_parms*)&((skb)->cb))
1001 static void nft_notify_enqueue(struct sk_buff
*skb
, bool report
,
1002 struct list_head
*notify_list
)
1004 NFT_CB(skb
).report
= report
;
1005 list_add_tail(&skb
->list
, notify_list
);
1008 static void nf_tables_table_notify(const struct nft_ctx
*ctx
, int event
)
1010 struct nftables_pernet
*nft_net
;
1011 struct sk_buff
*skb
;
1016 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
1019 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
1023 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
1024 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
1026 err
= nf_tables_fill_table_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
1027 event
, flags
, ctx
->family
, ctx
->table
);
1033 nft_net
= nft_pernet(ctx
->net
);
1034 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
1037 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
1040 static int nf_tables_dump_tables(struct sk_buff
*skb
,
1041 struct netlink_callback
*cb
)
1043 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1044 struct nftables_pernet
*nft_net
;
1045 const struct nft_table
*table
;
1046 unsigned int idx
= 0, s_idx
= cb
->args
[0];
1047 struct net
*net
= sock_net(skb
->sk
);
1048 int family
= nfmsg
->nfgen_family
;
1051 nft_net
= nft_pernet(net
);
1052 cb
->seq
= READ_ONCE(nft_net
->base_seq
);
1054 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
1055 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
1061 memset(&cb
->args
[1], 0,
1062 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
1063 if (!nft_is_active(net
, table
))
1065 if (nf_tables_fill_table_info(skb
, net
,
1066 NETLINK_CB(cb
->skb
).portid
,
1068 NFT_MSG_NEWTABLE
, NLM_F_MULTI
,
1069 table
->family
, table
) < 0)
1072 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
1082 static int nft_netlink_dump_start_rcu(struct sock
*nlsk
, struct sk_buff
*skb
,
1083 const struct nlmsghdr
*nlh
,
1084 struct netlink_dump_control
*c
)
1088 if (!try_module_get(THIS_MODULE
))
1092 err
= netlink_dump_start(nlsk
, skb
, nlh
, c
);
1094 module_put(THIS_MODULE
);
1099 /* called with rcu_read_lock held */
1100 static int nf_tables_gettable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1101 const struct nlattr
* const nla
[])
1103 struct netlink_ext_ack
*extack
= info
->extack
;
1104 u8 genmask
= nft_genmask_cur(info
->net
);
1105 u8 family
= info
->nfmsg
->nfgen_family
;
1106 const struct nft_table
*table
;
1107 struct net
*net
= info
->net
;
1108 struct sk_buff
*skb2
;
1111 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1112 struct netlink_dump_control c
= {
1113 .dump
= nf_tables_dump_tables
,
1114 .module
= THIS_MODULE
,
1117 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
1120 table
= nft_table_lookup(net
, nla
[NFTA_TABLE_NAME
], family
, genmask
, 0);
1121 if (IS_ERR(table
)) {
1122 NL_SET_BAD_ATTR(extack
, nla
[NFTA_TABLE_NAME
]);
1123 return PTR_ERR(table
);
1126 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
1130 err
= nf_tables_fill_table_info(skb2
, net
, NETLINK_CB(skb
).portid
,
1131 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWTABLE
,
1134 goto err_fill_table_info
;
1136 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
1138 err_fill_table_info
:
1143 static void nft_table_disable(struct net
*net
, struct nft_table
*table
, u32 cnt
)
1145 struct nft_chain
*chain
;
1148 list_for_each_entry(chain
, &table
->chains
, list
) {
1149 if (!nft_is_active_next(net
, chain
))
1151 if (!nft_is_base_chain(chain
))
1154 if (cnt
&& i
++ == cnt
)
1157 nf_tables_unregister_hook(net
, table
, chain
);
1161 static int nf_tables_table_enable(struct net
*net
, struct nft_table
*table
)
1163 struct nft_chain
*chain
;
1166 list_for_each_entry(chain
, &table
->chains
, list
) {
1167 if (!nft_is_active_next(net
, chain
))
1169 if (!nft_is_base_chain(chain
))
1172 err
= nf_tables_register_hook(net
, table
, chain
);
1174 goto err_register_hooks
;
1182 nft_table_disable(net
, table
, i
);
1186 static void nf_tables_table_disable(struct net
*net
, struct nft_table
*table
)
1188 table
->flags
&= ~NFT_TABLE_F_DORMANT
;
1189 nft_table_disable(net
, table
, 0);
1190 table
->flags
|= NFT_TABLE_F_DORMANT
;
1193 #define __NFT_TABLE_F_INTERNAL (NFT_TABLE_F_MASK + 1)
1194 #define __NFT_TABLE_F_WAS_DORMANT (__NFT_TABLE_F_INTERNAL << 0)
1195 #define __NFT_TABLE_F_WAS_AWAKEN (__NFT_TABLE_F_INTERNAL << 1)
1196 #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \
1197 __NFT_TABLE_F_WAS_AWAKEN)
1199 static int nf_tables_updtable(struct nft_ctx
*ctx
)
1201 struct nft_trans
*trans
;
1205 if (!ctx
->nla
[NFTA_TABLE_FLAGS
])
1208 flags
= ntohl(nla_get_be32(ctx
->nla
[NFTA_TABLE_FLAGS
]));
1209 if (flags
& ~NFT_TABLE_F_MASK
)
1212 if (flags
== ctx
->table
->flags
)
1215 if ((nft_table_has_owner(ctx
->table
) &&
1216 !(flags
& NFT_TABLE_F_OWNER
)) ||
1217 (!nft_table_has_owner(ctx
->table
) &&
1218 flags
& NFT_TABLE_F_OWNER
))
1221 /* No dormant off/on/off/on games in single transaction */
1222 if (ctx
->table
->flags
& __NFT_TABLE_F_UPDATE
)
1225 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWTABLE
,
1226 sizeof(struct nft_trans_table
));
1230 if ((flags
& NFT_TABLE_F_DORMANT
) &&
1231 !(ctx
->table
->flags
& NFT_TABLE_F_DORMANT
)) {
1232 ctx
->table
->flags
|= NFT_TABLE_F_DORMANT
;
1233 if (!(ctx
->table
->flags
& __NFT_TABLE_F_UPDATE
))
1234 ctx
->table
->flags
|= __NFT_TABLE_F_WAS_AWAKEN
;
1235 } else if (!(flags
& NFT_TABLE_F_DORMANT
) &&
1236 ctx
->table
->flags
& NFT_TABLE_F_DORMANT
) {
1237 ctx
->table
->flags
&= ~NFT_TABLE_F_DORMANT
;
1238 if (!(ctx
->table
->flags
& __NFT_TABLE_F_UPDATE
)) {
1239 ret
= nf_tables_table_enable(ctx
->net
, ctx
->table
);
1241 goto err_register_hooks
;
1243 ctx
->table
->flags
|= __NFT_TABLE_F_WAS_DORMANT
;
1247 nft_trans_table_update(trans
) = true;
1248 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
1253 nft_trans_destroy(trans
);
1257 static u32
nft_chain_hash(const void *data
, u32 len
, u32 seed
)
1259 const char *name
= data
;
1261 return jhash(name
, strlen(name
), seed
);
1264 static u32
nft_chain_hash_obj(const void *data
, u32 len
, u32 seed
)
1266 const struct nft_chain
*chain
= data
;
1268 return nft_chain_hash(chain
->name
, 0, seed
);
1271 static int nft_chain_hash_cmp(struct rhashtable_compare_arg
*arg
,
1274 const struct nft_chain
*chain
= ptr
;
1275 const char *name
= arg
->key
;
1277 return strcmp(chain
->name
, name
);
1280 static u32
nft_objname_hash(const void *data
, u32 len
, u32 seed
)
1282 const struct nft_object_hash_key
*k
= data
;
1284 seed
^= hash_ptr(k
->table
, 32);
1286 return jhash(k
->name
, strlen(k
->name
), seed
);
1289 static u32
nft_objname_hash_obj(const void *data
, u32 len
, u32 seed
)
1291 const struct nft_object
*obj
= data
;
1293 return nft_objname_hash(&obj
->key
, 0, seed
);
1296 static int nft_objname_hash_cmp(struct rhashtable_compare_arg
*arg
,
1299 const struct nft_object_hash_key
*k
= arg
->key
;
1300 const struct nft_object
*obj
= ptr
;
1302 if (obj
->key
.table
!= k
->table
)
1305 return strcmp(obj
->key
.name
, k
->name
);
1308 static bool nft_supported_family(u8 family
)
1311 #ifdef CONFIG_NF_TABLES_INET
1312 || family
== NFPROTO_INET
1314 #ifdef CONFIG_NF_TABLES_IPV4
1315 || family
== NFPROTO_IPV4
1317 #ifdef CONFIG_NF_TABLES_ARP
1318 || family
== NFPROTO_ARP
1320 #ifdef CONFIG_NF_TABLES_NETDEV
1321 || family
== NFPROTO_NETDEV
1323 #if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
1324 || family
== NFPROTO_BRIDGE
1326 #ifdef CONFIG_NF_TABLES_IPV6
1327 || family
== NFPROTO_IPV6
1332 static int nf_tables_newtable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1333 const struct nlattr
* const nla
[])
1335 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
1336 struct netlink_ext_ack
*extack
= info
->extack
;
1337 u8 genmask
= nft_genmask_next(info
->net
);
1338 u8 family
= info
->nfmsg
->nfgen_family
;
1339 struct net
*net
= info
->net
;
1340 const struct nlattr
*attr
;
1341 struct nft_table
*table
;
1346 if (!nft_supported_family(family
))
1349 lockdep_assert_held(&nft_net
->commit_mutex
);
1350 attr
= nla
[NFTA_TABLE_NAME
];
1351 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1352 NETLINK_CB(skb
).portid
);
1353 if (IS_ERR(table
)) {
1354 if (PTR_ERR(table
) != -ENOENT
)
1355 return PTR_ERR(table
);
1357 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
1358 NL_SET_BAD_ATTR(extack
, attr
);
1361 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
1364 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
1366 return nf_tables_updtable(&ctx
);
1369 if (nla
[NFTA_TABLE_FLAGS
]) {
1370 flags
= ntohl(nla_get_be32(nla
[NFTA_TABLE_FLAGS
]));
1371 if (flags
& ~NFT_TABLE_F_MASK
)
1376 table
= kzalloc(sizeof(*table
), GFP_KERNEL_ACCOUNT
);
1380 table
->validate_state
= nft_net
->validate_state
;
1381 table
->name
= nla_strdup(attr
, GFP_KERNEL_ACCOUNT
);
1382 if (table
->name
== NULL
)
1385 if (nla
[NFTA_TABLE_USERDATA
]) {
1386 table
->udata
= nla_memdup(nla
[NFTA_TABLE_USERDATA
], GFP_KERNEL_ACCOUNT
);
1387 if (table
->udata
== NULL
)
1388 goto err_table_udata
;
1390 table
->udlen
= nla_len(nla
[NFTA_TABLE_USERDATA
]);
1393 err
= rhltable_init(&table
->chains_ht
, &nft_chain_ht_params
);
1397 INIT_LIST_HEAD(&table
->chains
);
1398 INIT_LIST_HEAD(&table
->sets
);
1399 INIT_LIST_HEAD(&table
->objects
);
1400 INIT_LIST_HEAD(&table
->flowtables
);
1401 table
->family
= family
;
1402 table
->flags
= flags
;
1403 table
->handle
= ++nft_net
->table_handle
;
1404 if (table
->flags
& NFT_TABLE_F_OWNER
)
1405 table
->nlpid
= NETLINK_CB(skb
).portid
;
1407 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
1408 err
= nft_trans_table_add(&ctx
, NFT_MSG_NEWTABLE
);
1412 list_add_tail_rcu(&table
->list
, &nft_net
->tables
);
1415 rhltable_destroy(&table
->chains_ht
);
1417 kfree(table
->udata
);
1426 static int nft_flush_table(struct nft_ctx
*ctx
)
1428 struct nft_flowtable
*flowtable
, *nft
;
1429 struct nft_chain
*chain
, *nc
;
1430 struct nft_object
*obj
, *ne
;
1431 struct nft_set
*set
, *ns
;
1434 list_for_each_entry(chain
, &ctx
->table
->chains
, list
) {
1435 if (!nft_is_active_next(ctx
->net
, chain
))
1438 if (nft_chain_binding(chain
))
1443 err
= nft_delrule_by_chain(ctx
);
1448 list_for_each_entry_safe(set
, ns
, &ctx
->table
->sets
, list
) {
1449 if (!nft_is_active_next(ctx
->net
, set
))
1452 if (nft_set_is_anonymous(set
))
1455 err
= nft_delset(ctx
, set
);
1460 list_for_each_entry_safe(flowtable
, nft
, &ctx
->table
->flowtables
, list
) {
1461 if (!nft_is_active_next(ctx
->net
, flowtable
))
1464 err
= nft_delflowtable(ctx
, flowtable
);
1469 list_for_each_entry_safe(obj
, ne
, &ctx
->table
->objects
, list
) {
1470 if (!nft_is_active_next(ctx
->net
, obj
))
1473 err
= nft_delobj(ctx
, obj
);
1478 list_for_each_entry_safe(chain
, nc
, &ctx
->table
->chains
, list
) {
1479 if (!nft_is_active_next(ctx
->net
, chain
))
1482 if (nft_chain_binding(chain
))
1487 err
= nft_delchain(ctx
);
1492 err
= nft_deltable(ctx
);
1497 static int nft_flush(struct nft_ctx
*ctx
, int family
)
1499 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
1500 const struct nlattr
* const *nla
= ctx
->nla
;
1501 struct nft_table
*table
, *nt
;
1504 list_for_each_entry_safe(table
, nt
, &nft_net
->tables
, list
) {
1505 if (family
!= AF_UNSPEC
&& table
->family
!= family
)
1508 ctx
->family
= table
->family
;
1510 if (!nft_is_active_next(ctx
->net
, table
))
1513 if (nft_table_has_owner(table
) && table
->nlpid
!= ctx
->portid
)
1516 if (nla
[NFTA_TABLE_NAME
] &&
1517 nla_strcmp(nla
[NFTA_TABLE_NAME
], table
->name
) != 0)
1522 err
= nft_flush_table(ctx
);
1530 static int nf_tables_deltable(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1531 const struct nlattr
* const nla
[])
1533 struct netlink_ext_ack
*extack
= info
->extack
;
1534 u8 genmask
= nft_genmask_next(info
->net
);
1535 u8 family
= info
->nfmsg
->nfgen_family
;
1536 struct net
*net
= info
->net
;
1537 const struct nlattr
*attr
;
1538 struct nft_table
*table
;
1541 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, 0, NULL
, NULL
, nla
);
1542 if (family
== AF_UNSPEC
||
1543 (!nla
[NFTA_TABLE_NAME
] && !nla
[NFTA_TABLE_HANDLE
]))
1544 return nft_flush(&ctx
, family
);
1546 if (nla
[NFTA_TABLE_HANDLE
]) {
1547 attr
= nla
[NFTA_TABLE_HANDLE
];
1548 table
= nft_table_lookup_byhandle(net
, attr
, family
, genmask
,
1549 NETLINK_CB(skb
).portid
);
1551 attr
= nla
[NFTA_TABLE_NAME
];
1552 table
= nft_table_lookup(net
, attr
, family
, genmask
,
1553 NETLINK_CB(skb
).portid
);
1556 if (IS_ERR(table
)) {
1557 if (PTR_ERR(table
) == -ENOENT
&&
1558 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYTABLE
)
1561 NL_SET_BAD_ATTR(extack
, attr
);
1562 return PTR_ERR(table
);
1565 if (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
1569 ctx
.family
= family
;
1572 return nft_flush_table(&ctx
);
1575 static void nf_tables_table_destroy(struct nft_ctx
*ctx
)
1577 if (WARN_ON(ctx
->table
->use
> 0))
1580 rhltable_destroy(&ctx
->table
->chains_ht
);
1581 kfree(ctx
->table
->name
);
1582 kfree(ctx
->table
->udata
);
1586 void nft_register_chain_type(const struct nft_chain_type
*ctype
)
1588 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1589 if (WARN_ON(__nft_chain_type_get(ctype
->family
, ctype
->type
))) {
1590 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1593 chain_type
[ctype
->family
][ctype
->type
] = ctype
;
1594 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1596 EXPORT_SYMBOL_GPL(nft_register_chain_type
);
1598 void nft_unregister_chain_type(const struct nft_chain_type
*ctype
)
1600 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
1601 chain_type
[ctype
->family
][ctype
->type
] = NULL
;
1602 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
1604 EXPORT_SYMBOL_GPL(nft_unregister_chain_type
);
1610 static struct nft_chain
*
1611 nft_chain_lookup_byhandle(const struct nft_table
*table
, u64 handle
, u8 genmask
)
1613 struct nft_chain
*chain
;
1615 list_for_each_entry(chain
, &table
->chains
, list
) {
1616 if (chain
->handle
== handle
&&
1617 nft_active_genmask(chain
, genmask
))
1621 return ERR_PTR(-ENOENT
);
1624 static bool lockdep_commit_lock_is_held(const struct net
*net
)
1626 #ifdef CONFIG_PROVE_LOCKING
1627 struct nftables_pernet
*nft_net
= nft_pernet(net
);
1629 return lockdep_is_held(&nft_net
->commit_mutex
);
1635 static struct nft_chain
*nft_chain_lookup(struct net
*net
,
1636 struct nft_table
*table
,
1637 const struct nlattr
*nla
, u8 genmask
)
1639 char search
[NFT_CHAIN_MAXNAMELEN
+ 1];
1640 struct rhlist_head
*tmp
, *list
;
1641 struct nft_chain
*chain
;
1644 return ERR_PTR(-EINVAL
);
1646 nla_strscpy(search
, nla
, sizeof(search
));
1648 WARN_ON(!rcu_read_lock_held() &&
1649 !lockdep_commit_lock_is_held(net
));
1651 chain
= ERR_PTR(-ENOENT
);
1653 list
= rhltable_lookup(&table
->chains_ht
, search
, nft_chain_ht_params
);
1657 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
1658 if (nft_active_genmask(chain
, genmask
))
1661 chain
= ERR_PTR(-ENOENT
);
1667 static const struct nla_policy nft_chain_policy
[NFTA_CHAIN_MAX
+ 1] = {
1668 [NFTA_CHAIN_TABLE
] = { .type
= NLA_STRING
,
1669 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
1670 [NFTA_CHAIN_HANDLE
] = { .type
= NLA_U64
},
1671 [NFTA_CHAIN_NAME
] = { .type
= NLA_STRING
,
1672 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
1673 [NFTA_CHAIN_HOOK
] = { .type
= NLA_NESTED
},
1674 [NFTA_CHAIN_POLICY
] = { .type
= NLA_U32
},
1675 [NFTA_CHAIN_TYPE
] = { .type
= NLA_STRING
,
1676 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
1677 [NFTA_CHAIN_COUNTERS
] = { .type
= NLA_NESTED
},
1678 [NFTA_CHAIN_FLAGS
] = { .type
= NLA_U32
},
1679 [NFTA_CHAIN_ID
] = { .type
= NLA_U32
},
1680 [NFTA_CHAIN_USERDATA
] = { .type
= NLA_BINARY
,
1681 .len
= NFT_USERDATA_MAXLEN
},
1684 static const struct nla_policy nft_hook_policy
[NFTA_HOOK_MAX
+ 1] = {
1685 [NFTA_HOOK_HOOKNUM
] = { .type
= NLA_U32
},
1686 [NFTA_HOOK_PRIORITY
] = { .type
= NLA_U32
},
1687 [NFTA_HOOK_DEV
] = { .type
= NLA_STRING
,
1688 .len
= IFNAMSIZ
- 1 },
1691 static int nft_dump_stats(struct sk_buff
*skb
, struct nft_stats __percpu
*stats
)
1693 struct nft_stats
*cpu_stats
, total
;
1694 struct nlattr
*nest
;
1702 memset(&total
, 0, sizeof(total
));
1703 for_each_possible_cpu(cpu
) {
1704 cpu_stats
= per_cpu_ptr(stats
, cpu
);
1706 seq
= u64_stats_fetch_begin(&cpu_stats
->syncp
);
1707 pkts
= cpu_stats
->pkts
;
1708 bytes
= cpu_stats
->bytes
;
1709 } while (u64_stats_fetch_retry(&cpu_stats
->syncp
, seq
));
1711 total
.bytes
+= bytes
;
1713 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_COUNTERS
);
1715 goto nla_put_failure
;
1717 if (nla_put_be64(skb
, NFTA_COUNTER_PACKETS
, cpu_to_be64(total
.pkts
),
1718 NFTA_COUNTER_PAD
) ||
1719 nla_put_be64(skb
, NFTA_COUNTER_BYTES
, cpu_to_be64(total
.bytes
),
1721 goto nla_put_failure
;
1723 nla_nest_end(skb
, nest
);
1730 static int nft_dump_basechain_hook(struct sk_buff
*skb
, int family
,
1731 const struct nft_base_chain
*basechain
,
1732 const struct list_head
*hook_list
)
1734 const struct nf_hook_ops
*ops
= &basechain
->ops
;
1735 struct nft_hook
*hook
, *first
= NULL
;
1736 struct nlattr
*nest
, *nest_devs
;
1739 nest
= nla_nest_start_noflag(skb
, NFTA_CHAIN_HOOK
);
1741 goto nla_put_failure
;
1742 if (nla_put_be32(skb
, NFTA_HOOK_HOOKNUM
, htonl(ops
->hooknum
)))
1743 goto nla_put_failure
;
1744 if (nla_put_be32(skb
, NFTA_HOOK_PRIORITY
, htonl(ops
->priority
)))
1745 goto nla_put_failure
;
1747 if (nft_base_chain_netdev(family
, ops
->hooknum
)) {
1748 nest_devs
= nla_nest_start_noflag(skb
, NFTA_HOOK_DEVS
);
1750 goto nla_put_failure
;
1753 hook_list
= &basechain
->hook_list
;
1755 list_for_each_entry(hook
, hook_list
, list
) {
1759 if (nla_put_string(skb
, NFTA_DEVICE_NAME
,
1760 hook
->ops
.dev
->name
))
1761 goto nla_put_failure
;
1764 nla_nest_end(skb
, nest_devs
);
1767 nla_put_string(skb
, NFTA_HOOK_DEV
, first
->ops
.dev
->name
))
1768 goto nla_put_failure
;
1770 nla_nest_end(skb
, nest
);
1777 static int nf_tables_fill_chain_info(struct sk_buff
*skb
, struct net
*net
,
1778 u32 portid
, u32 seq
, int event
, u32 flags
,
1779 int family
, const struct nft_table
*table
,
1780 const struct nft_chain
*chain
,
1781 const struct list_head
*hook_list
)
1783 struct nlmsghdr
*nlh
;
1785 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
1786 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
1787 NFNETLINK_V0
, nft_base_seq(net
));
1789 goto nla_put_failure
;
1791 if (nla_put_string(skb
, NFTA_CHAIN_TABLE
, table
->name
) ||
1792 nla_put_string(skb
, NFTA_CHAIN_NAME
, chain
->name
) ||
1793 nla_put_be64(skb
, NFTA_CHAIN_HANDLE
, cpu_to_be64(chain
->handle
),
1795 goto nla_put_failure
;
1797 if (event
== NFT_MSG_DELCHAIN
&& !hook_list
) {
1798 nlmsg_end(skb
, nlh
);
1802 if (nft_is_base_chain(chain
)) {
1803 const struct nft_base_chain
*basechain
= nft_base_chain(chain
);
1804 struct nft_stats __percpu
*stats
;
1806 if (nft_dump_basechain_hook(skb
, family
, basechain
, hook_list
))
1807 goto nla_put_failure
;
1809 if (nla_put_be32(skb
, NFTA_CHAIN_POLICY
,
1810 htonl(basechain
->policy
)))
1811 goto nla_put_failure
;
1813 if (nla_put_string(skb
, NFTA_CHAIN_TYPE
, basechain
->type
->name
))
1814 goto nla_put_failure
;
1816 stats
= rcu_dereference_check(basechain
->stats
,
1817 lockdep_commit_lock_is_held(net
));
1818 if (nft_dump_stats(skb
, stats
))
1819 goto nla_put_failure
;
1823 nla_put_be32(skb
, NFTA_CHAIN_FLAGS
, htonl(chain
->flags
)))
1824 goto nla_put_failure
;
1826 if (nla_put_be32(skb
, NFTA_CHAIN_USE
, htonl(chain
->use
)))
1827 goto nla_put_failure
;
1830 nla_put(skb
, NFTA_CHAIN_USERDATA
, chain
->udlen
, chain
->udata
))
1831 goto nla_put_failure
;
1833 nlmsg_end(skb
, nlh
);
1837 nlmsg_trim(skb
, nlh
);
1841 static void nf_tables_chain_notify(const struct nft_ctx
*ctx
, int event
,
1842 const struct list_head
*hook_list
)
1844 struct nftables_pernet
*nft_net
;
1845 struct sk_buff
*skb
;
1850 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
1853 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
1857 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
1858 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
1860 err
= nf_tables_fill_chain_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
1861 event
, flags
, ctx
->family
, ctx
->table
,
1862 ctx
->chain
, hook_list
);
1868 nft_net
= nft_pernet(ctx
->net
);
1869 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
1872 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
1875 static int nf_tables_dump_chains(struct sk_buff
*skb
,
1876 struct netlink_callback
*cb
)
1878 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1879 unsigned int idx
= 0, s_idx
= cb
->args
[0];
1880 struct net
*net
= sock_net(skb
->sk
);
1881 int family
= nfmsg
->nfgen_family
;
1882 struct nftables_pernet
*nft_net
;
1883 const struct nft_table
*table
;
1884 const struct nft_chain
*chain
;
1887 nft_net
= nft_pernet(net
);
1888 cb
->seq
= READ_ONCE(nft_net
->base_seq
);
1890 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
1891 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
1894 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
1898 memset(&cb
->args
[1], 0,
1899 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
1900 if (!nft_is_active(net
, chain
))
1902 if (nf_tables_fill_chain_info(skb
, net
,
1903 NETLINK_CB(cb
->skb
).portid
,
1907 table
->family
, table
,
1911 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
1922 /* called with rcu_read_lock held */
1923 static int nf_tables_getchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
1924 const struct nlattr
* const nla
[])
1926 struct netlink_ext_ack
*extack
= info
->extack
;
1927 u8 genmask
= nft_genmask_cur(info
->net
);
1928 u8 family
= info
->nfmsg
->nfgen_family
;
1929 const struct nft_chain
*chain
;
1930 struct net
*net
= info
->net
;
1931 struct nft_table
*table
;
1932 struct sk_buff
*skb2
;
1935 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1936 struct netlink_dump_control c
= {
1937 .dump
= nf_tables_dump_chains
,
1938 .module
= THIS_MODULE
,
1941 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
1944 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
, 0);
1945 if (IS_ERR(table
)) {
1946 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
1947 return PTR_ERR(table
);
1950 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_CHAIN_NAME
], genmask
);
1951 if (IS_ERR(chain
)) {
1952 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
1953 return PTR_ERR(chain
);
1956 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
1960 err
= nf_tables_fill_chain_info(skb2
, net
, NETLINK_CB(skb
).portid
,
1961 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWCHAIN
,
1962 0, family
, table
, chain
, NULL
);
1964 goto err_fill_chain_info
;
1966 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
1968 err_fill_chain_info
:
1973 static const struct nla_policy nft_counter_policy
[NFTA_COUNTER_MAX
+ 1] = {
1974 [NFTA_COUNTER_PACKETS
] = { .type
= NLA_U64
},
1975 [NFTA_COUNTER_BYTES
] = { .type
= NLA_U64
},
1978 static struct nft_stats __percpu
*nft_stats_alloc(const struct nlattr
*attr
)
1980 struct nlattr
*tb
[NFTA_COUNTER_MAX
+1];
1981 struct nft_stats __percpu
*newstats
;
1982 struct nft_stats
*stats
;
1985 err
= nla_parse_nested_deprecated(tb
, NFTA_COUNTER_MAX
, attr
,
1986 nft_counter_policy
, NULL
);
1988 return ERR_PTR(err
);
1990 if (!tb
[NFTA_COUNTER_BYTES
] || !tb
[NFTA_COUNTER_PACKETS
])
1991 return ERR_PTR(-EINVAL
);
1993 newstats
= netdev_alloc_pcpu_stats(struct nft_stats
);
1994 if (newstats
== NULL
)
1995 return ERR_PTR(-ENOMEM
);
1997 /* Restore old counters on this cpu, no problem. Per-cpu statistics
1998 * are not exposed to userspace.
