~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nf_tables_api.c

Version: ~ [ linux-5.1-rc5 ] ~ [ linux-5.0.7 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.34 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.111 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.168 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.178 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.138 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.65 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  9  */
 10 
 11 #include <linux/module.h>
 12 #include <linux/init.h>
 13 #include <linux/list.h>
 14 #include <linux/skbuff.h>
 15 #include <linux/netlink.h>
 16 #include <linux/netfilter.h>
 17 #include <linux/netfilter/nfnetlink.h>
 18 #include <linux/netfilter/nf_tables.h>
 19 #include <net/netfilter/nf_tables_core.h>
 20 #include <net/netfilter/nf_tables.h>
 21 #include <net/net_namespace.h>
 22 #include <net/sock.h>
 23 
 24 static LIST_HEAD(nf_tables_expressions);
 25 
 26 /**
 27  *      nft_register_afinfo - register nf_tables address family info
 28  *
 29  *      @afi: address family info to register
 30  *
 31  *      Register the address family for use with nf_tables. Returns zero on
 32  *      success or a negative errno code otherwise.
 33  */
 34 int nft_register_afinfo(struct net *net, struct nft_af_info *afi)
 35 {
 36         INIT_LIST_HEAD(&afi->tables);
 37         nfnl_lock(NFNL_SUBSYS_NFTABLES);
 38         list_add_tail_rcu(&afi->list, &net->nft.af_info);
 39         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
 40         return 0;
 41 }
 42 EXPORT_SYMBOL_GPL(nft_register_afinfo);
 43 
 44 /**
 45  *      nft_unregister_afinfo - unregister nf_tables address family info
 46  *
 47  *      @afi: address family info to unregister
 48  *
 49  *      Unregister the address family for use with nf_tables.
 50  */
 51 void nft_unregister_afinfo(struct nft_af_info *afi)
 52 {
 53         nfnl_lock(NFNL_SUBSYS_NFTABLES);
 54         list_del_rcu(&afi->list);
 55         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
 56 }
 57 EXPORT_SYMBOL_GPL(nft_unregister_afinfo);
 58 
 59 static struct nft_af_info *nft_afinfo_lookup(struct net *net, int family)
 60 {
 61         struct nft_af_info *afi;
 62 
 63         list_for_each_entry(afi, &net->nft.af_info, list) {
 64                 if (afi->family == family)
 65                         return afi;
 66         }
 67         return NULL;
 68 }
 69 
 70 static struct nft_af_info *
 71 nf_tables_afinfo_lookup(struct net *net, int family, bool autoload)
 72 {
 73         struct nft_af_info *afi;
 74 
 75         afi = nft_afinfo_lookup(net, family);
 76         if (afi != NULL)
 77                 return afi;
 78 #ifdef CONFIG_MODULES
 79         if (autoload) {
 80                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
 81                 request_module("nft-afinfo-%u", family);
 82                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
 83                 afi = nft_afinfo_lookup(net, family);
 84                 if (afi != NULL)
 85                         return ERR_PTR(-EAGAIN);
 86         }
 87 #endif
 88         return ERR_PTR(-EAFNOSUPPORT);
 89 }
 90 
 91 static void nft_ctx_init(struct nft_ctx *ctx,
 92                          const struct sk_buff *skb,
 93                          const struct nlmsghdr *nlh,
 94                          struct nft_af_info *afi,
 95                          struct nft_table *table,
 96                          struct nft_chain *chain,
 97                          const struct nlattr * const *nla)
 98 {
 99         ctx->net        = sock_net(skb->sk);
100         ctx->afi        = afi;
101         ctx->table      = table;
102         ctx->chain      = chain;
103         ctx->nla        = nla;
104         ctx->portid     = NETLINK_CB(skb).portid;
105         ctx->report     = nlmsg_report(nlh);
106         ctx->seq        = nlh->nlmsg_seq;
107 }
108 
109 static struct nft_trans *nft_trans_alloc(struct nft_ctx *ctx, int msg_type,
110                                          u32 size)
111 {
112         struct nft_trans *trans;
113 
114         trans = kzalloc(sizeof(struct nft_trans) + size, GFP_KERNEL);
115         if (trans == NULL)
116                 return NULL;
117 
118         trans->msg_type = msg_type;
119         trans->ctx      = *ctx;
120 
121         return trans;
122 }
123 
124 static void nft_trans_destroy(struct nft_trans *trans)
125 {
126         list_del(&trans->list);
127         kfree(trans);
128 }
129 
130 static void nf_tables_unregister_hooks(const struct nft_table *table,
131                                        const struct nft_chain *chain,
132                                        unsigned int hook_nops)
133 {
134         if (!(table->flags & NFT_TABLE_F_DORMANT) &&
135             chain->flags & NFT_BASE_CHAIN)
136                 nf_unregister_hooks(nft_base_chain(chain)->ops, hook_nops);
137 }
138 
139 /* Internal table flags */
140 #define NFT_TABLE_INACTIVE      (1 << 15)
141 
142 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
143 {
144         struct nft_trans *trans;
145 
146         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
147         if (trans == NULL)
148                 return -ENOMEM;
149 
150         if (msg_type == NFT_MSG_NEWTABLE)
151                 ctx->table->flags |= NFT_TABLE_INACTIVE;
152 
153         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
154         return 0;
155 }
156 
157 static int nft_deltable(struct nft_ctx *ctx)
158 {
159         int err;
160 
161         err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
162         if (err < 0)
163                 return err;
164 
165         list_del_rcu(&ctx->table->list);
166         return err;
167 }
168 
169 static int nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
170 {
171         struct nft_trans *trans;
172 
173         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
174         if (trans == NULL)
175                 return -ENOMEM;
176 
177         if (msg_type == NFT_MSG_NEWCHAIN)
178                 ctx->chain->flags |= NFT_CHAIN_INACTIVE;
179 
180         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
181         return 0;
182 }
183 
184 static int nft_delchain(struct nft_ctx *ctx)
185 {
186         int err;
187 
188         err = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
189         if (err < 0)
190                 return err;
191 
192         ctx->table->use--;
193         list_del_rcu(&ctx->chain->list);
194 
195         return err;
196 }
197 
198 static inline bool
199 nft_rule_is_active(struct net *net, const struct nft_rule *rule)
200 {
201         return (rule->genmask & (1 << net->nft.gencursor)) == 0;
202 }
203 
204 static inline int gencursor_next(struct net *net)
205 {
206         return net->nft.gencursor+1 == 1 ? 1 : 0;
207 }
208 
209 static inline int
210 nft_rule_is_active_next(struct net *net, const struct nft_rule *rule)
211 {
212         return (rule->genmask & (1 << gencursor_next(net))) == 0;
213 }
214 
215 static inline void
216 nft_rule_activate_next(struct net *net, struct nft_rule *rule)
217 {
218         /* Now inactive, will be active in the future */
219         rule->genmask = (1 << net->nft.gencursor);
220 }
221 
222 static inline void
223 nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
224 {
225         rule->genmask = (1 << gencursor_next(net));
226 }
227 
228 static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
229 {
230         rule->genmask &= ~(1 << gencursor_next(net));
231 }
232 
233 static int
234 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
235 {
236         /* You cannot delete the same rule twice */
237         if (nft_rule_is_active_next(ctx->net, rule)) {
238                 nft_rule_deactivate_next(ctx->net, rule);
239                 ctx->chain->use--;
240                 return 0;
241         }
242         return -ENOENT;
243 }
244 
245 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
246                                             struct nft_rule *rule)
247 {
248         struct nft_trans *trans;
249 
250         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
251         if (trans == NULL)
252                 return NULL;
253 
254         nft_trans_rule(trans) = rule;
255         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
256 
257         return trans;
258 }
259 
260 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
261 {
262         struct nft_trans *trans;
263         int err;
264 
265         trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
266         if (trans == NULL)
267                 return -ENOMEM;
268 
269         err = nf_tables_delrule_deactivate(ctx, rule);
270         if (err < 0) {
271                 nft_trans_destroy(trans);
272                 return err;
273         }
274 
275         return 0;
276 }
277 
278 static int nft_delrule_by_chain(struct nft_ctx *ctx)
279 {
280         struct nft_rule *rule;
281         int err;
282 
283         list_for_each_entry(rule, &ctx->chain->rules, list) {
284                 err = nft_delrule(ctx, rule);
285                 if (err < 0)
286                         return err;
287         }
288         return 0;
289 }
290 
291 /* Internal set flag */
292 #define NFT_SET_INACTIVE        (1 << 15)
293 
294 static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
295                              struct nft_set *set)
296 {
297         struct nft_trans *trans;
298 
299         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
300         if (trans == NULL)
301                 return -ENOMEM;
302 
303         if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
304                 nft_trans_set_id(trans) =
305                         ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
306                 set->flags |= NFT_SET_INACTIVE;
307         }
308         nft_trans_set(trans) = set;
309         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
310 
311         return 0;
312 }
313 
314 static int nft_delset(struct nft_ctx *ctx, struct nft_set *set)
315 {
316         int err;
317 
318         err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
319         if (err < 0)
320                 return err;
321 
322         list_del_rcu(&set->list);
323         ctx->table->use--;
324 
325         return err;
326 }
327 
328 /*
329  * Tables
330  */
331 
332 static struct nft_table *nft_table_lookup(const struct nft_af_info *afi,
333                                           const struct nlattr *nla)
334 {
335         struct nft_table *table;
336 
337         list_for_each_entry(table, &afi->tables, list) {
338                 if (!nla_strcmp(nla, table->name))
339                         return table;
340         }
341         return NULL;
342 }
343 
344 static struct nft_table *nf_tables_table_lookup(const struct nft_af_info *afi,
345                                                 const struct nlattr *nla)
346 {
347         struct nft_table *table;
348 
349         if (nla == NULL)
350                 return ERR_PTR(-EINVAL);
351 
352         table = nft_table_lookup(afi, nla);
353         if (table != NULL)
354                 return table;
355 
356         return ERR_PTR(-ENOENT);
357 }
358 
359 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
360 {
361         return ++table->hgenerator;
362 }
363 
364 static const struct nf_chain_type *chain_type[AF_MAX][NFT_CHAIN_T_MAX];
365 
366 static const struct nf_chain_type *
367 __nf_tables_chain_type_lookup(int family, const struct nlattr *nla)
368 {
369         int i;
370 
371         for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
372                 if (chain_type[family][i] != NULL &&
373                     !nla_strcmp(nla, chain_type[family][i]->name))
374                         return chain_type[family][i];
375         }
376         return NULL;
377 }
378 
379 static const struct nf_chain_type *
380 nf_tables_chain_type_lookup(const struct nft_af_info *afi,
381                             const struct nlattr *nla,
382                             bool autoload)
383 {
384         const struct nf_chain_type *type;
385 
386         type = __nf_tables_chain_type_lookup(afi->family, nla);
387         if (type != NULL)
388                 return type;
389 #ifdef CONFIG_MODULES
390         if (autoload) {
391                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
392                 request_module("nft-chain-%u-%.*s", afi->family,
393                                nla_len(nla), (const char *)nla_data(nla));
394                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
395                 type = __nf_tables_chain_type_lookup(afi->family, nla);
396                 if (type != NULL)
397                         return ERR_PTR(-EAGAIN);
398         }
399 #endif
400         return ERR_PTR(-ENOENT);
401 }
402 
403 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
404         [NFTA_TABLE_NAME]       = { .type = NLA_STRING },
405         [NFTA_TABLE_FLAGS]      = { .type = NLA_U32 },
406 };
407 
408 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
409                                      u32 portid, u32 seq, int event, u32 flags,
410                                      int family, const struct nft_table *table)
411 {
412         struct nlmsghdr *nlh;
413         struct nfgenmsg *nfmsg;
414 
415         event |= NFNL_SUBSYS_NFTABLES << 8;
416         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
417         if (nlh == NULL)
418                 goto nla_put_failure;
419 
420         nfmsg = nlmsg_data(nlh);
421         nfmsg->nfgen_family     = family;
422         nfmsg->version          = NFNETLINK_V0;
423         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
424 
425         if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
426             nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
427             nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
428                 goto nla_put_failure;
429 
430         return nlmsg_end(skb, nlh);
431 
432 nla_put_failure:
433         nlmsg_trim(skb, nlh);
434         return -1;
435 }
436 
437 static int nf_tables_table_notify(const struct nft_ctx *ctx, int event)
438 {
439         struct sk_buff *skb;
440         int err;
441 
442         if (!ctx->report &&
443             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
444                 return 0;
445 
446         err = -ENOBUFS;
447         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
448         if (skb == NULL)
449                 goto err;
450 
451         err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
452                                         event, 0, ctx->afi->family, ctx->table);
453         if (err < 0) {
454                 kfree_skb(skb);
455                 goto err;
456         }
457 
458         err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
459                              ctx->report, GFP_KERNEL);
460 err:
461         if (err < 0) {
462                 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
463                                   err);
464         }
465         return err;
466 }
467 
468 static int nf_tables_dump_tables(struct sk_buff *skb,
469                                  struct netlink_callback *cb)
470 {
471         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
472         const struct nft_af_info *afi;
473         const struct nft_table *table;
474         unsigned int idx = 0, s_idx = cb->args[0];
475         struct net *net = sock_net(skb->sk);
476         int family = nfmsg->nfgen_family;
477 
478         rcu_read_lock();
479         cb->seq = net->nft.base_seq;
480 
481         list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
482                 if (family != NFPROTO_UNSPEC && family != afi->family)
483                         continue;
484 
485                 list_for_each_entry_rcu(table, &afi->tables, list) {
486                         if (idx < s_idx)
487                                 goto cont;
488                         if (idx > s_idx)
489                                 memset(&cb->args[1], 0,
490                                        sizeof(cb->args) - sizeof(cb->args[0]));
491                         if (nf_tables_fill_table_info(skb, net,
492                                                       NETLINK_CB(cb->skb).portid,
493                                                       cb->nlh->nlmsg_seq,
494                                                       NFT_MSG_NEWTABLE,
495                                                       NLM_F_MULTI,
496                                                       afi->family, table) < 0)
497                                 goto done;
498 
499                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
500 cont:
501                         idx++;
502                 }
503         }
504 done:
505         rcu_read_unlock();
506         cb->args[0] = idx;
507         return skb->len;
508 }
509 
510 static int nf_tables_gettable(struct sock *nlsk, struct sk_buff *skb,
511                               const struct nlmsghdr *nlh,
512                               const struct nlattr * const nla[])
513 {
514         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
515         const struct nft_af_info *afi;
516         const struct nft_table *table;
517         struct sk_buff *skb2;
518         struct net *net = sock_net(skb->sk);
519         int family = nfmsg->nfgen_family;
520         int err;
521 
522         if (nlh->nlmsg_flags & NLM_F_DUMP) {
523                 struct netlink_dump_control c = {
524                         .dump = nf_tables_dump_tables,
525                 };
526                 return netlink_dump_start(nlsk, skb, nlh, &c);
527         }
528 
529         afi = nf_tables_afinfo_lookup(net, family, false);
530         if (IS_ERR(afi))
531                 return PTR_ERR(afi);
532 
533         table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
534         if (IS_ERR(table))
535                 return PTR_ERR(table);
536         if (table->flags & NFT_TABLE_INACTIVE)
537                 return -ENOENT;
538 
539         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
540         if (!skb2)
541                 return -ENOMEM;
542 
543         err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
544                                         nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
545                                         family, table);
546         if (err < 0)
547                 goto err;
548 
549         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
550 
551 err:
552         kfree_skb(skb2);
553         return err;
554 }
555 
556 static int nf_tables_table_enable(const struct nft_af_info *afi,
557                                   struct nft_table *table)
558 {
559         struct nft_chain *chain;
560         int err, i = 0;
561 
562         list_for_each_entry(chain, &table->chains, list) {
563                 if (!(chain->flags & NFT_BASE_CHAIN))
564                         continue;
565 
566                 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
567                 if (err < 0)
568                         goto err;
569 
570                 i++;
571         }
572         return 0;
573 err:
574         list_for_each_entry(chain, &table->chains, list) {
575                 if (!(chain->flags & NFT_BASE_CHAIN))
576                         continue;
577 
578                 if (i-- <= 0)
579                         break;
580 
581                 nf_unregister_hooks(nft_base_chain(chain)->ops, afi->nops);
582         }
583         return err;
584 }
585 
586 static void nf_tables_table_disable(const struct nft_af_info *afi,
587                                    struct nft_table *table)
588 {
589         struct nft_chain *chain;
590 
591         list_for_each_entry(chain, &table->chains, list) {
592                 if (chain->flags & NFT_BASE_CHAIN)
593                         nf_unregister_hooks(nft_base_chain(chain)->ops,
594                                             afi->nops);
