netfilter: nf_tables: add userdata attributes to nft_chain

Enables storing userdata for nft_chain. Field udata points to user data
and udlen stores its length.

Adds new attribute flag NFTA_CHAIN_USERDATA.

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index c4c526507ddb508abacc99e6fde1b080d6c577d8..0bd2a081ae390ebbb28e3604ecf82cde483cc10b 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -945,6 +945,8 @@ struct nft_chain {
                                        bound:1,
                                        genmask:2;
        char                            *name;
+       u16                             udlen;
+       u8                              *udata;
 
        /* Only used during control plane commit phase: */
        struct nft_rule                 **rules_next;

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 3c2469b437427ff8637460f7d0f74b0638ee99ed..352ee51707a1b56bdcd67239e5453c22c504c9ed 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -208,6 +208,7 @@ enum nft_chain_flags {
  * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
  * @NFTA_CHAIN_FLAGS: chain flags
  * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
+ * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
  */
 enum nft_chain_attributes {
        NFTA_CHAIN_UNSPEC,
@@ -222,6 +223,7 @@ enum nft_chain_attributes {
        NFTA_CHAIN_PAD,
        NFTA_CHAIN_FLAGS,
        NFTA_CHAIN_ID,
+       NFTA_CHAIN_USERDATA,
        __NFTA_CHAIN_MAX
 };
 #define NFTA_CHAIN_MAX         (__NFTA_CHAIN_MAX - 1)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0473316aa39236bffc30c49928c3d21f0fa947c6..3cfff31e48182578bc90c8780315a7c9c4fe7ad6 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1304,6 +1304,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
        [NFTA_CHAIN_COUNTERS]   = { .type = NLA_NESTED },
        [NFTA_CHAIN_FLAGS]      = { .type = NLA_U32 },
        [NFTA_CHAIN_ID]         = { .type = NLA_U32 },
+       [NFTA_CHAIN_USERDATA]   = { .type = NLA_BINARY,
+                                   .len = NFT_USERDATA_MAXLEN },
 };
 
 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
@@ -1445,6 +1447,10 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
        if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
                goto nla_put_failure;
 
+       if (chain->udata &&
+           nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata))
+               goto nla_put_failure;
+
        nlmsg_end(skb, nlh);
        return 0;
 
@@ -1682,9 +1688,11 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx)
                        free_percpu(rcu_dereference_raw(basechain->stats));
                }
                kfree(chain->name);
+               kfree(chain->udata);
                kfree(basechain);
        } else {
                kfree(chain->name);
+               kfree(chain->udata);
                kfree(chain);
        }
 }
@@ -2038,7 +2046,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
        } else {
                if (!(flags & NFT_CHAIN_BINDING)) {
                        err = -EINVAL;
-                       goto err1;
+                       goto err_destroy_chain;
                }
 
                snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
@@ -2047,13 +2055,22 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
 
        if (!chain->name) {
                err = -ENOMEM;
-               goto err1;
+               goto err_destroy_chain;
+       }
+
+       if (nla[NFTA_CHAIN_USERDATA]) {
+               chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);
+               if (chain->udata == NULL) {
+                       err = -ENOMEM;
+                       goto err_destroy_chain;
+               }
+               chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]);
        }
 
        rules = nf_tables_chain_alloc_rules(chain, 0);
        if (!rules) {
                err = -ENOMEM;
-               goto err1;
+               goto err_destroy_chain;
        }
 
        *rules = NULL;
@@ -2062,12 +2079,12 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
 
        err = nf_tables_register_hook(net, table, chain);
        if (err < 0)
-               goto err1;
+               goto err_destroy_chain;
 
        trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
        if (IS_ERR(trans)) {
                err = PTR_ERR(trans);
-               goto err2;
+               goto err_unregister_hook;
        }
 
        nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
@@ -2077,15 +2094,15 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
        err = nft_chain_add(table, chain);
        if (err < 0) {
                nft_trans_destroy(trans);
-               goto err2;
+               goto err_unregister_hook;
        }
 
        table->use++;
 
        return 0;
-err2:
+err_unregister_hook:
        nf_tables_unregister_hook(net, table, chain);
-err1:
+err_destroy_chain:
        nf_tables_chain_destroy(ctx);
 
        return err;