2001 stats
= this_cpu_ptr(newstats
);
2002 stats
->bytes
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_BYTES
]));
2003 stats
->pkts
= be64_to_cpu(nla_get_be64(tb
[NFTA_COUNTER_PACKETS
]));
2009 static void nft_chain_stats_replace(struct nft_trans
*trans
)
2011 struct nft_base_chain
*chain
= nft_base_chain(trans
->ctx
.chain
);
2013 if (!nft_trans_chain_stats(trans
))
2016 nft_trans_chain_stats(trans
) =
2017 rcu_replace_pointer(chain
->stats
, nft_trans_chain_stats(trans
),
2018 lockdep_commit_lock_is_held(trans
->ctx
.net
));
2020 if (!nft_trans_chain_stats(trans
))
2021 static_branch_inc(&nft_counters_enabled
);
2024 static void nf_tables_chain_free_chain_rules(struct nft_chain
*chain
)
2026 struct nft_rule_blob
*g0
= rcu_dereference_raw(chain
->blob_gen_0
);
2027 struct nft_rule_blob
*g1
= rcu_dereference_raw(chain
->blob_gen_1
);
2033 /* should be NULL either via abort or via successful commit */
2034 WARN_ON_ONCE(chain
->blob_next
);
2035 kvfree(chain
->blob_next
);
2038 void nf_tables_chain_destroy(struct nft_ctx
*ctx
)
2040 struct nft_chain
*chain
= ctx
->chain
;
2041 struct nft_hook
*hook
, *next
;
2043 if (WARN_ON(chain
->use
> 0))
2046 /* no concurrent access possible anymore */
2047 nf_tables_chain_free_chain_rules(chain
);
2049 if (nft_is_base_chain(chain
)) {
2050 struct nft_base_chain
*basechain
= nft_base_chain(chain
);
2052 if (nft_base_chain_netdev(ctx
->family
, basechain
->ops
.hooknum
)) {
2053 list_for_each_entry_safe(hook
, next
,
2054 &basechain
->hook_list
, list
) {
2055 list_del_rcu(&hook
->list
);
2056 kfree_rcu(hook
, rcu
);
2059 module_put(basechain
->type
->owner
);
2060 if (rcu_access_pointer(basechain
->stats
)) {
2061 static_branch_dec(&nft_counters_enabled
);
2062 free_percpu(rcu_dereference_raw(basechain
->stats
));
2065 kfree(chain
->udata
);
2069 kfree(chain
->udata
);
2074 static struct nft_hook
*nft_netdev_hook_alloc(struct net
*net
,
2075 const struct nlattr
*attr
)
2077 struct net_device
*dev
;
2078 char ifname
[IFNAMSIZ
];
2079 struct nft_hook
*hook
;
2082 hook
= kmalloc(sizeof(struct nft_hook
), GFP_KERNEL_ACCOUNT
);
2085 goto err_hook_alloc
;
2088 nla_strscpy(ifname
, attr
, IFNAMSIZ
);
2089 /* nf_tables_netdev_event() is called under rtnl_mutex, this is
2090 * indirectly serializing all the other holders of the commit_mutex with
2093 dev
= __dev_get_by_name(net
, ifname
);
2098 hook
->ops
.dev
= dev
;
2105 return ERR_PTR(err
);
2108 static struct nft_hook
*nft_hook_list_find(struct list_head
*hook_list
,
2109 const struct nft_hook
*this)
2111 struct nft_hook
*hook
;
2113 list_for_each_entry(hook
, hook_list
, list
) {
2114 if (this->ops
.dev
== hook
->ops
.dev
)
2121 static int nf_tables_parse_netdev_hooks(struct net
*net
,
2122 const struct nlattr
*attr
,
2123 struct list_head
*hook_list
,
2124 struct netlink_ext_ack
*extack
)
2126 struct nft_hook
*hook
, *next
;
2127 const struct nlattr
*tmp
;
2128 int rem
, n
= 0, err
;
2130 nla_for_each_nested(tmp
, attr
, rem
) {
2131 if (nla_type(tmp
) != NFTA_DEVICE_NAME
) {
2136 hook
= nft_netdev_hook_alloc(net
, tmp
);
2138 NL_SET_BAD_ATTR(extack
, tmp
);
2139 err
= PTR_ERR(hook
);
2142 if (nft_hook_list_find(hook_list
, hook
)) {
2143 NL_SET_BAD_ATTR(extack
, tmp
);
2148 list_add_tail(&hook
->list
, hook_list
);
2151 if (n
== NFT_NETDEVICE_MAX
) {
2160 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
2161 list_del(&hook
->list
);
2167 struct nft_chain_hook
{
2170 const struct nft_chain_type
*type
;
2171 struct list_head list
;
2174 static int nft_chain_parse_netdev(struct net
*net
, struct nlattr
*tb
[],
2175 struct list_head
*hook_list
,
2176 struct netlink_ext_ack
*extack
, u32 flags
)
2178 struct nft_hook
*hook
;
2181 if (tb
[NFTA_HOOK_DEV
]) {
2182 hook
= nft_netdev_hook_alloc(net
, tb
[NFTA_HOOK_DEV
]);
2184 NL_SET_BAD_ATTR(extack
, tb
[NFTA_HOOK_DEV
]);
2185 return PTR_ERR(hook
);
2188 list_add_tail(&hook
->list
, hook_list
);
2189 } else if (tb
[NFTA_HOOK_DEVS
]) {
2190 err
= nf_tables_parse_netdev_hooks(net
, tb
[NFTA_HOOK_DEVS
],
2197 if (flags
& NFT_CHAIN_HW_OFFLOAD
&&
2198 list_empty(hook_list
))
2204 static int nft_chain_parse_hook(struct net
*net
,
2205 struct nft_base_chain
*basechain
,
2206 const struct nlattr
* const nla
[],
2207 struct nft_chain_hook
*hook
, u8 family
,
2208 u32 flags
, struct netlink_ext_ack
*extack
)
2210 struct nftables_pernet
*nft_net
= nft_pernet(net
);
2211 struct nlattr
*ha
[NFTA_HOOK_MAX
+ 1];
2212 const struct nft_chain_type
*type
;
2215 lockdep_assert_held(&nft_net
->commit_mutex
);
2216 lockdep_nfnl_nft_mutex_not_held();
2218 err
= nla_parse_nested_deprecated(ha
, NFTA_HOOK_MAX
,
2219 nla
[NFTA_CHAIN_HOOK
],
2220 nft_hook_policy
, NULL
);
2225 if (!ha
[NFTA_HOOK_HOOKNUM
] ||
2226 !ha
[NFTA_HOOK_PRIORITY
]) {
2227 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2231 hook
->num
= ntohl(nla_get_be32(ha
[NFTA_HOOK_HOOKNUM
]));
2232 hook
->priority
= ntohl(nla_get_be32(ha
[NFTA_HOOK_PRIORITY
]));
2234 type
= __nft_chain_type_get(family
, NFT_CHAIN_T_DEFAULT
);
2238 if (nla
[NFTA_CHAIN_TYPE
]) {
2239 type
= nf_tables_chain_type_lookup(net
, nla
[NFTA_CHAIN_TYPE
],
2242 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TYPE
]);
2243 return PTR_ERR(type
);
2246 if (hook
->num
>= NFT_MAX_HOOKS
|| !(type
->hook_mask
& (1 << hook
->num
)))
2249 if (type
->type
== NFT_CHAIN_T_NAT
&&
2250 hook
->priority
<= NF_IP_PRI_CONNTRACK
)
2253 if (ha
[NFTA_HOOK_HOOKNUM
]) {
2254 hook
->num
= ntohl(nla_get_be32(ha
[NFTA_HOOK_HOOKNUM
]));
2255 if (hook
->num
!= basechain
->ops
.hooknum
)
2258 if (ha
[NFTA_HOOK_PRIORITY
]) {
2259 hook
->priority
= ntohl(nla_get_be32(ha
[NFTA_HOOK_PRIORITY
]));
2260 if (hook
->priority
!= basechain
->ops
.priority
)
2264 type
= basechain
->type
;
2267 if (!try_module_get(type
->owner
)) {
2268 if (nla
[NFTA_CHAIN_TYPE
])
2269 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TYPE
]);
2275 INIT_LIST_HEAD(&hook
->list
);
2276 if (nft_base_chain_netdev(family
, hook
->num
)) {
2277 err
= nft_chain_parse_netdev(net
, ha
, &hook
->list
, extack
, flags
);
2279 module_put(type
->owner
);
2282 } else if (ha
[NFTA_HOOK_DEV
] || ha
[NFTA_HOOK_DEVS
]) {
2283 module_put(type
->owner
);
2290 static void nft_chain_release_hook(struct nft_chain_hook
*hook
)
2292 struct nft_hook
*h
, *next
;
2294 list_for_each_entry_safe(h
, next
, &hook
->list
, list
) {
2298 module_put(hook
->type
->owner
);
2301 static void nft_last_rule(const struct nft_chain
*chain
, const void *ptr
)
2303 struct nft_rule_dp_last
*lrule
;
2305 BUILD_BUG_ON(offsetof(struct nft_rule_dp_last
, end
) != 0);
2307 lrule
= (struct nft_rule_dp_last
*)ptr
;
2308 lrule
->end
.is_last
= 1;
2309 lrule
->chain
= chain
;
2310 /* blob size does not include the trailer rule */
2313 static struct nft_rule_blob
*nf_tables_chain_alloc_rules(const struct nft_chain
*chain
,
2316 struct nft_rule_blob
*blob
;
2321 size
+= sizeof(struct nft_rule_blob
) + sizeof(struct nft_rule_dp_last
);
2323 blob
= kvmalloc(size
, GFP_KERNEL_ACCOUNT
);
2328 nft_last_rule(chain
, blob
->data
);
2333 static void nft_basechain_hook_init(struct nf_hook_ops
*ops
, u8 family
,
2334 const struct nft_chain_hook
*hook
,
2335 struct nft_chain
*chain
)
2338 ops
->hooknum
= hook
->num
;
2339 ops
->priority
= hook
->priority
;
2341 ops
->hook
= hook
->type
->hooks
[ops
->hooknum
];
2342 ops
->hook_ops_type
= NF_HOOK_OP_NF_TABLES
;
2345 static int nft_basechain_init(struct nft_base_chain
*basechain
, u8 family
,
2346 struct nft_chain_hook
*hook
, u32 flags
)
2348 struct nft_chain
*chain
;
2351 basechain
->type
= hook
->type
;
2352 INIT_LIST_HEAD(&basechain
->hook_list
);
2353 chain
= &basechain
->chain
;
2355 if (nft_base_chain_netdev(family
, hook
->num
)) {
2356 list_splice_init(&hook
->list
, &basechain
->hook_list
);
2357 list_for_each_entry(h
, &basechain
->hook_list
, list
)
2358 nft_basechain_hook_init(&h
->ops
, family
, hook
, chain
);
2360 nft_basechain_hook_init(&basechain
->ops
, family
, hook
, chain
);
2362 chain
->flags
|= NFT_CHAIN_BASE
| flags
;
2363 basechain
->policy
= NF_ACCEPT
;
2364 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
&&
2365 !nft_chain_offload_support(basechain
)) {
2366 list_splice_init(&basechain
->hook_list
, &hook
->list
);
2370 flow_block_init(&basechain
->flow_block
);
2375 int nft_chain_add(struct nft_table
*table
, struct nft_chain
*chain
)
2379 err
= rhltable_insert_key(&table
->chains_ht
, chain
->name
,
2380 &chain
->rhlhead
, nft_chain_ht_params
);
2384 list_add_tail_rcu(&chain
->list
, &table
->chains
);
2389 static u64 chain_id
;
2391 static int nf_tables_addchain(struct nft_ctx
*ctx
, u8 family
, u8 genmask
,
2392 u8 policy
, u32 flags
,
2393 struct netlink_ext_ack
*extack
)
2395 const struct nlattr
* const *nla
= ctx
->nla
;
2396 struct nft_table
*table
= ctx
->table
;
2397 struct nft_base_chain
*basechain
;
2398 struct net
*net
= ctx
->net
;
2399 char name
[NFT_NAME_MAXLEN
];
2400 struct nft_rule_blob
*blob
;
2401 struct nft_trans
*trans
;
2402 struct nft_chain
*chain
;
2405 if (nla
[NFTA_CHAIN_HOOK
]) {
2406 struct nft_stats __percpu
*stats
= NULL
;
2407 struct nft_chain_hook hook
= {};
2409 if (flags
& NFT_CHAIN_BINDING
)
2412 err
= nft_chain_parse_hook(net
, NULL
, nla
, &hook
, family
, flags
,
2417 basechain
= kzalloc(sizeof(*basechain
), GFP_KERNEL_ACCOUNT
);
2418 if (basechain
== NULL
) {
2419 nft_chain_release_hook(&hook
);
2422 chain
= &basechain
->chain
;
2424 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2425 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2426 if (IS_ERR(stats
)) {
2427 nft_chain_release_hook(&hook
);
2429 return PTR_ERR(stats
);
2431 rcu_assign_pointer(basechain
->stats
, stats
);
2434 err
= nft_basechain_init(basechain
, family
, &hook
, flags
);
2436 nft_chain_release_hook(&hook
);
2442 static_branch_inc(&nft_counters_enabled
);
2444 if (flags
& NFT_CHAIN_BASE
)
2446 if (flags
& NFT_CHAIN_HW_OFFLOAD
)
2449 chain
= kzalloc(sizeof(*chain
), GFP_KERNEL_ACCOUNT
);
2453 chain
->flags
= flags
;
2457 INIT_LIST_HEAD(&chain
->rules
);
2458 chain
->handle
= nf_tables_alloc_handle(table
);
2459 chain
->table
= table
;
2461 if (nla
[NFTA_CHAIN_NAME
]) {
2462 chain
->name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL_ACCOUNT
);
2464 if (!(flags
& NFT_CHAIN_BINDING
)) {
2466 goto err_destroy_chain
;
2469 snprintf(name
, sizeof(name
), "__chain%llu", ++chain_id
);
2470 chain
->name
= kstrdup(name
, GFP_KERNEL_ACCOUNT
);
2475 goto err_destroy_chain
;
2478 if (nla
[NFTA_CHAIN_USERDATA
]) {
2479 chain
->udata
= nla_memdup(nla
[NFTA_CHAIN_USERDATA
], GFP_KERNEL_ACCOUNT
);
2480 if (chain
->udata
== NULL
) {
2482 goto err_destroy_chain
;
2484 chain
->udlen
= nla_len(nla
[NFTA_CHAIN_USERDATA
]);
2487 blob
= nf_tables_chain_alloc_rules(chain
, 0);
2490 goto err_destroy_chain
;
2493 RCU_INIT_POINTER(chain
->blob_gen_0
, blob
);
2494 RCU_INIT_POINTER(chain
->blob_gen_1
, blob
);
2496 err
= nf_tables_register_hook(net
, table
, chain
);
2498 goto err_destroy_chain
;
2500 if (!nft_use_inc(&table
->use
)) {
2505 trans
= nft_trans_chain_add(ctx
, NFT_MSG_NEWCHAIN
);
2506 if (IS_ERR(trans
)) {
2507 err
= PTR_ERR(trans
);
2508 goto err_unregister_hook
;
2511 nft_trans_chain_policy(trans
) = NFT_CHAIN_POLICY_UNSET
;
2512 if (nft_is_base_chain(chain
))
2513 nft_trans_chain_policy(trans
) = policy
;
2515 err
= nft_chain_add(table
, chain
);
2517 nft_trans_destroy(trans
);
2518 goto err_unregister_hook
;
2523 err_unregister_hook
:
2524 nft_use_dec_restore(&table
->use
);
2526 nf_tables_unregister_hook(net
, table
, chain
);
2528 nf_tables_chain_destroy(ctx
);
2533 static int nf_tables_updchain(struct nft_ctx
*ctx
, u8 genmask
, u8 policy
,
2534 u32 flags
, const struct nlattr
*attr
,
2535 struct netlink_ext_ack
*extack
)
2537 const struct nlattr
* const *nla
= ctx
->nla
;
2538 struct nft_base_chain
*basechain
= NULL
;
2539 struct nft_table
*table
= ctx
->table
;
2540 struct nft_chain
*chain
= ctx
->chain
;
2541 struct nft_chain_hook hook
= {};
2542 struct nft_stats
*stats
= NULL
;
2543 struct nft_hook
*h
, *next
;
2544 struct nf_hook_ops
*ops
;
2545 struct nft_trans
*trans
;
2546 bool unregister
= false;
2549 if (chain
->flags
^ flags
)
2552 INIT_LIST_HEAD(&hook
.list
);
2554 if (nla
[NFTA_CHAIN_HOOK
]) {
2555 if (!nft_is_base_chain(chain
)) {
2556 NL_SET_BAD_ATTR(extack
, attr
);
2560 basechain
= nft_base_chain(chain
);
2561 err
= nft_chain_parse_hook(ctx
->net
, basechain
, nla
, &hook
,
2562 ctx
->family
, flags
, extack
);
2566 if (basechain
->type
!= hook
.type
) {
2567 nft_chain_release_hook(&hook
);
2568 NL_SET_BAD_ATTR(extack
, attr
);
2572 if (nft_base_chain_netdev(ctx
->family
, basechain
->ops
.hooknum
)) {
2573 list_for_each_entry_safe(h
, next
, &hook
.list
, list
) {
2574 h
->ops
.pf
= basechain
->ops
.pf
;
2575 h
->ops
.hooknum
= basechain
->ops
.hooknum
;
2576 h
->ops
.priority
= basechain
->ops
.priority
;
2577 h
->ops
.priv
= basechain
->ops
.priv
;
2578 h
->ops
.hook
= basechain
->ops
.hook
;
2580 if (nft_hook_list_find(&basechain
->hook_list
, h
)) {
2586 ops
= &basechain
->ops
;
2587 if (ops
->hooknum
!= hook
.num
||
2588 ops
->priority
!= hook
.priority
) {
2589 nft_chain_release_hook(&hook
);
2590 NL_SET_BAD_ATTR(extack
, attr
);
2596 if (nla
[NFTA_CHAIN_HANDLE
] &&
2597 nla
[NFTA_CHAIN_NAME
]) {
2598 struct nft_chain
*chain2
;
2600 chain2
= nft_chain_lookup(ctx
->net
, table
,
2601 nla
[NFTA_CHAIN_NAME
], genmask
);
2602 if (!IS_ERR(chain2
)) {
2603 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2609 if (nla
[NFTA_CHAIN_COUNTERS
]) {
2610 if (!nft_is_base_chain(chain
)) {
2615 stats
= nft_stats_alloc(nla
[NFTA_CHAIN_COUNTERS
]);
2616 if (IS_ERR(stats
)) {
2617 err
= PTR_ERR(stats
);
2622 if (!(table
->flags
& NFT_TABLE_F_DORMANT
) &&
2623 nft_is_base_chain(chain
) &&
2624 !list_empty(&hook
.list
)) {
2625 basechain
= nft_base_chain(chain
);
2626 ops
= &basechain
->ops
;
2628 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
)) {
2629 err
= nft_netdev_register_hooks(ctx
->net
, &hook
.list
);
2637 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWCHAIN
,
2638 sizeof(struct nft_trans_chain
));
2642 nft_trans_chain_stats(trans
) = stats
;
2643 nft_trans_chain_update(trans
) = true;
2645 if (nla
[NFTA_CHAIN_POLICY
])
2646 nft_trans_chain_policy(trans
) = policy
;
2648 nft_trans_chain_policy(trans
) = -1;
2650 if (nla
[NFTA_CHAIN_HANDLE
] &&
2651 nla
[NFTA_CHAIN_NAME
]) {
2652 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
2653 struct nft_trans
*tmp
;
2657 name
= nla_strdup(nla
[NFTA_CHAIN_NAME
], GFP_KERNEL_ACCOUNT
);
2662 list_for_each_entry(tmp
, &nft_net
->commit_list
, list
) {
2663 if (tmp
->msg_type
== NFT_MSG_NEWCHAIN
&&
2664 tmp
->ctx
.table
== table
&&
2665 nft_trans_chain_update(tmp
) &&
2666 nft_trans_chain_name(tmp
) &&
2667 strcmp(name
, nft_trans_chain_name(tmp
)) == 0) {
2668 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_NAME
]);
2674 nft_trans_chain_name(trans
) = name
;
2677 nft_trans_basechain(trans
) = basechain
;
2678 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans
));
2679 list_splice(&hook
.list
, &nft_trans_chain_hooks(trans
));
2680 if (nla
[NFTA_CHAIN_HOOK
])
2681 module_put(hook
.type
->owner
);
2683 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
2691 if (nla
[NFTA_CHAIN_HOOK
]) {
2692 list_for_each_entry_safe(h
, next
, &hook
.list
, list
) {
2694 nf_unregister_net_hook(ctx
->net
, &h
->ops
);
2698 module_put(hook
.type
->owner
);
2704 static struct nft_chain
*nft_chain_lookup_byid(const struct net
*net
,
2705 const struct nft_table
*table
,
2706 const struct nlattr
*nla
, u8 genmask
)
2708 struct nftables_pernet
*nft_net
= nft_pernet(net
);
2709 u32 id
= ntohl(nla_get_be32(nla
));
2710 struct nft_trans
*trans
;
2712 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
2713 struct nft_chain
*chain
= trans
->ctx
.chain
;
2715 if (trans
->msg_type
== NFT_MSG_NEWCHAIN
&&
2716 chain
->table
== table
&&
2717 id
== nft_trans_chain_id(trans
) &&
2718 nft_active_genmask(chain
, genmask
))
2721 return ERR_PTR(-ENOENT
);
2724 static int nf_tables_newchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
2725 const struct nlattr
* const nla
[])
2727 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
2728 struct netlink_ext_ack
*extack
= info
->extack
;
2729 u8 genmask
= nft_genmask_next(info
->net
);
2730 u8 family
= info
->nfmsg
->nfgen_family
;
2731 struct nft_chain
*chain
= NULL
;
2732 struct net
*net
= info
->net
;
2733 const struct nlattr
*attr
;
2734 struct nft_table
*table
;
2735 u8 policy
= NF_ACCEPT
;
2740 lockdep_assert_held(&nft_net
->commit_mutex
);
2742 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2743 NETLINK_CB(skb
).portid
);
2744 if (IS_ERR(table
)) {
2745 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2746 return PTR_ERR(table
);
2750 attr
= nla
[NFTA_CHAIN_NAME
];
2752 if (nla
[NFTA_CHAIN_HANDLE
]) {
2753 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_CHAIN_HANDLE
]));
2754 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2755 if (IS_ERR(chain
)) {
2756 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_HANDLE
]);
2757 return PTR_ERR(chain
);
2759 attr
= nla
[NFTA_CHAIN_HANDLE
];
2760 } else if (nla
[NFTA_CHAIN_NAME
]) {
2761 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2762 if (IS_ERR(chain
)) {
2763 if (PTR_ERR(chain
) != -ENOENT
) {
2764 NL_SET_BAD_ATTR(extack
, attr
);
2765 return PTR_ERR(chain
);
2769 } else if (!nla
[NFTA_CHAIN_ID
]) {
2773 if (nla
[NFTA_CHAIN_POLICY
]) {
2774 if (chain
!= NULL
&&
2775 !nft_is_base_chain(chain
)) {
2776 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2780 if (chain
== NULL
&&
2781 nla
[NFTA_CHAIN_HOOK
] == NULL
) {
2782 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_POLICY
]);
2786 policy
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_POLICY
]));
2796 if (nla
[NFTA_CHAIN_FLAGS
])
2797 flags
= ntohl(nla_get_be32(nla
[NFTA_CHAIN_FLAGS
]));
2799 flags
= chain
->flags
;
2801 if (flags
& ~NFT_CHAIN_FLAGS
)
2804 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
2806 if (chain
!= NULL
) {
2807 if (chain
->flags
& NFT_CHAIN_BINDING
)
2810 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
2811 NL_SET_BAD_ATTR(extack
, attr
);
2814 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
2817 flags
|= chain
->flags
& NFT_CHAIN_BASE
;
2818 return nf_tables_updchain(&ctx
, genmask
, policy
, flags
, attr
,
2822 return nf_tables_addchain(&ctx
, family
, genmask
, policy
, flags
, extack
);
2825 static int nft_delchain_hook(struct nft_ctx
*ctx
,
2826 struct nft_base_chain
*basechain
,
2827 struct netlink_ext_ack
*extack
)
2829 const struct nft_chain
*chain
= &basechain
->chain
;
2830 const struct nlattr
* const *nla
= ctx
->nla
;
2831 struct nft_chain_hook chain_hook
= {};
2832 struct nft_hook
*this, *hook
;
2833 LIST_HEAD(chain_del_list
);
2834 struct nft_trans
*trans
;
2837 err
= nft_chain_parse_hook(ctx
->net
, basechain
, nla
, &chain_hook
,
2838 ctx
->family
, chain
->flags
, extack
);
2842 list_for_each_entry(this, &chain_hook
.list
, list
) {
2843 hook
= nft_hook_list_find(&basechain
->hook_list
, this);
2846 goto err_chain_del_hook
;
2848 list_move(&hook
->list
, &chain_del_list
);
2851 trans
= nft_trans_alloc(ctx
, NFT_MSG_DELCHAIN
,
2852 sizeof(struct nft_trans_chain
));
2855 goto err_chain_del_hook
;
2858 nft_trans_basechain(trans
) = basechain
;
2859 nft_trans_chain_update(trans
) = true;
2860 INIT_LIST_HEAD(&nft_trans_chain_hooks(trans
));
2861 list_splice(&chain_del_list
, &nft_trans_chain_hooks(trans
));
2862 nft_chain_release_hook(&chain_hook
);
2864 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
2869 list_splice(&chain_del_list
, &basechain
->hook_list
);
2870 nft_chain_release_hook(&chain_hook
);
2875 static int nf_tables_delchain(struct sk_buff
*skb
, const struct nfnl_info
*info
,
2876 const struct nlattr
* const nla
[])
2878 struct netlink_ext_ack
*extack
= info
->extack
;
2879 u8 genmask
= nft_genmask_next(info
->net
);
2880 u8 family
= info
->nfmsg
->nfgen_family
;
2881 struct net
*net
= info
->net
;
2882 const struct nlattr
*attr
;
2883 struct nft_table
*table
;
2884 struct nft_chain
*chain
;
2885 struct nft_rule
*rule
;
2891 table
= nft_table_lookup(net
, nla
[NFTA_CHAIN_TABLE
], family
, genmask
,
2892 NETLINK_CB(skb
).portid
);
2893 if (IS_ERR(table
)) {
2894 NL_SET_BAD_ATTR(extack
, nla
[NFTA_CHAIN_TABLE
]);
2895 return PTR_ERR(table
);
2898 if (nla
[NFTA_CHAIN_HANDLE
]) {
2899 attr
= nla
[NFTA_CHAIN_HANDLE
];
2900 handle
= be64_to_cpu(nla_get_be64(attr
));
2901 chain
= nft_chain_lookup_byhandle(table
, handle
, genmask
);
2903 attr
= nla
[NFTA_CHAIN_NAME
];
2904 chain
= nft_chain_lookup(net
, table
, attr
, genmask
);
2906 if (IS_ERR(chain
)) {
2907 if (PTR_ERR(chain
) == -ENOENT
&&
2908 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYCHAIN
)
2911 NL_SET_BAD_ATTR(extack
, attr
);
2912 return PTR_ERR(chain
);
2915 if (nft_chain_binding(chain
))
2918 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
2920 if (nla
[NFTA_CHAIN_HOOK
]) {
2921 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
2924 if (nft_is_base_chain(chain
)) {
2925 struct nft_base_chain
*basechain
= nft_base_chain(chain
);
2927 if (nft_base_chain_netdev(table
->family
, basechain
->ops
.hooknum
))
2928 return nft_delchain_hook(&ctx
, basechain
, extack
);
2932 if (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
2937 list_for_each_entry(rule
, &chain
->rules
, list
) {
2938 if (!nft_is_active_next(net
, rule
))
2942 err
= nft_delrule(&ctx
, rule
);
2947 /* There are rules and elements that are still holding references to us,
2948 * we cannot do a recursive removal in this case.
2951 NL_SET_BAD_ATTR(extack
, attr
);
2955 return nft_delchain(&ctx
);
2963 * nft_register_expr - register nf_tables expr type
2966 * Registers the expr type for use with nf_tables. Returns zero on
2967 * success or a negative errno code otherwise.
2969 int nft_register_expr(struct nft_expr_type
*type
)
2971 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2972 if (type
->family
== NFPROTO_UNSPEC
)
2973 list_add_tail_rcu(&type
->list
, &nf_tables_expressions
);
2975 list_add_rcu(&type
->list
, &nf_tables_expressions
);
2976 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2979 EXPORT_SYMBOL_GPL(nft_register_expr
);
2982 * nft_unregister_expr - unregister nf_tables expr type
2985 * Unregisters the expr typefor use with nf_tables.
2987 void nft_unregister_expr(struct nft_expr_type
*type
)
2989 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
2990 list_del_rcu(&type
->list
);
2991 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
2993 EXPORT_SYMBOL_GPL(nft_unregister_expr
);
2995 static const struct nft_expr_type
*__nft_expr_type_get(u8 family
,
2998 const struct nft_expr_type
*type
, *candidate
= NULL
;
3000 list_for_each_entry(type
, &nf_tables_expressions
, list
) {
3001 if (!nla_strcmp(nla
, type
->name
)) {
3002 if (!type
->family
&& !candidate
)
3004 else if (type
->family
== family
)
3011 #ifdef CONFIG_MODULES
3012 static int nft_expr_type_request_module(struct net
*net
, u8 family
,
3015 if (nft_request_module(net
, "nft-expr-%u-%.*s", family
,
3016 nla_len(nla
), (char *)nla_data(nla
)) == -EAGAIN
)
3023 static const struct nft_expr_type
*nft_expr_type_get(struct net
*net
,
3027 const struct nft_expr_type
*type
;
3030 return ERR_PTR(-EINVAL
);
3032 type
= __nft_expr_type_get(family
, nla
);
3033 if (type
!= NULL
&& try_module_get(type
->owner
))
3036 lockdep_nfnl_nft_mutex_not_held();
3037 #ifdef CONFIG_MODULES
3039 if (nft_expr_type_request_module(net
, family
, nla
) == -EAGAIN
)
3040 return ERR_PTR(-EAGAIN
);
3042 if (nft_request_module(net
, "nft-expr-%.*s",
3044 (char *)nla_data(nla
)) == -EAGAIN
)
3045 return ERR_PTR(-EAGAIN
);
3048 return ERR_PTR(-ENOENT
);
3051 static const struct nla_policy nft_expr_policy
[NFTA_EXPR_MAX
+ 1] = {
3052 [NFTA_EXPR_NAME
] = { .type
= NLA_STRING
,
3053 .len
= NFT_MODULE_AUTOLOAD_LIMIT
},
3054 [NFTA_EXPR_DATA
] = { .type
= NLA_NESTED
},
3057 static int nf_tables_fill_expr_info(struct sk_buff
*skb
,
3058 const struct nft_expr
*expr
, bool reset
)
3060 if (nla_put_string(skb
, NFTA_EXPR_NAME
, expr
->ops
->type
->name
))
3061 goto nla_put_failure
;
3063 if (expr
->ops
->dump
) {
3064 struct nlattr
*data
= nla_nest_start_noflag(skb
,
3067 goto nla_put_failure
;
3068 if (expr
->ops
->dump(skb
, expr
, reset
) < 0)
3069 goto nla_put_failure
;
3070 nla_nest_end(skb
, data
);
3079 int nft_expr_dump(struct sk_buff
*skb
, unsigned int attr
,
3080 const struct nft_expr
*expr
, bool reset
)
3082 struct nlattr
*nest
;
3084 nest
= nla_nest_start_noflag(skb
, attr
);
3086 goto nla_put_failure
;
3087 if (nf_tables_fill_expr_info(skb
, expr
, reset
) < 0)
3088 goto nla_put_failure
;
3089 nla_nest_end(skb
, nest
);
3096 struct nft_expr_info
{
3097 const struct nft_expr_ops
*ops
;
3098 const struct nlattr
*attr
;
3099 struct nlattr
*tb
[NFT_EXPR_MAXATTR
+ 1];
3102 static int nf_tables_expr_parse(const struct nft_ctx
*ctx
,
3103 const struct nlattr
*nla
,
3104 struct nft_expr_info
*info
)
3106 const struct nft_expr_type
*type
;
3107 const struct nft_expr_ops
*ops
;
3108 struct nlattr
*tb
[NFTA_EXPR_MAX
+ 1];
3111 err
= nla_parse_nested_deprecated(tb
, NFTA_EXPR_MAX
, nla
,
3112 nft_expr_policy
, NULL
);
3116 type
= nft_expr_type_get(ctx
->net
, ctx
->family
, tb
[NFTA_EXPR_NAME
]);
3118 return PTR_ERR(type
);
3120 if (tb
[NFTA_EXPR_DATA
]) {
3121 err
= nla_parse_nested_deprecated(info
->tb
, type
->maxattr
,
3123 type
->policy
, NULL
);
3127 memset(info
->tb
, 0, sizeof(info
->tb
[0]) * (type
->maxattr
+ 1));
3129 if (type
->select_ops
!= NULL
) {
3130 ops
= type
->select_ops(ctx
,
3131 (const struct nlattr
* const *)info
->tb
);
3134 #ifdef CONFIG_MODULES
3136 if (nft_expr_type_request_module(ctx
->net
,
3138 tb
[NFTA_EXPR_NAME
]) != -EAGAIN
)
3152 module_put(type
->owner
);
3156 int nft_expr_inner_parse(const struct nft_ctx
*ctx
, const struct nlattr
*nla
,
3157 struct nft_expr_info
*info
)
3159 struct nlattr
*tb
[NFTA_EXPR_MAX
+ 1];
3160 const struct nft_expr_type
*type
;
3163 err
= nla_parse_nested_deprecated(tb
, NFTA_EXPR_MAX
, nla
,
3164 nft_expr_policy
, NULL
);
3168 if (!tb
[NFTA_EXPR_DATA
] || !tb
[NFTA_EXPR_NAME
])
3171 type
= __nft_expr_type_get(ctx
->family
, tb
[NFTA_EXPR_NAME
]);
3175 if (!type
->inner_ops
)
3178 err
= nla_parse_nested_deprecated(info
->tb
, type
->maxattr
,
3180 type
->policy
, NULL
);
3185 info
->ops
= type
->inner_ops
;
3193 static int nf_tables_newexpr(const struct nft_ctx
*ctx
,
3194 const struct nft_expr_info
*expr_info
,
3195 struct nft_expr
*expr
)
3197 const struct nft_expr_ops
*ops
= expr_info
->ops
;
3202 err
= ops
->init(ctx
, expr
, (const struct nlattr
**)expr_info
->tb
);
3213 static void nf_tables_expr_destroy(const struct nft_ctx
*ctx
,
3214 struct nft_expr
*expr
)
3216 const struct nft_expr_type
*type
= expr
->ops
->type
;
3218 if (expr
->ops
->destroy
)
3219 expr
->ops
->destroy(ctx
, expr
);
3220 module_put(type
->owner
);
3223 static struct nft_expr
*nft_expr_init(const struct nft_ctx
*ctx
,
3224 const struct nlattr
*nla
)
3226 struct nft_expr_info expr_info
;
3227 struct nft_expr
*expr
;
3228 struct module
*owner
;
3231 err
= nf_tables_expr_parse(ctx
, nla
, &expr_info
);
3233 goto err_expr_parse
;
3236 if (!(expr_info
.ops
->type
->flags
& NFT_EXPR_STATEFUL
))
3237 goto err_expr_stateful
;
3240 expr
= kzalloc(expr_info
.ops
->size
, GFP_KERNEL_ACCOUNT
);
3242 goto err_expr_stateful
;
3244 err
= nf_tables_newexpr(ctx
, &expr_info
, expr
);
3252 owner
= expr_info
.ops
->type
->owner
;
3253 if (expr_info
.ops
->type
->release_ops
)
3254 expr_info
.ops
->type
->release_ops(expr_info
.ops
);
3258 return ERR_PTR(err
);
3261 int nft_expr_clone(struct nft_expr
*dst
, struct nft_expr
*src
)
3265 if (src
->ops
->clone
) {
3266 dst
->ops
= src
->ops
;
3267 err
= src
->ops
->clone(dst
, src
);
3271 memcpy(dst
, src
, src
->ops
->size
);
3274 __module_get(src
->ops
->type
->owner
);
3279 void nft_expr_destroy(const struct nft_ctx
*ctx
, struct nft_expr
*expr
)
3281 nf_tables_expr_destroy(ctx
, expr
);
3289 static struct nft_rule
*__nft_rule_lookup(const struct nft_chain
*chain
,
3292 struct nft_rule
*rule
;
3294 // FIXME: this sucks
3295 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
3296 if (handle
== rule
->handle
)
3300 return ERR_PTR(-ENOENT
);
3303 static struct nft_rule
*nft_rule_lookup(const struct nft_chain
*chain
,
3304 const struct nlattr
*nla
)
3307 return ERR_PTR(-EINVAL
);
3309 return __nft_rule_lookup(chain
, be64_to_cpu(nla_get_be64(nla
)));
3312 static const struct nla_policy nft_rule_policy
[NFTA_RULE_MAX
+ 1] = {
3313 [NFTA_RULE_TABLE
] = { .type
= NLA_STRING
,
3314 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
3315 [NFTA_RULE_CHAIN
] = { .type
= NLA_STRING
,
3316 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
3317 [NFTA_RULE_HANDLE
] = { .type
= NLA_U64
},
3318 [NFTA_RULE_EXPRESSIONS
] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy
),
3319 [NFTA_RULE_COMPAT
] = { .type
= NLA_NESTED
},
3320 [NFTA_RULE_POSITION
] = { .type
= NLA_U64
},
3321 [NFTA_RULE_USERDATA
] = { .type
= NLA_BINARY
,
3322 .len
= NFT_USERDATA_MAXLEN
},
3323 [NFTA_RULE_ID
] = { .type
= NLA_U32
},
3324 [NFTA_RULE_POSITION_ID
] = { .type
= NLA_U32
},
3325 [NFTA_RULE_CHAIN_ID
] = { .type
= NLA_U32
},
3328 static int nf_tables_fill_rule_info(struct sk_buff
*skb
, struct net
*net
,
3329 u32 portid
, u32 seq
, int event
,
3330 u32 flags
, int family
,
3331 const struct nft_table
*table
,
3332 const struct nft_chain
*chain
,
3333 const struct nft_rule
*rule
, u64 handle
,
3336 struct nlmsghdr
*nlh
;
3337 const struct nft_expr
*expr
, *next
;
3338 struct nlattr
*list
;
3339 u16 type
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
3341 nlh
= nfnl_msg_put(skb
, portid
, seq
, type
, flags
, family
, NFNETLINK_V0
,
3344 goto nla_put_failure
;
3346 if (nla_put_string(skb
, NFTA_RULE_TABLE
, table
->name
))
3347 goto nla_put_failure
;
3348 if (nla_put_string(skb
, NFTA_RULE_CHAIN
, chain
->name
))
3349 goto nla_put_failure
;
3350 if (nla_put_be64(skb
, NFTA_RULE_HANDLE
, cpu_to_be64(rule
->handle
),
3352 goto nla_put_failure
;
3354 if (event
!= NFT_MSG_DELRULE
&& handle
) {
3355 if (nla_put_be64(skb
, NFTA_RULE_POSITION
, cpu_to_be64(handle
),
3357 goto nla_put_failure
;
3360 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
3361 nft_flow_rule_stats(chain
, rule
);
3363 list
= nla_nest_start_noflag(skb
, NFTA_RULE_EXPRESSIONS
);
3365 goto nla_put_failure
;
3366 nft_rule_for_each_expr(expr
, next
, rule
) {
3367 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
, reset
) < 0)
3368 goto nla_put_failure
;
3370 nla_nest_end(skb
, list
);
3373 struct nft_userdata
*udata
= nft_userdata(rule
);
3374 if (nla_put(skb
, NFTA_RULE_USERDATA
, udata
->len
+ 1,
3376 goto nla_put_failure
;
3379 nlmsg_end(skb
, nlh
);
3383 nlmsg_trim(skb
, nlh
);
3387 static void nf_tables_rule_notify(const struct nft_ctx
*ctx
,
3388 const struct nft_rule
*rule
, int event
)
3390 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
3391 const struct nft_rule
*prule
;
3392 struct sk_buff
*skb
;
3398 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
3401 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
3405 if (event
== NFT_MSG_NEWRULE
&&
3406 !list_is_first(&rule
->list
, &ctx
->chain
->rules
) &&
3407 !list_is_last(&rule
->list
, &ctx
->chain
->rules
)) {
3408 prule
= list_prev_entry(rule
, list
);
3409 handle
= prule
->handle
;
3411 if (ctx
->flags
& (NLM_F_APPEND
| NLM_F_REPLACE
))
3412 flags
|= NLM_F_APPEND
;
3413 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
3414 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
3416 err
= nf_tables_fill_rule_info(skb
, ctx
->net
, ctx
->portid
, ctx
->seq
,
3417 event
, flags
, ctx
->family
, ctx
->table
,
3418 ctx
->chain
, rule
, handle
, false);
3424 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
3427 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
3430 static void audit_log_rule_reset(const struct nft_table
*table
,
3431 unsigned int base_seq
,
3432 unsigned int nentries
)
3434 char *buf
= kasprintf(GFP_ATOMIC
, "%s:%u",
3435 table
->name
, base_seq
);
3437 audit_log_nfcfg(buf
, table
->family
, nentries
,
3438 AUDIT_NFT_OP_RULE_RESET
, GFP_ATOMIC
);
3442 struct nft_rule_dump_ctx
{
3449 static int __nf_tables_dump_rules(struct sk_buff
*skb
,
3451 struct netlink_callback
*cb
,
3452 const struct nft_table
*table
,
3453 const struct nft_chain
*chain
)
3455 struct nft_rule_dump_ctx
*ctx
= (void *)cb
->ctx
;
3456 struct net
*net
= sock_net(skb
->sk
);
3457 const struct nft_rule
*rule
, *prule
;
3458 unsigned int entries
= 0;
3463 list_for_each_entry_rcu(rule
, &chain
->rules
, list
) {
3464 if (!nft_is_active(net
, rule
))
3466 if (*idx
< ctx
->s_idx
)
3469 handle
= prule
->handle
;
3473 if (nf_tables_fill_rule_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
3476 NLM_F_MULTI
| NLM_F_APPEND
,
3478 table
, chain
, rule
, handle
, ctx
->reset
) < 0) {
3483 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
3490 if (ctx
->reset
&& entries
)
3491 audit_log_rule_reset(table
, cb
->seq
, entries
);
3496 static int nf_tables_dump_rules(struct sk_buff
*skb
,
3497 struct netlink_callback
*cb
)
3499 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
3500 struct nft_rule_dump_ctx
*ctx
= (void *)cb
->ctx
;
3501 struct nft_table
*table
;
3502 const struct nft_chain
*chain
;
3503 unsigned int idx
= 0;
3504 struct net
*net
= sock_net(skb
->sk
);
3505 int family
= nfmsg
->nfgen_family
;
3506 struct nftables_pernet
*nft_net
;
3509 nft_net
= nft_pernet(net
);
3510 cb
->seq
= READ_ONCE(nft_net
->base_seq
);
3512 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
3513 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
3516 if (ctx
->table
&& strcmp(ctx
->table
, table
->name
) != 0)
3519 if (ctx
->table
&& ctx
->chain
) {
3520 struct rhlist_head
*list
, *tmp
;
3522 list
= rhltable_lookup(&table
->chains_ht
, ctx
->chain
,
3523 nft_chain_ht_params
);
3527 rhl_for_each_entry_rcu(chain
, tmp
, list
, rhlhead
) {
3528 if (!nft_is_active(net
, chain
))
3530 __nf_tables_dump_rules(skb
, &idx
,
3537 list_for_each_entry_rcu(chain
, &table
->chains
, list
) {
3538 if (__nf_tables_dump_rules(skb
, &idx
,
3553 static int nf_tables_dumpreset_rules(struct sk_buff
*skb
,
3554 struct netlink_callback
*cb
)
3556 struct nftables_pernet
*nft_net
= nft_pernet(sock_net(skb
->sk
));
3559 /* Mutex is held is to prevent that two concurrent dump-and-reset calls
3560 * do not underrun counters and quotas. The commit_mutex is used for
3561 * the lack a better lock, this is not transaction path.
3563 mutex_lock(&nft_net
->commit_mutex
);
3564 ret
= nf_tables_dump_rules(skb
, cb
);
3565 mutex_unlock(&nft_net
->commit_mutex
);
3570 static int nf_tables_dump_rules_start(struct netlink_callback
*cb
)
3572 struct nft_rule_dump_ctx
*ctx
= (void *)cb
->ctx
;
3573 const struct nlattr
* const *nla
= cb
->data
;
3575 BUILD_BUG_ON(sizeof(*ctx
) > sizeof(cb
->ctx
));
3577 if (nla
[NFTA_RULE_TABLE
]) {
3578 ctx
->table
= nla_strdup(nla
[NFTA_RULE_TABLE
], GFP_ATOMIC
);
3582 if (nla
[NFTA_RULE_CHAIN
]) {
3583 ctx
->chain
= nla_strdup(nla
[NFTA_RULE_CHAIN
], GFP_ATOMIC
);
3592 static int nf_tables_dumpreset_rules_start(struct netlink_callback
*cb
)
3594 struct nft_rule_dump_ctx
*ctx
= (void *)cb
->ctx
;
3598 return nf_tables_dump_rules_start(cb
);
3601 static int nf_tables_dump_rules_done(struct netlink_callback
*cb
)
3603 struct nft_rule_dump_ctx
*ctx
= (void *)cb
->ctx
;
3610 /* called with rcu_read_lock held */
3611 static struct sk_buff
*
3612 nf_tables_getrule_single(u32 portid
, const struct nfnl_info
*info
,
3613 const struct nlattr
* const nla
[], bool reset
)
3615 struct netlink_ext_ack
*extack
= info
->extack
;
3616 u8 genmask
= nft_genmask_cur(info
->net
);
3617 u8 family
= info
->nfmsg
->nfgen_family
;
3618 const struct nft_chain
*chain
;
3619 const struct nft_rule
*rule
;
3620 struct net
*net
= info
->net
;
3621 struct nft_table
*table
;
3622 struct sk_buff
*skb2
;
3625 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
, 0);
3626 if (IS_ERR(table
)) {
3627 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3628 return ERR_CAST(table
);
3631 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
], genmask
);
3632 if (IS_ERR(chain
)) {
3633 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3634 return ERR_CAST(chain
);
3637 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
3639 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3640 return ERR_CAST(rule
);
3643 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
3645 return ERR_PTR(-ENOMEM
);
3647 err
= nf_tables_fill_rule_info(skb2
, net
, portid
,
3648 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWRULE
, 0,
3649 family
, table
, chain
, rule
, 0, reset
);
3652 return ERR_PTR(err
);
3658 static int nf_tables_getrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3659 const struct nlattr
* const nla
[])
3661 u32 portid
= NETLINK_CB(skb
).portid
;
3662 struct net
*net
= info
->net
;
3663 struct sk_buff
*skb2
;
3665 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3666 struct netlink_dump_control c
= {
3667 .start
= nf_tables_dump_rules_start
,
3668 .dump
= nf_tables_dump_rules
,
3669 .done
= nf_tables_dump_rules_done
,
3670 .module
= THIS_MODULE
,
3671 .data
= (void *)nla
,
3674 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
3677 skb2
= nf_tables_getrule_single(portid
, info
, nla
, false);
3679 return PTR_ERR(skb2
);
3681 return nfnetlink_unicast(skb2
, net
, portid
);
3684 static int nf_tables_getrule_reset(struct sk_buff
*skb
,
3685 const struct nfnl_info
*info
,
3686 const struct nlattr
* const nla
[])
3688 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
3689 u32 portid
= NETLINK_CB(skb
).portid
;
3690 struct net
*net
= info
->net
;
3691 struct sk_buff
*skb2
;
3694 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3695 struct netlink_dump_control c
= {
3696 .start
= nf_tables_dumpreset_rules_start
,
3697 .dump
= nf_tables_dumpreset_rules
,
3698 .done
= nf_tables_dump_rules_done
,
3699 .module
= THIS_MODULE
,
3700 .data
= (void *)nla
,
3703 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
3706 if (!try_module_get(THIS_MODULE
))
3709 mutex_lock(&nft_net
->commit_mutex
);
3710 skb2
= nf_tables_getrule_single(portid
, info
, nla
, true);
3711 mutex_unlock(&nft_net
->commit_mutex
);
3713 module_put(THIS_MODULE
);
3716 return PTR_ERR(skb2
);
3718 buf
= kasprintf(GFP_ATOMIC
, "%.*s:%u",
3719 nla_len(nla
[NFTA_RULE_TABLE
]),
3720 (char *)nla_data(nla
[NFTA_RULE_TABLE
]),
3722 audit_log_nfcfg(buf
, info
->nfmsg
->nfgen_family
, 1,
3723 AUDIT_NFT_OP_RULE_RESET
, GFP_ATOMIC
);
3726 return nfnetlink_unicast(skb2
, net
, portid
);
3729 void nf_tables_rule_destroy(const struct nft_ctx
*ctx
, struct nft_rule
*rule
)
3731 struct nft_expr
*expr
, *next
;
3734 * Careful: some expressions might not be initialized in case this
3735 * is called on error from nf_tables_newrule().