595         }
596 }
597 
598 static int nf_tables_updtable(struct nft_ctx *ctx)
599 {
600         struct nft_trans *trans;
601         u32 flags;
602         int ret = 0;
603 
604         if (!ctx->nla[NFTA_TABLE_FLAGS])
605                 return 0;
606 
607         flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
608         if (flags & ~NFT_TABLE_F_DORMANT)
609                 return -EINVAL;
610 
611         if (flags == ctx->table->flags)
612                 return 0;
613 
614         trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
615                                 sizeof(struct nft_trans_table));
616         if (trans == NULL)
617                 return -ENOMEM;
618 
619         if ((flags & NFT_TABLE_F_DORMANT) &&
620             !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
621                 nft_trans_table_enable(trans) = false;
622         } else if (!(flags & NFT_TABLE_F_DORMANT) &&
623                    ctx->table->flags & NFT_TABLE_F_DORMANT) {
624                 ret = nf_tables_table_enable(ctx->afi, ctx->table);
625                 if (ret >= 0) {
626                         ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
627                         nft_trans_table_enable(trans) = true;
628                 }
629         }
630         if (ret < 0)
631                 goto err;
632 
633         nft_trans_table_update(trans) = true;
634         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
635         return 0;
636 err:
637         nft_trans_destroy(trans);
638         return ret;
639 }
640 
641 static int nf_tables_newtable(struct sock *nlsk, struct sk_buff *skb,
642                               const struct nlmsghdr *nlh,
643                               const struct nlattr * const nla[])
644 {
645         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
646         const struct nlattr *name;
647         struct nft_af_info *afi;
648         struct nft_table *table;
649         struct net *net = sock_net(skb->sk);
650         int family = nfmsg->nfgen_family;
651         u32 flags = 0;
652         struct nft_ctx ctx;
653         int err;
654 
655         afi = nf_tables_afinfo_lookup(net, family, true);
656         if (IS_ERR(afi))
657                 return PTR_ERR(afi);
658 
659         name = nla[NFTA_TABLE_NAME];
660         table = nf_tables_table_lookup(afi, name);
661         if (IS_ERR(table)) {
662                 if (PTR_ERR(table) != -ENOENT)
663                         return PTR_ERR(table);
664                 table = NULL;
665         }
666 
667         if (table != NULL) {
668                 if (table->flags & NFT_TABLE_INACTIVE)
669                         return -ENOENT;
670                 if (nlh->nlmsg_flags & NLM_F_EXCL)
671                         return -EEXIST;
672                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
673                         return -EOPNOTSUPP;
674 
675                 nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
676                 return nf_tables_updtable(&ctx);
677         }
678 
679         if (nla[NFTA_TABLE_FLAGS]) {
680                 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
681                 if (flags & ~NFT_TABLE_F_DORMANT)
682                         return -EINVAL;
683         }
684 
685         if (!try_module_get(afi->owner))
686                 return -EAFNOSUPPORT;
687 
688         table = kzalloc(sizeof(*table) + nla_len(name), GFP_KERNEL);
689         if (table == NULL) {
690                 module_put(afi->owner);
691                 return -ENOMEM;
692         }
693 
694         nla_strlcpy(table->name, name, nla_len(name));
695         INIT_LIST_HEAD(&table->chains);
696         INIT_LIST_HEAD(&table->sets);
697         table->flags = flags;
698 
699         nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
700         err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
701         if (err < 0) {
702                 kfree(table);
703                 module_put(afi->owner);
704                 return err;
705         }
706         list_add_tail_rcu(&table->list, &afi->tables);
707         return 0;
708 }
709 
710 static int nft_flush_table(struct nft_ctx *ctx)
711 {
712         int err;
713         struct nft_chain *chain, *nc;
714         struct nft_set *set, *ns;
715 
716         list_for_each_entry(chain, &ctx->table->chains, list) {
717                 ctx->chain = chain;
718 
719                 err = nft_delrule_by_chain(ctx);
720                 if (err < 0)
721                         goto out;
722         }
723 
724         list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
725                 if (set->flags & NFT_SET_ANONYMOUS &&
726                     !list_empty(&set->bindings))
727                         continue;
728 
729                 err = nft_delset(ctx, set);
730                 if (err < 0)
731                         goto out;
732         }
733 
734         list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
735                 ctx->chain = chain;
736 
737                 err = nft_delchain(ctx);
738                 if (err < 0)
739                         goto out;
740         }
741 
742         err = nft_deltable(ctx);
743 out:
744         return err;
745 }
746 
747 static int nft_flush(struct nft_ctx *ctx, int family)
748 {
749         struct nft_af_info *afi;
750         struct nft_table *table, *nt;
751         const struct nlattr * const *nla = ctx->nla;
752         int err = 0;
753 
754         list_for_each_entry(afi, &ctx->net->nft.af_info, list) {
755                 if (family != AF_UNSPEC && afi->family != family)
756                         continue;
757 
758                 ctx->afi = afi;
759                 list_for_each_entry_safe(table, nt, &afi->tables, list) {
760                         if (nla[NFTA_TABLE_NAME] &&
761                             nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
762                                 continue;
763 
764                         ctx->table = table;
765 
766                         err = nft_flush_table(ctx);
767                         if (err < 0)
768                                 goto out;
769                 }
770         }
771 out:
772         return err;
773 }
774 
775 static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
776                               const struct nlmsghdr *nlh,
777                               const struct nlattr * const nla[])
778 {
779         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
780         struct nft_af_info *afi;
781         struct nft_table *table;
782         struct net *net = sock_net(skb->sk);
783         int family = nfmsg->nfgen_family;
784         struct nft_ctx ctx;
785 
786         nft_ctx_init(&ctx, skb, nlh, NULL, NULL, NULL, nla);
787         if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
788                 return nft_flush(&ctx, family);
789 
790         afi = nf_tables_afinfo_lookup(net, family, false);
791         if (IS_ERR(afi))
792                 return PTR_ERR(afi);
793 
794         table = nf_tables_table_lookup(afi, nla[NFTA_TABLE_NAME]);
795         if (IS_ERR(table))
796                 return PTR_ERR(table);
797         if (table->flags & NFT_TABLE_INACTIVE)
798                 return -ENOENT;
799 
800         ctx.afi = afi;
801         ctx.table = table;
802 
803         return nft_flush_table(&ctx);
804 }
805 
806 static void nf_tables_table_destroy(struct nft_ctx *ctx)
807 {
808         BUG_ON(ctx->table->use > 0);
809 
810         kfree(ctx->table);
811         module_put(ctx->afi->owner);
812 }
813 
814 int nft_register_chain_type(const struct nf_chain_type *ctype)
815 {
816         int err = 0;
817 
818         nfnl_lock(NFNL_SUBSYS_NFTABLES);
819         if (chain_type[ctype->family][ctype->type] != NULL) {
820                 err = -EBUSY;
821                 goto out;
822         }
823         chain_type[ctype->family][ctype->type] = ctype;
824 out:
825         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
826         return err;
827 }
828 EXPORT_SYMBOL_GPL(nft_register_chain_type);
829 
830 void nft_unregister_chain_type(const struct nf_chain_type *ctype)
831 {
832         nfnl_lock(NFNL_SUBSYS_NFTABLES);
833         chain_type[ctype->family][ctype->type] = NULL;
834         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
835 }
836 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
837 
838 /*
839  * Chains
840  */
841 
842 static struct nft_chain *
843 nf_tables_chain_lookup_byhandle(const struct nft_table *table, u64 handle)
844 {
845         struct nft_chain *chain;
846 
847         list_for_each_entry(chain, &table->chains, list) {
848                 if (chain->handle == handle)
849                         return chain;
850         }
851 
852         return ERR_PTR(-ENOENT);
853 }
854 
855 static struct nft_chain *nf_tables_chain_lookup(const struct nft_table *table,
856                                                 const struct nlattr *nla)
857 {
858         struct nft_chain *chain;
859 
860         if (nla == NULL)
861                 return ERR_PTR(-EINVAL);
862 
863         list_for_each_entry(chain, &table->chains, list) {
864                 if (!nla_strcmp(nla, chain->name))
865                         return chain;
866         }
867 
868         return ERR_PTR(-ENOENT);
869 }
870 
871 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
872         [NFTA_CHAIN_TABLE]      = { .type = NLA_STRING },
873         [NFTA_CHAIN_HANDLE]     = { .type = NLA_U64 },
874         [NFTA_CHAIN_NAME]       = { .type = NLA_STRING,
875                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
876         [NFTA_CHAIN_HOOK]       = { .type = NLA_NESTED },
877         [NFTA_CHAIN_POLICY]     = { .type = NLA_U32 },
878         [NFTA_CHAIN_TYPE]       = { .type = NLA_STRING },
879         [NFTA_CHAIN_COUNTERS]   = { .type = NLA_NESTED },
880 };
881 
882 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
883         [NFTA_HOOK_HOOKNUM]     = { .type = NLA_U32 },
884         [NFTA_HOOK_PRIORITY]    = { .type = NLA_U32 },
885 };
886 
887 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
888 {
889         struct nft_stats *cpu_stats, total;
890         struct nlattr *nest;
891         unsigned int seq;
892         u64 pkts, bytes;
893         int cpu;
894 
895         memset(&total, 0, sizeof(total));
896         for_each_possible_cpu(cpu) {
897                 cpu_stats = per_cpu_ptr(stats, cpu);
898                 do {
899                         seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
900                         pkts = cpu_stats->pkts;
901                         bytes = cpu_stats->bytes;
902                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
903                 total.pkts += pkts;
904                 total.bytes += bytes;
905         }
906         nest = nla_nest_start(skb, NFTA_CHAIN_COUNTERS);
907         if (nest == NULL)
908                 goto nla_put_failure;
909 
910         if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts)) ||
911             nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes)))
912                 goto nla_put_failure;
913 
914         nla_nest_end(skb, nest);
915         return 0;
916 
917 nla_put_failure:
918         return -ENOSPC;
919 }
920 
921 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
922                                      u32 portid, u32 seq, int event, u32 flags,
923                                      int family, const struct nft_table *table,
924                                      const struct nft_chain *chain)
925 {
926         struct nlmsghdr *nlh;
927         struct nfgenmsg *nfmsg;
928 
929         event |= NFNL_SUBSYS_NFTABLES << 8;
930         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
931         if (nlh == NULL)
932                 goto nla_put_failure;
933 
934         nfmsg = nlmsg_data(nlh);
935         nfmsg->nfgen_family     = family;
936         nfmsg->version          = NFNETLINK_V0;
937         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
938 
939         if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
940                 goto nla_put_failure;
941         if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle)))
942                 goto nla_put_failure;
943         if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
944                 goto nla_put_failure;
945 
946         if (chain->flags & NFT_BASE_CHAIN) {
947                 const struct nft_base_chain *basechain = nft_base_chain(chain);
948                 const struct nf_hook_ops *ops = &basechain->ops[0];
949                 struct nlattr *nest;
950 
951                 nest = nla_nest_start(skb, NFTA_CHAIN_HOOK);
952                 if (nest == NULL)
953                         goto nla_put_failure;
954                 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
955                         goto nla_put_failure;
956                 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
957                         goto nla_put_failure;
958                 nla_nest_end(skb, nest);
959 
960                 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
961                                  htonl(basechain->policy)))
962                         goto nla_put_failure;
963 
964                 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
965                         goto nla_put_failure;
966 
967                 if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
968                         goto nla_put_failure;
969         }
970 
971         if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
972                 goto nla_put_failure;
973 
974         return nlmsg_end(skb, nlh);
975 
976 nla_put_failure:
977         nlmsg_trim(skb, nlh);
978         return -1;
979 }
980 
981 static int nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
982 {
983         struct sk_buff *skb;
984         int err;
985 
986         if (!ctx->report &&
987             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
988                 return 0;
989 
990         err = -ENOBUFS;
991         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
992         if (skb == NULL)
993                 goto err;
994 
995         err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
996                                         event, 0, ctx->afi->family, ctx->table,
997                                         ctx->chain);
998         if (err < 0) {
999                 kfree_skb(skb);
1000                 goto err;
1001         }
1002 
1003         err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1004                              ctx->report, GFP_KERNEL);
1005 err:
1006         if (err < 0) {
1007                 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1008                                   err);
1009         }
1010         return err;
1011 }
1012 
1013 static int nf_tables_dump_chains(struct sk_buff *skb,
1014                                  struct netlink_callback *cb)
1015 {
1016         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1017         const struct nft_af_info *afi;
1018         const struct nft_table *table;
1019         const struct nft_chain *chain;
1020         unsigned int idx = 0, s_idx = cb->args[0];
1021         struct net *net = sock_net(skb->sk);
1022         int family = nfmsg->nfgen_family;
1023 
1024         rcu_read_lock();
1025         cb->seq = net->nft.base_seq;
1026 
1027         list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
1028                 if (family != NFPROTO_UNSPEC && family != afi->family)
1029                         continue;
1030 
1031                 list_for_each_entry_rcu(table, &afi->tables, list) {
1032                         list_for_each_entry_rcu(chain, &table->chains, list) {
1033                                 if (idx < s_idx)
1034                                         goto cont;
1035                                 if (idx > s_idx)
1036                                         memset(&cb->args[1], 0,
1037                                                sizeof(cb->args) - sizeof(cb->args[0]));
1038                                 if (nf_tables_fill_chain_info(skb, net,
1039                                                               NETLINK_CB(cb->skb).portid,
1040                                                               cb->nlh->nlmsg_seq,
1041                                                               NFT_MSG_NEWCHAIN,
1042                                                               NLM_F_MULTI,
1043                                                               afi->family, table, chain) < 0)
1044                                         goto done;
1045 
1046                                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1047 cont:
1048                                 idx++;
1049                         }
1050                 }
1051         }
1052 done:
1053         rcu_read_unlock();
1054         cb->args[0] = idx;
1055         return skb->len;
1056 }
1057 
1058 static int nf_tables_getchain(struct sock *nlsk, struct sk_buff *skb,
1059                               const struct nlmsghdr *nlh,
1060                               const struct nlattr * const nla[])
1061 {
1062         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1063         const struct nft_af_info *afi;
1064         const struct nft_table *table;
1065         const struct nft_chain *chain;
1066         struct sk_buff *skb2;
1067         struct net *net = sock_net(skb->sk);
1068         int family = nfmsg->nfgen_family;
1069         int err;
1070 
1071         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1072                 struct netlink_dump_control c = {
1073                         .dump = nf_tables_dump_chains,
1074                 };
1075                 return netlink_dump_start(nlsk, skb, nlh, &c);
1076         }
1077 
1078         afi = nf_tables_afinfo_lookup(net, family, false);
1079         if (IS_ERR(afi))
1080                 return PTR_ERR(afi);
1081 
1082         table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
1083         if (IS_ERR(table))
1084                 return PTR_ERR(table);
1085         if (table->flags & NFT_TABLE_INACTIVE)
1086                 return -ENOENT;
1087 
1088         chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
1089         if (IS_ERR(chain))
1090                 return PTR_ERR(chain);
1091         if (chain->flags & NFT_CHAIN_INACTIVE)
1092                 return -ENOENT;
1093 
1094         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1095         if (!skb2)
1096                 return -ENOMEM;
1097 
1098         err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1099                                         nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1100                                         family, table, chain);
1101         if (err < 0)
1102                 goto err;
1103 
1104         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1105 
1106 err:
1107         kfree_skb(skb2);
1108         return err;
1109 }
1110 
1111 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1112         [NFTA_COUNTER_PACKETS]  = { .type = NLA_U64 },
1113         [NFTA_COUNTER_BYTES]    = { .type = NLA_U64 },
1114 };
1115 
1116 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1117 {
1118         struct nlattr *tb[NFTA_COUNTER_MAX+1];
1119         struct nft_stats __percpu *newstats;
1120         struct nft_stats *stats;
1121         int err;
1122 
1123         err = nla_parse_nested(tb, NFTA_COUNTER_MAX, attr, nft_counter_policy);
1124         if (err < 0)
1125                 return ERR_PTR(err);
1126 
1127         if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1128                 return ERR_PTR(-EINVAL);
1129 
1130         newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1131         if (newstats == NULL)
1132                 return ERR_PTR(-ENOMEM);
1133 
1134         /* Restore old counters on this cpu, no problem. Per-cpu statistics
1135          * are not exposed to userspace.