3737 expr
= nft_expr_first(rule
);
3738 while (nft_expr_more(rule
, expr
)) {
3739 next
= nft_expr_next(expr
);
3740 nf_tables_expr_destroy(ctx
, expr
);
3746 static void nf_tables_rule_release(const struct nft_ctx
*ctx
, struct nft_rule
*rule
)
3748 nft_rule_expr_deactivate(ctx
, rule
, NFT_TRANS_RELEASE
);
3749 nf_tables_rule_destroy(ctx
, rule
);
3752 int nft_chain_validate(const struct nft_ctx
*ctx
, const struct nft_chain
*chain
)
3754 struct nft_expr
*expr
, *last
;
3755 const struct nft_data
*data
;
3756 struct nft_rule
*rule
;
3759 if (ctx
->level
== NFT_JUMP_STACK_SIZE
)
3762 list_for_each_entry(rule
, &chain
->rules
, list
) {
3763 if (fatal_signal_pending(current
))
3766 if (!nft_is_active_next(ctx
->net
, rule
))
3769 nft_rule_for_each_expr(expr
, last
, rule
) {
3770 if (!expr
->ops
->validate
)
3773 err
= expr
->ops
->validate(ctx
, expr
, &data
);
3781 EXPORT_SYMBOL_GPL(nft_chain_validate
);
3783 static int nft_table_validate(struct net
*net
, const struct nft_table
*table
)
3785 struct nft_chain
*chain
;
3786 struct nft_ctx ctx
= {
3788 .family
= table
->family
,
3792 list_for_each_entry(chain
, &table
->chains
, list
) {
3793 if (!nft_is_base_chain(chain
))
3797 err
= nft_chain_validate(&ctx
, chain
);
3807 int nft_setelem_validate(const struct nft_ctx
*ctx
, struct nft_set
*set
,
3808 const struct nft_set_iter
*iter
,
3809 struct nft_elem_priv
*elem_priv
)
3811 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
3812 struct nft_ctx
*pctx
= (struct nft_ctx
*)ctx
;
3813 const struct nft_data
*data
;
3816 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
3817 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_INTERVAL_END
)
3820 data
= nft_set_ext_data(ext
);
3821 switch (data
->verdict
.code
) {
3825 err
= nft_chain_validate(ctx
, data
->verdict
.chain
);
3837 int nft_set_catchall_validate(const struct nft_ctx
*ctx
, struct nft_set
*set
)
3839 u8 genmask
= nft_genmask_next(ctx
->net
);
3840 struct nft_set_elem_catchall
*catchall
;
3841 struct nft_set_ext
*ext
;
3844 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
3845 ext
= nft_set_elem_ext(set
, catchall
->elem
);
3846 if (!nft_set_elem_active(ext
, genmask
))
3849 ret
= nft_setelem_validate(ctx
, set
, NULL
, catchall
->elem
);
3857 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
3858 const struct nft_chain
*chain
,
3859 const struct nlattr
*nla
);
3861 #define NFT_RULE_MAXEXPRS 128
3863 static int nf_tables_newrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
3864 const struct nlattr
* const nla
[])
3866 struct nftables_pernet
*nft_net
= nft_pernet(info
->net
);
3867 struct netlink_ext_ack
*extack
= info
->extack
;
3868 unsigned int size
, i
, n
, ulen
= 0, usize
= 0;
3869 u8 genmask
= nft_genmask_next(info
->net
);
3870 struct nft_rule
*rule
, *old_rule
= NULL
;
3871 struct nft_expr_info
*expr_info
= NULL
;
3872 u8 family
= info
->nfmsg
->nfgen_family
;
3873 struct nft_flow_rule
*flow
= NULL
;
3874 struct net
*net
= info
->net
;
3875 struct nft_userdata
*udata
;
3876 struct nft_table
*table
;
3877 struct nft_chain
*chain
;
3878 struct nft_trans
*trans
;
3879 u64 handle
, pos_handle
;
3880 struct nft_expr
*expr
;
3885 lockdep_assert_held(&nft_net
->commit_mutex
);
3887 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
3888 NETLINK_CB(skb
).portid
);
3889 if (IS_ERR(table
)) {
3890 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
3891 return PTR_ERR(table
);
3894 if (nla
[NFTA_RULE_CHAIN
]) {
3895 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
3897 if (IS_ERR(chain
)) {
3898 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
3899 return PTR_ERR(chain
);
3902 } else if (nla
[NFTA_RULE_CHAIN_ID
]) {
3903 chain
= nft_chain_lookup_byid(net
, table
, nla
[NFTA_RULE_CHAIN_ID
],
3905 if (IS_ERR(chain
)) {
3906 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN_ID
]);
3907 return PTR_ERR(chain
);
3913 if (nft_chain_is_bound(chain
))
3916 if (nla
[NFTA_RULE_HANDLE
]) {
3917 handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_HANDLE
]));
3918 rule
= __nft_rule_lookup(chain
, handle
);
3920 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3921 return PTR_ERR(rule
);
3924 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
3925 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
3928 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3933 if (!(info
->nlh
->nlmsg_flags
& NLM_F_CREATE
) ||
3934 info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
3936 handle
= nf_tables_alloc_handle(table
);
3938 if (nla
[NFTA_RULE_POSITION
]) {
3939 pos_handle
= be64_to_cpu(nla_get_be64(nla
[NFTA_RULE_POSITION
]));
3940 old_rule
= __nft_rule_lookup(chain
, pos_handle
);
3941 if (IS_ERR(old_rule
)) {
3942 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION
]);
3943 return PTR_ERR(old_rule
);
3945 } else if (nla
[NFTA_RULE_POSITION_ID
]) {
3946 old_rule
= nft_rule_lookup_byid(net
, chain
, nla
[NFTA_RULE_POSITION_ID
]);
3947 if (IS_ERR(old_rule
)) {
3948 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_POSITION_ID
]);
3949 return PTR_ERR(old_rule
);
3954 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
3958 if (nla
[NFTA_RULE_EXPRESSIONS
]) {
3959 expr_info
= kvmalloc_array(NFT_RULE_MAXEXPRS
,
3960 sizeof(struct nft_expr_info
),
3965 nla_for_each_nested(tmp
, nla
[NFTA_RULE_EXPRESSIONS
], rem
) {
3967 if (nla_type(tmp
) != NFTA_LIST_ELEM
)
3968 goto err_release_expr
;
3969 if (n
== NFT_RULE_MAXEXPRS
)
3970 goto err_release_expr
;
3971 err
= nf_tables_expr_parse(&ctx
, tmp
, &expr_info
[n
]);
3973 NL_SET_BAD_ATTR(extack
, tmp
);
3974 goto err_release_expr
;
3976 size
+= expr_info
[n
].ops
->size
;
3980 /* Check for overflow of dlen field */
3982 if (size
>= 1 << 12)
3983 goto err_release_expr
;
3985 if (nla
[NFTA_RULE_USERDATA
]) {
3986 ulen
= nla_len(nla
[NFTA_RULE_USERDATA
]);
3988 usize
= sizeof(struct nft_userdata
) + ulen
;
3992 rule
= kzalloc(sizeof(*rule
) + size
+ usize
, GFP_KERNEL_ACCOUNT
);
3994 goto err_release_expr
;
3996 nft_activate_next(net
, rule
);
3998 rule
->handle
= handle
;
4000 rule
->udata
= ulen
? 1 : 0;
4003 udata
= nft_userdata(rule
);
4004 udata
->len
= ulen
- 1;
4005 nla_memcpy(udata
->data
, nla
[NFTA_RULE_USERDATA
], ulen
);
4008 expr
= nft_expr_first(rule
);
4009 for (i
= 0; i
< n
; i
++) {
4010 err
= nf_tables_newexpr(&ctx
, &expr_info
[i
], expr
);
4012 NL_SET_BAD_ATTR(extack
, expr_info
[i
].attr
);
4013 goto err_release_rule
;
4016 if (expr_info
[i
].ops
->validate
)
4017 nft_validate_state_update(table
, NFT_VALIDATE_NEED
);
4019 expr_info
[i
].ops
= NULL
;
4020 expr
= nft_expr_next(expr
);
4023 if (chain
->flags
& NFT_CHAIN_HW_OFFLOAD
) {
4024 flow
= nft_flow_rule_create(net
, rule
);
4026 err
= PTR_ERR(flow
);
4027 goto err_release_rule
;
4031 if (!nft_use_inc(&chain
->use
)) {
4033 goto err_release_rule
;
4036 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
) {
4037 if (nft_chain_binding(chain
)) {
4039 goto err_destroy_flow_rule
;
4042 err
= nft_delrule(&ctx
, old_rule
);
4044 goto err_destroy_flow_rule
;
4046 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
4047 if (trans
== NULL
) {
4049 goto err_destroy_flow_rule
;
4051 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
4053 trans
= nft_trans_rule_add(&ctx
, NFT_MSG_NEWRULE
, rule
);
4056 goto err_destroy_flow_rule
;
4059 if (info
->nlh
->nlmsg_flags
& NLM_F_APPEND
) {
4061 list_add_rcu(&rule
->list
, &old_rule
->list
);
4063 list_add_tail_rcu(&rule
->list
, &chain
->rules
);
4066 list_add_tail_rcu(&rule
->list
, &old_rule
->list
);
4068 list_add_rcu(&rule
->list
, &chain
->rules
);
4074 nft_trans_flow_rule(trans
) = flow
;
4076 if (table
->validate_state
== NFT_VALIDATE_DO
)
4077 return nft_table_validate(net
, table
);
4081 err_destroy_flow_rule
:
4082 nft_use_dec_restore(&chain
->use
);
4084 nft_flow_rule_destroy(flow
);
4086 nft_rule_expr_deactivate(&ctx
, rule
, NFT_TRANS_PREPARE_ERROR
);
4087 nf_tables_rule_destroy(&ctx
, rule
);
4089 for (i
= 0; i
< n
; i
++) {
4090 if (expr_info
[i
].ops
) {
4091 module_put(expr_info
[i
].ops
->type
->owner
);
4092 if (expr_info
[i
].ops
->type
->release_ops
)
4093 expr_info
[i
].ops
->type
->release_ops(expr_info
[i
].ops
);
4101 static struct nft_rule
*nft_rule_lookup_byid(const struct net
*net
,
4102 const struct nft_chain
*chain
,
4103 const struct nlattr
*nla
)
4105 struct nftables_pernet
*nft_net
= nft_pernet(net
);
4106 u32 id
= ntohl(nla_get_be32(nla
));
4107 struct nft_trans
*trans
;
4109 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
4110 if (trans
->msg_type
== NFT_MSG_NEWRULE
&&
4111 trans
->ctx
.chain
== chain
&&
4112 id
== nft_trans_rule_id(trans
))
4113 return nft_trans_rule(trans
);
4115 return ERR_PTR(-ENOENT
);
4118 static int nf_tables_delrule(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4119 const struct nlattr
* const nla
[])
4121 struct netlink_ext_ack
*extack
= info
->extack
;
4122 u8 genmask
= nft_genmask_next(info
->net
);
4123 u8 family
= info
->nfmsg
->nfgen_family
;
4124 struct nft_chain
*chain
= NULL
;
4125 struct net
*net
= info
->net
;
4126 struct nft_table
*table
;
4127 struct nft_rule
*rule
;
4131 table
= nft_table_lookup(net
, nla
[NFTA_RULE_TABLE
], family
, genmask
,
4132 NETLINK_CB(skb
).portid
);
4133 if (IS_ERR(table
)) {
4134 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_TABLE
]);
4135 return PTR_ERR(table
);
4138 if (nla
[NFTA_RULE_CHAIN
]) {
4139 chain
= nft_chain_lookup(net
, table
, nla
[NFTA_RULE_CHAIN
],
4141 if (IS_ERR(chain
)) {
4142 if (PTR_ERR(chain
) == -ENOENT
&&
4143 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYRULE
)
4146 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_CHAIN
]);
4147 return PTR_ERR(chain
);
4149 if (nft_chain_binding(chain
))
4153 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, chain
, nla
);
4156 if (nla
[NFTA_RULE_HANDLE
]) {
4157 rule
= nft_rule_lookup(chain
, nla
[NFTA_RULE_HANDLE
]);
4159 if (PTR_ERR(rule
) == -ENOENT
&&
4160 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYRULE
)
4163 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_HANDLE
]);
4164 return PTR_ERR(rule
);
4167 err
= nft_delrule(&ctx
, rule
);
4168 } else if (nla
[NFTA_RULE_ID
]) {
4169 rule
= nft_rule_lookup_byid(net
, chain
, nla
[NFTA_RULE_ID
]);
4171 NL_SET_BAD_ATTR(extack
, nla
[NFTA_RULE_ID
]);
4172 return PTR_ERR(rule
);
4175 err
= nft_delrule(&ctx
, rule
);
4177 err
= nft_delrule_by_chain(&ctx
);
4180 list_for_each_entry(chain
, &table
->chains
, list
) {
4181 if (!nft_is_active_next(net
, chain
))
4183 if (nft_chain_binding(chain
))
4187 err
= nft_delrule_by_chain(&ctx
);
4199 static const struct nft_set_type
*nft_set_types
[] = {
4200 &nft_set_hash_fast_type
,
4202 &nft_set_rhash_type
,
4203 &nft_set_bitmap_type
,
4204 &nft_set_rbtree_type
,
4205 #if defined(CONFIG_X86_64) && !defined(CONFIG_UML)
4206 &nft_set_pipapo_avx2_type
,
4208 &nft_set_pipapo_type
,
4211 #define NFT_SET_FEATURES (NFT_SET_INTERVAL | NFT_SET_MAP | \
4212 NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
4215 static bool nft_set_ops_candidate(const struct nft_set_type
*type
, u32 flags
)
4217 return (flags
& type
->features
) == (flags
& NFT_SET_FEATURES
);
4221 * Select a set implementation based on the data characteristics and the
4222 * given policy. The total memory use might not be known if no size is
4223 * given, in that case the amount of memory per element is used.
4225 static const struct nft_set_ops
*
4226 nft_select_set_ops(const struct nft_ctx
*ctx
,
4227 const struct nlattr
* const nla
[],
4228 const struct nft_set_desc
*desc
)
4230 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
4231 const struct nft_set_ops
*ops
, *bops
;
4232 struct nft_set_estimate est
, best
;
4233 const struct nft_set_type
*type
;
4237 lockdep_assert_held(&nft_net
->commit_mutex
);
4238 lockdep_nfnl_nft_mutex_not_held();
4240 if (nla
[NFTA_SET_FLAGS
] != NULL
)
4241 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
4248 for (i
= 0; i
< ARRAY_SIZE(nft_set_types
); i
++) {
4249 type
= nft_set_types
[i
];
4252 if (!nft_set_ops_candidate(type
, flags
))
4254 if (!ops
->estimate(desc
, flags
, &est
))
4257 switch (desc
->policy
) {
4258 case NFT_SET_POL_PERFORMANCE
:
4259 if (est
.lookup
< best
.lookup
)
4261 if (est
.lookup
== best
.lookup
&&
4262 est
.space
< best
.space
)
4265 case NFT_SET_POL_MEMORY
:
4267 if (est
.space
< best
.space
)
4269 if (est
.space
== best
.space
&&
4270 est
.lookup
< best
.lookup
)
4272 } else if (est
.size
< best
.size
|| !bops
) {
4287 return ERR_PTR(-EOPNOTSUPP
);
4290 static const struct nla_policy nft_set_policy
[NFTA_SET_MAX
+ 1] = {
4291 [NFTA_SET_TABLE
] = { .type
= NLA_STRING
,
4292 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
4293 [NFTA_SET_NAME
] = { .type
= NLA_STRING
,
4294 .len
= NFT_SET_MAXNAMELEN
- 1 },
4295 [NFTA_SET_FLAGS
] = { .type
= NLA_U32
},
4296 [NFTA_SET_KEY_TYPE
] = { .type
= NLA_U32
},
4297 [NFTA_SET_KEY_LEN
] = { .type
= NLA_U32
},
4298 [NFTA_SET_DATA_TYPE
] = { .type
= NLA_U32
},
4299 [NFTA_SET_DATA_LEN
] = { .type
= NLA_U32
},
4300 [NFTA_SET_POLICY
] = { .type
= NLA_U32
},
4301 [NFTA_SET_DESC
] = { .type
= NLA_NESTED
},
4302 [NFTA_SET_ID
] = { .type
= NLA_U32
},
4303 [NFTA_SET_TIMEOUT
] = { .type
= NLA_U64
},
4304 [NFTA_SET_GC_INTERVAL
] = { .type
= NLA_U32
},
4305 [NFTA_SET_USERDATA
] = { .type
= NLA_BINARY
,
4306 .len
= NFT_USERDATA_MAXLEN
},
4307 [NFTA_SET_OBJ_TYPE
] = { .type
= NLA_U32
},
4308 [NFTA_SET_HANDLE
] = { .type
= NLA_U64
},
4309 [NFTA_SET_EXPR
] = { .type
= NLA_NESTED
},
4310 [NFTA_SET_EXPRESSIONS
] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy
),
4313 static const struct nla_policy nft_concat_policy
[NFTA_SET_FIELD_MAX
+ 1] = {
4314 [NFTA_SET_FIELD_LEN
] = { .type
= NLA_U32
},
4317 static const struct nla_policy nft_set_desc_policy
[NFTA_SET_DESC_MAX
+ 1] = {
4318 [NFTA_SET_DESC_SIZE
] = { .type
= NLA_U32
},
4319 [NFTA_SET_DESC_CONCAT
] = NLA_POLICY_NESTED_ARRAY(nft_concat_policy
),
4322 static struct nft_set
*nft_set_lookup(const struct nft_table
*table
,
4323 const struct nlattr
*nla
, u8 genmask
)
4325 struct nft_set
*set
;
4328 return ERR_PTR(-EINVAL
);
4330 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
4331 if (!nla_strcmp(nla
, set
->name
) &&
4332 nft_active_genmask(set
, genmask
))
4335 return ERR_PTR(-ENOENT
);
4338 static struct nft_set
*nft_set_lookup_byhandle(const struct nft_table
*table
,
4339 const struct nlattr
*nla
,
4342 struct nft_set
*set
;
4344 list_for_each_entry(set
, &table
->sets
, list
) {
4345 if (be64_to_cpu(nla_get_be64(nla
)) == set
->handle
&&
4346 nft_active_genmask(set
, genmask
))
4349 return ERR_PTR(-ENOENT
);
4352 static struct nft_set
*nft_set_lookup_byid(const struct net
*net
,
4353 const struct nft_table
*table
,
4354 const struct nlattr
*nla
, u8 genmask
)
4356 struct nftables_pernet
*nft_net
= nft_pernet(net
);
4357 u32 id
= ntohl(nla_get_be32(nla
));
4358 struct nft_trans
*trans
;
4360 list_for_each_entry(trans
, &nft_net
->commit_list
, list
) {
4361 if (trans
->msg_type
== NFT_MSG_NEWSET
) {
4362 struct nft_set
*set
= nft_trans_set(trans
);
4364 if (id
== nft_trans_set_id(trans
) &&
4365 set
->table
== table
&&
4366 nft_active_genmask(set
, genmask
))
4370 return ERR_PTR(-ENOENT
);
4373 struct nft_set
*nft_set_lookup_global(const struct net
*net
,
4374 const struct nft_table
*table
,
4375 const struct nlattr
*nla_set_name
,
4376 const struct nlattr
*nla_set_id
,
4379 struct nft_set
*set
;
4381 set
= nft_set_lookup(table
, nla_set_name
, genmask
);
4386 set
= nft_set_lookup_byid(net
, table
, nla_set_id
, genmask
);
4390 EXPORT_SYMBOL_GPL(nft_set_lookup_global
);
4392 static int nf_tables_set_alloc_name(struct nft_ctx
*ctx
, struct nft_set
*set
,
4395 const struct nft_set
*i
;
4397 unsigned long *inuse
;
4398 unsigned int n
= 0, min
= 0;
4400 p
= strchr(name
, '%');
4402 if (p
[1] != 'd' || strchr(p
+ 2, '%'))
4405 inuse
= (unsigned long *)get_zeroed_page(GFP_KERNEL
);
4409 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
4412 if (!nft_is_active_next(ctx
->net
, i
))
4414 if (!sscanf(i
->name
, name
, &tmp
))
4416 if (tmp
< min
|| tmp
>= min
+ BITS_PER_BYTE
* PAGE_SIZE
)
4419 set_bit(tmp
- min
, inuse
);
4422 n
= find_first_zero_bit(inuse
, BITS_PER_BYTE
* PAGE_SIZE
);
4423 if (n
>= BITS_PER_BYTE
* PAGE_SIZE
) {
4424 min
+= BITS_PER_BYTE
* PAGE_SIZE
;
4425 memset(inuse
, 0, PAGE_SIZE
);
4428 free_page((unsigned long)inuse
);
4431 set
->name
= kasprintf(GFP_KERNEL_ACCOUNT
, name
, min
+ n
);
4435 list_for_each_entry(i
, &ctx
->table
->sets
, list
) {
4436 if (!nft_is_active_next(ctx
->net
, i
))
4438 if (!strcmp(set
->name
, i
->name
)) {
4447 int nf_msecs_to_jiffies64(const struct nlattr
*nla
, u64
*result
)
4449 u64 ms
= be64_to_cpu(nla_get_be64(nla
));
4450 u64 max
= (u64
)(~((u64
)0));
4452 max
= div_u64(max
, NSEC_PER_MSEC
);
4456 ms
*= NSEC_PER_MSEC
;
4457 *result
= nsecs_to_jiffies64(ms
);
4461 __be64
nf_jiffies64_to_msecs(u64 input
)
4463 return cpu_to_be64(jiffies64_to_msecs(input
));
4466 static int nf_tables_fill_set_concat(struct sk_buff
*skb
,
4467 const struct nft_set
*set
)
4469 struct nlattr
*concat
, *field
;
4472 concat
= nla_nest_start_noflag(skb
, NFTA_SET_DESC_CONCAT
);
4476 for (i
= 0; i
< set
->field_count
; i
++) {
4477 field
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
4481 if (nla_put_be32(skb
, NFTA_SET_FIELD_LEN
,
4482 htonl(set
->field_len
[i
])))
4485 nla_nest_end(skb
, field
);
4488 nla_nest_end(skb
, concat
);
4493 static int nf_tables_fill_set(struct sk_buff
*skb
, const struct nft_ctx
*ctx
,
4494 const struct nft_set
*set
, u16 event
, u16 flags
)
4496 u64 timeout
= READ_ONCE(set
->timeout
);
4497 u32 gc_int
= READ_ONCE(set
->gc_int
);
4498 u32 portid
= ctx
->portid
;
4499 struct nlmsghdr
*nlh
;
4500 struct nlattr
*nest
;
4504 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
4505 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, ctx
->family
,
4506 NFNETLINK_V0
, nft_base_seq(ctx
->net
));
4508 goto nla_put_failure
;
4510 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
4511 goto nla_put_failure
;
4512 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
4513 goto nla_put_failure
;
4514 if (nla_put_be64(skb
, NFTA_SET_HANDLE
, cpu_to_be64(set
->handle
),
4516 goto nla_put_failure
;
4518 if (event
== NFT_MSG_DELSET
) {
4519 nlmsg_end(skb
, nlh
);
4523 if (set
->flags
!= 0)
4524 if (nla_put_be32(skb
, NFTA_SET_FLAGS
, htonl(set
->flags
)))
4525 goto nla_put_failure
;
4527 if (nla_put_be32(skb
, NFTA_SET_KEY_TYPE
, htonl(set
->ktype
)))
4528 goto nla_put_failure
;
4529 if (nla_put_be32(skb
, NFTA_SET_KEY_LEN
, htonl(set
->klen
)))
4530 goto nla_put_failure
;
4531 if (set
->flags
& NFT_SET_MAP
) {
4532 if (nla_put_be32(skb
, NFTA_SET_DATA_TYPE
, htonl(set
->dtype
)))
4533 goto nla_put_failure
;
4534 if (nla_put_be32(skb
, NFTA_SET_DATA_LEN
, htonl(set
->dlen
)))
4535 goto nla_put_failure
;
4537 if (set
->flags
& NFT_SET_OBJECT
&&
4538 nla_put_be32(skb
, NFTA_SET_OBJ_TYPE
, htonl(set
->objtype
)))
4539 goto nla_put_failure
;
4542 nla_put_be64(skb
, NFTA_SET_TIMEOUT
,
4543 nf_jiffies64_to_msecs(timeout
),
4545 goto nla_put_failure
;
4547 nla_put_be32(skb
, NFTA_SET_GC_INTERVAL
, htonl(gc_int
)))
4548 goto nla_put_failure
;
4550 if (set
->policy
!= NFT_SET_POL_PERFORMANCE
) {
4551 if (nla_put_be32(skb
, NFTA_SET_POLICY
, htonl(set
->policy
)))
4552 goto nla_put_failure
;
4556 nla_put(skb
, NFTA_SET_USERDATA
, set
->udlen
, set
->udata
))
4557 goto nla_put_failure
;
4559 nest
= nla_nest_start_noflag(skb
, NFTA_SET_DESC
);
4561 goto nla_put_failure
;
4563 nla_put_be32(skb
, NFTA_SET_DESC_SIZE
, htonl(set
->size
)))
4564 goto nla_put_failure
;
4566 if (set
->field_count
> 1 &&
4567 nf_tables_fill_set_concat(skb
, set
))
4568 goto nla_put_failure
;
4570 nla_nest_end(skb
, nest
);
4572 if (set
->num_exprs
== 1) {
4573 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPR
);
4574 if (nf_tables_fill_expr_info(skb
, set
->exprs
[0], false) < 0)
4575 goto nla_put_failure
;
4577 nla_nest_end(skb
, nest
);
4578 } else if (set
->num_exprs
> 1) {
4579 nest
= nla_nest_start_noflag(skb
, NFTA_SET_EXPRESSIONS
);
4581 goto nla_put_failure
;
4583 for (i
= 0; i
< set
->num_exprs
; i
++) {
4584 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
,
4585 set
->exprs
[i
], false) < 0)
4586 goto nla_put_failure
;
4588 nla_nest_end(skb
, nest
);
4591 nlmsg_end(skb
, nlh
);
4595 nlmsg_trim(skb
, nlh
);
4599 static void nf_tables_set_notify(const struct nft_ctx
*ctx
,
4600 const struct nft_set
*set
, int event
,
4603 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
4604 u32 portid
= ctx
->portid
;
4605 struct sk_buff
*skb
;
4610 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
4613 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp_flags
);
4617 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
4618 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
4620 err
= nf_tables_fill_set(skb
, ctx
, set
, event
, flags
);
4626 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
4629 nfnetlink_set_err(ctx
->net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
4632 static int nf_tables_dump_sets(struct sk_buff
*skb
, struct netlink_callback
*cb
)
4634 const struct nft_set
*set
;
4635 unsigned int idx
, s_idx
= cb
->args
[0];
4636 struct nft_table
*table
, *cur_table
= (struct nft_table
*)cb
->args
[2];
4637 struct net
*net
= sock_net(skb
->sk
);
4638 struct nft_ctx
*ctx
= cb
->data
, ctx_set
;
4639 struct nftables_pernet
*nft_net
;
4645 nft_net
= nft_pernet(net
);
4646 cb
->seq
= READ_ONCE(nft_net
->base_seq
);
4648 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
4649 if (ctx
->family
!= NFPROTO_UNSPEC
&&
4650 ctx
->family
!= table
->family
)
4653 if (ctx
->table
&& ctx
->table
!= table
)
4657 if (cur_table
!= table
)
4663 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
4666 if (!nft_is_active(net
, set
))
4670 ctx_set
.table
= table
;
4671 ctx_set
.family
= table
->family
;
4673 if (nf_tables_fill_set(skb
, &ctx_set
, set
,
4677 cb
->args
[2] = (unsigned long) table
;
4680 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
4693 static int nf_tables_dump_sets_start(struct netlink_callback
*cb
)
4695 struct nft_ctx
*ctx_dump
= NULL
;
4697 ctx_dump
= kmemdup(cb
->data
, sizeof(*ctx_dump
), GFP_ATOMIC
);
4698 if (ctx_dump
== NULL
)
4701 cb
->data
= ctx_dump
;
4705 static int nf_tables_dump_sets_done(struct netlink_callback
*cb
)
4711 /* called with rcu_read_lock held */
4712 static int nf_tables_getset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4713 const struct nlattr
* const nla
[])
4715 struct netlink_ext_ack
*extack
= info
->extack
;
4716 u8 genmask
= nft_genmask_cur(info
->net
);
4717 u8 family
= info
->nfmsg
->nfgen_family
;
4718 struct nft_table
*table
= NULL
;
4719 struct net
*net
= info
->net
;
4720 const struct nft_set
*set
;
4721 struct sk_buff
*skb2
;
4725 if (nla
[NFTA_SET_TABLE
]) {
4726 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
,
4728 if (IS_ERR(table
)) {
4729 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
4730 return PTR_ERR(table
);
4734 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
4736 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
4737 struct netlink_dump_control c
= {
4738 .start
= nf_tables_dump_sets_start
,
4739 .dump
= nf_tables_dump_sets
,
4740 .done
= nf_tables_dump_sets_done
,
4742 .module
= THIS_MODULE
,
4745 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
4748 /* Only accept unspec with dump */
4749 if (info
->nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
4750 return -EAFNOSUPPORT
;
4751 if (!nla
[NFTA_SET_TABLE
])
4754 set
= nft_set_lookup(table
, nla
[NFTA_SET_NAME
], genmask
);
4756 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
4757 return PTR_ERR(set
);
4760 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
4764 err
= nf_tables_fill_set(skb2
, &ctx
, set
, NFT_MSG_NEWSET
, 0);
4766 goto err_fill_set_info
;
4768 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
4775 static int nft_set_desc_concat_parse(const struct nlattr
*attr
,
4776 struct nft_set_desc
*desc
)
4778 struct nlattr
*tb
[NFTA_SET_FIELD_MAX
+ 1];
4782 if (desc
->field_count
>= ARRAY_SIZE(desc
->field_len
))
4785 err
= nla_parse_nested_deprecated(tb
, NFTA_SET_FIELD_MAX
, attr
,
4786 nft_concat_policy
, NULL
);
4790 if (!tb
[NFTA_SET_FIELD_LEN
])
4793 len
= ntohl(nla_get_be32(tb
[NFTA_SET_FIELD_LEN
]));
4794 if (!len
|| len
> U8_MAX
)
4797 desc
->field_len
[desc
->field_count
++] = len
;
4802 static int nft_set_desc_concat(struct nft_set_desc
*desc
,
4803 const struct nlattr
*nla
)
4805 struct nlattr
*attr
;
4809 nla_for_each_nested(attr
, nla
, rem
) {
4810 if (nla_type(attr
) != NFTA_LIST_ELEM
)
4813 err
= nft_set_desc_concat_parse(attr
, desc
);
4818 for (i
= 0; i
< desc
->field_count
; i
++)
4819 num_regs
+= DIV_ROUND_UP(desc
->field_len
[i
], sizeof(u32
));
4821 if (num_regs
> NFT_REG32_COUNT
)
4827 static int nf_tables_set_desc_parse(struct nft_set_desc
*desc
,
4828 const struct nlattr
*nla
)
4830 struct nlattr
*da
[NFTA_SET_DESC_MAX
+ 1];
4833 err
= nla_parse_nested_deprecated(da
, NFTA_SET_DESC_MAX
, nla
,
4834 nft_set_desc_policy
, NULL
);
4838 if (da
[NFTA_SET_DESC_SIZE
] != NULL
)
4839 desc
->size
= ntohl(nla_get_be32(da
[NFTA_SET_DESC_SIZE
]));
4840 if (da
[NFTA_SET_DESC_CONCAT
])
4841 err
= nft_set_desc_concat(desc
, da
[NFTA_SET_DESC_CONCAT
]);
4846 static int nft_set_expr_alloc(struct nft_ctx
*ctx
, struct nft_set
*set
,
4847 const struct nlattr
* const *nla
,
4848 struct nft_expr
**exprs
, int *num_exprs
,
4851 struct nft_expr
*expr
;
4854 if (nla
[NFTA_SET_EXPR
]) {
4855 expr
= nft_set_elem_expr_alloc(ctx
, set
, nla
[NFTA_SET_EXPR
]);
4857 err
= PTR_ERR(expr
);
4858 goto err_set_expr_alloc
;
4862 } else if (nla
[NFTA_SET_EXPRESSIONS
]) {
4866 if (!(flags
& NFT_SET_EXPR
)) {
4868 goto err_set_expr_alloc
;
4871 nla_for_each_nested(tmp
, nla
[NFTA_SET_EXPRESSIONS
], left
) {
4872 if (i
== NFT_SET_EXPR_MAX
) {
4874 goto err_set_expr_alloc
;
4876 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
4878 goto err_set_expr_alloc
;
4880 expr
= nft_set_elem_expr_alloc(ctx
, set
, tmp
);
4882 err
= PTR_ERR(expr
);
4883 goto err_set_expr_alloc
;
4893 for (i
= 0; i
< *num_exprs
; i
++)
4894 nft_expr_destroy(ctx
, exprs
[i
]);
4899 static bool nft_set_is_same(const struct nft_set
*set
,
4900 const struct nft_set_desc
*desc
,
4901 struct nft_expr
*exprs
[], u32 num_exprs
, u32 flags
)
4905 if (set
->ktype
!= desc
->ktype
||
4906 set
->dtype
!= desc
->dtype
||
4907 set
->flags
!= flags
||
4908 set
->klen
!= desc
->klen
||
4909 set
->dlen
!= desc
->dlen
||
4910 set
->field_count
!= desc
->field_count
||
4911 set
->num_exprs
!= num_exprs
)
4914 for (i
= 0; i
< desc
->field_count
; i
++) {
4915 if (set
->field_len
[i
] != desc
->field_len
[i
])
4919 for (i
= 0; i
< num_exprs
; i
++) {
4920 if (set
->exprs
[i
]->ops
!= exprs
[i
]->ops
)
4927 static int nf_tables_newset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
4928 const struct nlattr
* const nla
[])
4930 struct netlink_ext_ack
*extack
= info
->extack
;
4931 u8 genmask
= nft_genmask_next(info
->net
);
4932 u8 family
= info
->nfmsg
->nfgen_family
;
4933 const struct nft_set_ops
*ops
;
4934 struct net
*net
= info
->net
;
4935 struct nft_set_desc desc
;
4936 struct nft_table
*table
;
4937 unsigned char *udata
;
4938 struct nft_set
*set
;
4948 if (nla
[NFTA_SET_TABLE
] == NULL
||
4949 nla
[NFTA_SET_NAME
] == NULL
||
4950 nla
[NFTA_SET_KEY_LEN
] == NULL
||
4951 nla
[NFTA_SET_ID
] == NULL
)
4954 memset(&desc
, 0, sizeof(desc
));
4956 desc
.ktype
= NFT_DATA_VALUE
;
4957 if (nla
[NFTA_SET_KEY_TYPE
] != NULL
) {
4958 desc
.ktype
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_TYPE
]));
4959 if ((desc
.ktype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
)
4963 desc
.klen
= ntohl(nla_get_be32(nla
[NFTA_SET_KEY_LEN
]));
4964 if (desc
.klen
== 0 || desc
.klen
> NFT_DATA_VALUE_MAXLEN
)
4968 if (nla
[NFTA_SET_FLAGS
] != NULL
) {
4969 flags
= ntohl(nla_get_be32(nla
[NFTA_SET_FLAGS
]));
4970 if (flags
& ~(NFT_SET_ANONYMOUS
| NFT_SET_CONSTANT
|
4971 NFT_SET_INTERVAL
| NFT_SET_TIMEOUT
|
4972 NFT_SET_MAP
| NFT_SET_EVAL
|
4973 NFT_SET_OBJECT
| NFT_SET_CONCAT
| NFT_SET_EXPR
))
4975 /* Only one of these operations is supported */
4976 if ((flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
)) ==
4977 (NFT_SET_MAP
| NFT_SET_OBJECT
))
4979 if ((flags
& (NFT_SET_EVAL
| NFT_SET_OBJECT
)) ==
4980 (NFT_SET_EVAL
| NFT_SET_OBJECT
))
4985 if (nla
[NFTA_SET_DATA_TYPE
] != NULL
) {
4986 if (!(flags
& NFT_SET_MAP
))
4989 desc
.dtype
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_TYPE
]));
4990 if ((desc
.dtype
& NFT_DATA_RESERVED_MASK
) == NFT_DATA_RESERVED_MASK
&&
4991 desc
.dtype
!= NFT_DATA_VERDICT
)
4994 if (desc
.dtype
!= NFT_DATA_VERDICT
) {
4995 if (nla
[NFTA_SET_DATA_LEN
] == NULL
)
4997 desc
.dlen
= ntohl(nla_get_be32(nla
[NFTA_SET_DATA_LEN
]));
4998 if (desc
.dlen
== 0 || desc
.dlen
> NFT_DATA_VALUE_MAXLEN
)
5001 desc
.dlen
= sizeof(struct nft_verdict
);
5002 } else if (flags
& NFT_SET_MAP
)
5005 if (nla
[NFTA_SET_OBJ_TYPE
] != NULL
) {
5006 if (!(flags
& NFT_SET_OBJECT
))
5009 desc
.objtype
= ntohl(nla_get_be32(nla
[NFTA_SET_OBJ_TYPE
]));
5010 if (desc
.objtype
== NFT_OBJECT_UNSPEC
||
5011 desc
.objtype
> NFT_OBJECT_MAX
)
5013 } else if (flags
& NFT_SET_OBJECT
)
5016 desc
.objtype
= NFT_OBJECT_UNSPEC
;
5019 if (nla
[NFTA_SET_TIMEOUT
] != NULL
) {
5020 if (!(flags
& NFT_SET_TIMEOUT
))
5023 if (flags
& NFT_SET_ANONYMOUS
)
5026 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_TIMEOUT
], &desc
.timeout
);
5031 if (nla
[NFTA_SET_GC_INTERVAL
] != NULL
) {
5032 if (!(flags
& NFT_SET_TIMEOUT
))
5035 if (flags
& NFT_SET_ANONYMOUS
)
5038 desc
.gc_int
= ntohl(nla_get_be32(nla
[NFTA_SET_GC_INTERVAL
]));
5041 desc
.policy
= NFT_SET_POL_PERFORMANCE
;
5042 if (nla
[NFTA_SET_POLICY
] != NULL
)
5043 desc
.policy
= ntohl(nla_get_be32(nla
[NFTA_SET_POLICY
]));
5045 if (nla
[NFTA_SET_DESC
] != NULL
) {
5046 err
= nf_tables_set_desc_parse(&desc
, nla
[NFTA_SET_DESC
]);
5050 if (desc
.field_count
> 1 && !(flags
& NFT_SET_CONCAT
))
5052 } else if (flags
& NFT_SET_CONCAT
) {
5056 if (nla
[NFTA_SET_EXPR
] || nla
[NFTA_SET_EXPRESSIONS
])
5059 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
, genmask
,
5060 NETLINK_CB(skb
).portid
);
5061 if (IS_ERR(table
)) {
5062 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
5063 return PTR_ERR(table
);
5066 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
5068 set
= nft_set_lookup(table
, nla
[NFTA_SET_NAME
], genmask
);
5070 if (PTR_ERR(set
) != -ENOENT
) {
5071 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
5072 return PTR_ERR(set
);
5075 struct nft_expr
*exprs
[NFT_SET_EXPR_MAX
] = {};
5077 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
5078 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
5081 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
5084 if (nft_set_is_anonymous(set
))
5087 err
= nft_set_expr_alloc(&ctx
, set
, nla
, exprs
, &num_exprs
, flags
);
5092 if (!nft_set_is_same(set
, &desc
, exprs
, num_exprs
, flags
)) {
5093 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_NAME
]);
5097 for (i
= 0; i
< num_exprs
; i
++)
5098 nft_expr_destroy(&ctx
, exprs
[i
]);
5103 return __nft_trans_set_add(&ctx
, NFT_MSG_NEWSET
, set
, &desc
);
5106 if (!(info
->nlh
->nlmsg_flags
& NLM_F_CREATE
))
5109 ops
= nft_select_set_ops(&ctx
, nla
, &desc
);
5111 return PTR_ERR(ops
);
5114 if (nla
[NFTA_SET_USERDATA
])
5115 udlen
= nla_len(nla
[NFTA_SET_USERDATA
]);
5118 if (ops
->privsize
!= NULL
)
5119 size
= ops
->privsize(nla
, &desc
);
5120 alloc_size
= sizeof(*set
) + size
+ udlen
;
5121 if (alloc_size
< size
|| alloc_size
> INT_MAX
)
5124 if (!nft_use_inc(&table
->use
))
5127 set
= kvzalloc(alloc_size
, GFP_KERNEL_ACCOUNT
);
5133 name
= nla_strdup(nla
[NFTA_SET_NAME
], GFP_KERNEL_ACCOUNT
);
5139 err
= nf_tables_set_alloc_name(&ctx
, set
, name
);
5146 udata
= set
->data
+ size
;
5147 nla_memcpy(udata
, nla
[NFTA_SET_USERDATA
], udlen
);
5150 INIT_LIST_HEAD(&set
->bindings
);
5151 INIT_LIST_HEAD(&set
->catchall_list
);
5152 refcount_set(&set
->refs
, 1);
5154 write_pnet(&set
->net
, net
);
5156 set
->ktype
= desc
.ktype
;
5157 set
->klen
= desc
.klen
;
5158 set
->dtype
= desc
.dtype
;
5159 set
->objtype
= desc
.objtype
;
5160 set
->dlen
= desc
.dlen
;
5162 set
->size
= desc
.size
;
5163 set
->policy
= desc
.policy
;
5166 set
->timeout
= desc
.timeout
;
5167 set
->gc_int
= desc
.gc_int
;
5169 set
->field_count
= desc
.field_count
;
5170 for (i
= 0; i
< desc
.field_count
; i
++)
5171 set
->field_len
[i
] = desc
.field_len
[i
];
5173 err
= ops
->init(set
, &desc
, nla
);
5177 err
= nft_set_expr_alloc(&ctx
, set
, nla
, set
->exprs
, &num_exprs
, flags
);
5179 goto err_set_destroy
;
5181 set
->num_exprs
= num_exprs
;
5182 set
->handle
= nf_tables_alloc_handle(table
);
5183 INIT_LIST_HEAD(&set
->pending_update
);
5185 err
= nft_trans_set_add(&ctx
, NFT_MSG_NEWSET
, set
);
5187 goto err_set_expr_alloc
;
5189 list_add_tail_rcu(&set
->list
, &table
->sets
);
5194 for (i
= 0; i
< set
->num_exprs
; i
++)
5195 nft_expr_destroy(&ctx
, set
->exprs
[i
]);
5197 ops
->destroy(&ctx
, set
);
5203 nft_use_dec_restore(&table
->use
);
5208 static void nft_set_catchall_destroy(const struct nft_ctx
*ctx
,
5209 struct nft_set
*set
)
5211 struct nft_set_elem_catchall
*next
, *catchall
;
5213 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
5214 list_del_rcu(&catchall
->list
);
5215 nf_tables_set_elem_destroy(ctx
, set
, catchall
->elem
);
5216 kfree_rcu(catchall
, rcu
);
5220 static void nft_set_put(struct nft_set
*set
)
5222 if (refcount_dec_and_test(&set
->refs
)) {
5228 static void nft_set_destroy(const struct nft_ctx
*ctx
, struct nft_set
*set
)
5232 if (WARN_ON(set
->use
> 0))
5235 for (i
= 0; i
< set
->num_exprs
; i
++)
5236 nft_expr_destroy(ctx
, set
->exprs
[i
]);
5238 set
->ops
->destroy(ctx
, set
);
5239 nft_set_catchall_destroy(ctx
, set
);
5243 static int nf_tables_delset(struct sk_buff
*skb
, const struct nfnl_info
*info
,
5244 const struct nlattr
* const nla
[])
5246 struct netlink_ext_ack
*extack
= info
->extack
;
5247 u8 genmask
= nft_genmask_next(info
->net
);
5248 u8 family
= info
->nfmsg
->nfgen_family
;
5249 struct net
*net
= info
->net
;
5250 const struct nlattr
*attr
;
5251 struct nft_table
*table
;
5252 struct nft_set
*set
;
5255 if (info
->nfmsg
->nfgen_family
== NFPROTO_UNSPEC
)
5256 return -EAFNOSUPPORT
;
5258 table
= nft_table_lookup(net
, nla
[NFTA_SET_TABLE
], family
,
5259 genmask
, NETLINK_CB(skb
).portid
);
5260 if (IS_ERR(table
)) {
5261 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_TABLE
]);
5262 return PTR_ERR(table
);
5265 if (nla
[NFTA_SET_HANDLE
]) {
5266 attr
= nla
[NFTA_SET_HANDLE
];
5267 set
= nft_set_lookup_byhandle(table
, attr
, genmask
);
5269 attr
= nla
[NFTA_SET_NAME
];
5270 set
= nft_set_lookup(table
, attr
, genmask
);
5274 if (PTR_ERR(set
) == -ENOENT
&&
5275 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYSET
)
5278 NL_SET_BAD_ATTR(extack
, attr
);
5279 return PTR_ERR(set
);
5282 (info
->nlh
->nlmsg_flags
& NLM_F_NONREC
&&
5283 atomic_read(&set
->nelems
) > 0)) {
5284 NL_SET_BAD_ATTR(extack
, attr
);
5288 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
5290 return nft_delset(&ctx
, set
);
5293 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
5294 enum nft_registers reg
,
5295 const struct nft_data
*data
,
5296 enum nft_data_types type
,
5299 static int nft_setelem_data_validate(const struct nft_ctx
*ctx
,
5300 struct nft_set
*set
,
5301 struct nft_elem_priv
*elem_priv
)
5303 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
5304 enum nft_registers dreg
;
5306 dreg
= nft_type_to_reg(set
->dtype
);
5307 return nft_validate_register_store(ctx
, dreg
, nft_set_ext_data(ext
),
5308 set
->dtype
== NFT_DATA_VERDICT
?
5309 NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
5313 static int nf_tables_bind_check_setelem(const struct nft_ctx
*ctx
,
5314 struct nft_set
*set
,
5315 const struct nft_set_iter
*iter
,
5316 struct nft_elem_priv
*elem_priv
)
5318 return nft_setelem_data_validate(ctx
, set
, elem_priv
);
5321 static int nft_set_catchall_bind_check(const struct nft_ctx
*ctx
,
5322 struct nft_set
*set
)
5324 u8 genmask
= nft_genmask_next(ctx
->net
);
5325 struct nft_set_elem_catchall
*catchall
;
5326 struct nft_set_ext
*ext
;
5329 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
5330 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5331 if (!nft_set_elem_active(ext
, genmask
))
5334 ret
= nft_setelem_data_validate(ctx
, set
, catchall
->elem
);
5342 int nf_tables_bind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
5343 struct nft_set_binding
*binding
)
5345 struct nft_set_binding
*i
;
5346 struct nft_set_iter iter
;
5348 if (!list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
5351 if (binding
->flags
& NFT_SET_MAP
) {
5352 /* If the set is already bound to the same chain all
5353 * jumps are already validated for that chain.
5355 list_for_each_entry(i
, &set
->bindings
, list
) {
5356 if (i
->flags
& NFT_SET_MAP
&&
5357 i
->chain
== binding
->chain
)
5361 iter
.genmask
= nft_genmask_next(ctx
->net
);
5365 iter
.fn
= nf_tables_bind_check_setelem
;
5367 set
->ops
->walk(ctx
, set
, &iter
);
5369 iter
.err
= nft_set_catchall_bind_check(ctx
, set
);
5375 if (!nft_use_inc(&set
->use
))
5378 binding
->chain
= ctx
->chain
;
5379 list_add_tail_rcu(&binding
->list
, &set
->bindings
);
5380 nft_set_trans_bind(ctx
, set
);
5384 EXPORT_SYMBOL_GPL(nf_tables_bind_set
);
5386 static void nf_tables_unbind_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
5387 struct nft_set_binding
*binding
, bool event
)
5389 list_del_rcu(&binding
->list
);
5391 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
)) {
5392 list_del_rcu(&set
->list
);
5394 nf_tables_set_notify(ctx
, set
, NFT_MSG_DELSET
,
5399 static void nft_setelem_data_activate(const struct net
*net
,
5400 const struct nft_set
*set
,
5401 struct nft_elem_priv
*elem_priv
);
5403 static int nft_mapelem_activate(const struct nft_ctx
*ctx
,
5404 struct nft_set
*set
,
5405 const struct nft_set_iter
*iter
,
5406 struct nft_elem_priv
*elem_priv
)
5408 nft_setelem_data_activate(ctx
->net
, set
, elem_priv
);
5413 static void nft_map_catchall_activate(const struct nft_ctx
*ctx
,
5414 struct nft_set
*set
)
5416 u8 genmask
= nft_genmask_next(ctx
->net
);
5417 struct nft_set_elem_catchall
*catchall
;
5418 struct nft_set_ext
*ext
;
5420 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
5421 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5422 if (!nft_set_elem_active(ext
, genmask
))
5425 nft_setelem_data_activate(ctx
->net
, set
, catchall
->elem
);
5430 static void nft_map_activate(const struct nft_ctx
*ctx
, struct nft_set
*set
)
5432 struct nft_set_iter iter
= {
5433 .genmask
= nft_genmask_next(ctx
->net
),
5434 .fn
= nft_mapelem_activate
,
5437 set
->ops
->walk(ctx
, set
, &iter
);
5438 WARN_ON_ONCE(iter
.err
);
5440 nft_map_catchall_activate(ctx
, set
);
5443 void nf_tables_activate_set(const struct nft_ctx
*ctx
, struct nft_set
*set
)
5445 if (nft_set_is_anonymous(set
)) {
5446 if (set
->flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
))
5447 nft_map_activate(ctx
, set
);
5449 nft_clear(ctx
->net
, set
);
5452 nft_use_inc_restore(&set
->use
);
5454 EXPORT_SYMBOL_GPL(nf_tables_activate_set
);
5456 void nf_tables_deactivate_set(const struct nft_ctx
*ctx
, struct nft_set
*set
,
5457 struct nft_set_binding
*binding
,
5458 enum nft_trans_phase phase
)
5461 case NFT_TRANS_PREPARE_ERROR
:
5462 nft_set_trans_unbind(ctx
, set
);
5463 if (nft_set_is_anonymous(set
))
5464 nft_deactivate_next(ctx
->net
, set
);
5466 list_del_rcu(&binding
->list
);
5468 nft_use_dec(&set
->use
);
5470 case NFT_TRANS_PREPARE
:
5471 if (nft_set_is_anonymous(set
)) {
5472 if (set
->flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
))
5473 nft_map_deactivate(ctx
, set
);
5475 nft_deactivate_next(ctx
->net
, set
);
5477 nft_use_dec(&set
->use
);
5479 case NFT_TRANS_ABORT
:
5480 case NFT_TRANS_RELEASE
:
5481 if (nft_set_is_anonymous(set
) &&
5482 set
->flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
))
5483 nft_map_deactivate(ctx
, set
);
5485 nft_use_dec(&set
->use
);
5488 nf_tables_unbind_set(ctx
, set
, binding
,
5489 phase
== NFT_TRANS_COMMIT
);
5492 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set
);
5494 void nf_tables_destroy_set(const struct nft_ctx
*ctx
, struct nft_set
*set
)
5496 if (list_empty(&set
->bindings
) && nft_set_is_anonymous(set
))
5497 nft_set_destroy(ctx
, set
);
5499 EXPORT_SYMBOL_GPL(nf_tables_destroy_set
);
5501 const struct nft_set_ext_type nft_set_ext_types
[] = {
5502 [NFT_SET_EXT_KEY
] = {
5503 .align
= __alignof__(u32
),
5505 [NFT_SET_EXT_DATA
] = {
5506 .align
= __alignof__(u32
),
5508 [NFT_SET_EXT_EXPRESSIONS
] = {
5509 .align
= __alignof__(struct nft_set_elem_expr
),
5511 [NFT_SET_EXT_OBJREF
] = {
5512 .len
= sizeof(struct nft_object
*),
5513 .align
= __alignof__(struct nft_object
*),
5515 [NFT_SET_EXT_FLAGS
] = {
5517 .align
= __alignof__(u8
),
5519 [NFT_SET_EXT_TIMEOUT
] = {
5521 .align
= __alignof__(u64
),
5523 [NFT_SET_EXT_EXPIRATION
] = {
5525 .align
= __alignof__(u64
),
5527 [NFT_SET_EXT_USERDATA
] = {
5528 .len
= sizeof(struct nft_userdata
),
5529 .align
= __alignof__(struct nft_userdata
),
5531 [NFT_SET_EXT_KEY_END
] = {
5532 .align
= __alignof__(u32
),
5540 static const struct nla_policy nft_set_elem_policy
[NFTA_SET_ELEM_MAX
+ 1] = {
5541 [NFTA_SET_ELEM_KEY
] = { .type
= NLA_NESTED
},
5542 [NFTA_SET_ELEM_DATA
] = { .type
= NLA_NESTED
},
5543 [NFTA_SET_ELEM_FLAGS
] = { .type
= NLA_U32
},
5544 [NFTA_SET_ELEM_TIMEOUT
] = { .type
= NLA_U64
},
5545 [NFTA_SET_ELEM_EXPIRATION
] = { .type
= NLA_U64
},
5546 [NFTA_SET_ELEM_USERDATA
] = { .type
= NLA_BINARY
,
5547 .len
= NFT_USERDATA_MAXLEN
},
5548 [NFTA_SET_ELEM_EXPR
] = { .type
= NLA_NESTED
},
5549 [NFTA_SET_ELEM_OBJREF
] = { .type
= NLA_STRING
,
5550 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
5551 [NFTA_SET_ELEM_KEY_END
] = { .type
= NLA_NESTED
},
5552 [NFTA_SET_ELEM_EXPRESSIONS
] = NLA_POLICY_NESTED_ARRAY(nft_expr_policy
),
5555 static const struct nla_policy nft_set_elem_list_policy
[NFTA_SET_ELEM_LIST_MAX
+ 1] = {
5556 [NFTA_SET_ELEM_LIST_TABLE
] = { .type
= NLA_STRING
,
5557 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
5558 [NFTA_SET_ELEM_LIST_SET
] = { .type
= NLA_STRING
,
5559 .len
= NFT_SET_MAXNAMELEN
- 1 },
5560 [NFTA_SET_ELEM_LIST_ELEMENTS
] = NLA_POLICY_NESTED_ARRAY(nft_set_elem_policy
),
5561 [NFTA_SET_ELEM_LIST_SET_ID
] = { .type
= NLA_U32
},
5564 static int nft_set_elem_expr_dump(struct sk_buff
*skb
,
5565 const struct nft_set
*set
,
5566 const struct nft_set_ext
*ext
,
5569 struct nft_set_elem_expr
*elem_expr
;
5570 u32 size
, num_exprs
= 0;
5571 struct nft_expr
*expr
;
5572 struct nlattr
*nest
;
5574 elem_expr
= nft_set_ext_expr(ext
);
5575 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
5578 if (num_exprs
== 1) {
5579 expr
= nft_setelem_expr_at(elem_expr
, 0);
5580 if (nft_expr_dump(skb
, NFTA_SET_ELEM_EXPR
, expr
, reset
) < 0)
5584 } else if (num_exprs
> 1) {
5585 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_EXPRESSIONS
);
5587 goto nla_put_failure
;
5589 nft_setelem_expr_foreach(expr
, elem_expr
, size
) {
5590 expr
= nft_setelem_expr_at(elem_expr
, size
);
5591 if (nft_expr_dump(skb
, NFTA_LIST_ELEM
, expr
, reset
) < 0)
5592 goto nla_put_failure
;
5594 nla_nest_end(skb
, nest
);
5602 static int nf_tables_fill_setelem(struct sk_buff
*skb
,
5603 const struct nft_set
*set
,
5604 const struct nft_elem_priv
*elem_priv
,
5607 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
5608 unsigned char *b
= skb_tail_pointer(skb
);
5609 struct nlattr
*nest
;
5611 nest
= nla_nest_start_noflag(skb
, NFTA_LIST_ELEM
);
5613 goto nla_put_failure
;
5615 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY
) &&
5616 nft_data_dump(skb
, NFTA_SET_ELEM_KEY
, nft_set_ext_key(ext
),
5617 NFT_DATA_VALUE
, set
->klen
) < 0)
5618 goto nla_put_failure
;
5620 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
) &&
5621 nft_data_dump(skb
, NFTA_SET_ELEM_KEY_END
, nft_set_ext_key_end(ext
),
5622 NFT_DATA_VALUE
, set
->klen
) < 0)
5623 goto nla_put_failure
;
5625 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
5626 nft_data_dump(skb
, NFTA_SET_ELEM_DATA
, nft_set_ext_data(ext
),
5627 set
->dtype
== NFT_DATA_VERDICT
? NFT_DATA_VERDICT
: NFT_DATA_VALUE
,
5629 goto nla_put_failure
;
5631 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
) &&
5632 nft_set_elem_expr_dump(skb
, set
, ext
, reset
))
5633 goto nla_put_failure
;
5635 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
5636 nla_put_string(skb
, NFTA_SET_ELEM_OBJREF
,
5637 (*nft_set_ext_obj(ext
))->key
.name
) < 0)
5638 goto nla_put_failure
;
5640 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
5641 nla_put_be32(skb
, NFTA_SET_ELEM_FLAGS
,
5642 htonl(*nft_set_ext_flags(ext
))))
5643 goto nla_put_failure
;
5645 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
) &&
5646 nla_put_be64(skb
, NFTA_SET_ELEM_TIMEOUT
,
5647 nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext
)),
5649 goto nla_put_failure
;
5651 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
5652 u64 expires
, now
= get_jiffies_64();
5654 expires
= *nft_set_ext_expiration(ext
);
5655 if (time_before64(now
, expires
))
5660 if (nla_put_be64(skb
, NFTA_SET_ELEM_EXPIRATION
,
5661 nf_jiffies64_to_msecs(expires
),
5663 goto nla_put_failure
;
5666 if (nft_set_ext_exists(ext
, NFT_SET_EXT_USERDATA
)) {
5667 struct nft_userdata
*udata
;
5669 udata
= nft_set_ext_userdata(ext
);
5670 if (nla_put(skb
, NFTA_SET_ELEM_USERDATA
,
5671 udata
->len
+ 1, udata
->data
))
5672 goto nla_put_failure
;
5675 nla_nest_end(skb
, nest
);
5683 struct nft_set_dump_args
{
5684 const struct netlink_callback
*cb
;
5685 struct nft_set_iter iter
;
5686 struct sk_buff
*skb
;
5690 static int nf_tables_dump_setelem(const struct nft_ctx
*ctx
,
5691 struct nft_set
*set
,
5692 const struct nft_set_iter
*iter
,
5693 struct nft_elem_priv
*elem_priv
)
5695 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
5696 struct nft_set_dump_args
*args
;
5698 if (nft_set_elem_expired(ext
))
5701 args
= container_of(iter
, struct nft_set_dump_args
, iter
);
5702 return nf_tables_fill_setelem(args
->skb
, set
, elem_priv
, args
->reset
);
5705 static void audit_log_nft_set_reset(const struct nft_table
*table
,
5706 unsigned int base_seq
,
5707 unsigned int nentries
)
5709 char *buf
= kasprintf(GFP_ATOMIC
, "%s:%u", table
->name
, base_seq
);
5711 audit_log_nfcfg(buf
, table
->family
, nentries
,
5712 AUDIT_NFT_OP_SETELEM_RESET
, GFP_ATOMIC
);
5716 struct nft_set_dump_ctx
{
5717 const struct nft_set
*set
;
5722 static int nft_set_catchall_dump(struct net
*net
, struct sk_buff
*skb
,
5723 const struct nft_set
*set
, bool reset
,
5724 unsigned int base_seq
)
5726 struct nft_set_elem_catchall
*catchall
;
5727 u8 genmask
= nft_genmask_cur(net
);
5728 struct nft_set_ext
*ext
;
5731 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
5732 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5733 if (!nft_set_elem_active(ext
, genmask
) ||
5734 nft_set_elem_expired(ext
))
5737 ret
= nf_tables_fill_setelem(skb
, set
, catchall
->elem
, reset
);
5739 audit_log_nft_set_reset(set
->table
, base_seq
, 1);
5746 static int nf_tables_dump_set(struct sk_buff
*skb
, struct netlink_callback
*cb
)
5748 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
5749 struct net
*net
= sock_net(skb
->sk
);
5750 struct nftables_pernet
*nft_net
;
5751 struct nft_table
*table
;
5752 struct nft_set
*set
;
5753 struct nft_set_dump_args args
;
5754 bool set_found
= false;
5755 struct nlmsghdr
*nlh
;
5756 struct nlattr
*nest
;
5761 nft_net
= nft_pernet(net
);
5762 cb
->seq
= READ_ONCE(nft_net
->base_seq
);
5764 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
5765 if (dump_ctx
->ctx
.family
!= NFPROTO_UNSPEC
&&
5766 dump_ctx
->ctx
.family
!= table
->family
)
5769 if (table
!= dump_ctx
->ctx
.table
)
5772 list_for_each_entry_rcu(set
, &table
->sets
, list
) {
5773 if (set
== dump_ctx
->set
) {
5786 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWSETELEM
);
5787 portid
= NETLINK_CB(cb
->skb
).portid
;
5788 seq
= cb
->nlh
->nlmsg_seq
;
5790 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, NLM_F_MULTI
,
5791 table
->family
, NFNETLINK_V0
, nft_base_seq(net
));
5793 goto nla_put_failure
;
5795 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_TABLE
, table
->name
))
5796 goto nla_put_failure
;
5797 if (nla_put_string(skb
, NFTA_SET_ELEM_LIST_SET
, set
->name
))
5798 goto nla_put_failure
;
5800 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
5802 goto nla_put_failure
;
5806 args
.reset
= dump_ctx
->reset
;
5807 args
.iter
.genmask
= nft_genmask_cur(net
);
5808 args
.iter
.skip
= cb
->args
[0];
5809 args
.iter
.count
= 0;
5811 args
.iter
.fn
= nf_tables_dump_setelem
;
5812 set
->ops
->walk(&dump_ctx
->ctx
, set
, &args
.iter
);
5814 if (!args
.iter
.err
&& args
.iter
.count
== cb
->args
[0])
5815 args
.iter
.err
= nft_set_catchall_dump(net
, skb
, set
,
5816 dump_ctx
->reset
, cb
->seq
);
5817 nla_nest_end(skb
, nest
);
5818 nlmsg_end(skb
, nlh
);
5820 if (dump_ctx
->reset
&& args
.iter
.count
> args
.iter
.skip
)
5821 audit_log_nft_set_reset(table
, cb
->seq
,
5822 args
.iter
.count
- args
.iter
.skip
);
5826 if (args
.iter
.err
&& args
.iter
.err
!= -EMSGSIZE
)
5827 return args
.iter
.err
;
5828 if (args
.iter
.count
== cb
->args
[0])
5831 cb
->args
[0] = args
.iter
.count
;
5839 static int nf_tables_dump_set_start(struct netlink_callback
*cb
)
5841 struct nft_set_dump_ctx
*dump_ctx
= cb
->data
;
5843 cb
->data
= kmemdup(dump_ctx
, sizeof(*dump_ctx
), GFP_ATOMIC
);
5845 return cb
->data
? 0 : -ENOMEM
;
5848 static int nf_tables_dump_set_done(struct netlink_callback
*cb
)
5854 static int nf_tables_fill_setelem_info(struct sk_buff
*skb
,
5855 const struct nft_ctx
*ctx
, u32 seq
,
5856 u32 portid
, int event
, u16 flags
,
5857 const struct nft_set
*set
,
5858 const struct nft_elem_priv
*elem_priv
,
5861 struct nlmsghdr
*nlh
;
5862 struct nlattr
*nest
;
5865 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
5866 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, ctx
->family
,
5867 NFNETLINK_V0
, nft_base_seq(ctx
->net
));
5869 goto nla_put_failure
;
5871 if (nla_put_string(skb
, NFTA_SET_TABLE
, ctx
->table
->name
))
5872 goto nla_put_failure
;
5873 if (nla_put_string(skb
, NFTA_SET_NAME
, set
->name
))
5874 goto nla_put_failure
;
5876 nest
= nla_nest_start_noflag(skb
, NFTA_SET_ELEM_LIST_ELEMENTS
);
5878 goto nla_put_failure
;
5880 err
= nf_tables_fill_setelem(skb
, set
, elem_priv
, reset
);
5882 goto nla_put_failure
;
5884 nla_nest_end(skb
, nest
);
5886 nlmsg_end(skb
, nlh
);
5890 nlmsg_trim(skb
, nlh
);
5894 static int nft_setelem_parse_flags(const struct nft_set
*set
,
5895 const struct nlattr
*attr
, u32
*flags
)
5900 *flags
= ntohl(nla_get_be32(attr
));
5901 if (*flags
& ~(NFT_SET_ELEM_INTERVAL_END
| NFT_SET_ELEM_CATCHALL
))
5903 if (!(set
->flags
& NFT_SET_INTERVAL
) &&
5904 *flags
& NFT_SET_ELEM_INTERVAL_END
)
5906 if ((*flags
& (NFT_SET_ELEM_INTERVAL_END
| NFT_SET_ELEM_CATCHALL
)) ==
5907 (NFT_SET_ELEM_INTERVAL_END
| NFT_SET_ELEM_CATCHALL
))
5913 static int nft_setelem_parse_key(struct nft_ctx
*ctx
, struct nft_set
*set
,
5914 struct nft_data
*key
, struct nlattr
*attr
)
5916 struct nft_data_desc desc
= {
5917 .type
= NFT_DATA_VALUE
,
5918 .size
= NFT_DATA_VALUE_MAXLEN
,
5922 return nft_data_init(ctx
, key
, &desc
, attr
);
5925 static int nft_setelem_parse_data(struct nft_ctx
*ctx
, struct nft_set
*set
,
5926 struct nft_data_desc
*desc
,
5927 struct nft_data
*data
,
5928 struct nlattr
*attr
)
5932 if (set
->dtype
== NFT_DATA_VERDICT
)
5933 dtype
= NFT_DATA_VERDICT
;
5935 dtype
= NFT_DATA_VALUE
;
5938 desc
->size
= NFT_DATA_VALUE_MAXLEN
;
5939 desc
->len
= set
->dlen
;
5940 desc
->flags
= NFT_DATA_DESC_SETELEM
;
5942 return nft_data_init(ctx
, data
, desc
, attr
);
5945 static void *nft_setelem_catchall_get(const struct net
*net
,
5946 const struct nft_set
*set
)
5948 struct nft_set_elem_catchall
*catchall
;
5949 u8 genmask
= nft_genmask_cur(net
);
5950 struct nft_set_ext
*ext
;
5953 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
5954 ext
= nft_set_elem_ext(set
, catchall
->elem
);
5955 if (!nft_set_elem_active(ext
, genmask
) ||
5956 nft_set_elem_expired(ext
))
5959 priv
= catchall
->elem
;
5966 static int nft_setelem_get(struct nft_ctx
*ctx
, struct nft_set
*set
,
5967 struct nft_set_elem
*elem
, u32 flags
)
5971 if (!(flags
& NFT_SET_ELEM_CATCHALL
)) {
5972 priv
= set
->ops
->get(ctx
->net
, set
, elem
, flags
);
5974 return PTR_ERR(priv
);
5976 priv
= nft_setelem_catchall_get(ctx
->net
, set
);
5985 static int nft_get_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
5986 const struct nlattr
*attr
, bool reset
)
5988 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
5989 struct nft_set_elem elem
;
5990 struct sk_buff
*skb
;
5994 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
5995 nft_set_elem_policy
, NULL
);
5999 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
6003 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
6006 if (nla
[NFTA_SET_ELEM_KEY
]) {
6007 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
6008 nla
[NFTA_SET_ELEM_KEY
]);
6013 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
6014 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
6015 nla
[NFTA_SET_ELEM_KEY_END
]);
6020 err
= nft_setelem_get(ctx
, set
, &elem
, flags
);
6025 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_ATOMIC
);
6029 err
= nf_tables_fill_setelem_info(skb
, ctx
, ctx
->seq
, ctx
->portid
,
6030 NFT_MSG_NEWSETELEM
, 0, set
, elem
.priv
,
6033 goto err_fill_setelem
;
6035 return nfnetlink_unicast(skb
, ctx
->net
, ctx
->portid
);
6042 /* called with rcu_read_lock held */
6043 static int nf_tables_getsetelem(struct sk_buff
*skb
,
6044 const struct nfnl_info
*info
,
6045 const struct nlattr
* const nla
[])
6047 struct netlink_ext_ack
*extack
= info
->extack
;
6048 u8 genmask
= nft_genmask_cur(info
->net
);
6049 u8 family
= info
->nfmsg
->nfgen_family
;
6050 int rem
, err
= 0, nelems
= 0;
6051 struct net
*net
= info
->net
;
6052 struct nft_table
*table
;
6053 struct nft_set
*set
;
6054 struct nlattr
*attr
;
6058 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
6060 if (IS_ERR(table
)) {
6061 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
6062 return PTR_ERR(table
);
6065 set
= nft_set_lookup(table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
6067 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_SET
]);
6068 return PTR_ERR(set
);
6071 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6073 if (NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_GETSETELEM_RESET
)
6076 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
6077 struct netlink_dump_control c
= {
6078 .start
= nf_tables_dump_set_start
,
6079 .dump
= nf_tables_dump_set
,
6080 .done
= nf_tables_dump_set_done
,
6081 .module
= THIS_MODULE
,
6083 struct nft_set_dump_ctx dump_ctx
= {
6090 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
6093 if (!nla
[NFTA_SET_ELEM_LIST_ELEMENTS
])
6096 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
6097 err
= nft_get_set_elem(&ctx
, set
, attr
, reset
);
6099 NL_SET_BAD_ATTR(extack
, attr
);
6106 audit_log_nft_set_reset(table
, nft_pernet(net
)->base_seq
,
6112 static void nf_tables_setelem_notify(const struct nft_ctx
*ctx
,
6113 const struct nft_set
*set
,
6114 const struct nft_elem_priv
*elem_priv
,
6117 struct nftables_pernet
*nft_net
;
6118 struct net
*net
= ctx
->net
;
6119 u32 portid
= ctx
->portid
;
6120 struct sk_buff
*skb
;
6124 if (!ctx
->report
&& !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
6127 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
6131 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
6132 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
6134 err
= nf_tables_fill_setelem_info(skb
, ctx
, 0, portid
, event
, flags
,
6135 set
, elem_priv
, false);
6141 nft_net
= nft_pernet(net
);
6142 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
6145 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
6148 static struct nft_trans
*nft_trans_elem_alloc(struct nft_ctx
*ctx
,
6150 struct nft_set
*set
)
6152 struct nft_trans
*trans
;
6154 trans
= nft_trans_alloc(ctx
, msg_type
, sizeof(struct nft_trans_elem
));
6158 nft_trans_elem_set(trans
) = set
;
6162 struct nft_expr
*nft_set_elem_expr_alloc(const struct nft_ctx
*ctx
,
6163 const struct nft_set
*set
,
6164 const struct nlattr
*attr
)
6166 struct nft_expr
*expr
;
6169 expr
= nft_expr_init(ctx
, attr
);
6174 if (expr
->ops
->type
->flags
& NFT_EXPR_GC
) {
6175 if (set
->flags
& NFT_SET_TIMEOUT
)
6176 goto err_set_elem_expr
;
6177 if (!set
->ops
->gc_init
)
6178 goto err_set_elem_expr
;
6179 set
->ops
->gc_init(set
);
6185 nft_expr_destroy(ctx
, expr
);
6186 return ERR_PTR(err
);
6189 static int nft_set_ext_check(const struct nft_set_ext_tmpl
*tmpl
, u8 id
, u32 len
)
6191 len
+= nft_set_ext_types
[id
].len
;
6192 if (len
> tmpl
->ext_len
[id
] ||
6199 static int nft_set_ext_memcpy(const struct nft_set_ext_tmpl
*tmpl
, u8 id
,
6200 void *to
, const void *from
, u32 len
)
6202 if (nft_set_ext_check(tmpl
, id
, len
) < 0)
6205 memcpy(to
, from
, len
);
6210 struct nft_elem_priv
*nft_set_elem_init(const struct nft_set
*set
,
6211 const struct nft_set_ext_tmpl
*tmpl
,
6212 const u32
*key
, const u32
*key_end
,
6214 u64 timeout
, u64 expiration
, gfp_t gfp
)
6216 struct nft_set_ext
*ext
;
6219 elem
= kzalloc(set
->ops
->elemsize
+ tmpl
->len
, gfp
);
6221 return ERR_PTR(-ENOMEM
);
6223 ext
= nft_set_elem_ext(set
, elem
);
6224 nft_set_ext_init(ext
, tmpl
);
6226 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY
) &&
6227 nft_set_ext_memcpy(tmpl
, NFT_SET_EXT_KEY
,
6228 nft_set_ext_key(ext
), key
, set
->klen
) < 0)
6231 if (nft_set_ext_exists(ext
, NFT_SET_EXT_KEY_END
) &&
6232 nft_set_ext_memcpy(tmpl
, NFT_SET_EXT_KEY_END
,
6233 nft_set_ext_key_end(ext
), key_end
, set
->klen
) < 0)
6236 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
6237 nft_set_ext_memcpy(tmpl
, NFT_SET_EXT_DATA
,
6238 nft_set_ext_data(ext
), data
, set
->dlen
) < 0)
6241 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPIRATION
)) {
6242 *nft_set_ext_expiration(ext
) = get_jiffies_64() + expiration
;
6243 if (expiration
== 0)
6244 *nft_set_ext_expiration(ext
) += timeout
;
6246 if (nft_set_ext_exists(ext
, NFT_SET_EXT_TIMEOUT
))
6247 *nft_set_ext_timeout(ext
) = timeout
;
6254 return ERR_PTR(-EINVAL
);
6257 static void __nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
6258 struct nft_expr
*expr
)
6260 if (expr
->ops
->destroy_clone
) {
6261 expr
->ops
->destroy_clone(ctx
, expr
);
6262 module_put(expr
->ops
->type
->owner
);
6264 nf_tables_expr_destroy(ctx
, expr
);
6268 static void nft_set_elem_expr_destroy(const struct nft_ctx
*ctx
,
6269 struct nft_set_elem_expr
*elem_expr
)
6271 struct nft_expr
*expr
;
6274 nft_setelem_expr_foreach(expr
, elem_expr
, size
)
6275 __nft_set_elem_expr_destroy(ctx
, expr
);
6278 /* Drop references and destroy. Called from gc, dynset and abort path. */
6279 void nft_set_elem_destroy(const struct nft_set
*set
,
6280 const struct nft_elem_priv
*elem_priv
,
6283 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
6284 struct nft_ctx ctx
= {
6285 .net
= read_pnet(&set
->net
),
6286 .family
= set
->table
->family
,
6289 nft_data_release(nft_set_ext_key(ext
), NFT_DATA_VALUE
);
6290 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
6291 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
6292 if (destroy_expr
&& nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
6293 nft_set_elem_expr_destroy(&ctx
, nft_set_ext_expr(ext
));
6294 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
6295 nft_use_dec(&(*nft_set_ext_obj(ext
))->use
);
6299 EXPORT_SYMBOL_GPL(nft_set_elem_destroy
);
6301 /* Destroy element. References have been already dropped in the preparation
6302 * path via nft_setelem_data_deactivate().