1136          */
1137         preempt_disable();
1138         stats = this_cpu_ptr(newstats);
1139         stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1140         stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1141         preempt_enable();
1142 
1143         return newstats;
1144 }
1145 
1146 static void nft_chain_stats_replace(struct nft_base_chain *chain,
1147                                     struct nft_stats __percpu *newstats)
1148 {
1149         if (newstats == NULL)
1150                 return;
1151 
1152         if (chain->stats) {
1153                 struct nft_stats __percpu *oldstats =
1154                                 nft_dereference(chain->stats);
1155 
1156                 rcu_assign_pointer(chain->stats, newstats);
1157                 synchronize_rcu();
1158                 free_percpu(oldstats);
1159         } else
1160                 rcu_assign_pointer(chain->stats, newstats);
1161 }
1162 
1163 static void nf_tables_chain_destroy(struct nft_chain *chain)
1164 {
1165         BUG_ON(chain->use > 0);
1166 
1167         if (chain->flags & NFT_BASE_CHAIN) {
1168                 module_put(nft_base_chain(chain)->type->owner);
1169                 free_percpu(nft_base_chain(chain)->stats);
1170                 kfree(nft_base_chain(chain));
1171         } else {
1172                 kfree(chain);
1173         }
1174 }
1175 
1176 static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
1177                               const struct nlmsghdr *nlh,
1178                               const struct nlattr * const nla[])
1179 {
1180         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1181         const struct nlattr * uninitialized_var(name);
1182         struct nft_af_info *afi;
1183         struct nft_table *table;
1184         struct nft_chain *chain;
1185         struct nft_base_chain *basechain = NULL;
1186         struct nlattr *ha[NFTA_HOOK_MAX + 1];
1187         struct net *net = sock_net(skb->sk);
1188         int family = nfmsg->nfgen_family;
1189         u8 policy = NF_ACCEPT;
1190         u64 handle = 0;
1191         unsigned int i;
1192         struct nft_stats __percpu *stats;
1193         int err;
1194         bool create;
1195         struct nft_ctx ctx;
1196 
1197         create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1198 
1199         afi = nf_tables_afinfo_lookup(net, family, true);
1200         if (IS_ERR(afi))
1201                 return PTR_ERR(afi);
1202 
1203         table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
1204         if (IS_ERR(table))
1205                 return PTR_ERR(table);
1206 
1207         chain = NULL;
1208         name = nla[NFTA_CHAIN_NAME];
1209 
1210         if (nla[NFTA_CHAIN_HANDLE]) {
1211                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1212                 chain = nf_tables_chain_lookup_byhandle(table, handle);
1213                 if (IS_ERR(chain))
1214                         return PTR_ERR(chain);
1215         } else {
1216                 chain = nf_tables_chain_lookup(table, name);
1217                 if (IS_ERR(chain)) {
1218                         if (PTR_ERR(chain) != -ENOENT)
1219                                 return PTR_ERR(chain);
1220                         chain = NULL;
1221                 }
1222         }
1223 
1224         if (nla[NFTA_CHAIN_POLICY]) {
1225                 if ((chain != NULL &&
1226                     !(chain->flags & NFT_BASE_CHAIN)) ||
1227                     nla[NFTA_CHAIN_HOOK] == NULL)
1228                         return -EOPNOTSUPP;
1229 
1230                 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
1231                 switch (policy) {
1232                 case NF_DROP:
1233                 case NF_ACCEPT:
1234                         break;
1235                 default:
1236                         return -EINVAL;
1237                 }
1238         }
1239 
1240         if (chain != NULL) {
1241                 struct nft_stats *stats = NULL;
1242                 struct nft_trans *trans;
1243 
1244                 if (chain->flags & NFT_CHAIN_INACTIVE)
1245                         return -ENOENT;
1246                 if (nlh->nlmsg_flags & NLM_F_EXCL)
1247                         return -EEXIST;
1248                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1249                         return -EOPNOTSUPP;
1250 
1251                 if (nla[NFTA_CHAIN_HANDLE] && name &&
1252                     !IS_ERR(nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME])))
1253                         return -EEXIST;
1254 
1255                 if (nla[NFTA_CHAIN_COUNTERS]) {
1256                         if (!(chain->flags & NFT_BASE_CHAIN))
1257                                 return -EOPNOTSUPP;
1258 
1259                         stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1260                         if (IS_ERR(stats))
1261                                 return PTR_ERR(stats);
1262                 }
1263 
1264                 nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1265                 trans = nft_trans_alloc(&ctx, NFT_MSG_NEWCHAIN,
1266                                         sizeof(struct nft_trans_chain));
1267                 if (trans == NULL) {
1268                         free_percpu(stats);
1269                         return -ENOMEM;
1270                 }
1271 
1272                 nft_trans_chain_stats(trans) = stats;
1273                 nft_trans_chain_update(trans) = true;
1274 
1275                 if (nla[NFTA_CHAIN_POLICY])
1276                         nft_trans_chain_policy(trans) = policy;
1277                 else
1278                         nft_trans_chain_policy(trans) = -1;
1279 
1280                 if (nla[NFTA_CHAIN_HANDLE] && name) {
1281                         nla_strlcpy(nft_trans_chain_name(trans), name,
1282                                     NFT_CHAIN_MAXNAMELEN);
1283                 }
1284                 list_add_tail(&trans->list, &net->nft.commit_list);
1285                 return 0;
1286         }
1287 
1288         if (table->use == UINT_MAX)
1289                 return -EOVERFLOW;
1290 
1291         if (nla[NFTA_CHAIN_HOOK]) {
1292                 const struct nf_chain_type *type;
1293                 struct nf_hook_ops *ops;
1294                 nf_hookfn *hookfn;
1295                 u32 hooknum, priority;
1296 
1297                 type = chain_type[family][NFT_CHAIN_T_DEFAULT];
1298                 if (nla[NFTA_CHAIN_TYPE]) {
1299                         type = nf_tables_chain_type_lookup(afi,
1300                                                            nla[NFTA_CHAIN_TYPE],
1301                                                            create);
1302                         if (IS_ERR(type))
1303                                 return PTR_ERR(type);
1304                 }
1305 
1306                 err = nla_parse_nested(ha, NFTA_HOOK_MAX, nla[NFTA_CHAIN_HOOK],
1307                                        nft_hook_policy);
1308                 if (err < 0)
1309                         return err;
1310                 if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1311                     ha[NFTA_HOOK_PRIORITY] == NULL)
1312                         return -EINVAL;
1313 
1314                 hooknum = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1315                 if (hooknum >= afi->nhooks)
1316                         return -EINVAL;
1317                 priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1318 
1319                 if (!(type->hook_mask & (1 << hooknum)))
1320                         return -EOPNOTSUPP;
1321                 if (!try_module_get(type->owner))
1322                         return -ENOENT;
1323                 hookfn = type->hooks[hooknum];
1324 
1325                 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1326                 if (basechain == NULL) {
1327                         module_put(type->owner);
1328                         return -ENOMEM;
1329                 }
1330 
1331                 if (nla[NFTA_CHAIN_COUNTERS]) {
1332                         stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1333                         if (IS_ERR(stats)) {
1334                                 module_put(type->owner);
1335                                 kfree(basechain);
1336                                 return PTR_ERR(stats);
1337                         }
1338                         basechain->stats = stats;
1339                 } else {
1340                         stats = netdev_alloc_pcpu_stats(struct nft_stats);
1341                         if (stats == NULL) {
1342                                 module_put(type->owner);
1343                                 kfree(basechain);
1344                                 return -ENOMEM;
1345                         }
1346                         rcu_assign_pointer(basechain->stats, stats);
1347                 }
1348 
1349                 basechain->type = type;
1350                 chain = &basechain->chain;
1351 
1352                 for (i = 0; i < afi->nops; i++) {
1353                         ops = &basechain->ops[i];
1354                         ops->pf         = family;
1355                         ops->owner      = afi->owner;
1356                         ops->hooknum    = hooknum;
1357                         ops->priority   = priority;
1358                         ops->priv       = chain;
1359                         ops->hook       = afi->hooks[ops->hooknum];
1360                         if (hookfn)
1361                                 ops->hook = hookfn;
1362                         if (afi->hook_ops_init)
1363                                 afi->hook_ops_init(ops, i);
1364                 }
1365 
1366                 chain->flags |= NFT_BASE_CHAIN;
1367                 basechain->policy = policy;
1368         } else {
1369                 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1370                 if (chain == NULL)
1371                         return -ENOMEM;
1372         }
1373 
1374         INIT_LIST_HEAD(&chain->rules);
1375         chain->handle = nf_tables_alloc_handle(table);
1376         chain->net = net;
1377         chain->table = table;
1378         nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
1379 
1380         if (!(table->flags & NFT_TABLE_F_DORMANT) &&
1381             chain->flags & NFT_BASE_CHAIN) {
1382                 err = nf_register_hooks(nft_base_chain(chain)->ops, afi->nops);
1383                 if (err < 0)
1384                         goto err1;
1385         }
1386 
1387         nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1388         err = nft_trans_chain_add(&ctx, NFT_MSG_NEWCHAIN);
1389         if (err < 0)
1390                 goto err2;
1391 
1392         table->use++;
1393         list_add_tail_rcu(&chain->list, &table->chains);
1394         return 0;
1395 err2:
1396         nf_tables_unregister_hooks(table, chain, afi->nops);
1397 err1:
1398         nf_tables_chain_destroy(chain);
1399         return err;
1400 }
1401 
1402 static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
1403                               const struct nlmsghdr *nlh,
1404                               const struct nlattr * const nla[])
1405 {
1406         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1407         struct nft_af_info *afi;
1408         struct nft_table *table;
1409         struct nft_chain *chain;
1410         struct net *net = sock_net(skb->sk);
1411         int family = nfmsg->nfgen_family;
1412         struct nft_ctx ctx;
1413 
1414         afi = nf_tables_afinfo_lookup(net, family, false);
1415         if (IS_ERR(afi))
1416                 return PTR_ERR(afi);
1417 
1418         table = nf_tables_table_lookup(afi, nla[NFTA_CHAIN_TABLE]);
1419         if (IS_ERR(table))
1420                 return PTR_ERR(table);
1421         if (table->flags & NFT_TABLE_INACTIVE)
1422                 return -ENOENT;
1423 
1424         chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME]);
1425         if (IS_ERR(chain))
1426                 return PTR_ERR(chain);
1427         if (chain->flags & NFT_CHAIN_INACTIVE)
1428                 return -ENOENT;
1429         if (chain->use > 0)
1430                 return -EBUSY;
1431 
1432         nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1433 
1434         return nft_delchain(&ctx);
1435 }
1436 
1437 /*
1438  * Expressions
1439  */
1440 
1441 /**
1442  *      nft_register_expr - register nf_tables expr type
1443  *      @ops: expr type
1444  *
1445  *      Registers the expr type for use with nf_tables. Returns zero on
1446  *      success or a negative errno code otherwise.
1447  */
1448 int nft_register_expr(struct nft_expr_type *type)
1449 {
1450         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1451         if (type->family == NFPROTO_UNSPEC)
1452                 list_add_tail_rcu(&type->list, &nf_tables_expressions);
1453         else
1454                 list_add_rcu(&type->list, &nf_tables_expressions);
1455         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1456         return 0;
1457 }
1458 EXPORT_SYMBOL_GPL(nft_register_expr);
1459 
1460 /**
1461  *      nft_unregister_expr - unregister nf_tables expr type
1462  *      @ops: expr type
1463  *
1464  *      Unregisters the expr typefor use with nf_tables.