6304 void nf_tables_set_elem_destroy(const struct nft_ctx
*ctx
,
6305 const struct nft_set
*set
,
6306 const struct nft_elem_priv
*elem_priv
)
6308 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
6310 if (nft_set_ext_exists(ext
, NFT_SET_EXT_EXPRESSIONS
))
6311 nft_set_elem_expr_destroy(ctx
, nft_set_ext_expr(ext
));
6316 int nft_set_elem_expr_clone(const struct nft_ctx
*ctx
, struct nft_set
*set
,
6317 struct nft_expr
*expr_array
[])
6319 struct nft_expr
*expr
;
6322 for (i
= 0; i
< set
->num_exprs
; i
++) {
6323 expr
= kzalloc(set
->exprs
[i
]->ops
->size
, GFP_KERNEL_ACCOUNT
);
6327 err
= nft_expr_clone(expr
, set
->exprs
[i
]);
6332 expr_array
[i
] = expr
;
6338 for (k
= i
- 1; k
>= 0; k
--)
6339 nft_expr_destroy(ctx
, expr_array
[k
]);
6344 static int nft_set_elem_expr_setup(struct nft_ctx
*ctx
,
6345 const struct nft_set_ext_tmpl
*tmpl
,
6346 const struct nft_set_ext
*ext
,
6347 struct nft_expr
*expr_array
[],
6350 struct nft_set_elem_expr
*elem_expr
= nft_set_ext_expr(ext
);
6351 u32 len
= sizeof(struct nft_set_elem_expr
);
6352 struct nft_expr
*expr
;
6358 for (i
= 0; i
< num_exprs
; i
++)
6359 len
+= expr_array
[i
]->ops
->size
;
6361 if (nft_set_ext_check(tmpl
, NFT_SET_EXT_EXPRESSIONS
, len
) < 0)
6364 for (i
= 0; i
< num_exprs
; i
++) {
6365 expr
= nft_setelem_expr_at(elem_expr
, elem_expr
->size
);
6366 err
= nft_expr_clone(expr
, expr_array
[i
]);
6368 goto err_elem_expr_setup
;
6370 elem_expr
->size
+= expr_array
[i
]->ops
->size
;
6371 nft_expr_destroy(ctx
, expr_array
[i
]);
6372 expr_array
[i
] = NULL
;
6377 err_elem_expr_setup
:
6378 for (; i
< num_exprs
; i
++) {
6379 nft_expr_destroy(ctx
, expr_array
[i
]);
6380 expr_array
[i
] = NULL
;
6386 struct nft_set_ext
*nft_set_catchall_lookup(const struct net
*net
,
6387 const struct nft_set
*set
)
6389 struct nft_set_elem_catchall
*catchall
;
6390 u8 genmask
= nft_genmask_cur(net
);
6391 struct nft_set_ext
*ext
;
6393 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
6394 ext
= nft_set_elem_ext(set
, catchall
->elem
);
6395 if (nft_set_elem_active(ext
, genmask
) &&
6396 !nft_set_elem_expired(ext
) &&
6397 !nft_set_elem_is_dead(ext
))
6403 EXPORT_SYMBOL_GPL(nft_set_catchall_lookup
);
6405 static int nft_setelem_catchall_insert(const struct net
*net
,
6406 struct nft_set
*set
,
6407 const struct nft_set_elem
*elem
,
6408 struct nft_elem_priv
**priv
)
6410 struct nft_set_elem_catchall
*catchall
;
6411 u8 genmask
= nft_genmask_next(net
);
6412 struct nft_set_ext
*ext
;
6414 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
6415 ext
= nft_set_elem_ext(set
, catchall
->elem
);
6416 if (nft_set_elem_active(ext
, genmask
)) {
6417 *priv
= catchall
->elem
;
6422 catchall
= kmalloc(sizeof(*catchall
), GFP_KERNEL
);
6426 catchall
->elem
= elem
->priv
;
6427 list_add_tail_rcu(&catchall
->list
, &set
->catchall_list
);
6432 static int nft_setelem_insert(const struct net
*net
,
6433 struct nft_set
*set
,
6434 const struct nft_set_elem
*elem
,
6435 struct nft_elem_priv
**elem_priv
,
6440 if (flags
& NFT_SET_ELEM_CATCHALL
)
6441 ret
= nft_setelem_catchall_insert(net
, set
, elem
, elem_priv
);
6443 ret
= set
->ops
->insert(net
, set
, elem
, elem_priv
);
6448 static bool nft_setelem_is_catchall(const struct nft_set
*set
,
6449 const struct nft_elem_priv
*elem_priv
)
6451 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
6453 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
6454 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_CATCHALL
)
6460 static void nft_setelem_activate(struct net
*net
, struct nft_set
*set
,
6461 struct nft_elem_priv
*elem_priv
)
6463 struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
6465 if (nft_setelem_is_catchall(set
, elem_priv
)) {
6466 nft_set_elem_change_active(net
, set
, ext
);
6468 set
->ops
->activate(net
, set
, elem_priv
);
6472 static int nft_setelem_catchall_deactivate(const struct net
*net
,
6473 struct nft_set
*set
,
6474 struct nft_set_elem
*elem
)
6476 struct nft_set_elem_catchall
*catchall
;
6477 struct nft_set_ext
*ext
;
6479 list_for_each_entry(catchall
, &set
->catchall_list
, list
) {
6480 ext
= nft_set_elem_ext(set
, catchall
->elem
);
6481 if (!nft_is_active(net
, ext
))
6485 elem
->priv
= catchall
->elem
;
6486 nft_set_elem_change_active(net
, set
, ext
);
6493 static int __nft_setelem_deactivate(const struct net
*net
,
6494 struct nft_set
*set
,
6495 struct nft_set_elem
*elem
)
6499 priv
= set
->ops
->deactivate(net
, set
, elem
);
6510 static int nft_setelem_deactivate(const struct net
*net
,
6511 struct nft_set
*set
,
6512 struct nft_set_elem
*elem
, u32 flags
)
6516 if (flags
& NFT_SET_ELEM_CATCHALL
)
6517 ret
= nft_setelem_catchall_deactivate(net
, set
, elem
);
6519 ret
= __nft_setelem_deactivate(net
, set
, elem
);
6524 static void nft_setelem_catchall_destroy(struct nft_set_elem_catchall
*catchall
)
6526 list_del_rcu(&catchall
->list
);
6527 kfree_rcu(catchall
, rcu
);
6530 static void nft_setelem_catchall_remove(const struct net
*net
,
6531 const struct nft_set
*set
,
6532 struct nft_elem_priv
*elem_priv
)
6534 struct nft_set_elem_catchall
*catchall
, *next
;
6536 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
6537 if (catchall
->elem
== elem_priv
) {
6538 nft_setelem_catchall_destroy(catchall
);
6544 static void nft_setelem_remove(const struct net
*net
,
6545 const struct nft_set
*set
,
6546 struct nft_elem_priv
*elem_priv
)
6548 if (nft_setelem_is_catchall(set
, elem_priv
))
6549 nft_setelem_catchall_remove(net
, set
, elem_priv
);
6551 set
->ops
->remove(net
, set
, elem_priv
);
6554 static bool nft_setelem_valid_key_end(const struct nft_set
*set
,
6555 struct nlattr
**nla
, u32 flags
)
6557 if ((set
->flags
& (NFT_SET_CONCAT
| NFT_SET_INTERVAL
)) ==
6558 (NFT_SET_CONCAT
| NFT_SET_INTERVAL
)) {
6559 if (flags
& NFT_SET_ELEM_INTERVAL_END
)
6562 if (nla
[NFTA_SET_ELEM_KEY_END
] &&
6563 flags
& NFT_SET_ELEM_CATCHALL
)
6566 if (nla
[NFTA_SET_ELEM_KEY_END
])
6573 static int nft_add_set_elem(struct nft_ctx
*ctx
, struct nft_set
*set
,
6574 const struct nlattr
*attr
, u32 nlmsg_flags
)
6576 struct nft_expr
*expr_array
[NFT_SET_EXPR_MAX
] = {};
6577 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
6578 u8 genmask
= nft_genmask_next(ctx
->net
);
6579 u32 flags
= 0, size
= 0, num_exprs
= 0;
6580 struct nft_set_ext_tmpl tmpl
;
6581 struct nft_set_ext
*ext
, *ext2
;
6582 struct nft_set_elem elem
;
6583 struct nft_set_binding
*binding
;
6584 struct nft_elem_priv
*elem_priv
;
6585 struct nft_object
*obj
= NULL
;
6586 struct nft_userdata
*udata
;
6587 struct nft_data_desc desc
;
6588 enum nft_registers dreg
;
6589 struct nft_trans
*trans
;
6595 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
6596 nft_set_elem_policy
, NULL
);
6600 nft_set_ext_prepare(&tmpl
);
6602 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
6606 if (((flags
& NFT_SET_ELEM_CATCHALL
) && nla
[NFTA_SET_ELEM_KEY
]) ||
6607 (!(flags
& NFT_SET_ELEM_CATCHALL
) && !nla
[NFTA_SET_ELEM_KEY
]))
6611 err
= nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
6616 if (set
->flags
& NFT_SET_MAP
) {
6617 if (nla
[NFTA_SET_ELEM_DATA
] == NULL
&&
6618 !(flags
& NFT_SET_ELEM_INTERVAL_END
))
6621 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
6625 if (set
->flags
& NFT_SET_OBJECT
) {
6626 if (!nla
[NFTA_SET_ELEM_OBJREF
] &&
6627 !(flags
& NFT_SET_ELEM_INTERVAL_END
))
6630 if (nla
[NFTA_SET_ELEM_OBJREF
])
6634 if (!nft_setelem_valid_key_end(set
, nla
, flags
))
6637 if ((flags
& NFT_SET_ELEM_INTERVAL_END
) &&
6638 (nla
[NFTA_SET_ELEM_DATA
] ||
6639 nla
[NFTA_SET_ELEM_OBJREF
] ||
6640 nla
[NFTA_SET_ELEM_TIMEOUT
] ||
6641 nla
[NFTA_SET_ELEM_EXPIRATION
] ||
6642 nla
[NFTA_SET_ELEM_USERDATA
] ||
6643 nla
[NFTA_SET_ELEM_EXPR
] ||
6644 nla
[NFTA_SET_ELEM_KEY_END
] ||
6645 nla
[NFTA_SET_ELEM_EXPRESSIONS
]))
6649 if (nla
[NFTA_SET_ELEM_TIMEOUT
] != NULL
) {
6650 if (!(set
->flags
& NFT_SET_TIMEOUT
))
6652 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_TIMEOUT
],
6656 } else if (set
->flags
& NFT_SET_TIMEOUT
&&
6657 !(flags
& NFT_SET_ELEM_INTERVAL_END
)) {
6658 timeout
= READ_ONCE(set
->timeout
);
6662 if (nla
[NFTA_SET_ELEM_EXPIRATION
] != NULL
) {
6663 if (!(set
->flags
& NFT_SET_TIMEOUT
))
6665 err
= nf_msecs_to_jiffies64(nla
[NFTA_SET_ELEM_EXPIRATION
],
6671 if (nla
[NFTA_SET_ELEM_EXPR
]) {
6672 struct nft_expr
*expr
;
6674 if (set
->num_exprs
&& set
->num_exprs
!= 1)
6677 expr
= nft_set_elem_expr_alloc(ctx
, set
,
6678 nla
[NFTA_SET_ELEM_EXPR
]);
6680 return PTR_ERR(expr
);
6682 expr_array
[0] = expr
;
6685 if (set
->num_exprs
&& set
->exprs
[0]->ops
!= expr
->ops
) {
6687 goto err_set_elem_expr
;
6689 } else if (nla
[NFTA_SET_ELEM_EXPRESSIONS
]) {
6690 struct nft_expr
*expr
;
6695 nla_for_each_nested(tmp
, nla
[NFTA_SET_ELEM_EXPRESSIONS
], left
) {
6696 if (i
== NFT_SET_EXPR_MAX
||
6697 (set
->num_exprs
&& set
->num_exprs
== i
)) {
6699 goto err_set_elem_expr
;
6701 if (nla_type(tmp
) != NFTA_LIST_ELEM
) {
6703 goto err_set_elem_expr
;
6705 expr
= nft_set_elem_expr_alloc(ctx
, set
, tmp
);
6707 err
= PTR_ERR(expr
);
6708 goto err_set_elem_expr
;
6710 expr_array
[i
] = expr
;
6713 if (set
->num_exprs
&& expr
->ops
!= set
->exprs
[i
]->ops
) {
6715 goto err_set_elem_expr
;
6719 if (set
->num_exprs
&& set
->num_exprs
!= i
) {
6721 goto err_set_elem_expr
;
6723 } else if (set
->num_exprs
> 0 &&
6724 !(flags
& NFT_SET_ELEM_INTERVAL_END
)) {
6725 err
= nft_set_elem_expr_clone(ctx
, set
, expr_array
);
6727 goto err_set_elem_expr_clone
;
6729 num_exprs
= set
->num_exprs
;
6732 if (nla
[NFTA_SET_ELEM_KEY
]) {
6733 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
6734 nla
[NFTA_SET_ELEM_KEY
]);
6736 goto err_set_elem_expr
;
6738 err
= nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
6743 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
6744 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
6745 nla
[NFTA_SET_ELEM_KEY_END
]);
6749 err
= nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
6751 goto err_parse_key_end
;
6755 err
= nft_set_ext_add(&tmpl
, NFT_SET_EXT_EXPIRATION
);
6757 goto err_parse_key_end
;
6759 if (timeout
!= READ_ONCE(set
->timeout
)) {
6760 err
= nft_set_ext_add(&tmpl
, NFT_SET_EXT_TIMEOUT
);
6762 goto err_parse_key_end
;
6767 for (i
= 0; i
< num_exprs
; i
++)
6768 size
+= expr_array
[i
]->ops
->size
;
6770 err
= nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_EXPRESSIONS
,
6771 sizeof(struct nft_set_elem_expr
) + size
);
6773 goto err_parse_key_end
;
6776 if (nla
[NFTA_SET_ELEM_OBJREF
] != NULL
) {
6777 obj
= nft_obj_lookup(ctx
->net
, ctx
->table
,
6778 nla
[NFTA_SET_ELEM_OBJREF
],
6779 set
->objtype
, genmask
);
6783 goto err_parse_key_end
;
6786 if (!nft_use_inc(&obj
->use
)) {
6789 goto err_parse_key_end
;
6792 err
= nft_set_ext_add(&tmpl
, NFT_SET_EXT_OBJREF
);
6794 goto err_parse_key_end
;
6797 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
) {
6798 err
= nft_setelem_parse_data(ctx
, set
, &desc
, &elem
.data
.val
,
6799 nla
[NFTA_SET_ELEM_DATA
]);
6801 goto err_parse_key_end
;
6803 dreg
= nft_type_to_reg(set
->dtype
);
6804 list_for_each_entry(binding
, &set
->bindings
, list
) {
6805 struct nft_ctx bind_ctx
= {
6807 .family
= ctx
->family
,
6808 .table
= ctx
->table
,
6809 .chain
= (struct nft_chain
*)binding
->chain
,
6812 if (!(binding
->flags
& NFT_SET_MAP
))
6815 err
= nft_validate_register_store(&bind_ctx
, dreg
,
6817 desc
.type
, desc
.len
);
6819 goto err_parse_data
;
6821 if (desc
.type
== NFT_DATA_VERDICT
&&
6822 (elem
.data
.val
.verdict
.code
== NFT_GOTO
||
6823 elem
.data
.val
.verdict
.code
== NFT_JUMP
))
6824 nft_validate_state_update(ctx
->table
,
6828 err
= nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_DATA
, desc
.len
);
6830 goto err_parse_data
;
6833 /* The full maximum length of userdata can exceed the maximum
6834 * offset value (U8_MAX) for following extensions, therefor it
6835 * must be the last extension added.
6838 if (nla
[NFTA_SET_ELEM_USERDATA
] != NULL
) {
6839 ulen
= nla_len(nla
[NFTA_SET_ELEM_USERDATA
]);
6841 err
= nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_USERDATA
,
6844 goto err_parse_data
;
6848 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
6849 elem
.key_end
.val
.data
, elem
.data
.val
.data
,
6850 timeout
, expiration
, GFP_KERNEL_ACCOUNT
);
6851 if (IS_ERR(elem
.priv
)) {
6852 err
= PTR_ERR(elem
.priv
);
6853 goto err_parse_data
;
6856 ext
= nft_set_elem_ext(set
, elem
.priv
);
6858 *nft_set_ext_flags(ext
) = flags
;
6861 *nft_set_ext_obj(ext
) = obj
;
6864 if (nft_set_ext_check(&tmpl
, NFT_SET_EXT_USERDATA
, ulen
) < 0) {
6868 udata
= nft_set_ext_userdata(ext
);
6869 udata
->len
= ulen
- 1;
6870 nla_memcpy(&udata
->data
, nla
[NFTA_SET_ELEM_USERDATA
], ulen
);
6872 err
= nft_set_elem_expr_setup(ctx
, &tmpl
, ext
, expr_array
, num_exprs
);
6876 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_NEWSETELEM
, set
);
6877 if (trans
== NULL
) {
6882 ext
->genmask
= nft_genmask_cur(ctx
->net
);
6884 err
= nft_setelem_insert(ctx
->net
, set
, &elem
, &elem_priv
, flags
);
6886 if (err
== -EEXIST
) {
6887 ext2
= nft_set_elem_ext(set
, elem_priv
);
6888 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) ^
6889 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) ||
6890 nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) ^
6891 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
))
6892 goto err_element_clash
;
6893 if ((nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
) &&
6894 nft_set_ext_exists(ext2
, NFT_SET_EXT_DATA
) &&
6895 memcmp(nft_set_ext_data(ext
),
6896 nft_set_ext_data(ext2
), set
->dlen
) != 0) ||
6897 (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
) &&
6898 nft_set_ext_exists(ext2
, NFT_SET_EXT_OBJREF
) &&
6899 *nft_set_ext_obj(ext
) != *nft_set_ext_obj(ext2
)))
6900 goto err_element_clash
;
6901 else if (!(nlmsg_flags
& NLM_F_EXCL
))
6903 } else if (err
== -ENOTEMPTY
) {
6904 /* ENOTEMPTY reports overlapping between this element
6905 * and an existing one.
6909 goto err_element_clash
;
6912 if (!(flags
& NFT_SET_ELEM_CATCHALL
)) {
6913 unsigned int max
= set
->size
? set
->size
+ set
->ndeact
: UINT_MAX
;
6915 if (!atomic_add_unless(&set
->nelems
, 1, max
)) {
6921 nft_trans_elem_priv(trans
) = elem
.priv
;
6922 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
6926 nft_setelem_remove(ctx
->net
, set
, elem
.priv
);
6930 nf_tables_set_elem_destroy(ctx
, set
, elem
.priv
);
6932 if (nla
[NFTA_SET_ELEM_DATA
] != NULL
)
6933 nft_data_release(&elem
.data
.val
, desc
.type
);
6936 nft_use_dec_restore(&obj
->use
);
6938 nft_data_release(&elem
.key_end
.val
, NFT_DATA_VALUE
);
6940 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
6942 for (i
= 0; i
< num_exprs
&& expr_array
[i
]; i
++)
6943 nft_expr_destroy(ctx
, expr_array
[i
]);
6944 err_set_elem_expr_clone
:
6948 static int nf_tables_newsetelem(struct sk_buff
*skb
,
6949 const struct nfnl_info
*info
,
6950 const struct nlattr
* const nla
[])
6952 struct netlink_ext_ack
*extack
= info
->extack
;
6953 u8 genmask
= nft_genmask_next(info
->net
);
6954 u8 family
= info
->nfmsg
->nfgen_family
;
6955 struct net
*net
= info
->net
;
6956 const struct nlattr
*attr
;
6957 struct nft_table
*table
;
6958 struct nft_set
*set
;
6962 if (nla
[NFTA_SET_ELEM_LIST_ELEMENTS
] == NULL
)
6965 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
6966 genmask
, NETLINK_CB(skb
).portid
);
6967 if (IS_ERR(table
)) {
6968 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
6969 return PTR_ERR(table
);
6972 set
= nft_set_lookup_global(net
, table
, nla
[NFTA_SET_ELEM_LIST_SET
],
6973 nla
[NFTA_SET_ELEM_LIST_SET_ID
], genmask
);
6975 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_SET
]);
6976 return PTR_ERR(set
);
6979 if (!list_empty(&set
->bindings
) &&
6980 (set
->flags
& (NFT_SET_CONSTANT
| NFT_SET_ANONYMOUS
)))
6983 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
6985 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
6986 err
= nft_add_set_elem(&ctx
, set
, attr
, info
->nlh
->nlmsg_flags
);
6988 NL_SET_BAD_ATTR(extack
, attr
);
6993 if (table
->validate_state
== NFT_VALIDATE_DO
)
6994 return nft_table_validate(net
, table
);
7000 * nft_data_hold - hold a nft_data item
7002 * @data: struct nft_data to release
7003 * @type: type of data
7005 * Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
7006 * NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
7007 * NFT_GOTO verdicts. This function must be called on active data objects
7008 * from the second phase of the commit protocol.
7010 void nft_data_hold(const struct nft_data
*data
, enum nft_data_types type
)
7012 struct nft_chain
*chain
;
7014 if (type
== NFT_DATA_VERDICT
) {
7015 switch (data
->verdict
.code
) {
7018 chain
= data
->verdict
.chain
;
7019 nft_use_inc_restore(&chain
->use
);
7025 static void nft_setelem_data_activate(const struct net
*net
,
7026 const struct nft_set
*set
,
7027 struct nft_elem_priv
*elem_priv
)
7029 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
7031 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
7032 nft_data_hold(nft_set_ext_data(ext
), set
->dtype
);
7033 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
7034 nft_use_inc_restore(&(*nft_set_ext_obj(ext
))->use
);
7037 void nft_setelem_data_deactivate(const struct net
*net
,
7038 const struct nft_set
*set
,
7039 struct nft_elem_priv
*elem_priv
)
7041 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
7043 if (nft_set_ext_exists(ext
, NFT_SET_EXT_DATA
))
7044 nft_data_release(nft_set_ext_data(ext
), set
->dtype
);
7045 if (nft_set_ext_exists(ext
, NFT_SET_EXT_OBJREF
))
7046 nft_use_dec(&(*nft_set_ext_obj(ext
))->use
);
7049 static int nft_del_setelem(struct nft_ctx
*ctx
, struct nft_set
*set
,
7050 const struct nlattr
*attr
)
7052 struct nlattr
*nla
[NFTA_SET_ELEM_MAX
+ 1];
7053 struct nft_set_ext_tmpl tmpl
;
7054 struct nft_set_elem elem
;
7055 struct nft_set_ext
*ext
;
7056 struct nft_trans
*trans
;
7060 err
= nla_parse_nested_deprecated(nla
, NFTA_SET_ELEM_MAX
, attr
,
7061 nft_set_elem_policy
, NULL
);
7065 err
= nft_setelem_parse_flags(set
, nla
[NFTA_SET_ELEM_FLAGS
], &flags
);
7069 if (!nla
[NFTA_SET_ELEM_KEY
] && !(flags
& NFT_SET_ELEM_CATCHALL
))
7072 if (!nft_setelem_valid_key_end(set
, nla
, flags
))
7075 nft_set_ext_prepare(&tmpl
);
7078 err
= nft_set_ext_add(&tmpl
, NFT_SET_EXT_FLAGS
);
7083 if (nla
[NFTA_SET_ELEM_KEY
]) {
7084 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key
.val
,
7085 nla
[NFTA_SET_ELEM_KEY
]);
7089 err
= nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY
, set
->klen
);
7094 if (nla
[NFTA_SET_ELEM_KEY_END
]) {
7095 err
= nft_setelem_parse_key(ctx
, set
, &elem
.key_end
.val
,
7096 nla
[NFTA_SET_ELEM_KEY_END
]);
7100 err
= nft_set_ext_add_length(&tmpl
, NFT_SET_EXT_KEY_END
, set
->klen
);
7102 goto fail_elem_key_end
;
7106 elem
.priv
= nft_set_elem_init(set
, &tmpl
, elem
.key
.val
.data
,
7107 elem
.key_end
.val
.data
, NULL
, 0, 0,
7108 GFP_KERNEL_ACCOUNT
);
7109 if (IS_ERR(elem
.priv
)) {
7110 err
= PTR_ERR(elem
.priv
);
7111 goto fail_elem_key_end
;
7114 ext
= nft_set_elem_ext(set
, elem
.priv
);
7116 *nft_set_ext_flags(ext
) = flags
;
7118 trans
= nft_trans_elem_alloc(ctx
, NFT_MSG_DELSETELEM
, set
);
7122 err
= nft_setelem_deactivate(ctx
->net
, set
, &elem
, flags
);
7126 nft_setelem_data_deactivate(ctx
->net
, set
, elem
.priv
);
7128 nft_trans_elem_priv(trans
) = elem
.priv
;
7129 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7137 nft_data_release(&elem
.key_end
.val
, NFT_DATA_VALUE
);
7139 nft_data_release(&elem
.key
.val
, NFT_DATA_VALUE
);
7143 static int nft_setelem_flush(const struct nft_ctx
*ctx
,
7144 struct nft_set
*set
,
7145 const struct nft_set_iter
*iter
,
7146 struct nft_elem_priv
*elem_priv
)
7148 struct nft_trans
*trans
;
7150 trans
= nft_trans_alloc_gfp(ctx
, NFT_MSG_DELSETELEM
,
7151 sizeof(struct nft_trans_elem
), GFP_ATOMIC
);
7155 set
->ops
->flush(ctx
->net
, set
, elem_priv
);
7158 nft_setelem_data_deactivate(ctx
->net
, set
, elem_priv
);
7159 nft_trans_elem_set(trans
) = set
;
7160 nft_trans_elem_priv(trans
) = elem_priv
;
7161 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7166 static int __nft_set_catchall_flush(const struct nft_ctx
*ctx
,
7167 struct nft_set
*set
,
7168 struct nft_elem_priv
*elem_priv
)
7170 struct nft_trans
*trans
;
7172 trans
= nft_trans_alloc_gfp(ctx
, NFT_MSG_DELSETELEM
,
7173 sizeof(struct nft_trans_elem
), GFP_KERNEL
);
7177 nft_setelem_data_deactivate(ctx
->net
, set
, elem_priv
);
7178 nft_trans_elem_set(trans
) = set
;
7179 nft_trans_elem_priv(trans
) = elem_priv
;
7180 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7185 static int nft_set_catchall_flush(const struct nft_ctx
*ctx
,
7186 struct nft_set
*set
)
7188 u8 genmask
= nft_genmask_next(ctx
->net
);
7189 struct nft_set_elem_catchall
*catchall
;
7190 struct nft_set_ext
*ext
;
7193 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
7194 ext
= nft_set_elem_ext(set
, catchall
->elem
);
7195 if (!nft_set_elem_active(ext
, genmask
))
7198 ret
= __nft_set_catchall_flush(ctx
, set
, catchall
->elem
);
7201 nft_set_elem_change_active(ctx
->net
, set
, ext
);
7207 static int nft_set_flush(struct nft_ctx
*ctx
, struct nft_set
*set
, u8 genmask
)
7209 struct nft_set_iter iter
= {
7211 .fn
= nft_setelem_flush
,
7214 set
->ops
->walk(ctx
, set
, &iter
);
7216 iter
.err
= nft_set_catchall_flush(ctx
, set
);
7221 static int nf_tables_delsetelem(struct sk_buff
*skb
,
7222 const struct nfnl_info
*info
,
7223 const struct nlattr
* const nla
[])
7225 struct netlink_ext_ack
*extack
= info
->extack
;
7226 u8 genmask
= nft_genmask_next(info
->net
);
7227 u8 family
= info
->nfmsg
->nfgen_family
;
7228 struct net
*net
= info
->net
;
7229 const struct nlattr
*attr
;
7230 struct nft_table
*table
;
7231 struct nft_set
*set
;
7235 table
= nft_table_lookup(net
, nla
[NFTA_SET_ELEM_LIST_TABLE
], family
,
7236 genmask
, NETLINK_CB(skb
).portid
);
7237 if (IS_ERR(table
)) {
7238 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_TABLE
]);
7239 return PTR_ERR(table
);
7242 set
= nft_set_lookup(table
, nla
[NFTA_SET_ELEM_LIST_SET
], genmask
);
7244 NL_SET_BAD_ATTR(extack
, nla
[NFTA_SET_ELEM_LIST_SET
]);
7245 return PTR_ERR(set
);
7248 if (nft_set_is_anonymous(set
))
7251 if (!list_empty(&set
->bindings
) && (set
->flags
& NFT_SET_CONSTANT
))
7254 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7256 if (!nla
[NFTA_SET_ELEM_LIST_ELEMENTS
])
7257 return nft_set_flush(&ctx
, set
, genmask
);
7259 nla_for_each_nested(attr
, nla
[NFTA_SET_ELEM_LIST_ELEMENTS
], rem
) {
7260 err
= nft_del_setelem(&ctx
, set
, attr
);
7261 if (err
== -ENOENT
&&
7262 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYSETELEM
)
7266 NL_SET_BAD_ATTR(extack
, attr
);
7279 * nft_register_obj- register nf_tables stateful object type
7280 * @obj_type: object type
7282 * Registers the object type for use with nf_tables. Returns zero on
7283 * success or a negative errno code otherwise.
7285 int nft_register_obj(struct nft_object_type
*obj_type
)
7287 if (obj_type
->type
== NFT_OBJECT_UNSPEC
)
7290 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7291 list_add_rcu(&obj_type
->list
, &nf_tables_objects
);
7292 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7295 EXPORT_SYMBOL_GPL(nft_register_obj
);
7298 * nft_unregister_obj - unregister nf_tables object type
7299 * @obj_type: object type
7301 * Unregisters the object type for use with nf_tables.
7303 void nft_unregister_obj(struct nft_object_type
*obj_type
)
7305 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7306 list_del_rcu(&obj_type
->list
);
7307 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7309 EXPORT_SYMBOL_GPL(nft_unregister_obj
);
7311 struct nft_object
*nft_obj_lookup(const struct net
*net
,
7312 const struct nft_table
*table
,
7313 const struct nlattr
*nla
, u32 objtype
,
7316 struct nft_object_hash_key k
= { .table
= table
};
7317 char search
[NFT_OBJ_MAXNAMELEN
];
7318 struct rhlist_head
*tmp
, *list
;
7319 struct nft_object
*obj
;
7321 nla_strscpy(search
, nla
, sizeof(search
));
7324 WARN_ON_ONCE(!rcu_read_lock_held() &&
7325 !lockdep_commit_lock_is_held(net
));
7328 list
= rhltable_lookup(&nft_objname_ht
, &k
, nft_objname_ht_params
);
7332 rhl_for_each_entry_rcu(obj
, tmp
, list
, rhlhead
) {
7333 if (objtype
== obj
->ops
->type
->type
&&
7334 nft_active_genmask(obj
, genmask
)) {
7341 return ERR_PTR(-ENOENT
);
7343 EXPORT_SYMBOL_GPL(nft_obj_lookup
);
7345 static struct nft_object
*nft_obj_lookup_byhandle(const struct nft_table
*table
,
7346 const struct nlattr
*nla
,
7347 u32 objtype
, u8 genmask
)
7349 struct nft_object
*obj
;
7351 list_for_each_entry(obj
, &table
->objects
, list
) {
7352 if (be64_to_cpu(nla_get_be64(nla
)) == obj
->handle
&&
7353 objtype
== obj
->ops
->type
->type
&&
7354 nft_active_genmask(obj
, genmask
))
7357 return ERR_PTR(-ENOENT
);
7360 static const struct nla_policy nft_obj_policy
[NFTA_OBJ_MAX
+ 1] = {
7361 [NFTA_OBJ_TABLE
] = { .type
= NLA_STRING
,
7362 .len
= NFT_TABLE_MAXNAMELEN
- 1 },
7363 [NFTA_OBJ_NAME
] = { .type
= NLA_STRING
,
7364 .len
= NFT_OBJ_MAXNAMELEN
- 1 },
7365 [NFTA_OBJ_TYPE
] = { .type
= NLA_U32
},
7366 [NFTA_OBJ_DATA
] = { .type
= NLA_NESTED
},
7367 [NFTA_OBJ_HANDLE
] = { .type
= NLA_U64
},
7368 [NFTA_OBJ_USERDATA
] = { .type
= NLA_BINARY
,
7369 .len
= NFT_USERDATA_MAXLEN
},
7372 static struct nft_object
*nft_obj_init(const struct nft_ctx
*ctx
,
7373 const struct nft_object_type
*type
,
7374 const struct nlattr
*attr
)
7377 const struct nft_object_ops
*ops
;
7378 struct nft_object
*obj
;
7381 tb
= kmalloc_array(type
->maxattr
+ 1, sizeof(*tb
), GFP_KERNEL
);
7386 err
= nla_parse_nested_deprecated(tb
, type
->maxattr
, attr
,
7387 type
->policy
, NULL
);
7391 memset(tb
, 0, sizeof(tb
[0]) * (type
->maxattr
+ 1));
7394 if (type
->select_ops
) {
7395 ops
= type
->select_ops(ctx
, (const struct nlattr
* const *)tb
);
7405 obj
= kzalloc(sizeof(*obj
) + ops
->size
, GFP_KERNEL_ACCOUNT
);
7409 err
= ops
->init(ctx
, (const struct nlattr
* const *)tb
, obj
);
7422 return ERR_PTR(err
);
7425 static int nft_object_dump(struct sk_buff
*skb
, unsigned int attr
,
7426 struct nft_object
*obj
, bool reset
)
7428 struct nlattr
*nest
;
7430 nest
= nla_nest_start_noflag(skb
, attr
);
7432 goto nla_put_failure
;
7433 if (obj
->ops
->dump(skb
, obj
, reset
) < 0)
7434 goto nla_put_failure
;
7435 nla_nest_end(skb
, nest
);
7442 static const struct nft_object_type
*__nft_obj_type_get(u32 objtype
)
7444 const struct nft_object_type
*type
;
7446 list_for_each_entry(type
, &nf_tables_objects
, list
) {
7447 if (objtype
== type
->type
)
7453 static const struct nft_object_type
*
7454 nft_obj_type_get(struct net
*net
, u32 objtype
)
7456 const struct nft_object_type
*type
;
7458 type
= __nft_obj_type_get(objtype
);
7459 if (type
!= NULL
&& try_module_get(type
->owner
))
7462 lockdep_nfnl_nft_mutex_not_held();
7463 #ifdef CONFIG_MODULES
7465 if (nft_request_module(net
, "nft-obj-%u", objtype
) == -EAGAIN
)
7466 return ERR_PTR(-EAGAIN
);
7469 return ERR_PTR(-ENOENT
);
7472 static int nf_tables_updobj(const struct nft_ctx
*ctx
,
7473 const struct nft_object_type
*type
,
7474 const struct nlattr
*attr
,
7475 struct nft_object
*obj
)
7477 struct nft_object
*newobj
;
7478 struct nft_trans
*trans
;
7481 if (!try_module_get(type
->owner
))
7484 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWOBJ
,
7485 sizeof(struct nft_trans_obj
));
7489 newobj
= nft_obj_init(ctx
, type
, attr
);
7490 if (IS_ERR(newobj
)) {
7491 err
= PTR_ERR(newobj
);
7492 goto err_free_trans
;
7495 nft_trans_obj(trans
) = obj
;
7496 nft_trans_obj_update(trans
) = true;
7497 nft_trans_obj_newobj(trans
) = newobj
;
7498 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
7505 module_put(type
->owner
);
7509 static int nf_tables_newobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
7510 const struct nlattr
* const nla
[])
7512 struct netlink_ext_ack
*extack
= info
->extack
;
7513 u8 genmask
= nft_genmask_next(info
->net
);
7514 u8 family
= info
->nfmsg
->nfgen_family
;
7515 const struct nft_object_type
*type
;
7516 struct net
*net
= info
->net
;
7517 struct nft_table
*table
;
7518 struct nft_object
*obj
;
7523 if (!nla
[NFTA_OBJ_TYPE
] ||
7524 !nla
[NFTA_OBJ_NAME
] ||
7525 !nla
[NFTA_OBJ_DATA
])
7528 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
7529 NETLINK_CB(skb
).portid
);
7530 if (IS_ERR(table
)) {
7531 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
7532 return PTR_ERR(table
);
7535 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
7536 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
7539 if (err
!= -ENOENT
) {
7540 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
7544 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
7545 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
7548 if (info
->nlh
->nlmsg_flags
& NLM_F_REPLACE
)
7551 type
= __nft_obj_type_get(objtype
);
7552 if (WARN_ON_ONCE(!type
))
7555 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7557 return nf_tables_updobj(&ctx
, type
, nla
[NFTA_OBJ_DATA
], obj
);
7560 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7562 if (!nft_use_inc(&table
->use
))
7565 type
= nft_obj_type_get(net
, objtype
);
7567 err
= PTR_ERR(type
);
7571 obj
= nft_obj_init(&ctx
, type
, nla
[NFTA_OBJ_DATA
]);
7576 obj
->key
.table
= table
;
7577 obj
->handle
= nf_tables_alloc_handle(table
);
7579 obj
->key
.name
= nla_strdup(nla
[NFTA_OBJ_NAME
], GFP_KERNEL_ACCOUNT
);
7580 if (!obj
->key
.name
) {
7585 if (nla
[NFTA_OBJ_USERDATA
]) {
7586 obj
->udata
= nla_memdup(nla
[NFTA_OBJ_USERDATA
], GFP_KERNEL_ACCOUNT
);
7587 if (obj
->udata
== NULL
)
7590 obj
->udlen
= nla_len(nla
[NFTA_OBJ_USERDATA
]);
7593 err
= nft_trans_obj_add(&ctx
, NFT_MSG_NEWOBJ
, obj
);
7597 err
= rhltable_insert(&nft_objname_ht
, &obj
->rhlhead
,
7598 nft_objname_ht_params
);
7602 list_add_tail_rcu(&obj
->list
, &table
->objects
);
7606 /* queued in transaction log */
7607 INIT_LIST_HEAD(&obj
->list
);
7612 kfree(obj
->key
.name
);
7614 if (obj
->ops
->destroy
)
7615 obj
->ops
->destroy(&ctx
, obj
);
7618 module_put(type
->owner
);
7620 nft_use_dec_restore(&table
->use
);
7625 static int nf_tables_fill_obj_info(struct sk_buff
*skb
, struct net
*net
,
7626 u32 portid
, u32 seq
, int event
, u32 flags
,
7627 int family
, const struct nft_table
*table
,
7628 struct nft_object
*obj
, bool reset
)
7630 struct nlmsghdr
*nlh
;
7632 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
7633 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
7634 NFNETLINK_V0
, nft_base_seq(net
));
7636 goto nla_put_failure
;
7638 if (nla_put_string(skb
, NFTA_OBJ_TABLE
, table
->name
) ||
7639 nla_put_string(skb
, NFTA_OBJ_NAME
, obj
->key
.name
) ||
7640 nla_put_be64(skb
, NFTA_OBJ_HANDLE
, cpu_to_be64(obj
->handle
),
7642 goto nla_put_failure
;
7644 if (event
== NFT_MSG_DELOBJ
) {
7645 nlmsg_end(skb
, nlh
);
7649 if (nla_put_be32(skb
, NFTA_OBJ_TYPE
, htonl(obj
->ops
->type
->type
)) ||
7650 nla_put_be32(skb
, NFTA_OBJ_USE
, htonl(obj
->use
)) ||
7651 nft_object_dump(skb
, NFTA_OBJ_DATA
, obj
, reset
))
7652 goto nla_put_failure
;
7655 nla_put(skb
, NFTA_OBJ_USERDATA
, obj
->udlen
, obj
->udata
))
7656 goto nla_put_failure
;
7658 nlmsg_end(skb
, nlh
);
7662 nlmsg_trim(skb
, nlh
);
7666 static void audit_log_obj_reset(const struct nft_table
*table
,
7667 unsigned int base_seq
, unsigned int nentries
)
7669 char *buf
= kasprintf(GFP_ATOMIC
, "%s:%u", table
->name
, base_seq
);
7671 audit_log_nfcfg(buf
, table
->family
, nentries
,
7672 AUDIT_NFT_OP_OBJ_RESET
, GFP_ATOMIC
);
7676 struct nft_obj_dump_ctx
{
7683 static int nf_tables_dump_obj(struct sk_buff
*skb
, struct netlink_callback
*cb
)
7685 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
7686 struct nft_obj_dump_ctx
*ctx
= (void *)cb
->ctx
;
7687 struct net
*net
= sock_net(skb
->sk
);
7688 int family
= nfmsg
->nfgen_family
;
7689 struct nftables_pernet
*nft_net
;
7690 const struct nft_table
*table
;
7691 unsigned int entries
= 0;
7692 struct nft_object
*obj
;
7693 unsigned int idx
= 0;
7697 nft_net
= nft_pernet(net
);
7698 cb
->seq
= READ_ONCE(nft_net
->base_seq
);
7700 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
7701 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
7705 list_for_each_entry_rcu(obj
, &table
->objects
, list
) {
7706 if (!nft_is_active(net
, obj
))
7708 if (idx
< ctx
->s_idx
)
7710 if (ctx
->table
&& strcmp(ctx
->table
, table
->name
))
7712 if (ctx
->type
!= NFT_OBJECT_UNSPEC
&&
7713 obj
->ops
->type
->type
!= ctx
->type
)
7716 rc
= nf_tables_fill_obj_info(skb
, net
,
7717 NETLINK_CB(cb
->skb
).portid
,
7720 NLM_F_MULTI
| NLM_F_APPEND
,
7721 table
->family
, table
,
7727 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
7731 if (ctx
->reset
&& entries
)
7732 audit_log_obj_reset(table
, nft_net
->base_seq
, entries
);
7742 static int nf_tables_dump_obj_start(struct netlink_callback
*cb
)
7744 struct nft_obj_dump_ctx
*ctx
= (void *)cb
->ctx
;
7745 const struct nlattr
* const *nla
= cb
->data
;
7747 BUILD_BUG_ON(sizeof(*ctx
) > sizeof(cb
->ctx
));
7749 if (nla
[NFTA_OBJ_TABLE
]) {
7750 ctx
->table
= nla_strdup(nla
[NFTA_OBJ_TABLE
], GFP_ATOMIC
);
7755 if (nla
[NFTA_OBJ_TYPE
])
7756 ctx
->type
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
7758 if (NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
7764 static int nf_tables_dump_obj_done(struct netlink_callback
*cb
)
7766 struct nft_obj_dump_ctx
*ctx
= (void *)cb
->ctx
;
7773 /* called with rcu_read_lock held */
7774 static int nf_tables_getobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
7775 const struct nlattr
* const nla
[])
7777 struct netlink_ext_ack
*extack
= info
->extack
;
7778 u8 genmask
= nft_genmask_cur(info
->net
);
7779 u8 family
= info
->nfmsg
->nfgen_family
;
7780 const struct nft_table
*table
;
7781 struct net
*net
= info
->net
;
7782 struct nft_object
*obj
;
7783 struct sk_buff
*skb2
;
7788 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
7789 struct netlink_dump_control c
= {
7790 .start
= nf_tables_dump_obj_start
,
7791 .dump
= nf_tables_dump_obj
,
7792 .done
= nf_tables_dump_obj_done
,
7793 .module
= THIS_MODULE
,
7794 .data
= (void *)nla
,
7797 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
7800 if (!nla
[NFTA_OBJ_NAME
] ||
7801 !nla
[NFTA_OBJ_TYPE
])
7804 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
, 0);
7805 if (IS_ERR(table
)) {
7806 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
7807 return PTR_ERR(table
);
7810 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
7811 obj
= nft_obj_lookup(net
, table
, nla
[NFTA_OBJ_NAME
], objtype
, genmask
);
7813 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_NAME
]);
7814 return PTR_ERR(obj
);
7817 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
7821 if (NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_GETOBJ_RESET
)
7825 const struct nftables_pernet
*nft_net
;
7828 nft_net
= nft_pernet(net
);
7829 buf
= kasprintf(GFP_ATOMIC
, "%s:%u", table
->name
, nft_net
->base_seq
);
7831 audit_log_nfcfg(buf
,
7834 AUDIT_NFT_OP_OBJ_RESET
,
7839 err
= nf_tables_fill_obj_info(skb2
, net
, NETLINK_CB(skb
).portid
,
7840 info
->nlh
->nlmsg_seq
, NFT_MSG_NEWOBJ
, 0,
7841 family
, table
, obj
, reset
);
7843 goto err_fill_obj_info
;
7845 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
7852 static void nft_obj_destroy(const struct nft_ctx
*ctx
, struct nft_object
*obj
)
7854 if (obj
->ops
->destroy
)
7855 obj
->ops
->destroy(ctx
, obj
);
7857 module_put(obj
->ops
->type
->owner
);
7858 kfree(obj
->key
.name
);
7863 static int nf_tables_delobj(struct sk_buff
*skb
, const struct nfnl_info
*info
,
7864 const struct nlattr
* const nla
[])
7866 struct netlink_ext_ack
*extack
= info
->extack
;
7867 u8 genmask
= nft_genmask_next(info
->net
);
7868 u8 family
= info
->nfmsg
->nfgen_family
;
7869 struct net
*net
= info
->net
;
7870 const struct nlattr
*attr
;
7871 struct nft_table
*table
;
7872 struct nft_object
*obj
;
7876 if (!nla
[NFTA_OBJ_TYPE
] ||
7877 (!nla
[NFTA_OBJ_NAME
] && !nla
[NFTA_OBJ_HANDLE
]))
7880 table
= nft_table_lookup(net
, nla
[NFTA_OBJ_TABLE
], family
, genmask
,
7881 NETLINK_CB(skb
).portid
);
7882 if (IS_ERR(table
)) {
7883 NL_SET_BAD_ATTR(extack
, nla
[NFTA_OBJ_TABLE
]);
7884 return PTR_ERR(table
);
7887 objtype
= ntohl(nla_get_be32(nla
[NFTA_OBJ_TYPE
]));
7888 if (nla
[NFTA_OBJ_HANDLE
]) {
7889 attr
= nla
[NFTA_OBJ_HANDLE
];
7890 obj
= nft_obj_lookup_byhandle(table
, attr
, objtype
, genmask
);
7892 attr
= nla
[NFTA_OBJ_NAME
];
7893 obj
= nft_obj_lookup(net
, table
, attr
, objtype
, genmask
);
7897 if (PTR_ERR(obj
) == -ENOENT
&&
7898 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYOBJ
)
7901 NL_SET_BAD_ATTR(extack
, attr
);
7902 return PTR_ERR(obj
);
7905 NL_SET_BAD_ATTR(extack
, attr
);
7909 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
7911 return nft_delobj(&ctx
, obj
);
7915 __nft_obj_notify(struct net
*net
, const struct nft_table
*table
,
7916 struct nft_object
*obj
, u32 portid
, u32 seq
, int event
,
7917 u16 flags
, int family
, int report
, gfp_t gfp
)
7919 struct nftables_pernet
*nft_net
= nft_pernet(net
);
7920 struct sk_buff
*skb
;
7924 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
7927 skb
= nlmsg_new(NLMSG_GOODSIZE
, gfp
);
7931 err
= nf_tables_fill_obj_info(skb
, net
, portid
, seq
, event
,
7932 flags
& (NLM_F_CREATE
| NLM_F_EXCL
),
7933 family
, table
, obj
, false);
7939 nft_notify_enqueue(skb
, report
, &nft_net
->notify_list
);
7942 nfnetlink_set_err(net
, portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
7945 void nft_obj_notify(struct net
*net
, const struct nft_table
*table
,
7946 struct nft_object
*obj
, u32 portid
, u32 seq
, int event
,
7947 u16 flags
, int family
, int report
, gfp_t gfp
)
7949 struct nftables_pernet
*nft_net
= nft_pernet(net
);
7950 char *buf
= kasprintf(gfp
, "%s:%u",
7951 table
->name
, nft_net
->base_seq
);
7953 audit_log_nfcfg(buf
,
7956 event
== NFT_MSG_NEWOBJ
?
7957 AUDIT_NFT_OP_OBJ_REGISTER
:
7958 AUDIT_NFT_OP_OBJ_UNREGISTER
,
7962 __nft_obj_notify(net
, table
, obj
, portid
, seq
, event
,
7963 flags
, family
, report
, gfp
);
7965 EXPORT_SYMBOL_GPL(nft_obj_notify
);
7967 static void nf_tables_obj_notify(const struct nft_ctx
*ctx
,
7968 struct nft_object
*obj
, int event
)
7970 __nft_obj_notify(ctx
->net
, ctx
->table
, obj
, ctx
->portid
,
7971 ctx
->seq
, event
, ctx
->flags
, ctx
->family
,
7972 ctx
->report
, GFP_KERNEL
);
7978 void nft_register_flowtable_type(struct nf_flowtable_type
*type
)
7980 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7981 list_add_tail_rcu(&type
->list
, &nf_tables_flowtables
);
7982 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7984 EXPORT_SYMBOL_GPL(nft_register_flowtable_type
);
7986 void nft_unregister_flowtable_type(struct nf_flowtable_type
*type
)
7988 nfnl_lock(NFNL_SUBSYS_NFTABLES
);
7989 list_del_rcu(&type
->list
);
7990 nfnl_unlock(NFNL_SUBSYS_NFTABLES
);
7992 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type
);
7994 static const struct nla_policy nft_flowtable_policy
[NFTA_FLOWTABLE_MAX
+ 1] = {
7995 [NFTA_FLOWTABLE_TABLE
] = { .type
= NLA_STRING
,
7996 .len
= NFT_NAME_MAXLEN
- 1 },
7997 [NFTA_FLOWTABLE_NAME
] = { .type
= NLA_STRING
,
7998 .len
= NFT_NAME_MAXLEN
- 1 },
7999 [NFTA_FLOWTABLE_HOOK
] = { .type
= NLA_NESTED
},
8000 [NFTA_FLOWTABLE_HANDLE
] = { .type
= NLA_U64
},
8001 [NFTA_FLOWTABLE_FLAGS
] = { .type
= NLA_U32
},
8004 struct nft_flowtable
*nft_flowtable_lookup(const struct nft_table
*table
,
8005 const struct nlattr
*nla
, u8 genmask
)
8007 struct nft_flowtable
*flowtable
;
8009 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
8010 if (!nla_strcmp(nla
, flowtable
->name
) &&
8011 nft_active_genmask(flowtable
, genmask
))
8014 return ERR_PTR(-ENOENT
);
8016 EXPORT_SYMBOL_GPL(nft_flowtable_lookup
);
8018 void nf_tables_deactivate_flowtable(const struct nft_ctx
*ctx
,
8019 struct nft_flowtable
*flowtable
,
8020 enum nft_trans_phase phase
)
8023 case NFT_TRANS_PREPARE_ERROR
:
8024 case NFT_TRANS_PREPARE
:
8025 case NFT_TRANS_ABORT
:
8026 case NFT_TRANS_RELEASE
:
8027 nft_use_dec(&flowtable
->use
);
8033 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable
);
8035 static struct nft_flowtable
*
8036 nft_flowtable_lookup_byhandle(const struct nft_table
*table
,
8037 const struct nlattr
*nla
, u8 genmask
)
8039 struct nft_flowtable
*flowtable
;
8041 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
8042 if (be64_to_cpu(nla_get_be64(nla
)) == flowtable
->handle
&&
8043 nft_active_genmask(flowtable
, genmask
))
8046 return ERR_PTR(-ENOENT
);
8049 struct nft_flowtable_hook
{
8052 struct list_head list
;
8055 static const struct nla_policy nft_flowtable_hook_policy
[NFTA_FLOWTABLE_HOOK_MAX
+ 1] = {
8056 [NFTA_FLOWTABLE_HOOK_NUM
] = { .type
= NLA_U32
},
8057 [NFTA_FLOWTABLE_HOOK_PRIORITY
] = { .type
= NLA_U32
},
8058 [NFTA_FLOWTABLE_HOOK_DEVS
] = { .type
= NLA_NESTED
},
8061 static int nft_flowtable_parse_hook(const struct nft_ctx
*ctx
,
8062 const struct nlattr
* const nla
[],
8063 struct nft_flowtable_hook
*flowtable_hook
,
8064 struct nft_flowtable
*flowtable
,
8065 struct netlink_ext_ack
*extack
, bool add
)
8067 struct nlattr
*tb
[NFTA_FLOWTABLE_HOOK_MAX
+ 1];
8068 struct nft_hook
*hook
;
8069 int hooknum
, priority
;
8072 INIT_LIST_HEAD(&flowtable_hook
->list
);
8074 err
= nla_parse_nested_deprecated(tb
, NFTA_FLOWTABLE_HOOK_MAX
,
8075 nla
[NFTA_FLOWTABLE_HOOK
],
8076 nft_flowtable_hook_policy
, NULL
);
8081 if (!tb
[NFTA_FLOWTABLE_HOOK_NUM
] ||
8082 !tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]) {
8083 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
8087 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
8088 if (hooknum
!= NF_NETDEV_INGRESS
)
8091 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
8093 flowtable_hook
->priority
= priority
;
8094 flowtable_hook
->num
= hooknum
;
8096 if (tb
[NFTA_FLOWTABLE_HOOK_NUM
]) {
8097 hooknum
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_NUM
]));
8098 if (hooknum
!= flowtable
->hooknum
)
8102 if (tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]) {
8103 priority
= ntohl(nla_get_be32(tb
[NFTA_FLOWTABLE_HOOK_PRIORITY
]));
8104 if (priority
!= flowtable
->data
.priority
)
8108 flowtable_hook
->priority
= flowtable
->data
.priority
;
8109 flowtable_hook
->num
= flowtable
->hooknum
;
8112 if (tb
[NFTA_FLOWTABLE_HOOK_DEVS
]) {
8113 err
= nf_tables_parse_netdev_hooks(ctx
->net
,
8114 tb
[NFTA_FLOWTABLE_HOOK_DEVS
],
8115 &flowtable_hook
->list
,
8121 list_for_each_entry(hook
, &flowtable_hook
->list
, list
) {
8122 hook
->ops
.pf
= NFPROTO_NETDEV
;
8123 hook
->ops
.hooknum
= flowtable_hook
->num
;
8124 hook
->ops
.priority
= flowtable_hook
->priority
;
8125 hook
->ops
.priv
= &flowtable
->data
;
8126 hook
->ops
.hook
= flowtable
->data
.type
->hook
;
8132 static const struct nf_flowtable_type
*__nft_flowtable_type_get(u8 family
)
8134 const struct nf_flowtable_type
*type
;
8136 list_for_each_entry(type
, &nf_tables_flowtables
, list
) {
8137 if (family
== type
->family
)
8143 static const struct nf_flowtable_type
*
8144 nft_flowtable_type_get(struct net
*net
, u8 family
)
8146 const struct nf_flowtable_type
*type
;
8148 type
= __nft_flowtable_type_get(family
);
8149 if (type
!= NULL
&& try_module_get(type
->owner
))
8152 lockdep_nfnl_nft_mutex_not_held();
8153 #ifdef CONFIG_MODULES
8155 if (nft_request_module(net
, "nf-flowtable-%u", family
) == -EAGAIN
)
8156 return ERR_PTR(-EAGAIN
);
8159 return ERR_PTR(-ENOENT
);
8162 /* Only called from error and netdev event paths. */
8163 static void nft_unregister_flowtable_hook(struct net
*net
,
8164 struct nft_flowtable
*flowtable
,
8165 struct nft_hook
*hook
)
8167 nf_unregister_net_hook(net
, &hook
->ops
);
8168 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
8172 static void __nft_unregister_flowtable_net_hooks(struct net
*net
,
8173 struct list_head
*hook_list
,
8174 bool release_netdev
)
8176 struct nft_hook
*hook
, *next
;
8178 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
8179 nf_unregister_net_hook(net
, &hook
->ops
);
8180 if (release_netdev
) {
8181 list_del(&hook
->list
);
8182 kfree_rcu(hook
, rcu
);
8187 static void nft_unregister_flowtable_net_hooks(struct net
*net
,
8188 struct list_head
*hook_list
)
8190 __nft_unregister_flowtable_net_hooks(net
, hook_list
, false);
8193 static int nft_register_flowtable_net_hooks(struct net
*net
,
8194 struct nft_table
*table
,
8195 struct list_head
*hook_list
,
8196 struct nft_flowtable
*flowtable
)
8198 struct nft_hook
*hook
, *hook2
, *next
;
8199 struct nft_flowtable
*ft
;
8202 list_for_each_entry(hook
, hook_list
, list
) {
8203 list_for_each_entry(ft
, &table
->flowtables
, list
) {
8204 if (!nft_is_active_next(net
, ft
))
8207 list_for_each_entry(hook2
, &ft
->hook_list
, list
) {
8208 if (hook
->ops
.dev
== hook2
->ops
.dev
&&
8209 hook
->ops
.pf
== hook2
->ops
.pf
) {
8211 goto err_unregister_net_hooks
;
8216 err
= flowtable
->data
.type
->setup(&flowtable
->data
,
8220 goto err_unregister_net_hooks
;
8222 err
= nf_register_net_hook(net
, &hook
->ops
);
8224 flowtable
->data
.type
->setup(&flowtable
->data
,
8227 goto err_unregister_net_hooks
;
8235 err_unregister_net_hooks
:
8236 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
8240 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
8241 list_del_rcu(&hook
->list
);
8242 kfree_rcu(hook
, rcu
);
8248 static void nft_hooks_destroy(struct list_head
*hook_list
)
8250 struct nft_hook
*hook
, *next
;
8252 list_for_each_entry_safe(hook
, next
, hook_list
, list
) {
8253 list_del_rcu(&hook
->list
);
8254 kfree_rcu(hook
, rcu
);
8258 static int nft_flowtable_update(struct nft_ctx
*ctx
, const struct nlmsghdr
*nlh
,
8259 struct nft_flowtable
*flowtable
,
8260 struct netlink_ext_ack
*extack
)
8262 const struct nlattr
* const *nla
= ctx
->nla
;
8263 struct nft_flowtable_hook flowtable_hook
;
8264 struct nft_hook
*hook
, *next
;
8265 struct nft_trans
*trans
;
8266 bool unregister
= false;
8270 err
= nft_flowtable_parse_hook(ctx
, nla
, &flowtable_hook
, flowtable
,
8275 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
8276 if (nft_hook_list_find(&flowtable
->hook_list
, hook
)) {
8277 list_del(&hook
->list
);
8282 if (nla
[NFTA_FLOWTABLE_FLAGS
]) {
8283 flags
= ntohl(nla_get_be32(nla
[NFTA_FLOWTABLE_FLAGS
]));
8284 if (flags
& ~NFT_FLOWTABLE_MASK
) {
8286 goto err_flowtable_update_hook
;
8288 if ((flowtable
->data
.flags
& NFT_FLOWTABLE_HW_OFFLOAD
) ^
8289 (flags
& NFT_FLOWTABLE_HW_OFFLOAD
)) {
8291 goto err_flowtable_update_hook
;
8294 flags
= flowtable
->data
.flags
;
8297 err
= nft_register_flowtable_net_hooks(ctx
->net
, ctx
->table
,
8298 &flowtable_hook
.list
, flowtable
);
8300 goto err_flowtable_update_hook
;
8302 trans
= nft_trans_alloc(ctx
, NFT_MSG_NEWFLOWTABLE
,
8303 sizeof(struct nft_trans_flowtable
));
8307 goto err_flowtable_update_hook
;
8310 nft_trans_flowtable_flags(trans
) = flags
;
8311 nft_trans_flowtable(trans
) = flowtable
;
8312 nft_trans_flowtable_update(trans
) = true;
8313 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
8314 list_splice(&flowtable_hook
.list
, &nft_trans_flowtable_hooks(trans
));
8316 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
8320 err_flowtable_update_hook
:
8321 list_for_each_entry_safe(hook
, next
, &flowtable_hook
.list
, list
) {
8323 nft_unregister_flowtable_hook(ctx
->net
, flowtable
, hook
);
8324 list_del_rcu(&hook
->list
);
8325 kfree_rcu(hook
, rcu
);
8332 static int nf_tables_newflowtable(struct sk_buff
*skb
,
8333 const struct nfnl_info
*info
,
8334 const struct nlattr
* const nla
[])
8336 struct netlink_ext_ack
*extack
= info
->extack
;
8337 struct nft_flowtable_hook flowtable_hook
;
8338 u8 genmask
= nft_genmask_next(info
->net
);
8339 u8 family
= info
->nfmsg
->nfgen_family
;
8340 const struct nf_flowtable_type
*type
;
8341 struct nft_flowtable
*flowtable
;
8342 struct nft_hook
*hook
, *next
;
8343 struct net
*net
= info
->net
;
8344 struct nft_table
*table
;
8348 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
8349 !nla
[NFTA_FLOWTABLE_NAME
] ||
8350 !nla
[NFTA_FLOWTABLE_HOOK
])
8353 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
8354 genmask
, NETLINK_CB(skb
).portid
);
8355 if (IS_ERR(table
)) {
8356 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
8357 return PTR_ERR(table
);
8360 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
8362 if (IS_ERR(flowtable
)) {
8363 err
= PTR_ERR(flowtable
);
8364 if (err
!= -ENOENT
) {
8365 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
8369 if (info
->nlh
->nlmsg_flags
& NLM_F_EXCL
) {
8370 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
8374 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
8376 return nft_flowtable_update(&ctx
, info
->nlh
, flowtable
, extack
);
8379 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
8381 if (!nft_use_inc(&table
->use
))
8384 flowtable
= kzalloc(sizeof(*flowtable
), GFP_KERNEL_ACCOUNT
);
8387 goto flowtable_alloc
;
8390 flowtable
->table
= table
;
8391 flowtable
->handle
= nf_tables_alloc_handle(table
);
8392 INIT_LIST_HEAD(&flowtable
->hook_list
);
8394 flowtable
->name
= nla_strdup(nla
[NFTA_FLOWTABLE_NAME
], GFP_KERNEL_ACCOUNT
);
8395 if (!flowtable
->name
) {
8400 type
= nft_flowtable_type_get(net
, family
);
8402 err
= PTR_ERR(type
);
8406 if (nla
[NFTA_FLOWTABLE_FLAGS
]) {
8407 flowtable
->data
.flags
=
8408 ntohl(nla_get_be32(nla
[NFTA_FLOWTABLE_FLAGS
]));
8409 if (flowtable
->data
.flags
& ~NFT_FLOWTABLE_MASK
) {
8415 write_pnet(&flowtable
->data
.net
, net
);
8416 flowtable
->data
.type
= type
;
8417 err
= type
->init(&flowtable
->data
);
8421 err
= nft_flowtable_parse_hook(&ctx
, nla
, &flowtable_hook
, flowtable
,
8426 list_splice(&flowtable_hook
.list
, &flowtable
->hook_list
);
8427 flowtable
->data
.priority
= flowtable_hook
.priority
;
8428 flowtable
->hooknum
= flowtable_hook
.num
;
8430 err
= nft_register_flowtable_net_hooks(ctx
.net
, table
,
8431 &flowtable
->hook_list
,
8434 nft_hooks_destroy(&flowtable
->hook_list
);
8438 err
= nft_trans_flowtable_add(&ctx
, NFT_MSG_NEWFLOWTABLE
, flowtable
);
8442 list_add_tail_rcu(&flowtable
->list
, &table
->flowtables
);
8446 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
8447 nft_unregister_flowtable_hook(net
, flowtable
, hook
);
8448 list_del_rcu(&hook
->list
);
8449 kfree_rcu(hook
, rcu
);
8452 flowtable
->data
.type
->free(&flowtable
->data
);
8454 module_put(type
->owner
);
8456 kfree(flowtable
->name
);
8460 nft_use_dec_restore(&table
->use
);
8465 static void nft_flowtable_hook_release(struct nft_flowtable_hook
*flowtable_hook
)
8467 struct nft_hook
*this, *next
;
8469 list_for_each_entry_safe(this, next
, &flowtable_hook
->list
, list
) {
8470 list_del(&this->list
);
8475 static int nft_delflowtable_hook(struct nft_ctx
*ctx
,
8476 struct nft_flowtable
*flowtable
,
8477 struct netlink_ext_ack
*extack
)
8479 const struct nlattr
* const *nla
= ctx
->nla
;
8480 struct nft_flowtable_hook flowtable_hook
;
8481 LIST_HEAD(flowtable_del_list
);
8482 struct nft_hook
*this, *hook
;
8483 struct nft_trans
*trans
;
8486 err
= nft_flowtable_parse_hook(ctx
, nla
, &flowtable_hook
, flowtable
,
8491 list_for_each_entry(this, &flowtable_hook
.list
, list
) {
8492 hook
= nft_hook_list_find(&flowtable
->hook_list
, this);
8495 goto err_flowtable_del_hook
;
8497 list_move(&hook
->list
, &flowtable_del_list
);
8500 trans
= nft_trans_alloc(ctx
, NFT_MSG_DELFLOWTABLE
,
8501 sizeof(struct nft_trans_flowtable
));
8504 goto err_flowtable_del_hook
;
8507 nft_trans_flowtable(trans
) = flowtable
;
8508 nft_trans_flowtable_update(trans
) = true;
8509 INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans
));
8510 list_splice(&flowtable_del_list
, &nft_trans_flowtable_hooks(trans
));
8511 nft_flowtable_hook_release(&flowtable_hook
);
8513 nft_trans_commit_list_add_tail(ctx
->net
, trans
);
8517 err_flowtable_del_hook
:
8518 list_splice(&flowtable_del_list
, &flowtable
->hook_list
);
8519 nft_flowtable_hook_release(&flowtable_hook
);
8524 static int nf_tables_delflowtable(struct sk_buff
*skb
,
8525 const struct nfnl_info
*info
,
8526 const struct nlattr
* const nla
[])
8528 struct netlink_ext_ack
*extack
= info
->extack
;
8529 u8 genmask
= nft_genmask_next(info
->net
);
8530 u8 family
= info
->nfmsg
->nfgen_family
;
8531 struct nft_flowtable
*flowtable
;
8532 struct net
*net
= info
->net
;
8533 const struct nlattr
*attr
;
8534 struct nft_table
*table
;
8537 if (!nla
[NFTA_FLOWTABLE_TABLE
] ||
8538 (!nla
[NFTA_FLOWTABLE_NAME
] &&
8539 !nla
[NFTA_FLOWTABLE_HANDLE
]))
8542 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
8543 genmask
, NETLINK_CB(skb
).portid
);
8544 if (IS_ERR(table
)) {
8545 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
8546 return PTR_ERR(table
);
8549 if (nla
[NFTA_FLOWTABLE_HANDLE
]) {
8550 attr
= nla
[NFTA_FLOWTABLE_HANDLE
];
8551 flowtable
= nft_flowtable_lookup_byhandle(table
, attr
, genmask
);
8553 attr
= nla
[NFTA_FLOWTABLE_NAME
];
8554 flowtable
= nft_flowtable_lookup(table
, attr
, genmask
);
8557 if (IS_ERR(flowtable
)) {
8558 if (PTR_ERR(flowtable
) == -ENOENT
&&
8559 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
) == NFT_MSG_DESTROYFLOWTABLE
)
8562 NL_SET_BAD_ATTR(extack
, attr
);
8563 return PTR_ERR(flowtable
);
8566 nft_ctx_init(&ctx
, net
, skb
, info
->nlh
, family
, table
, NULL
, nla
);
8568 if (nla
[NFTA_FLOWTABLE_HOOK
])
8569 return nft_delflowtable_hook(&ctx
, flowtable
, extack
);
8571 if (flowtable
->use
> 0) {
8572 NL_SET_BAD_ATTR(extack
, attr
);
8576 return nft_delflowtable(&ctx
, flowtable
);
8579 static int nf_tables_fill_flowtable_info(struct sk_buff
*skb
, struct net
*net
,
8580 u32 portid
, u32 seq
, int event
,
8581 u32 flags
, int family
,
8582 struct nft_flowtable
*flowtable
,
8583 struct list_head
*hook_list
)
8585 struct nlattr
*nest
, *nest_devs
;
8586 struct nft_hook
*hook
;
8587 struct nlmsghdr
*nlh
;
8589 event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, event
);
8590 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, family
,
8591 NFNETLINK_V0
, nft_base_seq(net
));
8593 goto nla_put_failure
;
8595 if (nla_put_string(skb
, NFTA_FLOWTABLE_TABLE
, flowtable
->table
->name
) ||
8596 nla_put_string(skb
, NFTA_FLOWTABLE_NAME
, flowtable
->name
) ||
8597 nla_put_be64(skb
, NFTA_FLOWTABLE_HANDLE
, cpu_to_be64(flowtable
->handle
),
8598 NFTA_FLOWTABLE_PAD
))
8599 goto nla_put_failure
;
8601 if (event
== NFT_MSG_DELFLOWTABLE
&& !hook_list
) {
8602 nlmsg_end(skb
, nlh
);
8606 if (nla_put_be32(skb
, NFTA_FLOWTABLE_USE
, htonl(flowtable
->use
)) ||
8607 nla_put_be32(skb
, NFTA_FLOWTABLE_FLAGS
, htonl(flowtable
->data
.flags
)))
8608 goto nla_put_failure
;
8610 nest
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK
);
8612 goto nla_put_failure
;
8613 if (nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_NUM
, htonl(flowtable
->hooknum
)) ||
8614 nla_put_be32(skb
, NFTA_FLOWTABLE_HOOK_PRIORITY
, htonl(flowtable
->data
.priority
)))
8615 goto nla_put_failure
;
8617 nest_devs
= nla_nest_start_noflag(skb
, NFTA_FLOWTABLE_HOOK_DEVS
);
8619 goto nla_put_failure
;
8622 hook_list
= &flowtable
->hook_list
;
8624 list_for_each_entry_rcu(hook
, hook_list
, list
) {
8625 if (nla_put_string(skb
, NFTA_DEVICE_NAME
, hook
->ops
.dev
->name
))
8626 goto nla_put_failure
;
8628 nla_nest_end(skb
, nest_devs
);
8629 nla_nest_end(skb
, nest
);
8631 nlmsg_end(skb
, nlh
);
8635 nlmsg_trim(skb
, nlh
);
8639 struct nft_flowtable_filter
{
8643 static int nf_tables_dump_flowtable(struct sk_buff
*skb
,
8644 struct netlink_callback
*cb
)
8646 const struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
8647 struct nft_flowtable_filter
*filter
= cb
->data
;
8648 unsigned int idx
= 0, s_idx
= cb
->args
[0];
8649 struct net
*net
= sock_net(skb
->sk
);
8650 int family
= nfmsg
->nfgen_family
;
8651 struct nft_flowtable
*flowtable
;
8652 struct nftables_pernet
*nft_net
;
8653 const struct nft_table
*table
;
8656 nft_net
= nft_pernet(net
);
8657 cb
->seq
= READ_ONCE(nft_net
->base_seq
);
8659 list_for_each_entry_rcu(table
, &nft_net
->tables
, list
) {
8660 if (family
!= NFPROTO_UNSPEC
&& family
!= table
->family
)
8663 list_for_each_entry_rcu(flowtable
, &table
->flowtables
, list
) {
8664 if (!nft_is_active(net
, flowtable
))
8669 memset(&cb
->args
[1], 0,
8670 sizeof(cb
->args
) - sizeof(cb
->args
[0]));
8671 if (filter
&& filter
->table
&&
8672 strcmp(filter
->table
, table
->name
))
8675 if (nf_tables_fill_flowtable_info(skb
, net
, NETLINK_CB(cb
->skb
).portid
,
8677 NFT_MSG_NEWFLOWTABLE
,
8678 NLM_F_MULTI
| NLM_F_APPEND
,
8680 flowtable
, NULL
) < 0)
8683 nl_dump_check_consistent(cb
, nlmsg_hdr(skb
));
8695 static int nf_tables_dump_flowtable_start(struct netlink_callback
*cb
)
8697 const struct nlattr
* const *nla
= cb
->data
;
8698 struct nft_flowtable_filter
*filter
= NULL
;
8700 if (nla
[NFTA_FLOWTABLE_TABLE
]) {
8701 filter
= kzalloc(sizeof(*filter
), GFP_ATOMIC
);
8705 filter
->table
= nla_strdup(nla
[NFTA_FLOWTABLE_TABLE
],
8707 if (!filter
->table
) {
8717 static int nf_tables_dump_flowtable_done(struct netlink_callback
*cb
)
8719 struct nft_flowtable_filter
*filter
= cb
->data
;
8724 kfree(filter
->table
);
8730 /* called with rcu_read_lock held */
8731 static int nf_tables_getflowtable(struct sk_buff
*skb
,
8732 const struct nfnl_info
*info
,
8733 const struct nlattr
* const nla
[])
8735 struct netlink_ext_ack
*extack
= info
->extack
;
8736 u8 genmask
= nft_genmask_cur(info
->net
);
8737 u8 family
= info
->nfmsg
->nfgen_family
;
8738 struct nft_flowtable
*flowtable
;
8739 const struct nft_table
*table
;
8740 struct net
*net
= info
->net
;
8741 struct sk_buff
*skb2
;
8744 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
8745 struct netlink_dump_control c
= {
8746 .start
= nf_tables_dump_flowtable_start
,
8747 .dump
= nf_tables_dump_flowtable
,
8748 .done
= nf_tables_dump_flowtable_done
,
8749 .module
= THIS_MODULE
,
8750 .data
= (void *)nla
,
8753 return nft_netlink_dump_start_rcu(info
->sk
, skb
, info
->nlh
, &c
);
8756 if (!nla
[NFTA_FLOWTABLE_NAME
])
8759 table
= nft_table_lookup(net
, nla
[NFTA_FLOWTABLE_TABLE
], family
,
8761 if (IS_ERR(table
)) {
8762 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_TABLE
]);
8763 return PTR_ERR(table
);
8766 flowtable
= nft_flowtable_lookup(table
, nla
[NFTA_FLOWTABLE_NAME
],
8768 if (IS_ERR(flowtable
)) {
8769 NL_SET_BAD_ATTR(extack
, nla
[NFTA_FLOWTABLE_NAME
]);
8770 return PTR_ERR(flowtable
);
8773 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
8777 err
= nf_tables_fill_flowtable_info(skb2
, net
, NETLINK_CB(skb
).portid
,
8778 info
->nlh
->nlmsg_seq
,
8779 NFT_MSG_NEWFLOWTABLE
, 0, family
,
8782 goto err_fill_flowtable_info
;
8784 return nfnetlink_unicast(skb2
, net
, NETLINK_CB(skb
).portid
);
8786 err_fill_flowtable_info
:
8791 static void nf_tables_flowtable_notify(struct nft_ctx
*ctx
,
8792 struct nft_flowtable
*flowtable
,
8793 struct list_head
*hook_list
, int event
)
8795 struct nftables_pernet
*nft_net
= nft_pernet(ctx
->net
);
8796 struct sk_buff
*skb
;
8801 !nfnetlink_has_listeners(ctx
->net
, NFNLGRP_NFTABLES
))
8804 skb
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
8808 if (ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
))
8809 flags
|= ctx
->flags
& (NLM_F_CREATE
| NLM_F_EXCL
);
8811 err
= nf_tables_fill_flowtable_info(skb
, ctx
->net
, ctx
->portid
,
8812 ctx
->seq
, event
, flags
,
8813 ctx
->family
, flowtable
, hook_list
);
8819 nft_notify_enqueue(skb
, ctx
->report
, &nft_net
->notify_list
);
8822 nfnetlink_set_err(ctx
->net
, ctx
->portid
, NFNLGRP_NFTABLES
, -ENOBUFS
);
8825 static void nf_tables_flowtable_destroy(struct nft_flowtable
*flowtable
)
8827 struct nft_hook
*hook
, *next
;
8829 flowtable
->data
.type
->free(&flowtable
->data
);
8830 list_for_each_entry_safe(hook
, next
, &flowtable
->hook_list
, list
) {
8831 flowtable
->data
.type
->setup(&flowtable
->data
, hook
->ops
.dev
,
8833 list_del_rcu(&hook
->list
);
8836 kfree(flowtable
->name
);
8837 module_put(flowtable
->data
.type
->owner
);
8841 static int nf_tables_fill_gen_info(struct sk_buff
*skb
, struct net
*net
,
8842 u32 portid
, u32 seq
)
8844 struct nftables_pernet
*nft_net
= nft_pernet(net
);
8845 struct nlmsghdr
*nlh
;
8846 char buf
[TASK_COMM_LEN
];
8847 int event
= nfnl_msg_type(NFNL_SUBSYS_NFTABLES
, NFT_MSG_NEWGEN
);
8849 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, 0, AF_UNSPEC
,
8850 NFNETLINK_V0
, nft_base_seq(net
));
8852 goto nla_put_failure
;
8854 if (nla_put_be32(skb
, NFTA_GEN_ID
, htonl(nft_net
->base_seq
)) ||
8855 nla_put_be32(skb
, NFTA_GEN_PROC_PID
, htonl(task_pid_nr(current
))) ||
8856 nla_put_string(skb
, NFTA_GEN_PROC_NAME
, get_task_comm(buf
, current
)))
8857 goto nla_put_failure
;
8859 nlmsg_end(skb
, nlh
);
8863 nlmsg_trim(skb
, nlh
);
8867 static void nft_flowtable_event(unsigned long event
, struct net_device
*dev
,
8868 struct nft_flowtable
*flowtable
)
8870 struct nft_hook
*hook
;
8872 list_for_each_entry(hook
, &flowtable
->hook_list
, list
) {
8873 if (hook
->ops
.dev
!= dev
)
8876 /* flow_offload_netdev_event() cleans up entries for us. */
8877 nft_unregister_flowtable_hook(dev_net(dev
), flowtable
, hook
);
8878 list_del_rcu(&hook
->list
);
8879 kfree_rcu(hook
, rcu
);
8884 static int nf_tables_flowtable_event(struct notifier_block
*this,
8885 unsigned long event
, void *ptr
)
8887 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
8888 struct nft_flowtable
*flowtable
;
8889 struct nftables_pernet
*nft_net
;
8890 struct nft_table
*table
;
8893 if (event
!= NETDEV_UNREGISTER
)
8897 nft_net
= nft_pernet(net
);
8898 mutex_lock(&nft_net
->commit_mutex
);
8899 list_for_each_entry(table
, &nft_net
->tables
, list
) {
8900 list_for_each_entry(flowtable
, &table
->flowtables
, list
) {
8901 nft_flowtable_event(event
, dev
, flowtable
);
8904 mutex_unlock(&nft_net
->commit_mutex
);
8909 static struct notifier_block nf_tables_flowtable_notifier
= {
8910 .notifier_call
= nf_tables_flowtable_event
,
8913 static void nf_tables_gen_notify(struct net
*net
, struct sk_buff
*skb
,
8916 struct nlmsghdr
*nlh
= nlmsg_hdr(skb
);
8917 struct sk_buff
*skb2
;
8920 if (!nlmsg_report(nlh
) &&
8921 !nfnetlink_has_listeners(net
, NFNLGRP_NFTABLES
))
8924 skb2
= nlmsg_new(NLMSG_GOODSIZE
, GFP_KERNEL
);
8928 err
= nf_tables_fill_gen_info(skb2
, net
, NETLINK_CB(skb
).portid
,
8935 nfnetlink_send(skb2
, net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
8936 nlmsg_report(nlh
), GFP_KERNEL
);
8939 nfnetlink_set_err(net
, NETLINK_CB(skb
).portid
, NFNLGRP_NFTABLES
,
8943 static int nf_tables_getgen(struct sk_buff
*skb
, const struct nfnl_info
*info
,
8944 const struct nlattr
* const nla
[])
8946 struct sk_buff
*skb2
;
8949 skb2
= alloc_skb(NLMSG_GOODSIZE
, GFP_ATOMIC
);
8953 err
= nf_tables_fill_gen_info(skb2
, info
->net
, NETLINK_CB(skb
).portid
,
8954 info
->nlh
->nlmsg_seq
);
8956 goto err_fill_gen_info
;
8958 return nfnetlink_unicast(skb2
, info
->net
, NETLINK_CB(skb
).portid
);
8965 static const struct nfnl_callback nf_tables_cb
[NFT_MSG_MAX
] = {
8966 [NFT_MSG_NEWTABLE
] = {
8967 .call
= nf_tables_newtable
,
8968 .type
= NFNL_CB_BATCH
,
8969 .attr_count
= NFTA_TABLE_MAX
,
8970 .policy
= nft_table_policy
,
8972 [NFT_MSG_GETTABLE
] = {
8973 .call
= nf_tables_gettable
,
8974 .type
= NFNL_CB_RCU
,
8975 .attr_count
= NFTA_TABLE_MAX
,
8976 .policy
= nft_table_policy
,
8978 [NFT_MSG_DELTABLE
] = {
8979 .call
= nf_tables_deltable
,
8980 .type
= NFNL_CB_BATCH
,
8981 .attr_count
= NFTA_TABLE_MAX
,
8982 .policy
= nft_table_policy
,
8984 [NFT_MSG_DESTROYTABLE
] = {
8985 .call
= nf_tables_deltable
,
8986 .type
= NFNL_CB_BATCH
,
8987 .attr_count
= NFTA_TABLE_MAX
,
8988 .policy
= nft_table_policy
,
8990 [NFT_MSG_NEWCHAIN
] = {
8991 .call
= nf_tables_newchain
,
8992 .type
= NFNL_CB_BATCH
,
8993 .attr_count
= NFTA_CHAIN_MAX
,
8994 .policy
= nft_chain_policy
,
8996 [NFT_MSG_GETCHAIN
] = {
8997 .call
= nf_tables_getchain
,
8998 .type
= NFNL_CB_RCU
,
8999 .attr_count
= NFTA_CHAIN_MAX
,
9000 .policy
= nft_chain_policy
,
9002 [NFT_MSG_DELCHAIN
] = {
9003 .call
= nf_tables_delchain
,
9004 .type
= NFNL_CB_BATCH
,
9005 .attr_count
= NFTA_CHAIN_MAX
,
9006 .policy
= nft_chain_policy
,
9008 [NFT_MSG_DESTROYCHAIN
] = {
9009 .call
= nf_tables_delchain
,
9010 .type
= NFNL_CB_BATCH
,
9011 .attr_count
= NFTA_CHAIN_MAX
,
9012 .policy
= nft_chain_policy
,
9014 [NFT_MSG_NEWRULE
] = {
9015 .call
= nf_tables_newrule
,
9016 .type
= NFNL_CB_BATCH
,
9017 .attr_count
= NFTA_RULE_MAX
,
9018 .policy
= nft_rule_policy
,
9020 [NFT_MSG_GETRULE
] = {
9021 .call
= nf_tables_getrule
,
9022 .type
= NFNL_CB_RCU
,
9023 .attr_count
= NFTA_RULE_MAX
,
9024 .policy
= nft_rule_policy
,
9026 [NFT_MSG_GETRULE_RESET
] = {
9027 .call
= nf_tables_getrule_reset
,
9028 .type
= NFNL_CB_RCU
,
9029 .attr_count
= NFTA_RULE_MAX
,
9030 .policy
= nft_rule_policy
,
9032 [NFT_MSG_DELRULE
] = {
9033 .call
= nf_tables_delrule
,
9034 .type
= NFNL_CB_BATCH
,
9035 .attr_count
= NFTA_RULE_MAX
,
9036 .policy
= nft_rule_policy
,
9038 [NFT_MSG_DESTROYRULE
] = {
9039 .call
= nf_tables_delrule
,
9040 .type
= NFNL_CB_BATCH
,
9041 .attr_count
= NFTA_RULE_MAX
,
9042 .policy
= nft_rule_policy
,
9044 [NFT_MSG_NEWSET
] = {
9045 .call
= nf_tables_newset
,
9046 .type
= NFNL_CB_BATCH
,
9047 .attr_count
= NFTA_SET_MAX
,
9048 .policy
= nft_set_policy
,
9050 [NFT_MSG_GETSET
] = {
9051 .call
= nf_tables_getset
,
9052 .type
= NFNL_CB_RCU
,
9053 .attr_count
= NFTA_SET_MAX
,
9054 .policy
= nft_set_policy
,
9056 [NFT_MSG_DELSET
] = {
9057 .call
= nf_tables_delset
,
9058 .type
= NFNL_CB_BATCH
,
9059 .attr_count
= NFTA_SET_MAX
,
9060 .policy
= nft_set_policy
,
9062 [NFT_MSG_DESTROYSET
] = {
9063 .call
= nf_tables_delset
,
9064 .type
= NFNL_CB_BATCH
,
9065 .attr_count
= NFTA_SET_MAX
,
9066 .policy
= nft_set_policy
,
9068 [NFT_MSG_NEWSETELEM
] = {
9069 .call
= nf_tables_newsetelem
,
9070 .type
= NFNL_CB_BATCH
,
9071 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
9072 .policy
= nft_set_elem_list_policy
,
9074 [NFT_MSG_GETSETELEM
] = {
9075 .call
= nf_tables_getsetelem
,
9076 .type
= NFNL_CB_RCU
,
9077 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
9078 .policy
= nft_set_elem_list_policy
,
9080 [NFT_MSG_GETSETELEM_RESET
] = {
9081 .call
= nf_tables_getsetelem
,
9082 .type
= NFNL_CB_RCU
,
9083 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
9084 .policy
= nft_set_elem_list_policy
,
9086 [NFT_MSG_DELSETELEM
] = {
9087 .call
= nf_tables_delsetelem
,
9088 .type
= NFNL_CB_BATCH
,
9089 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
9090 .policy
= nft_set_elem_list_policy
,
9092 [NFT_MSG_DESTROYSETELEM
] = {
9093 .call
= nf_tables_delsetelem
,
9094 .type
= NFNL_CB_BATCH
,
9095 .attr_count
= NFTA_SET_ELEM_LIST_MAX
,
9096 .policy
= nft_set_elem_list_policy
,
9098 [NFT_MSG_GETGEN
] = {
9099 .call
= nf_tables_getgen
,
9100 .type
= NFNL_CB_RCU
,
9102 [NFT_MSG_NEWOBJ
] = {
9103 .call
= nf_tables_newobj
,
9104 .type
= NFNL_CB_BATCH
,
9105 .attr_count
= NFTA_OBJ_MAX
,
9106 .policy
= nft_obj_policy
,
9108 [NFT_MSG_GETOBJ
] = {
9109 .call
= nf_tables_getobj
,
9110 .type
= NFNL_CB_RCU
,
9111 .attr_count
= NFTA_OBJ_MAX
,
9112 .policy
= nft_obj_policy
,
9114 [NFT_MSG_DELOBJ
] = {
9115 .call
= nf_tables_delobj
,
9116 .type
= NFNL_CB_BATCH
,
9117 .attr_count
= NFTA_OBJ_MAX
,
9118 .policy
= nft_obj_policy
,
9120 [NFT_MSG_DESTROYOBJ
] = {
9121 .call
= nf_tables_delobj
,
9122 .type
= NFNL_CB_BATCH
,
9123 .attr_count
= NFTA_OBJ_MAX
,
9124 .policy
= nft_obj_policy
,
9126 [NFT_MSG_GETOBJ_RESET
] = {
9127 .call
= nf_tables_getobj
,
9128 .type
= NFNL_CB_RCU
,
9129 .attr_count
= NFTA_OBJ_MAX
,
9130 .policy
= nft_obj_policy
,
9132 [NFT_MSG_NEWFLOWTABLE
] = {
9133 .call
= nf_tables_newflowtable
,
9134 .type
= NFNL_CB_BATCH
,
9135 .attr_count
= NFTA_FLOWTABLE_MAX
,
9136 .policy
= nft_flowtable_policy
,
9138 [NFT_MSG_GETFLOWTABLE
] = {
9139 .call
= nf_tables_getflowtable
,
9140 .type
= NFNL_CB_RCU
,
9141 .attr_count
= NFTA_FLOWTABLE_MAX
,
9142 .policy
= nft_flowtable_policy
,
9144 [NFT_MSG_DELFLOWTABLE
] = {
9145 .call
= nf_tables_delflowtable
,
9146 .type
= NFNL_CB_BATCH
,
9147 .attr_count
= NFTA_FLOWTABLE_MAX
,
9148 .policy
= nft_flowtable_policy
,
9150 [NFT_MSG_DESTROYFLOWTABLE
] = {
9151 .call
= nf_tables_delflowtable
,
9152 .type
= NFNL_CB_BATCH
,
9153 .attr_count
= NFTA_FLOWTABLE_MAX
,
9154 .policy
= nft_flowtable_policy
,
9158 static int nf_tables_validate(struct net
*net
)
9160 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9161 struct nft_table
*table
;
9163 list_for_each_entry(table
, &nft_net
->tables
, list
) {
9164 switch (table
->validate_state
) {
9165 case NFT_VALIDATE_SKIP
:
9167 case NFT_VALIDATE_NEED
:
9168 nft_validate_state_update(table
, NFT_VALIDATE_DO
);
9170 case NFT_VALIDATE_DO
:
9171 if (nft_table_validate(net
, table
) < 0)
9174 nft_validate_state_update(table
, NFT_VALIDATE_SKIP
);
9182 /* a drop policy has to be deferred until all rules have been activated,
9183 * otherwise a large ruleset that contains a drop-policy base chain will
9184 * cause all packets to get dropped until the full transaction has been
9187 * We defer the drop policy until the transaction has been finalized.