1465  */
1466 void nft_unregister_expr(struct nft_expr_type *type)
1467 {
1468         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1469         list_del_rcu(&type->list);
1470         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1471 }
1472 EXPORT_SYMBOL_GPL(nft_unregister_expr);
1473 
1474 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
1475                                                        struct nlattr *nla)
1476 {
1477         const struct nft_expr_type *type;
1478 
1479         list_for_each_entry(type, &nf_tables_expressions, list) {
1480                 if (!nla_strcmp(nla, type->name) &&
1481                     (!type->family || type->family == family))
1482                         return type;
1483         }
1484         return NULL;
1485 }
1486 
1487 static const struct nft_expr_type *nft_expr_type_get(u8 family,
1488                                                      struct nlattr *nla)
1489 {
1490         const struct nft_expr_type *type;
1491 
1492         if (nla == NULL)
1493                 return ERR_PTR(-EINVAL);
1494 
1495         type = __nft_expr_type_get(family, nla);
1496         if (type != NULL && try_module_get(type->owner))
1497                 return type;
1498 
1499 #ifdef CONFIG_MODULES
1500         if (type == NULL) {
1501                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1502                 request_module("nft-expr-%u-%.*s", family,
1503                                nla_len(nla), (char *)nla_data(nla));
1504                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1505                 if (__nft_expr_type_get(family, nla))
1506                         return ERR_PTR(-EAGAIN);
1507 
1508                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1509                 request_module("nft-expr-%.*s",
1510                                nla_len(nla), (char *)nla_data(nla));
1511                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
1512                 if (__nft_expr_type_get(family, nla))
1513                         return ERR_PTR(-EAGAIN);
1514         }
1515 #endif
1516         return ERR_PTR(-ENOENT);
1517 }
1518 
1519 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
1520         [NFTA_EXPR_NAME]        = { .type = NLA_STRING },
1521         [NFTA_EXPR_DATA]        = { .type = NLA_NESTED },
1522 };
1523 
1524 static int nf_tables_fill_expr_info(struct sk_buff *skb,
1525                                     const struct nft_expr *expr)
1526 {
1527         if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
1528                 goto nla_put_failure;
1529 
1530         if (expr->ops->dump) {
1531                 struct nlattr *data = nla_nest_start(skb, NFTA_EXPR_DATA);
1532                 if (data == NULL)
1533                         goto nla_put_failure;
1534                 if (expr->ops->dump(skb, expr) < 0)
1535                         goto nla_put_failure;
1536                 nla_nest_end(skb, data);
1537         }
1538 
1539         return skb->len;
1540 
1541 nla_put_failure:
1542         return -1;
1543 };
1544 
1545 struct nft_expr_info {
1546         const struct nft_expr_ops       *ops;
1547         struct nlattr                   *tb[NFT_EXPR_MAXATTR + 1];
1548 };
1549 
1550 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
1551                                 const struct nlattr *nla,
1552                                 struct nft_expr_info *info)
1553 {
1554         const struct nft_expr_type *type;
1555         const struct nft_expr_ops *ops;
1556         struct nlattr *tb[NFTA_EXPR_MAX + 1];
1557         int err;
1558 
1559         err = nla_parse_nested(tb, NFTA_EXPR_MAX, nla, nft_expr_policy);
1560         if (err < 0)
1561                 return err;
1562 
1563         type = nft_expr_type_get(ctx->afi->family, tb[NFTA_EXPR_NAME]);
1564         if (IS_ERR(type))
1565                 return PTR_ERR(type);
1566 
1567         if (tb[NFTA_EXPR_DATA]) {
1568                 err = nla_parse_nested(info->tb, type->maxattr,
1569                                        tb[NFTA_EXPR_DATA], type->policy);
1570                 if (err < 0)
1571                         goto err1;
1572         } else
1573                 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
1574 
1575         if (type->select_ops != NULL) {
1576                 ops = type->select_ops(ctx,
1577                                        (const struct nlattr * const *)info->tb);
1578                 if (IS_ERR(ops)) {
1579                         err = PTR_ERR(ops);
1580                         goto err1;
1581                 }
1582         } else
1583                 ops = type->ops;
1584 
1585         info->ops = ops;
1586         return 0;
1587 
1588 err1:
1589         module_put(type->owner);
1590         return err;
1591 }
1592 
1593 static int nf_tables_newexpr(const struct nft_ctx *ctx,
1594                              const struct nft_expr_info *info,
1595                              struct nft_expr *expr)
1596 {
1597         const struct nft_expr_ops *ops = info->ops;
1598         int err;
1599 
1600         expr->ops = ops;
1601         if (ops->init) {
1602                 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
1603                 if (err < 0)
1604                         goto err1;
1605         }
1606 
1607         return 0;
1608 
1609 err1:
1610         expr->ops = NULL;
1611         return err;
1612 }
1613 
1614 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
1615                                    struct nft_expr *expr)
1616 {
1617         if (expr->ops->destroy)
1618                 expr->ops->destroy(ctx, expr);
1619         module_put(expr->ops->type->owner);
1620 }
1621 
1622 /*
1623  * Rules
1624  */
1625 
1626 static struct nft_rule *__nf_tables_rule_lookup(const struct nft_chain *chain,
1627                                                 u64 handle)
1628 {
1629         struct nft_rule *rule;
1630 
1631         // FIXME: this sucks
1632         list_for_each_entry(rule, &chain->rules, list) {
1633                 if (handle == rule->handle)
1634                         return rule;
1635         }
1636 
1637         return ERR_PTR(-ENOENT);
1638 }
1639 
1640 static struct nft_rule *nf_tables_rule_lookup(const struct nft_chain *chain,
1641                                               const struct nlattr *nla)
1642 {
1643         if (nla == NULL)
1644                 return ERR_PTR(-EINVAL);
1645 
1646         return __nf_tables_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
1647 }
1648 
1649 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
1650         [NFTA_RULE_TABLE]       = { .type = NLA_STRING },
1651         [NFTA_RULE_CHAIN]       = { .type = NLA_STRING,
1652                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
1653         [NFTA_RULE_HANDLE]      = { .type = NLA_U64 },
1654         [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
1655         [NFTA_RULE_COMPAT]      = { .type = NLA_NESTED },
1656         [NFTA_RULE_POSITION]    = { .type = NLA_U64 },
1657         [NFTA_RULE_USERDATA]    = { .type = NLA_BINARY,
1658                                     .len = NFT_USERDATA_MAXLEN },
1659 };
1660 
1661 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
1662                                     u32 portid, u32 seq, int event,
1663                                     u32 flags, int family,
1664                                     const struct nft_table *table,
1665                                     const struct nft_chain *chain,
1666                                     const struct nft_rule *rule)
1667 {
1668         struct nlmsghdr *nlh;
1669         struct nfgenmsg *nfmsg;
1670         const struct nft_expr *expr, *next;
1671         struct nlattr *list;
1672         const struct nft_rule *prule;
1673         int type = event | NFNL_SUBSYS_NFTABLES << 8;
1674 
1675         nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg),
1676                         flags);
1677         if (nlh == NULL)
1678                 goto nla_put_failure;
1679 
1680         nfmsg = nlmsg_data(nlh);
1681         nfmsg->nfgen_family     = family;
1682         nfmsg->version          = NFNETLINK_V0;
1683         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
1684 
1685         if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
1686                 goto nla_put_failure;
1687         if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
1688                 goto nla_put_failure;
1689         if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle)))
1690                 goto nla_put_failure;
1691 
1692         if ((event != NFT_MSG_DELRULE) && (rule->list.prev != &chain->rules)) {
1693                 prule = list_entry(rule->list.prev, struct nft_rule, list);
1694                 if (nla_put_be64(skb, NFTA_RULE_POSITION,
1695                                  cpu_to_be64(prule->handle)))
1696                         goto nla_put_failure;
1697         }
1698 
1699         list = nla_nest_start(skb, NFTA_RULE_EXPRESSIONS);
1700         if (list == NULL)
1701                 goto nla_put_failure;
1702         nft_rule_for_each_expr(expr, next, rule) {
1703                 struct nlattr *elem = nla_nest_start(skb, NFTA_LIST_ELEM);
1704                 if (elem == NULL)
1705                         goto nla_put_failure;
1706                 if (nf_tables_fill_expr_info(skb, expr) < 0)
1707                         goto nla_put_failure;
1708                 nla_nest_end(skb, elem);
1709         }
1710         nla_nest_end(skb, list);
1711 
1712         if (rule->ulen &&
1713             nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
1714                 goto nla_put_failure;
1715 
1716         return nlmsg_end(skb, nlh);
1717 
1718 nla_put_failure:
1719         nlmsg_trim(skb, nlh);
1720         return -1;
1721 }
1722 
1723 static int nf_tables_rule_notify(const struct nft_ctx *ctx,
1724                                  const struct nft_rule *rule,
1725                                  int event)
1726 {
1727         struct sk_buff *skb;
1728         int err;
1729 
1730         if (!ctx->report &&
1731             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1732                 return 0;
1733 
1734         err = -ENOBUFS;
1735         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1736         if (skb == NULL)
1737                 goto err;
1738 
1739         err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
1740                                        event, 0, ctx->afi->family, ctx->table,
1741                                        ctx->chain, rule);
1742         if (err < 0) {
1743                 kfree_skb(skb);
1744                 goto err;
1745         }
1746 
1747         err = nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1748                              ctx->report, GFP_KERNEL);
1749 err:
1750         if (err < 0) {
1751                 nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1752                                   err);
1753         }
1754         return err;
1755 }
1756 
1757 static int nf_tables_dump_rules(struct sk_buff *skb,
1758                                 struct netlink_callback *cb)
1759 {
1760         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1761         const struct nft_af_info *afi;
1762         const struct nft_table *table;
1763         const struct nft_chain *chain;
1764         const struct nft_rule *rule;
1765         unsigned int idx = 0, s_idx = cb->args[0];
1766         struct net *net = sock_net(skb->sk);
1767         int family = nfmsg->nfgen_family;
1768 
1769         rcu_read_lock();
1770         cb->seq = net->nft.base_seq;
1771 
1772         list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
1773                 if (family != NFPROTO_UNSPEC && family != afi->family)
1774                         continue;
1775 
1776                 list_for_each_entry_rcu(table, &afi->tables, list) {
1777                         list_for_each_entry_rcu(chain, &table->chains, list) {
1778                                 list_for_each_entry_rcu(rule, &chain->rules, list) {
1779                                         if (!nft_rule_is_active(net, rule))
1780                                                 goto cont;
1781                                         if (idx < s_idx)
1782                                                 goto cont;
1783                                         if (idx > s_idx)
1784                                                 memset(&cb->args[1], 0,
1785                                                        sizeof(cb->args) - sizeof(cb->args[0]));
1786                                         if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
1787                                                                       cb->nlh->nlmsg_seq,
1788                                                                       NFT_MSG_NEWRULE,
1789                                                                       NLM_F_MULTI | NLM_F_APPEND,
1790                                                                       afi->family, table, chain, rule) < 0)
1791                                                 goto done;
1792 
1793                                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1794 cont:
1795                                         idx++;
1796                                 }
1797                         }
1798                 }
1799         }
1800 done:
1801         rcu_read_unlock();
1802 
1803         cb->args[0] = idx;
1804         return skb->len;
1805 }
1806 
1807 static int nf_tables_getrule(struct sock *nlsk, struct sk_buff *skb,
1808                              const struct nlmsghdr *nlh,
1809                              const struct nlattr * const nla[])
1810 {
1811         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1812         const struct nft_af_info *afi;
1813         const struct nft_table *table;
1814         const struct nft_chain *chain;
1815         const struct nft_rule *rule;
1816         struct sk_buff *skb2;
1817         struct net *net = sock_net(skb->sk);
1818         int family = nfmsg->nfgen_family;
1819         int err;
1820 
1821         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1822                 struct netlink_dump_control c = {
1823                         .dump = nf_tables_dump_rules,
1824                 };
1825                 return netlink_dump_start(nlsk, skb, nlh, &c);
1826         }
1827 
1828         afi = nf_tables_afinfo_lookup(net, family, false);
1829         if (IS_ERR(afi))
1830                 return PTR_ERR(afi);
1831 
1832         table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
1833         if (IS_ERR(table))
1834                 return PTR_ERR(table);
1835         if (table->flags & NFT_TABLE_INACTIVE)
1836                 return -ENOENT;
1837 
1838         chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1839         if (IS_ERR(chain))
1840                 return PTR_ERR(chain);
1841         if (chain->flags & NFT_CHAIN_INACTIVE)
1842                 return -ENOENT;
1843 
1844         rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
1845         if (IS_ERR(rule))
1846                 return PTR_ERR(rule);
1847 
1848         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1849         if (!skb2)
1850                 return -ENOMEM;
1851 
1852         err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
1853                                        nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
1854                                        family, table, chain, rule);
1855         if (err < 0)
1856                 goto err;
1857 
1858         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1859 
1860 err:
1861         kfree_skb(skb2);
1862         return err;
1863 }
1864 
1865 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
1866                                    struct nft_rule *rule)
1867 {
1868         struct nft_expr *expr;
1869 
1870         /*
1871          * Careful: some expressions might not be initialized in case this
1872          * is called on error from nf_tables_newrule().
1873          */
1874         expr = nft_expr_first(rule);
1875         while (expr->ops && expr != nft_expr_last(rule)) {
1876                 nf_tables_expr_destroy(ctx, expr);
1877                 expr = nft_expr_next(expr);
1878         }
1879         kfree(rule);
1880 }
1881 
1882 #define NFT_RULE_MAXEXPRS       128
1883 
1884 static struct nft_expr_info *info;
1885 
1886 static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
1887                              const struct nlmsghdr *nlh,
1888                              const struct nlattr * const nla[])
1889 {
1890         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1891         struct nft_af_info *afi;
1892         struct net *net = sock_net(skb->sk);
1893         struct nft_table *table;
1894         struct nft_chain *chain;
1895         struct nft_rule *rule, *old_rule = NULL;
1896         struct nft_trans *trans = NULL;
1897         struct nft_expr *expr;
1898         struct nft_ctx ctx;
1899         struct nlattr *tmp;
1900         unsigned int size, i, n, ulen = 0;
1901         int err, rem;
1902         bool create;
1903         u64 handle, pos_handle;
1904 
1905         create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
1906 
1907         afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
1908         if (IS_ERR(afi))
1909                 return PTR_ERR(afi);
1910 
1911         table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
1912         if (IS_ERR(table))
1913                 return PTR_ERR(table);
1914 
1915         chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
1916         if (IS_ERR(chain))
1917                 return PTR_ERR(chain);
1918 
1919         if (nla[NFTA_RULE_HANDLE]) {
1920                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
1921                 rule = __nf_tables_rule_lookup(chain, handle);
1922                 if (IS_ERR(rule))
1923                         return PTR_ERR(rule);
1924 
1925                 if (nlh->nlmsg_flags & NLM_F_EXCL)
1926                         return -EEXIST;
1927                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1928                         old_rule = rule;
1929                 else
1930                         return -EOPNOTSUPP;
1931         } else {
1932                 if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
1933                         return -EINVAL;
1934                 handle = nf_tables_alloc_handle(table);
1935 
1936                 if (chain->use == UINT_MAX)
1937                         return -EOVERFLOW;
1938         }
1939 
1940         if (nla[NFTA_RULE_POSITION]) {
1941                 if (!(nlh->nlmsg_flags & NLM_F_CREATE))
1942                         return -EOPNOTSUPP;
1943 
1944                 pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
1945                 old_rule = __nf_tables_rule_lookup(chain, pos_handle);
1946                 if (IS_ERR(old_rule))
1947                         return PTR_ERR(old_rule);
1948         }
1949 
1950         nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
1951 
1952         n = 0;
1953         size = 0;
1954         if (nla[NFTA_RULE_EXPRESSIONS]) {
1955                 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
1956                         err = -EINVAL;
1957                         if (nla_type(tmp) != NFTA_LIST_ELEM)
1958                                 goto err1;
1959                         if (n == NFT_RULE_MAXEXPRS)
1960                                 goto err1;
1961                         err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
1962                         if (err < 0)
1963                                 goto err1;
1964                         size += info[n].ops->size;
1965                         n++;
1966                 }
1967         }
1968 
1969         if (nla[NFTA_RULE_USERDATA])
1970                 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
1971 
1972         err = -ENOMEM;
1973         rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
1974         if (rule == NULL)
1975                 goto err1;
1976 
1977         nft_rule_activate_next(net, rule);
1978 
1979         rule->handle = handle;
1980         rule->dlen   = size;
1981         rule->ulen   = ulen;
1982 
1983         if (ulen)
1984                 nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
1985 
1986         expr = nft_expr_first(rule);
1987         for (i = 0; i < n; i++) {
1988                 err = nf_tables_newexpr(&ctx, &info[i], expr);
1989                 if (err < 0)
1990                         goto err2;
1991                 info[i].ops = NULL;
1992                 expr = nft_expr_next(expr);
1993         }
1994 
1995         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
1996                 if (nft_rule_is_active_next(net, old_rule)) {
1997                         trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE,
1998                                                    old_rule);
1999                         if (trans == NULL) {
2000                                 err = -ENOMEM;
2001                                 goto err2;
2002                         }
2003                         nft_rule_deactivate_next(net, old_rule);
2004                         chain->use--;
2005                         list_add_tail_rcu(&rule->list, &old_rule->list);
2006                 } else {
2007                         err = -ENOENT;
2008                         goto err2;
2009                 }
2010         } else if (nlh->nlmsg_flags & NLM_F_APPEND)
2011                 if (old_rule)
2012                         list_add_rcu(&rule->list, &old_rule->list);
2013                 else
2014                         list_add_tail_rcu(&rule->list, &chain->rules);
2015         else {
2016                 if (old_rule)
2017                         list_add_tail_rcu(&rule->list, &old_rule->list);
2018                 else
2019                         list_add_rcu(&rule->list, &chain->rules);
2020         }
2021 
2022         if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) {
2023                 err = -ENOMEM;
2024                 goto err3;
2025         }
2026         chain->use++;
2027         return 0;
2028 
2029 err3:
2030         list_del_rcu(&rule->list);
2031         if (trans) {
2032                 list_del_rcu(&nft_trans_rule(trans)->list);
2033                 nft_rule_clear(net, nft_trans_rule(trans));
2034                 nft_trans_destroy(trans);
2035                 chain->use++;
2036         }
2037 err2:
2038         nf_tables_rule_destroy(&ctx, rule);
2039 err1:
2040         for (i = 0; i < n; i++) {
2041                 if (info[i].ops != NULL)
2042                         module_put(info[i].ops->type->owner);
2043         }
2044         return err;
2045 }
2046 
2047 static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
2048                              const struct nlmsghdr *nlh,
2049                              const struct nlattr * const nla[])
2050 {
2051         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2052         struct nft_af_info *afi;
2053         struct net *net = sock_net(skb->sk);
2054         struct nft_table *table;
2055         struct nft_chain *chain = NULL;
2056         struct nft_rule *rule;
2057         int family = nfmsg->nfgen_family, err = 0;
2058         struct nft_ctx ctx;
2059 
2060         afi = nf_tables_afinfo_lookup(net, family, false);
2061         if (IS_ERR(afi))
2062                 return PTR_ERR(afi);
2063 
2064         table = nf_tables_table_lookup(afi, nla[NFTA_RULE_TABLE]);
2065         if (IS_ERR(table))
2066                 return PTR_ERR(table);
2067         if (table->flags & NFT_TABLE_INACTIVE)
2068                 return -ENOENT;
2069 
2070         if (nla[NFTA_RULE_CHAIN]) {
2071                 chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
2072                 if (IS_ERR(chain))
2073                         return PTR_ERR(chain);
2074         }
2075 
2076         nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
2077 
2078         if (chain) {
2079                 if (nla[NFTA_RULE_HANDLE]) {
2080                         rule = nf_tables_rule_lookup(chain,
2081                                                      nla[NFTA_RULE_HANDLE]);
2082                         if (IS_ERR(rule))
2083                                 return PTR_ERR(rule);
2084 
2085                         err = nft_delrule(&ctx, rule);
2086                 } else {
2087                         err = nft_delrule_by_chain(&ctx);
2088                 }
2089         } else {
2090                 list_for_each_entry(chain, &table->chains, list) {
2091                         ctx.chain = chain;
2092                         err = nft_delrule_by_chain(&ctx);
2093                         if (err < 0)
2094                                 break;
2095                 }
2096         }
2097 
2098         return err;
2099 }
2100 
2101 /*
2102  * Sets
2103  */
2104 
2105 static LIST_HEAD(nf_tables_set_ops);
2106 
2107 int nft_register_set(struct nft_set_ops *ops)
2108 {
2109         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2110         list_add_tail_rcu(&ops->list, &nf_tables_set_ops);
2111         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2112         return 0;
2113 }
2114 EXPORT_SYMBOL_GPL(nft_register_set);
2115 
2116 void nft_unregister_set(struct nft_set_ops *ops)
2117 {
2118         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2119         list_del_rcu(&ops->list);
2120         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2121 }
2122 EXPORT_SYMBOL_GPL(nft_unregister_set);
2123 
2124 /*
2125  * Select a set implementation based on the data characteristics and the
2126  * given policy. The total memory use might not be known if no size is
2127  * given, in that case the amount of memory per element is used.
2128  */
2129 static const struct nft_set_ops *
2130 nft_select_set_ops(const struct nlattr * const nla[],
2131                    const struct nft_set_desc *desc,
2132                    enum nft_set_policies policy)
2133 {
2134         const struct nft_set_ops *ops, *bops;
2135         struct nft_set_estimate est, best;
2136         u32 features;
2137 
2138 #ifdef CONFIG_MODULES
2139         if (list_empty(&nf_tables_set_ops)) {
2140                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2141                 request_module("nft-set");
2142                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
2143                 if (!list_empty(&nf_tables_set_ops))
2144                         return ERR_PTR(-EAGAIN);
2145         }
2146 #endif
2147         features = 0;
2148         if (nla[NFTA_SET_FLAGS] != NULL) {
2149                 features = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2150                 features &= NFT_SET_INTERVAL | NFT_SET_MAP;
2151         }
2152 
2153         bops       = NULL;
2154         best.size  = ~0;
2155         best.class = ~0;
2156 
2157         list_for_each_entry(ops, &nf_tables_set_ops, list) {
2158                 if ((ops->features & features) != features)
2159                         continue;
2160                 if (!ops->estimate(desc, features, &est))
2161                         continue;
2162 
2163                 switch (policy) {
2164                 case NFT_SET_POL_PERFORMANCE:
2165                         if (est.class < best.class)
2166                                 break;
2167                         if (est.class == best.class && est.size < best.size)
2168                                 break;
2169                         continue;
2170                 case NFT_SET_POL_MEMORY:
2171                         if (est.size < best.size)
2172                                 break;
2173                         if (est.size == best.size && est.class < best.class)
2174                                 break;
2175                         continue;
2176                 default:
2177                         break;
2178                 }
2179 
2180                 if (!try_module_get(ops->owner))
2181                         continue;
2182                 if (bops != NULL)
2183                         module_put(bops->owner);
2184 
2185                 bops = ops;
2186                 best = est;
2187         }
2188 
2189         if (bops != NULL)
2190                 return bops;
2191 
2192         return ERR_PTR(-EOPNOTSUPP);
2193 }
2194 
2195 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
2196         [NFTA_SET_TABLE]                = { .type = NLA_STRING },
2197         [NFTA_SET_NAME]                 = { .type = NLA_STRING,
2198                                             .len = IFNAMSIZ - 1 },
2199         [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
2200         [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
2201         [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
2202         [NFTA_SET_DATA_TYPE]            = { .type = NLA_U32 },
2203         [NFTA_SET_DATA_LEN]             = { .type = NLA_U32 },
2204         [NFTA_SET_POLICY]               = { .type = NLA_U32 },
2205         [NFTA_SET_DESC]                 = { .type = NLA_NESTED },
2206         [NFTA_SET_ID]                   = { .type = NLA_U32 },
2207 };
2208 
2209 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
2210         [NFTA_SET_DESC_SIZE]            = { .type = NLA_U32 },
2211 };
2212 
2213 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx,
2214                                      const struct sk_buff *skb,
2215                                      const struct nlmsghdr *nlh,
2216                                      const struct nlattr * const nla[])
2217 {
2218         struct net *net = sock_net(skb->sk);
2219         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2220         struct nft_af_info *afi = NULL;
2221         struct nft_table *table = NULL;
2222 
2223         if (nfmsg->nfgen_family != NFPROTO_UNSPEC) {
2224                 afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
2225                 if (IS_ERR(afi))
2226                         return PTR_ERR(afi);
2227         }
2228 
2229         if (nla[NFTA_SET_TABLE] != NULL) {
2230                 if (afi == NULL)
2231                         return -EAFNOSUPPORT;
2232 
2233                 table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
2234                 if (IS_ERR(table))
2235                         return PTR_ERR(table);
2236                 if (table->flags & NFT_TABLE_INACTIVE)
2237                         return -ENOENT;
2238         }
2239 
2240         nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
2241         return 0;
2242 }
2243 
2244 struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
2245                                      const struct nlattr *nla)
2246 {
2247         struct nft_set *set;
2248 
2249         if (nla == NULL)
2250                 return ERR_PTR(-EINVAL);
2251 
2252         list_for_each_entry(set, &table->sets, list) {
2253                 if (!nla_strcmp(nla, set->name))
2254                         return set;
2255         }
2256         return ERR_PTR(-ENOENT);
2257 }
2258 
2259 struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
2260                                           const struct nlattr *nla)
2261 {
2262         struct nft_trans *trans;
2263         u32 id = ntohl(nla_get_be32(nla));
2264 
2265         list_for_each_entry(trans, &net->nft.commit_list, list) {
2266                 if (trans->msg_type == NFT_MSG_NEWSET &&
2267                     id == nft_trans_set_id(trans))
2268                         return nft_trans_set(trans);
2269         }
2270         return ERR_PTR(-ENOENT);
2271 }
2272 
2273 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
2274                                     const char *name)
2275 {
2276         const struct nft_set *i;
2277         const char *p;
2278         unsigned long *inuse;
2279         unsigned int n = 0, min = 0;
2280 
2281         p = strnchr(name, IFNAMSIZ, '%');
2282         if (p != NULL) {
2283                 if (p[1] != 'd' || strchr(p + 2, '%'))
2284                         return -EINVAL;
2285 
2286                 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
2287                 if (inuse == NULL)
2288                         return -ENOMEM;
2289 cont:
2290                 list_for_each_entry(i, &ctx->table->sets, list) {
2291                         int tmp;
2292 
2293                         if (!sscanf(i->name, name, &tmp))
2294                                 continue;
2295                         if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
2296                                 continue;
2297 
2298                         set_bit(tmp - min, inuse);
2299                 }
2300 
2301                 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
2302                 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
2303                         min += BITS_PER_BYTE * PAGE_SIZE;
2304                         memset(inuse, 0, PAGE_SIZE);
2305                         goto cont;
2306                 }
2307                 free_page((unsigned long)inuse);
2308         }
2309 
2310         snprintf(set->name, sizeof(set->name), name, min + n);
2311         list_for_each_entry(i, &ctx->table->sets, list) {
2312                 if (!strcmp(set->name, i->name))
2313                         return -ENFILE;
2314         }
2315         return 0;
2316 }
2317 
2318 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
2319                               const struct nft_set *set, u16 event, u16 flags)
2320 {
2321         struct nfgenmsg *nfmsg;
2322         struct nlmsghdr *nlh;
2323         struct nlattr *desc;
2324         u32 portid = ctx->portid;
2325         u32 seq = ctx->seq;
2326 
2327         event |= NFNL_SUBSYS_NFTABLES << 8;
2328         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2329                         flags);
2330         if (nlh == NULL)
2331                 goto nla_put_failure;
2332 
2333         nfmsg = nlmsg_data(nlh);
2334         nfmsg->nfgen_family     = ctx->afi->family;
2335         nfmsg->version          = NFNETLINK_V0;
2336         nfmsg->res_id           = htons(ctx->net->nft.base_seq & 0xffff);
2337 
2338         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
2339                 goto nla_put_failure;
2340         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
2341                 goto nla_put_failure;
2342         if (set->flags != 0)
2343                 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
2344                         goto nla_put_failure;
2345 
2346         if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
2347                 goto nla_put_failure;
2348         if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
2349                 goto nla_put_failure;
2350         if (set->flags & NFT_SET_MAP) {
2351                 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
2352                         goto nla_put_failure;
2353                 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
2354                         goto nla_put_failure;
2355         }
2356 
2357         if (set->policy != NFT_SET_POL_PERFORMANCE) {
2358                 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
2359                         goto nla_put_failure;
2360         }
2361 
2362         desc = nla_nest_start(skb, NFTA_SET_DESC);
2363         if (desc == NULL)
2364                 goto nla_put_failure;
2365         if (set->size &&
2366             nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
2367                 goto nla_put_failure;
2368         nla_nest_end(skb, desc);
2369 
2370         return nlmsg_end(skb, nlh);
2371 
2372 nla_put_failure:
2373         nlmsg_trim(skb, nlh);
2374         return -1;
2375 }
2376 
2377 static int nf_tables_set_notify(const struct nft_ctx *ctx,
2378                                 const struct nft_set *set,
2379                                 int event, gfp_t gfp_flags)
2380 {
2381         struct sk_buff *skb;
2382         u32 portid = ctx->portid;
2383         int err;
2384 
2385         if (!ctx->report &&
2386             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2387                 return 0;
2388 
2389         err = -ENOBUFS;
2390         skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
2391         if (skb == NULL)
2392                 goto err;
2393 
2394         err = nf_tables_fill_set(skb, ctx, set, event, 0);
2395         if (err < 0) {
2396                 kfree_skb(skb);
2397                 goto err;
2398         }
2399 
2400         err = nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES,
2401                              ctx->report, gfp_flags);
2402 err:
2403         if (err < 0)
2404                 nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, err);
2405         return err;
2406 }
2407 
2408 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
2409 {
2410         const struct nft_set *set;
2411         unsigned int idx, s_idx = cb->args[0];
2412         struct nft_af_info *afi;
2413         struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
2414         struct net *net = sock_net(skb->sk);
2415         int cur_family = cb->args[3];
2416         struct nft_ctx *ctx = cb->data, ctx_set;
2417 
2418         if (cb->args[1])
2419                 return skb->len;
2420 
2421         rcu_read_lock();
2422         cb->seq = net->nft.base_seq;
2423 
2424         list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
2425                 if (ctx->afi && ctx->afi != afi)
2426                         continue;
2427 
2428                 if (cur_family) {
2429                         if (afi->family != cur_family)
2430                                 continue;
2431 
2432                         cur_family = 0;
2433                 }
2434                 list_for_each_entry_rcu(table, &afi->tables, list) {
2435                         if (ctx->table && ctx->table != table)
2436                                 continue;
2437 
2438                         if (cur_table) {
2439                                 if (cur_table != table)
2440                                         continue;
2441 
2442                                 cur_table = NULL;
2443                         }
2444                         idx = 0;
2445                         list_for_each_entry_rcu(set, &table->sets, list) {
2446                                 if (idx < s_idx)
2447                                         goto cont;
2448 
2449                                 ctx_set = *ctx;
2450                                 ctx_set.table = table;
2451                                 ctx_set.afi = afi;
2452                                 if (nf_tables_fill_set(skb, &ctx_set, set,
2453                                                        NFT_MSG_NEWSET,
2454                                                        NLM_F_MULTI) < 0) {
2455                                         cb->args[0] = idx;
2456                                         cb->args[2] = (unsigned long) table;
2457                                         cb->args[3] = afi->family;
2458                                         goto done;
2459                                 }
2460                                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2461 cont:
2462                                 idx++;
2463                         }
2464                         if (s_idx)
2465                                 s_idx = 0;
2466                 }
2467         }
2468         cb->args[1] = 1;
2469 done:
2470         rcu_read_unlock();
2471         return skb->len;
2472 }
2473 
2474 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
2475 {
2476         kfree(cb->data);
2477         return 0;
2478 }
2479 
2480 static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
2481                             const struct nlmsghdr *nlh,
2482                             const struct nlattr * const nla[])
2483 {
2484         const struct nft_set *set;
2485         struct nft_ctx ctx;
2486         struct sk_buff *skb2;
2487         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2488         int err;
2489 
2490         /* Verify existence before starting dump */
2491         err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2492         if (err < 0)
2493                 return err;
2494 
2495         if (nlh->nlmsg_flags & NLM_F_DUMP) {
2496                 struct netlink_dump_control c = {
2497                         .dump = nf_tables_dump_sets,
2498                         .done = nf_tables_dump_sets_done,
2499                 };
2500                 struct nft_ctx *ctx_dump;
2501 
2502                 ctx_dump = kmalloc(sizeof(*ctx_dump), GFP_KERNEL);
2503                 if (ctx_dump == NULL)
2504                         return -ENOMEM;
2505 
2506                 *ctx_dump = ctx;
2507                 c.data = ctx_dump;
2508 
2509                 return netlink_dump_start(nlsk, skb, nlh, &c);
2510         }
2511 
2512         /* Only accept unspec with dump */
2513         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2514                 return -EAFNOSUPPORT;
2515 
2516         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2517         if (IS_ERR(set))
2518                 return PTR_ERR(set);
2519         if (set->flags & NFT_SET_INACTIVE)
2520                 return -ENOENT;
2521 
2522         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2523         if (skb2 == NULL)
2524                 return -ENOMEM;
2525 
2526         err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
2527         if (err < 0)
2528                 goto err;
2529 
2530         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2531 
2532 err:
2533         kfree_skb(skb2);
2534         return err;
2535 }
2536 
2537 static int nf_tables_set_desc_parse(const struct nft_ctx *ctx,
2538                                     struct nft_set_desc *desc,
2539                                     const struct nlattr *nla)
2540 {
2541         struct nlattr *da[NFTA_SET_DESC_MAX + 1];
2542         int err;
2543 
2544         err = nla_parse_nested(da, NFTA_SET_DESC_MAX, nla, nft_set_desc_policy);
2545         if (err < 0)
2546                 return err;
2547 
2548         if (da[NFTA_SET_DESC_SIZE] != NULL)
2549                 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
2550 
2551         return 0;
2552 }
2553 
2554 static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
2555                             const struct nlmsghdr *nlh,
2556                             const struct nlattr * const nla[])
2557 {
2558         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2559         const struct nft_set_ops *ops;
2560         struct nft_af_info *afi;
2561         struct net *net = sock_net(skb->sk);
2562         struct nft_table *table;
2563         struct nft_set *set;
2564         struct nft_ctx ctx;
2565         char name[IFNAMSIZ];
2566         unsigned int size;
2567         bool create;
2568         u32 ktype, dtype, flags, policy;
2569         struct nft_set_desc desc;
2570         int err;
2571 
2572         if (nla[NFTA_SET_TABLE] == NULL ||
2573             nla[NFTA_SET_NAME] == NULL ||
2574             nla[NFTA_SET_KEY_LEN] == NULL ||
2575             nla[NFTA_SET_ID] == NULL)
2576                 return -EINVAL;
2577 
2578         memset(&desc, 0, sizeof(desc));
2579 
2580         ktype = NFT_DATA_VALUE;
2581         if (nla[NFTA_SET_KEY_TYPE] != NULL) {
2582                 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
2583                 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