9189 static void nft_chain_commit_drop_policy(struct nft_trans
*trans
)
9191 struct nft_base_chain
*basechain
;
9193 if (nft_trans_chain_policy(trans
) != NF_DROP
)
9196 if (!nft_is_base_chain(trans
->ctx
.chain
))
9199 basechain
= nft_base_chain(trans
->ctx
.chain
);
9200 basechain
->policy
= NF_DROP
;
9203 static void nft_chain_commit_update(struct nft_trans
*trans
)
9205 struct nft_base_chain
*basechain
;
9207 if (nft_trans_chain_name(trans
)) {
9208 rhltable_remove(&trans
->ctx
.table
->chains_ht
,
9209 &trans
->ctx
.chain
->rhlhead
,
9210 nft_chain_ht_params
);
9211 swap(trans
->ctx
.chain
->name
, nft_trans_chain_name(trans
));
9212 rhltable_insert_key(&trans
->ctx
.table
->chains_ht
,
9213 trans
->ctx
.chain
->name
,
9214 &trans
->ctx
.chain
->rhlhead
,
9215 nft_chain_ht_params
);
9218 if (!nft_is_base_chain(trans
->ctx
.chain
))
9221 nft_chain_stats_replace(trans
);
9223 basechain
= nft_base_chain(trans
->ctx
.chain
);
9225 switch (nft_trans_chain_policy(trans
)) {
9228 basechain
->policy
= nft_trans_chain_policy(trans
);
9233 static void nft_obj_commit_update(struct nft_trans
*trans
)
9235 struct nft_object
*newobj
;
9236 struct nft_object
*obj
;
9238 obj
= nft_trans_obj(trans
);
9239 newobj
= nft_trans_obj_newobj(trans
);
9241 if (obj
->ops
->update
)
9242 obj
->ops
->update(obj
, newobj
);
9244 nft_obj_destroy(&trans
->ctx
, newobj
);
9247 static void nft_commit_release(struct nft_trans
*trans
)
9249 switch (trans
->msg_type
) {
9250 case NFT_MSG_DELTABLE
:
9251 case NFT_MSG_DESTROYTABLE
:
9252 nf_tables_table_destroy(&trans
->ctx
);
9254 case NFT_MSG_NEWCHAIN
:
9255 free_percpu(nft_trans_chain_stats(trans
));
9256 kfree(nft_trans_chain_name(trans
));
9258 case NFT_MSG_DELCHAIN
:
9259 case NFT_MSG_DESTROYCHAIN
:
9260 if (nft_trans_chain_update(trans
))
9261 nft_hooks_destroy(&nft_trans_chain_hooks(trans
));
9263 nf_tables_chain_destroy(&trans
->ctx
);
9265 case NFT_MSG_DELRULE
:
9266 case NFT_MSG_DESTROYRULE
:
9267 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
9269 case NFT_MSG_DELSET
:
9270 case NFT_MSG_DESTROYSET
:
9271 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
9273 case NFT_MSG_DELSETELEM
:
9274 case NFT_MSG_DESTROYSETELEM
:
9275 nf_tables_set_elem_destroy(&trans
->ctx
,
9276 nft_trans_elem_set(trans
),
9277 nft_trans_elem_priv(trans
));
9279 case NFT_MSG_DELOBJ
:
9280 case NFT_MSG_DESTROYOBJ
:
9281 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
9283 case NFT_MSG_DELFLOWTABLE
:
9284 case NFT_MSG_DESTROYFLOWTABLE
:
9285 if (nft_trans_flowtable_update(trans
))
9286 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
9288 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
9293 put_net(trans
->ctx
.net
);
9298 static void nf_tables_trans_destroy_work(struct work_struct
*w
)
9300 struct nft_trans
*trans
, *next
;
9303 spin_lock(&nf_tables_destroy_list_lock
);
9304 list_splice_init(&nf_tables_destroy_list
, &head
);
9305 spin_unlock(&nf_tables_destroy_list_lock
);
9307 if (list_empty(&head
))
9312 list_for_each_entry_safe(trans
, next
, &head
, list
) {
9313 nft_trans_list_del(trans
);
9314 nft_commit_release(trans
);
9318 void nf_tables_trans_destroy_flush_work(void)
9320 flush_work(&trans_destroy_work
);
9322 EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work
);
9324 static bool nft_expr_reduce(struct nft_regs_track
*track
,
9325 const struct nft_expr
*expr
)
9330 static int nf_tables_commit_chain_prepare(struct net
*net
, struct nft_chain
*chain
)
9332 const struct nft_expr
*expr
, *last
;
9333 struct nft_regs_track track
= {};
9334 unsigned int size
, data_size
;
9335 void *data
, *data_boundary
;
9336 struct nft_rule_dp
*prule
;
9337 struct nft_rule
*rule
;
9339 /* already handled or inactive chain? */
9340 if (chain
->blob_next
|| !nft_is_active_next(net
, chain
))
9344 list_for_each_entry(rule
, &chain
->rules
, list
) {
9345 if (nft_is_active_next(net
, rule
)) {
9346 data_size
+= sizeof(*prule
) + rule
->dlen
;
9347 if (data_size
> INT_MAX
)
9352 chain
->blob_next
= nf_tables_chain_alloc_rules(chain
, data_size
);
9353 if (!chain
->blob_next
)
9356 data
= (void *)chain
->blob_next
->data
;
9357 data_boundary
= data
+ data_size
;
9360 list_for_each_entry(rule
, &chain
->rules
, list
) {
9361 if (!nft_is_active_next(net
, rule
))
9364 prule
= (struct nft_rule_dp
*)data
;
9365 data
+= offsetof(struct nft_rule_dp
, data
);
9366 if (WARN_ON_ONCE(data
> data_boundary
))
9370 track
.last
= nft_expr_last(rule
);
9371 nft_rule_for_each_expr(expr
, last
, rule
) {
9374 if (nft_expr_reduce(&track
, expr
)) {
9379 if (WARN_ON_ONCE(data
+ size
+ expr
->ops
->size
> data_boundary
))
9382 memcpy(data
+ size
, expr
, expr
->ops
->size
);
9383 size
+= expr
->ops
->size
;
9385 if (WARN_ON_ONCE(size
>= 1 << 12))
9388 prule
->handle
= rule
->handle
;
9394 chain
->blob_next
->size
+= (unsigned long)(data
- (void *)prule
);
9397 if (WARN_ON_ONCE(data
> data_boundary
))
9400 prule
= (struct nft_rule_dp
*)data
;
9401 nft_last_rule(chain
, prule
);
9406 static void nf_tables_commit_chain_prepare_cancel(struct net
*net
)
9408 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9409 struct nft_trans
*trans
, *next
;
9411 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
9412 struct nft_chain
*chain
= trans
->ctx
.chain
;
9414 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
9415 trans
->msg_type
== NFT_MSG_DELRULE
) {
9416 kvfree(chain
->blob_next
);
9417 chain
->blob_next
= NULL
;
9422 static void __nf_tables_commit_chain_free_rules(struct rcu_head
*h
)
9424 struct nft_rule_dp_last
*l
= container_of(h
, struct nft_rule_dp_last
, h
);
9429 static void nf_tables_commit_chain_free_rules_old(struct nft_rule_blob
*blob
)
9431 struct nft_rule_dp_last
*last
;
9433 /* last rule trailer is after end marker */
9434 last
= (void *)blob
+ sizeof(*blob
) + blob
->size
;
9437 call_rcu(&last
->h
, __nf_tables_commit_chain_free_rules
);
9440 static void nf_tables_commit_chain(struct net
*net
, struct nft_chain
*chain
)
9442 struct nft_rule_blob
*g0
, *g1
;
9445 next_genbit
= nft_gencursor_next(net
);
9447 g0
= rcu_dereference_protected(chain
->blob_gen_0
,
9448 lockdep_commit_lock_is_held(net
));
9449 g1
= rcu_dereference_protected(chain
->blob_gen_1
,
9450 lockdep_commit_lock_is_held(net
));
9452 /* No changes to this chain? */
9453 if (chain
->blob_next
== NULL
) {
9454 /* chain had no change in last or next generation */
9458 * chain had no change in this generation; make sure next
9459 * one uses same rules as current generation.
9462 rcu_assign_pointer(chain
->blob_gen_1
, g0
);
9463 nf_tables_commit_chain_free_rules_old(g1
);
9465 rcu_assign_pointer(chain
->blob_gen_0
, g1
);
9466 nf_tables_commit_chain_free_rules_old(g0
);
9473 rcu_assign_pointer(chain
->blob_gen_1
, chain
->blob_next
);
9475 rcu_assign_pointer(chain
->blob_gen_0
, chain
->blob_next
);
9477 chain
->blob_next
= NULL
;
9483 nf_tables_commit_chain_free_rules_old(g1
);
9485 nf_tables_commit_chain_free_rules_old(g0
);
9488 static void nft_obj_del(struct nft_object
*obj
)
9490 rhltable_remove(&nft_objname_ht
, &obj
->rhlhead
, nft_objname_ht_params
);
9491 list_del_rcu(&obj
->list
);
9494 void nft_chain_del(struct nft_chain
*chain
)
9496 struct nft_table
*table
= chain
->table
;
9498 WARN_ON_ONCE(rhltable_remove(&table
->chains_ht
, &chain
->rhlhead
,
9499 nft_chain_ht_params
));
9500 list_del_rcu(&chain
->list
);
9503 static void nft_trans_gc_setelem_remove(struct nft_ctx
*ctx
,
9504 struct nft_trans_gc
*trans
)
9506 struct nft_elem_priv
**priv
= trans
->priv
;
9509 for (i
= 0; i
< trans
->count
; i
++) {
9510 nft_setelem_data_deactivate(ctx
->net
, trans
->set
, priv
[i
]);
9511 nft_setelem_remove(ctx
->net
, trans
->set
, priv
[i
]);
9515 void nft_trans_gc_destroy(struct nft_trans_gc
*trans
)
9517 nft_set_put(trans
->set
);
9518 put_net(trans
->net
);
9522 static void nft_trans_gc_trans_free(struct rcu_head
*rcu
)
9524 struct nft_elem_priv
*elem_priv
;
9525 struct nft_trans_gc
*trans
;
9526 struct nft_ctx ctx
= {};
9529 trans
= container_of(rcu
, struct nft_trans_gc
, rcu
);
9530 ctx
.net
= read_pnet(&trans
->set
->net
);
9532 for (i
= 0; i
< trans
->count
; i
++) {
9533 elem_priv
= trans
->priv
[i
];
9534 if (!nft_setelem_is_catchall(trans
->set
, elem_priv
))
9535 atomic_dec(&trans
->set
->nelems
);
9537 nf_tables_set_elem_destroy(&ctx
, trans
->set
, elem_priv
);
9540 nft_trans_gc_destroy(trans
);
9543 static bool nft_trans_gc_work_done(struct nft_trans_gc
*trans
)
9545 struct nftables_pernet
*nft_net
;
9546 struct nft_ctx ctx
= {};
9548 nft_net
= nft_pernet(trans
->net
);
9550 mutex_lock(&nft_net
->commit_mutex
);
9552 /* Check for race with transaction, otherwise this batch refers to
9553 * stale objects that might not be there anymore. Skip transaction if
9554 * set has been destroyed from control plane transaction in case gc
9555 * worker loses race.
9557 if (READ_ONCE(nft_net
->gc_seq
) != trans
->seq
|| trans
->set
->dead
) {
9558 mutex_unlock(&nft_net
->commit_mutex
);
9562 ctx
.net
= trans
->net
;
9563 ctx
.table
= trans
->set
->table
;
9565 nft_trans_gc_setelem_remove(&ctx
, trans
);
9566 mutex_unlock(&nft_net
->commit_mutex
);
9571 static void nft_trans_gc_work(struct work_struct
*work
)
9573 struct nft_trans_gc
*trans
, *next
;
9574 LIST_HEAD(trans_gc_list
);
9576 spin_lock(&nf_tables_gc_list_lock
);
9577 list_splice_init(&nf_tables_gc_list
, &trans_gc_list
);
9578 spin_unlock(&nf_tables_gc_list_lock
);
9580 list_for_each_entry_safe(trans
, next
, &trans_gc_list
, list
) {
9581 list_del(&trans
->list
);
9582 if (!nft_trans_gc_work_done(trans
)) {
9583 nft_trans_gc_destroy(trans
);
9586 call_rcu(&trans
->rcu
, nft_trans_gc_trans_free
);
9590 struct nft_trans_gc
*nft_trans_gc_alloc(struct nft_set
*set
,
9591 unsigned int gc_seq
, gfp_t gfp
)
9593 struct net
*net
= read_pnet(&set
->net
);
9594 struct nft_trans_gc
*trans
;
9596 trans
= kzalloc(sizeof(*trans
), gfp
);
9600 trans
->net
= maybe_get_net(net
);
9606 refcount_inc(&set
->refs
);
9608 trans
->seq
= gc_seq
;
9613 void nft_trans_gc_elem_add(struct nft_trans_gc
*trans
, void *priv
)
9615 trans
->priv
[trans
->count
++] = priv
;
9618 static void nft_trans_gc_queue_work(struct nft_trans_gc
*trans
)
9620 spin_lock(&nf_tables_gc_list_lock
);
9621 list_add_tail(&trans
->list
, &nf_tables_gc_list
);
9622 spin_unlock(&nf_tables_gc_list_lock
);
9624 schedule_work(&trans_gc_work
);
9627 static int nft_trans_gc_space(struct nft_trans_gc
*trans
)
9629 return NFT_TRANS_GC_BATCHCOUNT
- trans
->count
;
9632 struct nft_trans_gc
*nft_trans_gc_queue_async(struct nft_trans_gc
*gc
,
9633 unsigned int gc_seq
, gfp_t gfp
)
9635 struct nft_set
*set
;
9637 if (nft_trans_gc_space(gc
))
9641 nft_trans_gc_queue_work(gc
);
9643 return nft_trans_gc_alloc(set
, gc_seq
, gfp
);
9646 void nft_trans_gc_queue_async_done(struct nft_trans_gc
*trans
)
9648 if (trans
->count
== 0) {
9649 nft_trans_gc_destroy(trans
);
9653 nft_trans_gc_queue_work(trans
);
9656 struct nft_trans_gc
*nft_trans_gc_queue_sync(struct nft_trans_gc
*gc
, gfp_t gfp
)
9658 struct nft_set
*set
;
9660 if (WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc
->net
)))
9663 if (nft_trans_gc_space(gc
))
9667 call_rcu(&gc
->rcu
, nft_trans_gc_trans_free
);
9669 return nft_trans_gc_alloc(set
, 0, gfp
);
9672 void nft_trans_gc_queue_sync_done(struct nft_trans_gc
*trans
)
9674 WARN_ON_ONCE(!lockdep_commit_lock_is_held(trans
->net
));
9676 if (trans
->count
== 0) {
9677 nft_trans_gc_destroy(trans
);
9681 call_rcu(&trans
->rcu
, nft_trans_gc_trans_free
);
9684 struct nft_trans_gc
*nft_trans_gc_catchall_async(struct nft_trans_gc
*gc
,
9685 unsigned int gc_seq
)
9687 struct nft_set_elem_catchall
*catchall
;
9688 const struct nft_set
*set
= gc
->set
;
9689 struct nft_set_ext
*ext
;
9691 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
9692 ext
= nft_set_elem_ext(set
, catchall
->elem
);
9694 if (!nft_set_elem_expired(ext
))
9696 if (nft_set_elem_is_dead(ext
))
9699 nft_set_elem_dead(ext
);
9701 gc
= nft_trans_gc_queue_async(gc
, gc_seq
, GFP_ATOMIC
);
9705 nft_trans_gc_elem_add(gc
, catchall
->elem
);
9711 struct nft_trans_gc
*nft_trans_gc_catchall_sync(struct nft_trans_gc
*gc
)
9713 struct nft_set_elem_catchall
*catchall
, *next
;
9714 const struct nft_set
*set
= gc
->set
;
9715 struct nft_elem_priv
*elem_priv
;
9716 struct nft_set_ext
*ext
;
9718 WARN_ON_ONCE(!lockdep_commit_lock_is_held(gc
->net
));
9720 list_for_each_entry_safe(catchall
, next
, &set
->catchall_list
, list
) {
9721 ext
= nft_set_elem_ext(set
, catchall
->elem
);
9723 if (!nft_set_elem_expired(ext
))
9726 gc
= nft_trans_gc_queue_sync(gc
, GFP_KERNEL
);
9730 elem_priv
= catchall
->elem
;
9731 nft_setelem_data_deactivate(gc
->net
, gc
->set
, elem_priv
);
9732 nft_setelem_catchall_destroy(catchall
);
9733 nft_trans_gc_elem_add(gc
, elem_priv
);
9739 static void nf_tables_module_autoload_cleanup(struct net
*net
)
9741 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9742 struct nft_module_request
*req
, *next
;
9744 WARN_ON_ONCE(!list_empty(&nft_net
->commit_list
));
9745 list_for_each_entry_safe(req
, next
, &nft_net
->module_list
, list
) {
9746 WARN_ON_ONCE(!req
->done
);
9747 list_del(&req
->list
);
9752 static void nf_tables_commit_release(struct net
*net
)
9754 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9755 struct nft_trans
*trans
;
9757 /* all side effects have to be made visible.
9758 * For example, if a chain named 'foo' has been deleted, a
9759 * new transaction must not find it anymore.
9761 * Memory reclaim happens asynchronously from work queue
9762 * to prevent expensive synchronize_rcu() in commit phase.
9764 if (list_empty(&nft_net
->commit_list
)) {
9765 nf_tables_module_autoload_cleanup(net
);
9766 mutex_unlock(&nft_net
->commit_mutex
);
9770 trans
= list_last_entry(&nft_net
->commit_list
,
9771 struct nft_trans
, list
);
9772 get_net(trans
->ctx
.net
);
9773 WARN_ON_ONCE(trans
->put_net
);
9775 trans
->put_net
= true;
9776 spin_lock(&nf_tables_destroy_list_lock
);
9777 list_splice_tail_init(&nft_net
->commit_list
, &nf_tables_destroy_list
);
9778 spin_unlock(&nf_tables_destroy_list_lock
);
9780 nf_tables_module_autoload_cleanup(net
);
9781 schedule_work(&trans_destroy_work
);
9783 mutex_unlock(&nft_net
->commit_mutex
);
9786 static void nft_commit_notify(struct net
*net
, u32 portid
)
9788 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9789 struct sk_buff
*batch_skb
= NULL
, *nskb
, *skb
;
9790 unsigned char *data
;
9793 list_for_each_entry_safe(skb
, nskb
, &nft_net
->notify_list
, list
) {
9797 len
= NLMSG_GOODSIZE
- skb
->len
;
9798 list_del(&skb
->list
);
9802 if (len
> 0 && NFT_CB(skb
).report
== NFT_CB(batch_skb
).report
) {
9803 data
= skb_put(batch_skb
, skb
->len
);
9804 memcpy(data
, skb
->data
, skb
->len
);
9805 list_del(&skb
->list
);
9809 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
9810 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
9815 nfnetlink_send(batch_skb
, net
, portid
, NFNLGRP_NFTABLES
,
9816 NFT_CB(batch_skb
).report
, GFP_KERNEL
);
9819 WARN_ON_ONCE(!list_empty(&nft_net
->notify_list
));
9822 static int nf_tables_commit_audit_alloc(struct list_head
*adl
,
9823 struct nft_table
*table
)
9825 struct nft_audit_data
*adp
;
9827 list_for_each_entry(adp
, adl
, list
) {
9828 if (adp
->table
== table
)
9831 adp
= kzalloc(sizeof(*adp
), GFP_KERNEL
);
9835 list_add(&adp
->list
, adl
);
9839 static void nf_tables_commit_audit_free(struct list_head
*adl
)
9841 struct nft_audit_data
*adp
, *adn
;
9843 list_for_each_entry_safe(adp
, adn
, adl
, list
) {
9844 list_del(&adp
->list
);
9849 static void nf_tables_commit_audit_collect(struct list_head
*adl
,
9850 struct nft_table
*table
, u32 op
)
9852 struct nft_audit_data
*adp
;
9854 list_for_each_entry(adp
, adl
, list
) {
9855 if (adp
->table
== table
)
9858 WARN_ONCE(1, "table=%s not expected in commit list", table
->name
);
9862 if (!adp
->op
|| adp
->op
> op
)
9866 #define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22)
9868 static void nf_tables_commit_audit_log(struct list_head
*adl
, u32 generation
)
9870 struct nft_audit_data
*adp
, *adn
;
9871 char aubuf
[AUNFTABLENAMELEN
];
9873 list_for_each_entry_safe(adp
, adn
, adl
, list
) {
9874 snprintf(aubuf
, AUNFTABLENAMELEN
, "%s:%u", adp
->table
->name
,
9876 audit_log_nfcfg(aubuf
, adp
->table
->family
, adp
->entries
,
9877 nft2audit_op
[adp
->op
], GFP_KERNEL
);
9878 list_del(&adp
->list
);
9883 static void nft_set_commit_update(struct list_head
*set_update_list
)
9885 struct nft_set
*set
, *next
;
9887 list_for_each_entry_safe(set
, next
, set_update_list
, pending_update
) {
9888 list_del_init(&set
->pending_update
);
9890 if (!set
->ops
->commit
)
9893 set
->ops
->commit(set
);
9897 static unsigned int nft_gc_seq_begin(struct nftables_pernet
*nft_net
)
9899 unsigned int gc_seq
;
9901 /* Bump gc counter, it becomes odd, this is the busy mark. */
9902 gc_seq
= READ_ONCE(nft_net
->gc_seq
);
9903 WRITE_ONCE(nft_net
->gc_seq
, ++gc_seq
);
9908 static void nft_gc_seq_end(struct nftables_pernet
*nft_net
, unsigned int gc_seq
)
9910 WRITE_ONCE(nft_net
->gc_seq
, ++gc_seq
);
9913 static int nf_tables_commit(struct net
*net
, struct sk_buff
*skb
)
9915 struct nftables_pernet
*nft_net
= nft_pernet(net
);
9916 struct nft_trans
*trans
, *next
;
9917 unsigned int base_seq
, gc_seq
;
9918 LIST_HEAD(set_update_list
);
9919 struct nft_trans_elem
*te
;
9920 struct nft_chain
*chain
;
9921 struct nft_table
*table
;
9925 if (list_empty(&nft_net
->commit_list
)) {
9926 mutex_unlock(&nft_net
->commit_mutex
);
9930 list_for_each_entry(trans
, &nft_net
->binding_list
, binding_list
) {
9931 switch (trans
->msg_type
) {
9932 case NFT_MSG_NEWSET
:
9933 if (!nft_trans_set_update(trans
) &&
9934 nft_set_is_anonymous(nft_trans_set(trans
)) &&
9935 !nft_trans_set_bound(trans
)) {
9936 pr_warn_once("nftables ruleset with unbound set\n");
9940 case NFT_MSG_NEWCHAIN
:
9941 if (!nft_trans_chain_update(trans
) &&
9942 nft_chain_binding(nft_trans_chain(trans
)) &&
9943 !nft_trans_chain_bound(trans
)) {
9944 pr_warn_once("nftables ruleset with unbound chain\n");
9951 /* 0. Validate ruleset, otherwise roll back for error reporting. */
9952 if (nf_tables_validate(net
) < 0) {
9953 nft_net
->validate_state
= NFT_VALIDATE_DO
;
9957 err
= nft_flow_rule_offload_commit(net
);
9961 /* 1. Allocate space for next generation rules_gen_X[] */
9962 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
9965 ret
= nf_tables_commit_audit_alloc(&adl
, trans
->ctx
.table
);
9967 nf_tables_commit_chain_prepare_cancel(net
);
9968 nf_tables_commit_audit_free(&adl
);
9971 if (trans
->msg_type
== NFT_MSG_NEWRULE
||
9972 trans
->msg_type
== NFT_MSG_DELRULE
) {
9973 chain
= trans
->ctx
.chain
;
9975 ret
= nf_tables_commit_chain_prepare(net
, chain
);
9977 nf_tables_commit_chain_prepare_cancel(net
);
9978 nf_tables_commit_audit_free(&adl
);
9984 /* step 2. Make rules_gen_X visible to packet path */
9985 list_for_each_entry(table
, &nft_net
->tables
, list
) {
9986 list_for_each_entry(chain
, &table
->chains
, list
)
9987 nf_tables_commit_chain(net
, chain
);
9991 * Bump generation counter, invalidate any dump in progress.
9992 * Cannot fail after this point.
9994 base_seq
= READ_ONCE(nft_net
->base_seq
);
9995 while (++base_seq
== 0)
9998 WRITE_ONCE(nft_net
->base_seq
, base_seq
);
10000 gc_seq
= nft_gc_seq_begin(nft_net
);
10002 /* step 3. Start new generation, rules_gen_X now in use. */
10003 net
->nft
.gencursor
= nft_gencursor_next(net
);
10005 list_for_each_entry_safe(trans
, next
, &nft_net
->commit_list
, list
) {
10006 nf_tables_commit_audit_collect(&adl
, trans
->ctx
.table
,
10008 switch (trans
->msg_type
) {
10009 case NFT_MSG_NEWTABLE
:
10010 if (nft_trans_table_update(trans
)) {
10011 if (!(trans
->ctx
.table
->flags
& __NFT_TABLE_F_UPDATE
)) {
10012 nft_trans_destroy(trans
);
10015 if (trans
->ctx
.table
->flags
& NFT_TABLE_F_DORMANT
)
10016 nf_tables_table_disable(net
, trans
->ctx
.table
);
10018 trans
->ctx
.table
->flags
&= ~__NFT_TABLE_F_UPDATE
;
10020 nft_clear(net
, trans
->ctx
.table
);
10022 nf_tables_table_notify(&trans
->ctx
, NFT_MSG_NEWTABLE
);
10023 nft_trans_destroy(trans
);
10025 case NFT_MSG_DELTABLE
:
10026 case NFT_MSG_DESTROYTABLE
:
10027 list_del_rcu(&trans
->ctx
.table
->list
);
10028 nf_tables_table_notify(&trans
->ctx
, trans
->msg_type
);
10030 case NFT_MSG_NEWCHAIN
:
10031 if (nft_trans_chain_update(trans
)) {
10032 nft_chain_commit_update(trans
);
10033 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
,
10034 &nft_trans_chain_hooks(trans
));
10035 list_splice(&nft_trans_chain_hooks(trans
),
10036 &nft_trans_basechain(trans
)->hook_list
);
10037 /* trans destroyed after rcu grace period */
10039 nft_chain_commit_drop_policy(trans
);
10040 nft_clear(net
, trans
->ctx
.chain
);
10041 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_NEWCHAIN
, NULL
);
10042 nft_trans_destroy(trans
);
10045 case NFT_MSG_DELCHAIN
:
10046 case NFT_MSG_DESTROYCHAIN
:
10047 if (nft_trans_chain_update(trans
)) {
10048 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_DELCHAIN
,
10049 &nft_trans_chain_hooks(trans
));
10050 nft_netdev_unregister_hooks(net
,
10051 &nft_trans_chain_hooks(trans
),
10054 nft_chain_del(trans
->ctx
.chain
);
10055 nf_tables_chain_notify(&trans
->ctx
, NFT_MSG_DELCHAIN
,
10057 nf_tables_unregister_hook(trans
->ctx
.net
,
10062 case NFT_MSG_NEWRULE
:
10063 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
10064 nf_tables_rule_notify(&trans
->ctx
,
10065 nft_trans_rule(trans
),
10067 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
10068 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
10070 nft_trans_destroy(trans
);
10072 case NFT_MSG_DELRULE
:
10073 case NFT_MSG_DESTROYRULE
:
10074 list_del_rcu(&nft_trans_rule(trans
)->list
);
10075 nf_tables_rule_notify(&trans
->ctx
,
10076 nft_trans_rule(trans
),
10078 nft_rule_expr_deactivate(&trans
->ctx
,
10079 nft_trans_rule(trans
),
10082 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
10083 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
10085 case NFT_MSG_NEWSET
:
10086 if (nft_trans_set_update(trans
)) {
10087 struct nft_set
*set
= nft_trans_set(trans
);
10089 WRITE_ONCE(set
->timeout
, nft_trans_set_timeout(trans
));
10090 WRITE_ONCE(set
->gc_int
, nft_trans_set_gc_int(trans
));
10092 if (nft_trans_set_size(trans
))
10093 WRITE_ONCE(set
->size
, nft_trans_set_size(trans
));
10095 nft_clear(net
, nft_trans_set(trans
));
10096 /* This avoids hitting -EBUSY when deleting the table
10097 * from the transaction.
10099 if (nft_set_is_anonymous(nft_trans_set(trans
)) &&
10100 !list_empty(&nft_trans_set(trans
)->bindings
))
10101 nft_use_dec(&trans
->ctx
.table
->use
);
10103 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
10104 NFT_MSG_NEWSET
, GFP_KERNEL
);
10105 nft_trans_destroy(trans
);
10107 case NFT_MSG_DELSET
:
10108 case NFT_MSG_DESTROYSET
:
10109 nft_trans_set(trans
)->dead
= 1;
10110 list_del_rcu(&nft_trans_set(trans
)->list
);
10111 nf_tables_set_notify(&trans
->ctx
, nft_trans_set(trans
),
10112 trans
->msg_type
, GFP_KERNEL
);
10114 case NFT_MSG_NEWSETELEM
:
10115 te
= (struct nft_trans_elem
*)trans
->data
;
10117 nft_setelem_activate(net
, te
->set
, te
->elem_priv
);
10118 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
10120 NFT_MSG_NEWSETELEM
);
10121 if (te
->set
->ops
->commit
&&
10122 list_empty(&te
->set
->pending_update
)) {
10123 list_add_tail(&te
->set
->pending_update
,
10126 nft_trans_destroy(trans
);
10128 case NFT_MSG_DELSETELEM
:
10129 case NFT_MSG_DESTROYSETELEM
:
10130 te
= (struct nft_trans_elem
*)trans
->data
;
10132 nf_tables_setelem_notify(&trans
->ctx
, te
->set
,
10135 nft_setelem_remove(net
, te
->set
, te
->elem_priv
);
10136 if (!nft_setelem_is_catchall(te
->set
, te
->elem_priv
)) {
10137 atomic_dec(&te
->set
->nelems
);
10140 if (te
->set
->ops
->commit
&&
10141 list_empty(&te
->set
->pending_update
)) {
10142 list_add_tail(&te
->set
->pending_update
,
10146 case NFT_MSG_NEWOBJ
:
10147 if (nft_trans_obj_update(trans
)) {
10148 nft_obj_commit_update(trans
);
10149 nf_tables_obj_notify(&trans
->ctx
,
10150 nft_trans_obj(trans
),
10153 nft_clear(net
, nft_trans_obj(trans
));
10154 nf_tables_obj_notify(&trans
->ctx
,
10155 nft_trans_obj(trans
),
10157 nft_trans_destroy(trans
);
10160 case NFT_MSG_DELOBJ
:
10161 case NFT_MSG_DESTROYOBJ
:
10162 nft_obj_del(nft_trans_obj(trans
));
10163 nf_tables_obj_notify(&trans
->ctx
, nft_trans_obj(trans
),
10166 case NFT_MSG_NEWFLOWTABLE
:
10167 if (nft_trans_flowtable_update(trans
)) {
10168 nft_trans_flowtable(trans
)->data
.flags
=
10169 nft_trans_flowtable_flags(trans
);
10170 nf_tables_flowtable_notify(&trans
->ctx
,
10171 nft_trans_flowtable(trans
),
10172 &nft_trans_flowtable_hooks(trans
),
10173 NFT_MSG_NEWFLOWTABLE
);
10174 list_splice(&nft_trans_flowtable_hooks(trans
),
10175 &nft_trans_flowtable(trans
)->hook_list
);
10177 nft_clear(net
, nft_trans_flowtable(trans
));
10178 nf_tables_flowtable_notify(&trans
->ctx
,
10179 nft_trans_flowtable(trans
),
10181 NFT_MSG_NEWFLOWTABLE
);
10183 nft_trans_destroy(trans
);
10185 case NFT_MSG_DELFLOWTABLE
:
10186 case NFT_MSG_DESTROYFLOWTABLE
:
10187 if (nft_trans_flowtable_update(trans
)) {
10188 nf_tables_flowtable_notify(&trans
->ctx
,
10189 nft_trans_flowtable(trans
),
10190 &nft_trans_flowtable_hooks(trans
),
10192 nft_unregister_flowtable_net_hooks(net
,
10193 &nft_trans_flowtable_hooks(trans
));
10195 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
10196 nf_tables_flowtable_notify(&trans
->ctx
,
10197 nft_trans_flowtable(trans
),
10200 nft_unregister_flowtable_net_hooks(net
,
10201 &nft_trans_flowtable(trans
)->hook_list
);
10207 nft_set_commit_update(&set_update_list
);
10209 nft_commit_notify(net
, NETLINK_CB(skb
).portid
);
10210 nf_tables_gen_notify(net
, skb
, NFT_MSG_NEWGEN
);
10211 nf_tables_commit_audit_log(&adl
, nft_net
->base_seq
);
10213 nft_gc_seq_end(nft_net
, gc_seq
);
10214 nft_net
->validate_state
= NFT_VALIDATE_SKIP
;
10215 nf_tables_commit_release(net
);
10220 static void nf_tables_module_autoload(struct net
*net
)
10222 struct nftables_pernet
*nft_net
= nft_pernet(net
);
10223 struct nft_module_request
*req
, *next
;
10224 LIST_HEAD(module_list
);
10226 list_splice_init(&nft_net
->module_list
, &module_list
);
10227 mutex_unlock(&nft_net
->commit_mutex
);
10228 list_for_each_entry_safe(req
, next
, &module_list
, list
) {
10229 request_module("%s", req
->module
);
10232 mutex_lock(&nft_net
->commit_mutex
);
10233 list_splice(&module_list
, &nft_net
->module_list
);
10236 static void nf_tables_abort_release(struct nft_trans
*trans
)
10238 switch (trans
->msg_type
) {
10239 case NFT_MSG_NEWTABLE
:
10240 nf_tables_table_destroy(&trans
->ctx
);
10242 case NFT_MSG_NEWCHAIN
:
10243 if (nft_trans_chain_update(trans
))
10244 nft_hooks_destroy(&nft_trans_chain_hooks(trans
));
10246 nf_tables_chain_destroy(&trans
->ctx
);
10248 case NFT_MSG_NEWRULE
:
10249 nf_tables_rule_destroy(&trans
->ctx
, nft_trans_rule(trans
));
10251 case NFT_MSG_NEWSET
:
10252 nft_set_destroy(&trans
->ctx
, nft_trans_set(trans
));
10254 case NFT_MSG_NEWSETELEM
:
10255 nft_set_elem_destroy(nft_trans_elem_set(trans
),
10256 nft_trans_elem_priv(trans
), true);
10258 case NFT_MSG_NEWOBJ
:
10259 nft_obj_destroy(&trans
->ctx
, nft_trans_obj(trans
));
10261 case NFT_MSG_NEWFLOWTABLE
:
10262 if (nft_trans_flowtable_update(trans
))
10263 nft_hooks_destroy(&nft_trans_flowtable_hooks(trans
));
10265 nf_tables_flowtable_destroy(nft_trans_flowtable(trans
));
10271 static void nft_set_abort_update(struct list_head
*set_update_list
)
10273 struct nft_set
*set
, *next
;
10275 list_for_each_entry_safe(set
, next
, set_update_list
, pending_update
) {
10276 list_del_init(&set
->pending_update
);
10278 if (!set
->ops
->abort
)
10281 set
->ops
->abort(set
);
10285 static int __nf_tables_abort(struct net
*net
, enum nfnl_abort_action action
)
10287 struct nftables_pernet
*nft_net
= nft_pernet(net
);
10288 struct nft_trans
*trans
, *next
;
10289 LIST_HEAD(set_update_list
);
10290 struct nft_trans_elem
*te
;
10292 if (action
== NFNL_ABORT_VALIDATE
&&
10293 nf_tables_validate(net
) < 0)
10296 list_for_each_entry_safe_reverse(trans
, next
, &nft_net
->commit_list
,
10298 switch (trans
->msg_type
) {
10299 case NFT_MSG_NEWTABLE
:
10300 if (nft_trans_table_update(trans
)) {
10301 if (!(trans
->ctx
.table
->flags
& __NFT_TABLE_F_UPDATE
)) {
10302 nft_trans_destroy(trans
);
10305 if (trans
->ctx
.table
->flags
& __NFT_TABLE_F_WAS_DORMANT
) {
10306 nf_tables_table_disable(net
, trans
->ctx
.table
);
10307 trans
->ctx
.table
->flags
|= NFT_TABLE_F_DORMANT
;
10308 } else if (trans
->ctx
.table
->flags
& __NFT_TABLE_F_WAS_AWAKEN
) {
10309 trans
->ctx
.table
->flags
&= ~NFT_TABLE_F_DORMANT
;
10311 trans
->ctx
.table
->flags
&= ~__NFT_TABLE_F_UPDATE
;
10312 nft_trans_destroy(trans
);
10314 list_del_rcu(&trans
->ctx
.table
->list
);
10317 case NFT_MSG_DELTABLE
:
10318 case NFT_MSG_DESTROYTABLE
:
10319 nft_clear(trans
->ctx
.net
, trans
->ctx
.table
);
10320 nft_trans_destroy(trans
);
10322 case NFT_MSG_NEWCHAIN
:
10323 if (nft_trans_chain_update(trans
)) {
10324 nft_netdev_unregister_hooks(net
,
10325 &nft_trans_chain_hooks(trans
),
10327 free_percpu(nft_trans_chain_stats(trans
));
10328 kfree(nft_trans_chain_name(trans
));
10329 nft_trans_destroy(trans
);
10331 if (nft_trans_chain_bound(trans
)) {
10332 nft_trans_destroy(trans
);
10335 nft_use_dec_restore(&trans
->ctx
.table
->use
);
10336 nft_chain_del(trans
->ctx
.chain
);
10337 nf_tables_unregister_hook(trans
->ctx
.net
,
10342 case NFT_MSG_DELCHAIN
:
10343 case NFT_MSG_DESTROYCHAIN
:
10344 if (nft_trans_chain_update(trans
)) {
10345 list_splice(&nft_trans_chain_hooks(trans
),
10346 &nft_trans_basechain(trans
)->hook_list
);
10348 nft_use_inc_restore(&trans
->ctx
.table
->use
);
10349 nft_clear(trans
->ctx
.net
, trans
->ctx
.chain
);
10351 nft_trans_destroy(trans
);
10353 case NFT_MSG_NEWRULE
:
10354 if (nft_trans_rule_bound(trans
)) {
10355 nft_trans_destroy(trans
);
10358 nft_use_dec_restore(&trans
->ctx
.chain
->use
);
10359 list_del_rcu(&nft_trans_rule(trans
)->list
);
10360 nft_rule_expr_deactivate(&trans
->ctx
,
10361 nft_trans_rule(trans
),
10363 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
10364 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
10366 case NFT_MSG_DELRULE
:
10367 case NFT_MSG_DESTROYRULE
:
10368 nft_use_inc_restore(&trans
->ctx
.chain
->use
);
10369 nft_clear(trans
->ctx
.net
, nft_trans_rule(trans
));
10370 nft_rule_expr_activate(&trans
->ctx
, nft_trans_rule(trans
));
10371 if (trans
->ctx
.chain
->flags
& NFT_CHAIN_HW_OFFLOAD
)
10372 nft_flow_rule_destroy(nft_trans_flow_rule(trans
));
10374 nft_trans_destroy(trans
);
10376 case NFT_MSG_NEWSET
:
10377 if (nft_trans_set_update(trans
)) {
10378 nft_trans_destroy(trans
);
10381 nft_use_dec_restore(&trans
->ctx
.table
->use
);
10382 if (nft_trans_set_bound(trans
)) {
10383 nft_trans_destroy(trans
);
10386 list_del_rcu(&nft_trans_set(trans
)->list
);
10388 case NFT_MSG_DELSET
:
10389 case NFT_MSG_DESTROYSET
:
10390 nft_use_inc_restore(&trans
->ctx
.table
->use
);
10391 nft_clear(trans
->ctx
.net
, nft_trans_set(trans
));
10392 if (nft_trans_set(trans
)->flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
))
10393 nft_map_activate(&trans
->ctx
, nft_trans_set(trans
));
10395 nft_trans_destroy(trans
);
10397 case NFT_MSG_NEWSETELEM
:
10398 if (nft_trans_elem_set_bound(trans
)) {
10399 nft_trans_destroy(trans
);
10402 te
= (struct nft_trans_elem
*)trans
->data
;
10403 nft_setelem_remove(net
, te
->set
, te
->elem_priv
);
10404 if (!nft_setelem_is_catchall(te
->set
, te
->elem_priv
))
10405 atomic_dec(&te
->set
->nelems
);
10407 if (te
->set
->ops
->abort
&&
10408 list_empty(&te
->set
->pending_update
)) {
10409 list_add_tail(&te
->set
->pending_update
,
10413 case NFT_MSG_DELSETELEM
:
10414 case NFT_MSG_DESTROYSETELEM
:
10415 te
= (struct nft_trans_elem
*)trans
->data
;
10417 nft_setelem_data_activate(net
, te
->set
, te
->elem_priv
);
10418 nft_setelem_activate(net
, te
->set
, te
->elem_priv
);
10419 if (!nft_setelem_is_catchall(te
->set
, te
->elem_priv
))
10422 if (te
->set
->ops
->abort
&&
10423 list_empty(&te
->set
->pending_update
)) {
10424 list_add_tail(&te
->set
->pending_update
,
10427 nft_trans_destroy(trans
);
10429 case NFT_MSG_NEWOBJ
:
10430 if (nft_trans_obj_update(trans
)) {
10431 nft_obj_destroy(&trans
->ctx
, nft_trans_obj_newobj(trans
));
10432 nft_trans_destroy(trans
);
10434 nft_use_dec_restore(&trans
->ctx
.table
->use
);
10435 nft_obj_del(nft_trans_obj(trans
));
10438 case NFT_MSG_DELOBJ
:
10439 case NFT_MSG_DESTROYOBJ
:
10440 nft_use_inc_restore(&trans
->ctx
.table
->use
);
10441 nft_clear(trans
->ctx
.net
, nft_trans_obj(trans
));
10442 nft_trans_destroy(trans
);
10444 case NFT_MSG_NEWFLOWTABLE
:
10445 if (nft_trans_flowtable_update(trans
)) {
10446 nft_unregister_flowtable_net_hooks(net
,
10447 &nft_trans_flowtable_hooks(trans
));
10449 nft_use_dec_restore(&trans
->ctx
.table
->use
);
10450 list_del_rcu(&nft_trans_flowtable(trans
)->list
);
10451 nft_unregister_flowtable_net_hooks(net
,
10452 &nft_trans_flowtable(trans
)->hook_list
);
10455 case NFT_MSG_DELFLOWTABLE
:
10456 case NFT_MSG_DESTROYFLOWTABLE
:
10457 if (nft_trans_flowtable_update(trans
)) {
10458 list_splice(&nft_trans_flowtable_hooks(trans
),
10459 &nft_trans_flowtable(trans
)->hook_list
);
10461 nft_use_inc_restore(&trans
->ctx
.table
->use
);
10462 nft_clear(trans
->ctx
.net
, nft_trans_flowtable(trans
));
10464 nft_trans_destroy(trans
);
10469 nft_set_abort_update(&set_update_list
);
10473 list_for_each_entry_safe_reverse(trans
, next
,
10474 &nft_net
->commit_list
, list
) {
10475 nft_trans_list_del(trans
);
10476 nf_tables_abort_release(trans
);
10479 if (action
== NFNL_ABORT_AUTOLOAD
)
10480 nf_tables_module_autoload(net
);
10482 nf_tables_module_autoload_cleanup(net
);
10487 static int nf_tables_abort(struct net
*net
, struct sk_buff
*skb
,
10488 enum nfnl_abort_action action
)
10490 struct nftables_pernet
*nft_net
= nft_pernet(net
);
10491 unsigned int gc_seq
;
10494 gc_seq
= nft_gc_seq_begin(nft_net
);
10495 ret
= __nf_tables_abort(net
, action
);
10496 nft_gc_seq_end(nft_net
, gc_seq
);
10497 mutex_unlock(&nft_net
->commit_mutex
);
10502 static bool nf_tables_valid_genid(struct net
*net
, u32 genid
)
10504 struct nftables_pernet
*nft_net
= nft_pernet(net
);
10507 mutex_lock(&nft_net
->commit_mutex
);
10509 genid_ok
= genid
== 0 || nft_net
->base_seq
== genid
;
10511 mutex_unlock(&nft_net
->commit_mutex
);
10513 /* else, commit mutex has to be released by commit or abort function */
10517 static const struct nfnetlink_subsystem nf_tables_subsys
= {
10518 .name
= "nf_tables",
10519 .subsys_id
= NFNL_SUBSYS_NFTABLES
,
10520 .cb_count
= NFT_MSG_MAX
,
10521 .cb
= nf_tables_cb
,
10522 .commit
= nf_tables_commit
,
10523 .abort
= nf_tables_abort
,
10524 .valid_genid
= nf_tables_valid_genid
,
10525 .owner
= THIS_MODULE
,
10528 int nft_chain_validate_dependency(const struct nft_chain
*chain
,
10529 enum nft_chain_types type
)
10531 const struct nft_base_chain
*basechain
;
10533 if (nft_is_base_chain(chain
)) {
10534 basechain
= nft_base_chain(chain
);
10535 if (basechain
->type
->type
!= type
)
10536 return -EOPNOTSUPP
;
10540 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency
);
10542 int nft_chain_validate_hooks(const struct nft_chain
*chain
,
10543 unsigned int hook_flags
)
10545 struct nft_base_chain
*basechain
;
10547 if (nft_is_base_chain(chain
)) {
10548 basechain
= nft_base_chain(chain
);
10550 if ((1 << basechain
->ops
.hooknum
) & hook_flags
)
10553 return -EOPNOTSUPP
;
10558 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks
);
10561 * Loop detection - walk through the ruleset beginning at the destination chain
10562 * of a new jump until either the source chain is reached (loop) or all
10563 * reachable chains have been traversed.
10565 * The loop check is performed whenever a new jump verdict is added to an
10566 * expression or verdict map or a verdict map is bound to a new chain.
10569 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
10570 const struct nft_chain
*chain
);
10572 static int nft_check_loops(const struct nft_ctx
*ctx
,
10573 const struct nft_set_ext
*ext
)
10575 const struct nft_data
*data
;
10578 data
= nft_set_ext_data(ext
);
10579 switch (data
->verdict
.code
) {
10582 ret
= nf_tables_check_loops(ctx
, data
->verdict
.chain
);
10592 static int nf_tables_loop_check_setelem(const struct nft_ctx
*ctx
,
10593 struct nft_set
*set
,
10594 const struct nft_set_iter
*iter
,
10595 struct nft_elem_priv
*elem_priv
)
10597 const struct nft_set_ext
*ext
= nft_set_elem_ext(set
, elem_priv
);
10599 if (nft_set_ext_exists(ext
, NFT_SET_EXT_FLAGS
) &&
10600 *nft_set_ext_flags(ext
) & NFT_SET_ELEM_INTERVAL_END
)
10603 return nft_check_loops(ctx
, ext
);
10606 static int nft_set_catchall_loops(const struct nft_ctx
*ctx
,
10607 struct nft_set
*set
)
10609 u8 genmask
= nft_genmask_next(ctx
->net
);
10610 struct nft_set_elem_catchall
*catchall
;
10611 struct nft_set_ext
*ext
;
10614 list_for_each_entry_rcu(catchall
, &set
->catchall_list
, list
) {
10615 ext
= nft_set_elem_ext(set
, catchall
->elem
);
10616 if (!nft_set_elem_active(ext
, genmask
))
10619 ret
= nft_check_loops(ctx
, ext
);
10627 static int nf_tables_check_loops(const struct nft_ctx
*ctx
,
10628 const struct nft_chain
*chain
)
10630 const struct nft_rule
*rule
;
10631 const struct nft_expr
*expr
, *last
;
10632 struct nft_set
*set
;
10633 struct nft_set_binding
*binding
;
10634 struct nft_set_iter iter
;
10636 if (ctx
->chain
== chain
)
10639 if (fatal_signal_pending(current
))
10642 list_for_each_entry(rule
, &chain
->rules
, list
) {
10643 nft_rule_for_each_expr(expr
, last
, rule
) {
10644 struct nft_immediate_expr
*priv
;
10645 const struct nft_data
*data
;
10648 if (strcmp(expr
->ops
->type
->name
, "immediate"))
10651 priv
= nft_expr_priv(expr
);
10652 if (priv
->dreg
!= NFT_REG_VERDICT
)
10655 data
= &priv
->data
;
10656 switch (data
->verdict
.code
) {
10659 err
= nf_tables_check_loops(ctx
,
10660 data
->verdict
.chain
);
10670 list_for_each_entry(set
, &ctx
->table
->sets
, list
) {
10671 if (!nft_is_active_next(ctx
->net
, set
))
10673 if (!(set
->flags
& NFT_SET_MAP
) ||
10674 set
->dtype
!= NFT_DATA_VERDICT
)
10677 list_for_each_entry(binding
, &set
->bindings
, list
) {
10678 if (!(binding
->flags
& NFT_SET_MAP
) ||
10679 binding
->chain
!= chain
)
10682 iter
.genmask
= nft_genmask_next(ctx
->net
);
10686 iter
.fn
= nf_tables_loop_check_setelem
;
10688 set
->ops
->walk(ctx
, set
, &iter
);
10690 iter
.err
= nft_set_catchall_loops(ctx
, set
);
10701 * nft_parse_u32_check - fetch u32 attribute and check for maximum value
10703 * @attr: netlink attribute to fetch value from
10704 * @max: maximum value to be stored in dest
10705 * @dest: pointer to the variable
10707 * Parse, check and store a given u32 netlink attribute into variable.
10708 * This function returns -ERANGE if the value goes over maximum value.
10709 * Otherwise a 0 is returned and the attribute value is stored in the
10710 * destination variable.
10712 int nft_parse_u32_check(const struct nlattr
*attr
, int max
, u32
*dest
)
10716 val
= ntohl(nla_get_be32(attr
));
10723 EXPORT_SYMBOL_GPL(nft_parse_u32_check
);
10725 static int nft_parse_register(const struct nlattr
*attr
, u32
*preg
)
10729 reg
= ntohl(nla_get_be32(attr
));
10731 case NFT_REG_VERDICT
...NFT_REG_4
:
10732 *preg
= reg
* NFT_REG_SIZE
/ NFT_REG32_SIZE
;
10734 case NFT_REG32_00
...NFT_REG32_15
:
10735 *preg
= reg
+ NFT_REG_SIZE
/ NFT_REG32_SIZE
- NFT_REG32_00
;
10745 * nft_dump_register - dump a register value to a netlink attribute
10747 * @skb: socket buffer
10748 * @attr: attribute number
10749 * @reg: register number
10751 * Construct a netlink attribute containing the register number. For
10752 * compatibility reasons, register numbers being a multiple of 4 are
10753 * translated to the corresponding 128 bit register numbers.
10755 int nft_dump_register(struct sk_buff
*skb
, unsigned int attr
, unsigned int reg
)
10757 if (reg
% (NFT_REG_SIZE
/ NFT_REG32_SIZE
) == 0)
10758 reg
= reg
/ (NFT_REG_SIZE
/ NFT_REG32_SIZE
);
10760 reg
= reg
- NFT_REG_SIZE
/ NFT_REG32_SIZE
+ NFT_REG32_00
;
10762 return nla_put_be32(skb
, attr
, htonl(reg
));
10764 EXPORT_SYMBOL_GPL(nft_dump_register
);
10766 static int nft_validate_register_load(enum nft_registers reg
, unsigned int len
)
10768 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
10772 if (reg
* NFT_REG32_SIZE
+ len
> sizeof_field(struct nft_regs
, data
))
10778 int nft_parse_register_load(const struct nlattr
*attr
, u8
*sreg
, u32 len
)
10783 err
= nft_parse_register(attr
, ®
);
10787 err
= nft_validate_register_load(reg
, len
);
10794 EXPORT_SYMBOL_GPL(nft_parse_register_load
);
10796 static int nft_validate_register_store(const struct nft_ctx
*ctx
,
10797 enum nft_registers reg
,
10798 const struct nft_data
*data
,
10799 enum nft_data_types type
,
10805 case NFT_REG_VERDICT
:
10806 if (type
!= NFT_DATA_VERDICT
)
10809 if (data
!= NULL
&&
10810 (data
->verdict
.code
== NFT_GOTO
||
10811 data
->verdict
.code
== NFT_JUMP
)) {
10812 err
= nf_tables_check_loops(ctx
, data
->verdict
.chain
);
10819 if (reg
< NFT_REG_1
* NFT_REG_SIZE
/ NFT_REG32_SIZE
)
10823 if (reg
* NFT_REG32_SIZE
+ len
>
10824 sizeof_field(struct nft_regs
, data
))
10827 if (data
!= NULL
&& type
!= NFT_DATA_VALUE
)
10833 int nft_parse_register_store(const struct nft_ctx
*ctx
,
10834 const struct nlattr
*attr
, u8
*dreg
,
10835 const struct nft_data
*data
,
10836 enum nft_data_types type
, unsigned int len
)
10841 err
= nft_parse_register(attr
, ®
);
10845 err
= nft_validate_register_store(ctx
, reg
, data
, type
, len
);
10852 EXPORT_SYMBOL_GPL(nft_parse_register_store
);
10854 static const struct nla_policy nft_verdict_policy
[NFTA_VERDICT_MAX
+ 1] = {
10855 [NFTA_VERDICT_CODE
] = { .type
= NLA_U32
},
10856 [NFTA_VERDICT_CHAIN
] = { .type
= NLA_STRING
,
10857 .len
= NFT_CHAIN_MAXNAMELEN
- 1 },
10858 [NFTA_VERDICT_CHAIN_ID
] = { .type
= NLA_U32
},
10861 static int nft_verdict_init(const struct nft_ctx
*ctx
, struct nft_data
*data
,
10862 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
10864 u8 genmask
= nft_genmask_next(ctx
->net
);
10865 struct nlattr
*tb
[NFTA_VERDICT_MAX
+ 1];
10866 struct nft_chain
*chain
;
10869 err
= nla_parse_nested_deprecated(tb
, NFTA_VERDICT_MAX
, nla
,
10870 nft_verdict_policy
, NULL
);
10874 if (!tb
[NFTA_VERDICT_CODE
])
10877 /* zero padding hole for memcmp */
10878 memset(data
, 0, sizeof(*data
));
10879 data
->verdict
.code
= ntohl(nla_get_be32(tb
[NFTA_VERDICT_CODE
]));
10881 switch (data
->verdict
.code
) {
10883 switch (data
->verdict
.code
& NF_VERDICT_MASK
) {
10898 if (tb
[NFTA_VERDICT_CHAIN
]) {
10899 chain
= nft_chain_lookup(ctx
->net
, ctx
->table
,
10900 tb
[NFTA_VERDICT_CHAIN
],
10902 } else if (tb
[NFTA_VERDICT_CHAIN_ID
]) {
10903 chain
= nft_chain_lookup_byid(ctx
->net
, ctx
->table
,
10904 tb
[NFTA_VERDICT_CHAIN_ID
],
10907 return PTR_ERR(chain
);
10913 return PTR_ERR(chain
);
10914 if (nft_is_base_chain(chain
))
10915 return -EOPNOTSUPP
;
10916 if (nft_chain_is_bound(chain
))
10918 if (desc
->flags
& NFT_DATA_DESC_SETELEM
&&
10919 chain
->flags
& NFT_CHAIN_BINDING
)
10921 if (!nft_use_inc(&chain
->use
))
10924 data
->verdict
.chain
= chain
;
10928 desc
->len
= sizeof(data
->verdict
);
10933 static void nft_verdict_uninit(const struct nft_data
*data
)
10935 struct nft_chain
*chain
;
10937 switch (data
->verdict
.code
) {
10940 chain
= data
->verdict
.chain
;
10941 nft_use_dec(&chain
->use
);
10946 int nft_verdict_dump(struct sk_buff
*skb
, int type
, const struct nft_verdict
*v
)
10948 struct nlattr
*nest
;
10950 nest
= nla_nest_start_noflag(skb
, type
);
10952 goto nla_put_failure
;
10954 if (nla_put_be32(skb
, NFTA_VERDICT_CODE
, htonl(v
->code
)))
10955 goto nla_put_failure
;
10960 if (nla_put_string(skb
, NFTA_VERDICT_CHAIN
,
10962 goto nla_put_failure
;
10964 nla_nest_end(skb
, nest
);
10971 static int nft_value_init(const struct nft_ctx
*ctx
,
10972 struct nft_data
*data
, struct nft_data_desc
*desc
,
10973 const struct nlattr
*nla
)
10977 len
= nla_len(nla
);
10980 if (len
> desc
->size
)
10983 if (len
!= desc
->len
)
10989 nla_memcpy(data
->data
, nla
, len
);
10994 static int nft_value_dump(struct sk_buff
*skb
, const struct nft_data
*data
,
10997 return nla_put(skb
, NFTA_DATA_VALUE
, len
, data
->data
);
11000 static const struct nla_policy nft_data_policy
[NFTA_DATA_MAX
+ 1] = {
11001 [NFTA_DATA_VALUE
] = { .type
= NLA_BINARY
},
11002 [NFTA_DATA_VERDICT
] = { .type
= NLA_NESTED
},
11006 * nft_data_init - parse nf_tables data netlink attributes
11008 * @ctx: context of the expression using the data
11009 * @data: destination struct nft_data
11010 * @desc: data description
11011 * @nla: netlink attribute containing data
11013 * Parse the netlink data attributes and initialize a struct nft_data.
11014 * The type and length of data are returned in the data description.
11016 * The caller can indicate that it only wants to accept data of type
11017 * NFT_DATA_VALUE by passing NULL for the ctx argument.
11019 int nft_data_init(const struct nft_ctx
*ctx
, struct nft_data
*data
,
11020 struct nft_data_desc
*desc
, const struct nlattr
*nla
)
11022 struct nlattr
*tb
[NFTA_DATA_MAX
+ 1];
11025 if (WARN_ON_ONCE(!desc
->size
))
11028 err
= nla_parse_nested_deprecated(tb
, NFTA_DATA_MAX
, nla
,
11029 nft_data_policy
, NULL
);
11033 if (tb
[NFTA_DATA_VALUE
]) {
11034 if (desc
->type
!= NFT_DATA_VALUE
)
11037 err
= nft_value_init(ctx
, data
, desc
, tb
[NFTA_DATA_VALUE
]);
11038 } else if (tb
[NFTA_DATA_VERDICT
] && ctx
!= NULL
) {
11039 if (desc
->type
!= NFT_DATA_VERDICT
)
11042 err
= nft_verdict_init(ctx
, data
, desc
, tb
[NFTA_DATA_VERDICT
]);
11049 EXPORT_SYMBOL_GPL(nft_data_init
);
11052 * nft_data_release - release a nft_data item
11054 * @data: struct nft_data to release
11055 * @type: type of data
11057 * Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
11058 * all others need to be released by calling this function.
11060 void nft_data_release(const struct nft_data
*data
, enum nft_data_types type
)
11062 if (type
< NFT_DATA_VERDICT
)
11065 case NFT_DATA_VERDICT
:
11066 return nft_verdict_uninit(data
);
11071 EXPORT_SYMBOL_GPL(nft_data_release
);
11073 int nft_data_dump(struct sk_buff
*skb
, int attr
, const struct nft_data
*data
,
11074 enum nft_data_types type
, unsigned int len
)
11076 struct nlattr
*nest
;
11079 nest
= nla_nest_start_noflag(skb
, attr
);
11084 case NFT_DATA_VALUE
:
11085 err
= nft_value_dump(skb
, data
, len
);
11087 case NFT_DATA_VERDICT
:
11088 err
= nft_verdict_dump(skb
, NFTA_DATA_VERDICT
, &data
->verdict
);
11095 nla_nest_end(skb
, nest
);
11098 EXPORT_SYMBOL_GPL(nft_data_dump
);
11100 int __nft_release_basechain(struct nft_ctx
*ctx
)
11102 struct nft_rule
*rule
, *nr
;
11104 if (WARN_ON(!nft_is_base_chain(ctx
->chain
)))
11107 nf_tables_unregister_hook(ctx
->net
, ctx
->chain
->table
, ctx
->chain
);
11108 list_for_each_entry_safe(rule
, nr
, &ctx
->chain
->rules
, list
) {
11109 list_del(&rule
->list
);
11110 nft_use_dec(&ctx
->chain
->use
);
11111 nf_tables_rule_release(ctx
, rule
);
11113 nft_chain_del(ctx
->chain
);
11114 nft_use_dec(&ctx
->table
->use
);
11115 nf_tables_chain_destroy(ctx
);
11119 EXPORT_SYMBOL_GPL(__nft_release_basechain
);
11121 static void __nft_release_hook(struct net
*net
, struct nft_table
*table
)
11123 struct nft_flowtable
*flowtable
;
11124 struct nft_chain
*chain
;
11126 list_for_each_entry(chain
, &table
->chains
, list
)
11127 __nf_tables_unregister_hook(net
, table
, chain
, true);
11128 list_for_each_entry(flowtable
, &table
->flowtables
, list
)
11129 __nft_unregister_flowtable_net_hooks(net
, &flowtable
->hook_list
,
11133 static void __nft_release_hooks(struct net
*net
)
11135 struct nftables_pernet
*nft_net
= nft_pernet(net
);
11136 struct nft_table
*table
;
11138 list_for_each_entry(table
, &nft_net
->tables
, list
) {
11139 if (nft_table_has_owner(table
))
11142 __nft_release_hook(net
, table
);
11146 static void __nft_release_table(struct net
*net
, struct nft_table
*table
)
11148 struct nft_flowtable
*flowtable
, *nf
;
11149 struct nft_chain
*chain
, *nc
;
11150 struct nft_object
*obj
, *ne
;
11151 struct nft_rule
*rule
, *nr
;
11152 struct nft_set
*set
, *ns
;
11153 struct nft_ctx ctx
= {
11155 .family
= NFPROTO_NETDEV
,
11158 ctx
.family
= table
->family
;
11160 list_for_each_entry(chain
, &table
->chains
, list
) {
11161 if (nft_chain_binding(chain
))
11165 list_for_each_entry_safe(rule
, nr
, &chain
->rules
, list
) {
11166 list_del(&rule
->list
);
11167 nft_use_dec(&chain
->use
);
11168 nf_tables_rule_release(&ctx
, rule
);
11171 list_for_each_entry_safe(flowtable
, nf
, &table
->flowtables
, list
) {
11172 list_del(&flowtable
->list
);
11173 nft_use_dec(&table
->use
);
11174 nf_tables_flowtable_destroy(flowtable
);
11176 list_for_each_entry_safe(set
, ns
, &table
->sets
, list
) {
11177 list_del(&set
->list
);
11178 nft_use_dec(&table
->use
);
11179 if (set
->flags
& (NFT_SET_MAP
| NFT_SET_OBJECT
))
11180 nft_map_deactivate(&ctx
, set
);
11182 nft_set_destroy(&ctx
, set
);
11184 list_for_each_entry_safe(obj
, ne
, &table
->objects
, list
) {
11186 nft_use_dec(&table
->use
);
11187 nft_obj_destroy(&ctx
, obj
);
11189 list_for_each_entry_safe(chain
, nc
, &table
->chains
, list
) {
11191 nft_chain_del(chain
);
11192 nft_use_dec(&table
->use
);
11193 nf_tables_chain_destroy(&ctx
);
11195 nf_tables_table_destroy(&ctx
);
11198 static void __nft_release_tables(struct net
*net
)
11200 struct nftables_pernet
*nft_net
= nft_pernet(net
);
11201 struct nft_table
*table
, *nt
;
11203 list_for_each_entry_safe(table
, nt
, &nft_net
->tables
, list
) {
11204 if (nft_table_has_owner(table
))
11207 list_del(&table
->list
);
11209 __nft_release_table(net
, table
);
11213 static int nft_rcv_nl_event(struct notifier_block
*this, unsigned long event
,
11216 struct nft_table
*table
, *to_delete
[8];
11217 struct nftables_pernet
*nft_net
;
11218 struct netlink_notify
*n
= ptr
;
11219 struct net
*net
= n
->net
;
11220 unsigned int deleted
;
11221 bool restart
= false;
11222 unsigned int gc_seq
;
11224 if (event
!= NETLINK_URELEASE
|| n
->protocol
!= NETLINK_NETFILTER
)
11225 return NOTIFY_DONE
;
11227 nft_net
= nft_pernet(net
);
11229 mutex_lock(&nft_net
->commit_mutex
);
11231 gc_seq
= nft_gc_seq_begin(nft_net
);
11233 if (!list_empty(&nf_tables_destroy_list
))
11234 nf_tables_trans_destroy_flush_work();
11236 list_for_each_entry(table
, &nft_net
->tables
, list
) {
11237 if (nft_table_has_owner(table
) &&
11238 n
->portid
== table
->nlpid
) {
11239 __nft_release_hook(net
, table
);
11240 list_del_rcu(&table
->list
);
11241 to_delete
[deleted
++] = table
;
11242 if (deleted
>= ARRAY_SIZE(to_delete
))
11247 restart
= deleted
>= ARRAY_SIZE(to_delete
);
11250 __nft_release_table(net
, to_delete
[--deleted
]);
11255 nft_gc_seq_end(nft_net
, gc_seq
);
11257 mutex_unlock(&nft_net
->commit_mutex
);
11259 return NOTIFY_DONE
;
11262 static struct notifier_block nft_nl_notifier
= {
11263 .notifier_call
= nft_rcv_nl_event
,
11266 static int __net_init
nf_tables_init_net(struct net
*net
)
11268 struct nftables_pernet
*nft_net
= nft_pernet(net
);
11270 INIT_LIST_HEAD(&nft_net
->tables
);
11271 INIT_LIST_HEAD(&nft_net
->commit_list
);
11272 INIT_LIST_HEAD(&nft_net
->binding_list
);
11273 INIT_LIST_HEAD(&nft_net
->module_list
);
11274 INIT_LIST_HEAD(&nft_net
->notify_list
);
11275 mutex_init(&nft_net
->commit_mutex
);
11276 nft_net
->base_seq
= 1;
11277 nft_net
->gc_seq
= 0;
11278 nft_net
->validate_state
= NFT_VALIDATE_SKIP
;
11283 static void __net_exit
nf_tables_pre_exit_net(struct net
*net
)
11285 struct nftables_pernet
*nft_net
= nft_pernet(net
);
11287 mutex_lock(&nft_net
->commit_mutex
);
11288 __nft_release_hooks(net
);
11289 mutex_unlock(&nft_net
->commit_mutex
);
11292 static void __net_exit
nf_tables_exit_net(struct net
*net
)
11294 struct nftables_pernet
*nft_net
= nft_pernet(net
);
11295 unsigned int gc_seq
;
11297 mutex_lock(&nft_net
->commit_mutex
);
11299 gc_seq
= nft_gc_seq_begin(nft_net
);
11301 if (!list_empty(&nft_net
->commit_list
) ||
11302 !list_empty(&nft_net
->module_list
))
11303 __nf_tables_abort(net
, NFNL_ABORT_NONE
);
11305 __nft_release_tables(net
);
11307 nft_gc_seq_end(nft_net
, gc_seq
);
11309 mutex_unlock(&nft_net
->commit_mutex
);
11310 WARN_ON_ONCE(!list_empty(&nft_net
->tables
));
11311 WARN_ON_ONCE(!list_empty(&nft_net
->module_list
));
11312 WARN_ON_ONCE(!list_empty(&nft_net
->notify_list
));
11315 static void nf_tables_exit_batch(struct list_head
*net_exit_list
)
11317 flush_work(&trans_gc_work
);
11320 static struct pernet_operations nf_tables_net_ops
= {
11321 .init
= nf_tables_init_net
,
11322 .pre_exit
= nf_tables_pre_exit_net
,
11323 .exit
= nf_tables_exit_net
,
11324 .exit_batch
= nf_tables_exit_batch
,
11325 .id
= &nf_tables_net_id
,
11326 .size
= sizeof(struct nftables_pernet
),
11329 static int __init
nf_tables_module_init(void)
11333 err
= register_pernet_subsys(&nf_tables_net_ops
);
11337 err
= nft_chain_filter_init();
11339 goto err_chain_filter
;
11341 err
= nf_tables_core_module_init();
11343 goto err_core_module
;
11345 err
= register_netdevice_notifier(&nf_tables_flowtable_notifier
);
11347 goto err_netdev_notifier
;
11349 err
= rhltable_init(&nft_objname_ht
, &nft_objname_ht_params
);
11351 goto err_rht_objname
;
11353 err
= nft_offload_init();
11357 err
= netlink_register_notifier(&nft_nl_notifier
);
11359 goto err_netlink_notifier
;
11362 err
= nfnetlink_subsys_register(&nf_tables_subsys
);
11364 goto err_nfnl_subsys
;
11366 nft_chain_route_init();
11371 netlink_unregister_notifier(&nft_nl_notifier
);
11372 err_netlink_notifier
:
11373 nft_offload_exit();
11375 rhltable_destroy(&nft_objname_ht
);
11377 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
11378 err_netdev_notifier
:
11379 nf_tables_core_module_exit();
11381 nft_chain_filter_fini();
11383 unregister_pernet_subsys(&nf_tables_net_ops
);
11387 static void __exit
nf_tables_module_exit(void)
11389 nfnetlink_subsys_unregister(&nf_tables_subsys
);
11390 netlink_unregister_notifier(&nft_nl_notifier
);
11391 nft_offload_exit();
11392 unregister_netdevice_notifier(&nf_tables_flowtable_notifier
);
11393 nft_chain_filter_fini();
11394 nft_chain_route_fini();
11395 unregister_pernet_subsys(&nf_tables_net_ops
);
11396 cancel_work_sync(&trans_gc_work
);
11397 cancel_work_sync(&trans_destroy_work
);
11399 rhltable_destroy(&nft_objname_ht
);
11400 nf_tables_core_module_exit();
11403 module_init(nf_tables_module_init
);
11404 module_exit(nf_tables_module_exit
);
11406 MODULE_LICENSE("GPL");
11407 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
11408 MODULE_DESCRIPTION("Framework for packet filtering and classification");
11409 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES
);