2584                         return -EINVAL;
2585         }
2586 
2587         desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
2588         if (desc.klen == 0 || desc.klen > FIELD_SIZEOF(struct nft_data, data))
2589                 return -EINVAL;
2590 
2591         flags = 0;
2592         if (nla[NFTA_SET_FLAGS] != NULL) {
2593                 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
2594                 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
2595                               NFT_SET_INTERVAL | NFT_SET_MAP))
2596                         return -EINVAL;
2597         }
2598 
2599         dtype = 0;
2600         if (nla[NFTA_SET_DATA_TYPE] != NULL) {
2601                 if (!(flags & NFT_SET_MAP))
2602                         return -EINVAL;
2603 
2604                 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
2605                 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
2606                     dtype != NFT_DATA_VERDICT)
2607                         return -EINVAL;
2608 
2609                 if (dtype != NFT_DATA_VERDICT) {
2610                         if (nla[NFTA_SET_DATA_LEN] == NULL)
2611                                 return -EINVAL;
2612                         desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
2613                         if (desc.dlen == 0 ||
2614                             desc.dlen > FIELD_SIZEOF(struct nft_data, data))
2615                                 return -EINVAL;
2616                 } else
2617                         desc.dlen = sizeof(struct nft_data);
2618         } else if (flags & NFT_SET_MAP)
2619                 return -EINVAL;
2620 
2621         policy = NFT_SET_POL_PERFORMANCE;
2622         if (nla[NFTA_SET_POLICY] != NULL)
2623                 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
2624 
2625         if (nla[NFTA_SET_DESC] != NULL) {
2626                 err = nf_tables_set_desc_parse(&ctx, &desc, nla[NFTA_SET_DESC]);
2627                 if (err < 0)
2628                         return err;
2629         }
2630 
2631         create = nlh->nlmsg_flags & NLM_F_CREATE ? true : false;
2632 
2633         afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, create);
2634         if (IS_ERR(afi))
2635                 return PTR_ERR(afi);
2636 
2637         table = nf_tables_table_lookup(afi, nla[NFTA_SET_TABLE]);
2638         if (IS_ERR(table))
2639                 return PTR_ERR(table);
2640 
2641         nft_ctx_init(&ctx, skb, nlh, afi, table, NULL, nla);
2642 
2643         set = nf_tables_set_lookup(table, nla[NFTA_SET_NAME]);
2644         if (IS_ERR(set)) {
2645                 if (PTR_ERR(set) != -ENOENT)
2646                         return PTR_ERR(set);
2647                 set = NULL;
2648         }
2649 
2650         if (set != NULL) {
2651                 if (nlh->nlmsg_flags & NLM_F_EXCL)
2652                         return -EEXIST;
2653                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2654                         return -EOPNOTSUPP;
2655                 return 0;
2656         }
2657 
2658         if (!(nlh->nlmsg_flags & NLM_F_CREATE))
2659                 return -ENOENT;
2660 
2661         ops = nft_select_set_ops(nla, &desc, policy);
2662         if (IS_ERR(ops))
2663                 return PTR_ERR(ops);
2664 
2665         size = 0;
2666         if (ops->privsize != NULL)
2667                 size = ops->privsize(nla);
2668 
2669         err = -ENOMEM;
2670         set = kzalloc(sizeof(*set) + size, GFP_KERNEL);
2671         if (set == NULL)
2672                 goto err1;
2673 
2674         nla_strlcpy(name, nla[NFTA_SET_NAME], sizeof(set->name));
2675         err = nf_tables_set_alloc_name(&ctx, set, name);
2676         if (err < 0)
2677                 goto err2;
2678 
2679         INIT_LIST_HEAD(&set->bindings);
2680         set->ops   = ops;
2681         set->ktype = ktype;
2682         set->klen  = desc.klen;
2683         set->dtype = dtype;
2684         set->dlen  = desc.dlen;
2685         set->flags = flags;
2686         set->size  = desc.size;
2687         set->policy = policy;
2688 
2689         err = ops->init(set, &desc, nla);
2690         if (err < 0)
2691                 goto err2;
2692 
2693         err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
2694         if (err < 0)
2695                 goto err2;
2696 
2697         list_add_tail_rcu(&set->list, &table->sets);
2698         table->use++;
2699         return 0;
2700 
2701 err2:
2702         kfree(set);
2703 err1:
2704         module_put(ops->owner);
2705         return err;
2706 }
2707 
2708 static void nft_set_destroy(struct nft_set *set)
2709 {
2710         set->ops->destroy(set);
2711         module_put(set->ops->owner);
2712         kfree(set);
2713 }
2714 
2715 static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
2716 {
2717         list_del_rcu(&set->list);
2718         nf_tables_set_notify(ctx, set, NFT_MSG_DELSET, GFP_ATOMIC);
2719         nft_set_destroy(set);
2720 }
2721 
2722 static int nf_tables_delset(struct sock *nlsk, struct sk_buff *skb,
2723                             const struct nlmsghdr *nlh,
2724                             const struct nlattr * const nla[])
2725 {
2726         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2727         struct nft_set *set;
2728         struct nft_ctx ctx;
2729         int err;
2730 
2731         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
2732                 return -EAFNOSUPPORT;
2733         if (nla[NFTA_SET_TABLE] == NULL)
2734                 return -EINVAL;
2735 
2736         err = nft_ctx_init_from_setattr(&ctx, skb, nlh, nla);
2737         if (err < 0)
2738                 return err;
2739 
2740         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
2741         if (IS_ERR(set))
2742                 return PTR_ERR(set);
2743         if (set->flags & NFT_SET_INACTIVE)
2744                 return -ENOENT;
2745         if (!list_empty(&set->bindings))
2746                 return -EBUSY;
2747 
2748         return nft_delset(&ctx, set);
2749 }
2750 
2751 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
2752                                         const struct nft_set *set,
2753                                         const struct nft_set_iter *iter,
2754                                         const struct nft_set_elem *elem)
2755 {
2756         enum nft_registers dreg;
2757 
2758         dreg = nft_type_to_reg(set->dtype);
2759         return nft_validate_data_load(ctx, dreg, &elem->data,
2760                                       set->dtype == NFT_DATA_VERDICT ?
2761                                       NFT_DATA_VERDICT : NFT_DATA_VALUE);
2762 }
2763 
2764 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
2765                        struct nft_set_binding *binding)
2766 {
2767         struct nft_set_binding *i;
2768         struct nft_set_iter iter;
2769 
2770         if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
2771                 return -EBUSY;
2772 
2773         if (set->flags & NFT_SET_MAP) {
2774                 /* If the set is already bound to the same chain all
2775                  * jumps are already validated for that chain.
2776                  */
2777                 list_for_each_entry(i, &set->bindings, list) {
2778                         if (i->chain == binding->chain)
2779                                 goto bind;
2780                 }
2781 
2782                 iter.skip       = 0;
2783                 iter.count      = 0;
2784                 iter.err        = 0;
2785                 iter.fn         = nf_tables_bind_check_setelem;
2786 
2787                 set->ops->walk(ctx, set, &iter);
2788                 if (iter.err < 0) {
2789                         /* Destroy anonymous sets if binding fails */
2790                         if (set->flags & NFT_SET_ANONYMOUS)
2791                                 nf_tables_set_destroy(ctx, set);
2792 
2793                         return iter.err;
2794                 }
2795         }
2796 bind:
2797         binding->chain = ctx->chain;
2798         list_add_tail_rcu(&binding->list, &set->bindings);
2799         return 0;
2800 }
2801 
2802 void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
2803                           struct nft_set_binding *binding)
2804 {
2805         list_del_rcu(&binding->list);
2806 
2807         if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS &&
2808             !(set->flags & NFT_SET_INACTIVE))
2809                 nf_tables_set_destroy(ctx, set);
2810 }
2811 
2812 /*
2813  * Set elements
2814  */
2815 
2816 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
2817         [NFTA_SET_ELEM_KEY]             = { .type = NLA_NESTED },
2818         [NFTA_SET_ELEM_DATA]            = { .type = NLA_NESTED },
2819         [NFTA_SET_ELEM_FLAGS]           = { .type = NLA_U32 },
2820 };
2821 
2822 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
2823         [NFTA_SET_ELEM_LIST_TABLE]      = { .type = NLA_STRING },
2824         [NFTA_SET_ELEM_LIST_SET]        = { .type = NLA_STRING },
2825         [NFTA_SET_ELEM_LIST_ELEMENTS]   = { .type = NLA_NESTED },
2826         [NFTA_SET_ELEM_LIST_SET_ID]     = { .type = NLA_U32 },
2827 };
2828 
2829 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx,
2830                                       const struct sk_buff *skb,
2831                                       const struct nlmsghdr *nlh,
2832                                       const struct nlattr * const nla[],
2833                                       bool trans)
2834 {
2835         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2836         struct nft_af_info *afi;
2837         struct nft_table *table;
2838         struct net *net = sock_net(skb->sk);
2839 
2840         afi = nf_tables_afinfo_lookup(net, nfmsg->nfgen_family, false);
2841         if (IS_ERR(afi))
2842                 return PTR_ERR(afi);
2843 
2844         table = nf_tables_table_lookup(afi, nla[NFTA_SET_ELEM_LIST_TABLE]);
2845         if (IS_ERR(table))
2846                 return PTR_ERR(table);
2847         if (!trans && (table->flags & NFT_TABLE_INACTIVE))
2848                 return -ENOENT;
2849 
2850         nft_ctx_init(ctx, skb, nlh, afi, table, NULL, nla);
2851         return 0;
2852 }
2853 
2854 static int nf_tables_fill_setelem(struct sk_buff *skb,
2855                                   const struct nft_set *set,
2856                                   const struct nft_set_elem *elem)
2857 {
2858         unsigned char *b = skb_tail_pointer(skb);
2859         struct nlattr *nest;
2860 
2861         nest = nla_nest_start(skb, NFTA_LIST_ELEM);
2862         if (nest == NULL)
2863                 goto nla_put_failure;
2864 
2865         if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, &elem->key, NFT_DATA_VALUE,
2866                           set->klen) < 0)
2867                 goto nla_put_failure;
2868 
2869         if (set->flags & NFT_SET_MAP &&
2870             !(elem->flags & NFT_SET_ELEM_INTERVAL_END) &&
2871             nft_data_dump(skb, NFTA_SET_ELEM_DATA, &elem->data,
2872                           set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
2873                           set->dlen) < 0)
2874                 goto nla_put_failure;
2875 
2876         if (elem->flags != 0)
2877                 if (nla_put_be32(skb, NFTA_SET_ELEM_FLAGS, htonl(elem->flags)))
2878                         goto nla_put_failure;
2879 
2880         nla_nest_end(skb, nest);
2881         return 0;
2882 
2883 nla_put_failure:
2884         nlmsg_trim(skb, b);
2885         return -EMSGSIZE;
2886 }
2887 
2888 struct nft_set_dump_args {
2889         const struct netlink_callback   *cb;
2890         struct nft_set_iter             iter;
2891         struct sk_buff                  *skb;
2892 };
2893 
2894 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
2895                                   const struct nft_set *set,
2896                                   const struct nft_set_iter *iter,
2897                                   const struct nft_set_elem *elem)
2898 {
2899         struct nft_set_dump_args *args;
2900 
2901         args = container_of(iter, struct nft_set_dump_args, iter);
2902         return nf_tables_fill_setelem(args->skb, set, elem);
2903 }
2904 
2905 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
2906 {
2907         const struct nft_set *set;
2908         struct nft_set_dump_args args;
2909         struct nft_ctx ctx;
2910         struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
2911         struct nfgenmsg *nfmsg;
2912         struct nlmsghdr *nlh;
2913         struct nlattr *nest;
2914         u32 portid, seq;
2915         int event, err;
2916 
2917         err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
2918                           NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy);
2919         if (err < 0)
2920                 return err;
2921 
2922         err = nft_ctx_init_from_elemattr(&ctx, cb->skb, cb->nlh, (void *)nla,
2923                                          false);
2924         if (err < 0)
2925                 return err;
2926 
2927         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2928         if (IS_ERR(set))
2929                 return PTR_ERR(set);
2930         if (set->flags & NFT_SET_INACTIVE)
2931                 return -ENOENT;
2932 
2933         event  = NFT_MSG_NEWSETELEM;
2934         event |= NFNL_SUBSYS_NFTABLES << 8;
2935         portid = NETLINK_CB(cb->skb).portid;
2936         seq    = cb->nlh->nlmsg_seq;
2937 
2938         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
2939                         NLM_F_MULTI);
2940         if (nlh == NULL)
2941                 goto nla_put_failure;
2942 
2943         nfmsg = nlmsg_data(nlh);
2944         nfmsg->nfgen_family = ctx.afi->family;
2945         nfmsg->version      = NFNETLINK_V0;
2946         nfmsg->res_id       = htons(ctx.net->nft.base_seq & 0xffff);
2947 
2948         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
2949                 goto nla_put_failure;
2950         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
2951                 goto nla_put_failure;
2952 
2953         nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
2954         if (nest == NULL)
2955                 goto nla_put_failure;
2956 
2957         args.cb         = cb;
2958         args.skb        = skb;
2959         args.iter.skip  = cb->args[0];
2960         args.iter.count = 0;
2961         args.iter.err   = 0;
2962         args.iter.fn    = nf_tables_dump_setelem;
2963         set->ops->walk(&ctx, set, &args.iter);
2964 
2965         nla_nest_end(skb, nest);
2966         nlmsg_end(skb, nlh);
2967 
2968         if (args.iter.err && args.iter.err != -EMSGSIZE)
2969                 return args.iter.err;
2970         if (args.iter.count == cb->args[0])
2971                 return 0;
2972 
2973         cb->args[0] = args.iter.count;
2974         return skb->len;
2975 
2976 nla_put_failure:
2977         return -ENOSPC;
2978 }
2979 
2980 static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
2981                                 const struct nlmsghdr *nlh,
2982                                 const struct nlattr * const nla[])
2983 {
2984         const struct nft_set *set;
2985         struct nft_ctx ctx;
2986         int err;
2987 
2988         err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false);
2989         if (err < 0)
2990                 return err;
2991 
2992         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
2993         if (IS_ERR(set))
2994                 return PTR_ERR(set);
2995         if (set->flags & NFT_SET_INACTIVE)
2996                 return -ENOENT;
2997 
2998         if (nlh->nlmsg_flags & NLM_F_DUMP) {
2999                 struct netlink_dump_control c = {
3000                         .dump = nf_tables_dump_set,
3001                 };
3002                 return netlink_dump_start(nlsk, skb, nlh, &c);
3003         }
3004         return -EOPNOTSUPP;
3005 }
3006 
3007 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
3008                                        const struct nft_ctx *ctx, u32 seq,
3009                                        u32 portid, int event, u16 flags,
3010                                        const struct nft_set *set,
3011                                        const struct nft_set_elem *elem)
3012 {
3013         struct nfgenmsg *nfmsg;
3014         struct nlmsghdr *nlh;
3015         struct nlattr *nest;
3016         int err;
3017 
3018         event |= NFNL_SUBSYS_NFTABLES << 8;
3019         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3020                         flags);
3021         if (nlh == NULL)
3022                 goto nla_put_failure;
3023 
3024         nfmsg = nlmsg_data(nlh);
3025         nfmsg->nfgen_family     = ctx->afi->family;
3026         nfmsg->version          = NFNETLINK_V0;
3027         nfmsg->res_id           = htons(ctx->net->nft.base_seq & 0xffff);
3028 
3029         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3030                 goto nla_put_failure;
3031         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3032                 goto nla_put_failure;
3033 
3034         nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
3035         if (nest == NULL)
3036                 goto nla_put_failure;
3037 
3038         err = nf_tables_fill_setelem(skb, set, elem);
3039         if (err < 0)
3040                 goto nla_put_failure;
3041 
3042         nla_nest_end(skb, nest);
3043 
3044         return nlmsg_end(skb, nlh);
3045 
3046 nla_put_failure:
3047         nlmsg_trim(skb, nlh);
3048         return -1;
3049 }
3050 
3051 static int nf_tables_setelem_notify(const struct nft_ctx *ctx,
3052                                     const struct nft_set *set,
3053                                     const struct nft_set_elem *elem,
3054                                     int event, u16 flags)
3055 {
3056         struct net *net = ctx->net;
3057         u32 portid = ctx->portid;
3058         struct sk_buff *skb;
3059         int err;
3060 
3061         if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
3062                 return 0;
3063 
3064         err = -ENOBUFS;
3065         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3066         if (skb == NULL)
3067                 goto err;
3068 
3069         err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
3070                                           set, elem);
3071         if (err < 0) {
3072                 kfree_skb(skb);
3073                 goto err;
3074         }
3075 
3076         err = nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
3077                              GFP_KERNEL);
3078 err:
3079         if (err < 0)
3080                 nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, err);
3081         return err;
3082 }
3083 
3084 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
3085                                               int msg_type,
3086                                               struct nft_set *set)
3087 {
3088         struct nft_trans *trans;
3089 
3090         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
3091         if (trans == NULL)
3092                 return NULL;
3093 
3094         nft_trans_elem_set(trans) = set;
3095         return trans;
3096 }
3097 
3098 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
3099                             const struct nlattr *attr)
3100 {
3101         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3102         struct nft_data_desc d1, d2;
3103         struct nft_set_elem elem;
3104         struct nft_set_binding *binding;
3105         enum nft_registers dreg;
3106         struct nft_trans *trans;
3107         int err;
3108 
3109         if (set->size && set->nelems == set->size)
3110                 return -ENFILE;
3111 
3112         err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3113                                nft_set_elem_policy);
3114         if (err < 0)
3115                 return err;
3116 
3117         if (nla[NFTA_SET_ELEM_KEY] == NULL)
3118                 return -EINVAL;
3119 
3120         elem.flags = 0;
3121         if (nla[NFTA_SET_ELEM_FLAGS] != NULL) {
3122                 elem.flags = ntohl(nla_get_be32(nla[NFTA_SET_ELEM_FLAGS]));
3123                 if (elem.flags & ~NFT_SET_ELEM_INTERVAL_END)
3124                         return -EINVAL;
3125         }
3126 
3127         if (set->flags & NFT_SET_MAP) {
3128                 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
3129                     !(elem.flags & NFT_SET_ELEM_INTERVAL_END))
3130                         return -EINVAL;
3131                 if (nla[NFTA_SET_ELEM_DATA] != NULL &&
3132                     elem.flags & NFT_SET_ELEM_INTERVAL_END)
3133                         return -EINVAL;
3134         } else {
3135                 if (nla[NFTA_SET_ELEM_DATA] != NULL)
3136                         return -EINVAL;
3137         }
3138 
3139         err = nft_data_init(ctx, &elem.key, &d1, nla[NFTA_SET_ELEM_KEY]);
3140         if (err < 0)
3141                 goto err1;
3142         err = -EINVAL;
3143         if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
3144                 goto err2;
3145 
3146         err = -EEXIST;
3147         if (set->ops->get(set, &elem) == 0)
3148                 goto err2;
3149 
3150         if (nla[NFTA_SET_ELEM_DATA] != NULL) {
3151                 err = nft_data_init(ctx, &elem.data, &d2, nla[NFTA_SET_ELEM_DATA]);
3152                 if (err < 0)
3153                         goto err2;
3154 
3155                 err = -EINVAL;
3156                 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
3157                         goto err3;
3158 
3159                 dreg = nft_type_to_reg(set->dtype);
3160                 list_for_each_entry(binding, &set->bindings, list) {
3161                         struct nft_ctx bind_ctx = {
3162                                 .afi    = ctx->afi,
3163                                 .table  = ctx->table,
3164                                 .chain  = (struct nft_chain *)binding->chain,
3165                         };
3166 
3167                         err = nft_validate_data_load(&bind_ctx, dreg,
3168                                                      &elem.data, d2.type);
3169                         if (err < 0)
3170                                 goto err3;
3171                 }
3172         }
3173 
3174         trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
3175         if (trans == NULL)
3176                 goto err3;
3177 
3178         err = set->ops->insert(set, &elem);
3179         if (err < 0)
3180                 goto err4;
3181 
3182         nft_trans_elem(trans) = elem;
3183         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
3184         return 0;
3185 
3186 err4:
3187         kfree(trans);
3188 err3:
3189         if (nla[NFTA_SET_ELEM_DATA] != NULL)
3190                 nft_data_uninit(&elem.data, d2.type);
3191 err2:
3192         nft_data_uninit(&elem.key, d1.type);
3193 err1:
3194         return err;
3195 }
3196 
3197 static int nf_tables_newsetelem(struct sock *nlsk, struct sk_buff *skb,
3198                                 const struct nlmsghdr *nlh,
3199                                 const struct nlattr * const nla[])
3200 {
3201         struct net *net = sock_net(skb->sk);
3202         const struct nlattr *attr;
3203         struct nft_set *set;
3204         struct nft_ctx ctx;
3205         int rem, err = 0;
3206 
3207         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
3208                 return -EINVAL;
3209 
3210         err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, true);
3211         if (err < 0)
3212                 return err;
3213 
3214         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
3215         if (IS_ERR(set)) {
3216                 if (nla[NFTA_SET_ELEM_LIST_SET_ID]) {
3217                         set = nf_tables_set_lookup_byid(net,
3218                                         nla[NFTA_SET_ELEM_LIST_SET_ID]);
3219                 }
3220                 if (IS_ERR(set))
3221                         return PTR_ERR(set);
3222         }
3223 
3224         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3225                 return -EBUSY;
3226 
3227         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3228                 err = nft_add_set_elem(&ctx, set, attr);
3229                 if (err < 0)
3230                         break;
3231 
3232                 set->nelems++;
3233         }
3234         return err;
3235 }
3236 
3237 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
3238                            const struct nlattr *attr)
3239 {
3240         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
3241         struct nft_data_desc desc;
3242         struct nft_set_elem elem;
3243         struct nft_trans *trans;
3244         int err;
3245 
3246         err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr,
3247                                nft_set_elem_policy);
3248         if (err < 0)
3249                 goto err1;
3250 
3251         err = -EINVAL;
3252         if (nla[NFTA_SET_ELEM_KEY] == NULL)
3253                 goto err1;
3254 
3255         err = nft_data_init(ctx, &elem.key, &desc, nla[NFTA_SET_ELEM_KEY]);
3256         if (err < 0)
3257                 goto err1;
3258 
3259         err = -EINVAL;
3260         if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
3261                 goto err2;
3262 
3263         err = set->ops->get(set, &elem);
3264         if (err < 0)
3265                 goto err2;
3266 
3267         trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
3268         if (trans == NULL) {
3269                 err = -ENOMEM;
3270                 goto err2;
3271         }
3272 
3273         nft_trans_elem(trans) = elem;
3274         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
3275         return 0;
3276 err2:
3277         nft_data_uninit(&elem.key, desc.type);
3278 err1:
3279         return err;
3280 }
3281 
3282 static int nf_tables_delsetelem(struct sock *nlsk, struct sk_buff *skb,
3283                                 const struct nlmsghdr *nlh,
3284                                 const struct nlattr * const nla[])
3285 {
3286         const struct nlattr *attr;
3287         struct nft_set *set;
3288         struct nft_ctx ctx;
3289         int rem, err = 0;
3290 
3291         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
3292                 return -EINVAL;
3293 
3294         err = nft_ctx_init_from_elemattr(&ctx, skb, nlh, nla, false);
3295         if (err < 0)
3296                 return err;
3297 
3298         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
3299         if (IS_ERR(set))
3300                 return PTR_ERR(set);
3301         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
3302                 return -EBUSY;
3303 
3304         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
3305                 err = nft_del_setelem(&ctx, set, attr);
3306                 if (err < 0)
3307                         break;
3308 
3309                 set->nelems--;
3310         }
3311         return err;
3312 }
3313 
3314 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
3315                                    u32 portid, u32 seq)
3316 {
3317         struct nlmsghdr *nlh;
3318         struct nfgenmsg *nfmsg;
3319         int event = (NFNL_SUBSYS_NFTABLES << 8) | NFT_MSG_NEWGEN;
3320 
3321         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
3322         if (nlh == NULL)
3323                 goto nla_put_failure;
3324 
3325         nfmsg = nlmsg_data(nlh);
3326         nfmsg->nfgen_family     = AF_UNSPEC;
3327         nfmsg->version          = NFNETLINK_V0;
3328         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
3329 
3330         if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)))
3331                 goto nla_put_failure;
3332 
3333         return nlmsg_end(skb, nlh);
3334 
3335 nla_put_failure:
3336         nlmsg_trim(skb, nlh);
3337         return -EMSGSIZE;
3338 }
3339 
3340 static int nf_tables_gen_notify(struct net *net, struct sk_buff *skb, int event)
3341 {
3342         struct nlmsghdr *nlh = nlmsg_hdr(skb);
3343         struct sk_buff *skb2;
3344         int err;
3345 
3346         if (nlmsg_report(nlh) &&
3347             !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
3348                 return 0;
3349 
3350         err = -ENOBUFS;
3351         skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3352         if (skb2 == NULL)
3353                 goto err;
3354 
3355         err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
3356                                       nlh->nlmsg_seq);
3357         if (err < 0) {
3358                 kfree_skb(skb2);
3359                 goto err;
3360         }
3361 
3362         err = nfnetlink_send(skb2, net, NETLINK_CB(skb).portid,
3363                              NFNLGRP_NFTABLES, nlmsg_report(nlh), GFP_KERNEL);
3364 err:
3365         if (err < 0) {
3366                 nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
3367                                   err);
3368         }
3369         return err;
3370 }
3371 
3372 static int nf_tables_getgen(struct sock *nlsk, struct sk_buff *skb,
3373                             const struct nlmsghdr *nlh,
3374                             const struct nlattr * const nla[])
3375 {
3376         struct net *net = sock_net(skb->sk);
3377         struct sk_buff *skb2;
3378         int err;
3379 
3380         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
3381         if (skb2 == NULL)
3382                 return -ENOMEM;
3383 
3384         err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
3385                                       nlh->nlmsg_seq);
3386         if (err < 0)
3387                 goto err;
3388 
3389         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3390 err:
3391         kfree_skb(skb2);
3392         return err;
3393 }
3394 
3395 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
3396         [NFT_MSG_NEWTABLE] = {
3397                 .call_batch     = nf_tables_newtable,
3398                 .attr_count     = NFTA_TABLE_MAX,
3399                 .policy         = nft_table_policy,
3400         },
3401         [NFT_MSG_GETTABLE] = {
3402                 .call           = nf_tables_gettable,
3403                 .attr_count     = NFTA_TABLE_MAX,
3404                 .policy         = nft_table_policy,
3405         },
3406         [NFT_MSG_DELTABLE] = {
3407                 .call_batch     = nf_tables_deltable,
3408                 .attr_count     = NFTA_TABLE_MAX,
3409                 .policy         = nft_table_policy,
3410         },
3411         [NFT_MSG_NEWCHAIN] = {
3412                 .call_batch     = nf_tables_newchain,
3413                 .attr_count     = NFTA_CHAIN_MAX,
3414                 .policy         = nft_chain_policy,
3415         },
3416         [NFT_MSG_GETCHAIN] = {
3417                 .call           = nf_tables_getchain,
3418                 .attr_count     = NFTA_CHAIN_MAX,
3419                 .policy         = nft_chain_policy,
3420         },
3421         [NFT_MSG_DELCHAIN] = {
3422                 .call_batch     = nf_tables_delchain,
3423                 .attr_count     = NFTA_CHAIN_MAX,
3424                 .policy         = nft_chain_policy,
3425         },
3426         [NFT_MSG_NEWRULE] = {
3427                 .call_batch     = nf_tables_newrule,
3428                 .attr_count     = NFTA_RULE_MAX,
3429                 .policy         = nft_rule_policy,
3430         },
3431         [NFT_MSG_GETRULE] = {
3432                 .call           = nf_tables_getrule,
3433                 .attr_count     = NFTA_RULE_MAX,
3434                 .policy         = nft_rule_policy,
3435         },
3436         [NFT_MSG_DELRULE] = {
3437                 .call_batch     = nf_tables_delrule,
3438                 .attr_count     = NFTA_RULE_MAX,
3439                 .policy         = nft_rule_policy,
3440         },
3441         [NFT_MSG_NEWSET] = {
3442                 .call_batch     = nf_tables_newset,
3443                 .attr_count     = NFTA_SET_MAX,
3444                 .policy         = nft_set_policy,
3445         },
3446         [NFT_MSG_GETSET] = {
3447                 .call           = nf_tables_getset,
3448                 .attr_count     = NFTA_SET_MAX,
3449                 .policy         = nft_set_policy,
3450         },
3451         [NFT_MSG_DELSET] = {
3452                 .call_batch     = nf_tables_delset,
3453                 .attr_count     = NFTA_SET_MAX,
3454                 .policy         = nft_set_policy,
3455         },
3456         [NFT_MSG_NEWSETELEM] = {
3457                 .call_batch     = nf_tables_newsetelem,
3458                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
3459                 .policy         = nft_set_elem_list_policy,
3460         },
3461         [NFT_MSG_GETSETELEM] = {
3462                 .call           = nf_tables_getsetelem,
3463                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
3464                 .policy         = nft_set_elem_list_policy,
3465         },
3466         [NFT_MSG_DELSETELEM] = {
3467                 .call_batch     = nf_tables_delsetelem,
3468                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
3469                 .policy         = nft_set_elem_list_policy,
3470         },
3471         [NFT_MSG_GETGEN] = {
3472                 .call           = nf_tables_getgen,
3473         },
3474 };
3475 
3476 static void nft_chain_commit_update(struct nft_trans *trans)
3477 {
3478         struct nft_base_chain *basechain;
3479 
3480         if (nft_trans_chain_name(trans)[0])
3481                 strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans));
3482 
3483         if (!(trans->ctx.chain->flags & NFT_BASE_CHAIN))
3484                 return;
3485 
3486         basechain = nft_base_chain(trans->ctx.chain);
3487         nft_chain_stats_replace(basechain, nft_trans_chain_stats(trans));
3488 
3489         switch (nft_trans_chain_policy(trans)) {
3490         case NF_DROP:
3491         case NF_ACCEPT:
3492                 basechain->policy = nft_trans_chain_policy(trans);
3493                 break;
3494         }
3495 }
3496 
3497 static void nf_tables_commit_release(struct nft_trans *trans)
3498 {
3499         switch (trans->msg_type) {
3500         case NFT_MSG_DELTABLE:
3501                 nf_tables_table_destroy(&trans->ctx);
3502                 break;
3503         case NFT_MSG_DELCHAIN:
3504                 nf_tables_chain_destroy(trans->ctx.chain);
3505                 break;
3506         case NFT_MSG_DELRULE:
3507                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
3508                 break;
3509         case NFT_MSG_DELSET:
3510                 nft_set_destroy(nft_trans_set(trans));
3511                 break;
3512         }
3513         kfree(trans);
3514 }
3515 
3516 static int nf_tables_commit(struct sk_buff *skb)
3517 {
3518         struct net *net = sock_net(skb->sk);
3519         struct nft_trans *trans, *next;
3520         struct nft_trans_elem *te;
3521 
3522         /* Bump generation counter, invalidate any dump in progress */
3523         while (++net->nft.base_seq == 0);
3524 
3525         /* A new generation has just started */
3526         net->nft.gencursor = gencursor_next(net);
3527 
3528         /* Make sure all packets have left the previous generation before
3529          * purging old rules.
3530          */
3531         synchronize_rcu();
3532 
3533         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
3534                 switch (trans->msg_type) {
3535                 case NFT_MSG_NEWTABLE:
3536                         if (nft_trans_table_update(trans)) {
3537                                 if (!nft_trans_table_enable(trans)) {
3538                                         nf_tables_table_disable(trans->ctx.afi,
3539                                                                 trans->ctx.table);
3540                                         trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
3541                                 }
3542                         } else {
3543                                 trans->ctx.table->flags &= ~NFT_TABLE_INACTIVE;
3544                         }
3545                         nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
3546                         nft_trans_destroy(trans);
3547                         break;
3548                 case NFT_MSG_DELTABLE:
3549                         nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
3550                         break;
3551                 case NFT_MSG_NEWCHAIN:
3552                         if (nft_trans_chain_update(trans))
3553                                 nft_chain_commit_update(trans);
3554                         else
3555                                 trans->ctx.chain->flags &= ~NFT_CHAIN_INACTIVE;
3556 
3557                         nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
3558                         nft_trans_destroy(trans);
3559                         break;
3560                 case NFT_MSG_DELCHAIN:
3561                         nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
3562                         nf_tables_unregister_hooks(trans->ctx.table,
3563                                                    trans->ctx.chain,
3564                                                    trans->ctx.afi->nops);
3565                         break;
3566                 case NFT_MSG_NEWRULE:
3567                         nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
3568                         nf_tables_rule_notify(&trans->ctx,
3569                                               nft_trans_rule(trans),
3570                                               NFT_MSG_NEWRULE);
3571                         nft_trans_destroy(trans);
3572                         break;
3573                 case NFT_MSG_DELRULE:
3574                         list_del_rcu(&nft_trans_rule(trans)->list);
3575                         nf_tables_rule_notify(&trans->ctx,
3576                                               nft_trans_rule(trans),
3577                                               NFT_MSG_DELRULE);
3578                         break;
3579                 case NFT_MSG_NEWSET:
3580                         nft_trans_set(trans)->flags &= ~NFT_SET_INACTIVE;
3581                         /* This avoids hitting -EBUSY when deleting the table
3582                          * from the transaction.
3583                          */
3584                         if (nft_trans_set(trans)->flags & NFT_SET_ANONYMOUS &&
3585                             !list_empty(&nft_trans_set(trans)->bindings))
3586                                 trans->ctx.table->use--;
3587 
3588                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
3589                                              NFT_MSG_NEWSET, GFP_KERNEL);
3590                         nft_trans_destroy(trans);
3591                         break;
3592                 case NFT_MSG_DELSET:
3593                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
3594                                              NFT_MSG_DELSET, GFP_KERNEL);
3595                         break;
3596                 case NFT_MSG_NEWSETELEM:
3597                         nf_tables_setelem_notify(&trans->ctx,
3598                                                  nft_trans_elem_set(trans),
3599                                                  &nft_trans_elem(trans),
3600                                                  NFT_MSG_NEWSETELEM, 0);
3601                         nft_trans_destroy(trans);
3602                         break;
3603                 case NFT_MSG_DELSETELEM:
3604                         te = (struct nft_trans_elem *)trans->data;
3605                         nf_tables_setelem_notify(&trans->ctx, te->set,
3606                                                  &te->elem,
3607                                                  NFT_MSG_DELSETELEM, 0);
3608                         te->set->ops->get(te->set, &te->elem);
3609                         nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
3610                         if (te->set->flags & NFT_SET_MAP &&
3611                             !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
3612                                 nft_data_uninit(&te->elem.data, te->set->dtype);
3613                         te->set->ops->remove(te->set, &te->elem);
3614                         nft_trans_destroy(trans);
3615                         break;
3616                 }
3617         }
3618 
3619         synchronize_rcu();
3620 
3621         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
3622                 list_del(&trans->list);
3623                 nf_tables_commit_release(trans);
3624         }
3625 
3626         nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
3627 
3628         return 0;
3629 }
3630 
3631 static void nf_tables_abort_release(struct nft_trans *trans)
3632 {
3633         switch (trans->msg_type) {
3634         case NFT_MSG_NEWTABLE:
3635                 nf_tables_table_destroy(&trans->ctx);
3636                 break;
3637         case NFT_MSG_NEWCHAIN:
3638                 nf_tables_chain_destroy(trans->ctx.chain);
3639                 break;
3640         case NFT_MSG_NEWRULE:
3641                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
3642                 break;
3643         case NFT_MSG_NEWSET:
3644                 nft_set_destroy(nft_trans_set(trans));
3645                 break;
3646         }
3647         kfree(trans);
3648 }
3649 
3650 static int nf_tables_abort(struct sk_buff *skb)
3651 {
3652         struct net *net = sock_net(skb->sk);
3653         struct nft_trans *trans, *next;
3654         struct nft_trans_elem *te;
3655 
3656         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
3657                 switch (trans->msg_type) {
3658                 case NFT_MSG_NEWTABLE:
3659                         if (nft_trans_table_update(trans)) {
3660                                 if (nft_trans_table_enable(trans)) {
3661                                         nf_tables_table_disable(trans->ctx.afi,
3662                                                                 trans->ctx.table);
3663                                         trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
3664                                 }
3665                                 nft_trans_destroy(trans);
3666                         } else {
3667                                 list_del_rcu(&trans->ctx.table->list);
3668                         }
3669                         break;
3670                 case NFT_MSG_DELTABLE:
3671                         list_add_tail_rcu(&trans->ctx.table->list,
3672                                           &trans->ctx.afi->tables);
3673                         nft_trans_destroy(trans);
3674                         break;
3675                 case NFT_MSG_NEWCHAIN:
3676                         if (nft_trans_chain_update(trans)) {
3677                                 free_percpu(nft_trans_chain_stats(trans));
3678 
3679                                 nft_trans_destroy(trans);
3680                         } else {
3681                                 trans->ctx.table->use--;
3682                                 list_del_rcu(&trans->ctx.chain->list);
3683                                 nf_tables_unregister_hooks(trans->ctx.table,
3684                                                            trans->ctx.chain,
3685                                                            trans->ctx.afi->nops);
3686                         }
3687                         break;
3688                 case NFT_MSG_DELCHAIN:
3689                         trans->ctx.table->use++;
3690                         list_add_tail_rcu(&trans->ctx.chain->list,
3691                                           &trans->ctx.table->chains);
3692                         nft_trans_destroy(trans);
3693                         break;
3694                 case NFT_MSG_NEWRULE:
3695                         trans->ctx.chain->use--;
3696                         list_del_rcu(&nft_trans_rule(trans)->list);
3697                         break;
3698                 case NFT_MSG_DELRULE:
3699                         trans->ctx.chain->use++;
3700                         nft_rule_clear(trans->ctx.net, nft_trans_rule(trans));
3701                         nft_trans_destroy(trans);
3702                         break;
3703                 case NFT_MSG_NEWSET:
3704                         trans->ctx.table->use--;
3705                         list_del_rcu(&nft_trans_set(trans)->list);
3706                         break;
3707                 case NFT_MSG_DELSET:
3708                         trans->ctx.table->use++;
3709                         list_add_tail_rcu(&nft_trans_set(trans)->list,
3710                                           &trans->ctx.table->sets);
3711                         nft_trans_destroy(trans);
3712                         break;
3713                 case NFT_MSG_NEWSETELEM:
3714                         nft_trans_elem_set(trans)->nelems--;
3715                         te = (struct nft_trans_elem *)trans->data;
3716                         te->set->ops->get(te->set, &te->elem);
3717                         nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
3718                         if (te->set->flags & NFT_SET_MAP &&
3719                             !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
3720                                 nft_data_uninit(&te->elem.data, te->set->dtype);
3721                         te->set->ops->remove(te->set, &te->elem);
3722                         nft_trans_destroy(trans);
3723                         break;
3724                 case NFT_MSG_DELSETELEM:
3725                         nft_trans_elem_set(trans)->nelems++;
3726                         nft_trans_destroy(trans);
3727                         break;
3728                 }
3729         }
3730 
3731         synchronize_rcu();
3732 
3733         list_for_each_entry_safe_reverse(trans, next,
3734                                          &net->nft.commit_list, list) {
3735                 list_del(&trans->list);
3736                 nf_tables_abort_release(trans);
3737         }
3738 
3739         return 0;
3740 }
3741 
3742 static const struct nfnetlink_subsystem nf_tables_subsys = {
3743         .name           = "nf_tables",
3744         .subsys_id      = NFNL_SUBSYS_NFTABLES,
3745         .cb_count       = NFT_MSG_MAX,
3746         .cb             = nf_tables_cb,
3747         .commit         = nf_tables_commit,
3748         .abort          = nf_tables_abort,
3749 };
3750 
3751 int nft_chain_validate_dependency(const struct nft_chain *chain,
3752                                   enum nft_chain_type type)
3753 {
3754         const struct nft_base_chain *basechain;
3755 
3756         if (chain->flags & NFT_BASE_CHAIN) {
3757                 basechain = nft_base_chain(chain);
3758                 if (basechain->type->type != type)
3759                         return -EOPNOTSUPP;
3760         }
3761         return 0;
3762 }
3763 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
3764 
3765 int nft_chain_validate_hooks(const struct nft_chain *chain,
3766                              unsigned int hook_flags)
3767 {
3768         struct nft_base_chain *basechain;
3769 
3770         if (chain->flags & NFT_BASE_CHAIN) {
3771                 basechain = nft_base_chain(chain);
3772 
3773                 if ((1 << basechain->ops[0].hooknum) & hook_flags)
3774                         return 0;
3775 
3776                 return -EOPNOTSUPP;
3777         }
3778 
3779         return 0;
3780 }
3781 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
3782 
3783 /*
3784  * Loop detection - walk through the ruleset beginning at the destination chain
3785  * of a new jump until either the source chain is reached (loop) or all
3786  * reachable chains have been traversed.
3787  *
3788  * The loop check is performed whenever a new jump verdict is added to an
3789  * expression or verdict map or a verdict map is bound to a new chain.
3790  */
3791 
3792 static int nf_tables_check_loops(const struct nft_ctx *ctx,
3793                                  const struct nft_chain *chain);
3794 
3795 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
3796                                         const struct nft_set *set,
3797                                         const struct nft_set_iter *iter,
3798                                         const struct nft_set_elem *elem)
3799 {
3800         if (elem->flags & NFT_SET_ELEM_INTERVAL_END)
3801                 return 0;
3802 
3803         switch (elem->data.verdict) {
3804         case NFT_JUMP:
3805         case NFT_GOTO:
3806                 return nf_tables_check_loops(ctx, elem->data.chain);
3807         default:
3808                 return 0;
3809         }
3810 }
3811 
3812 static int nf_tables_check_loops(const struct nft_ctx *ctx,
3813                                  const struct nft_chain *chain)
3814 {
3815         const struct nft_rule *rule;
3816         const struct nft_expr *expr, *last;
3817         const struct nft_set *set;
3818         struct nft_set_binding *binding;
3819         struct nft_set_iter iter;
3820 
3821         if (ctx->chain == chain)
3822                 return -ELOOP;
3823 
3824         list_for_each_entry(rule, &chain->rules, list) {
3825                 nft_rule_for_each_expr(expr, last, rule) {
3826                         const struct nft_data *data = NULL;
3827                         int err;
3828 
3829                         if (!expr->ops->validate)
3830                                 continue;
3831 
3832                         err = expr->ops->validate(ctx, expr, &data);
3833                         if (err < 0)
3834                                 return err;
3835 
3836                         if (data == NULL)
3837                                 continue;
3838 
3839                         switch (data->verdict) {
3840                         case NFT_JUMP:
3841                         case NFT_GOTO:
3842                                 err = nf_tables_check_loops(ctx, data->chain);
3843                                 if (err < 0)
3844                                         return err;
3845                         default:
3846                                 break;
3847                         }
3848                 }
3849         }
3850 
3851         list_for_each_entry(set, &ctx->table->sets, list) {
3852                 if (!(set->flags & NFT_SET_MAP) ||
3853                     set->dtype != NFT_DATA_VERDICT)
3854                         continue;
3855 
3856                 list_for_each_entry(binding, &set->bindings, list) {
3857                         if (binding->chain != chain)
3858                                 continue;
3859 
3860                         iter.skip       = 0;
3861                         iter.count      = 0;
3862                         iter.err        = 0;
3863                         iter.fn         = nf_tables_loop_check_setelem;
3864 
3865                         set->ops->walk(ctx, set, &iter);
3866                         if (iter.err < 0)
3867                                 return iter.err;
3868                 }
3869         }
3870 
3871         return 0;
3872 }
3873 
3874 /**
3875  *      nft_validate_input_register - validate an expressions' input register
3876  *
3877  *      @reg: the register number
3878  *
3879  *      Validate that the input register is one of the general purpose
3880  *      registers.
3881  */
3882 int nft_validate_input_register(enum nft_registers reg)
3883 {
3884         if (reg <= NFT_REG_VERDICT)
3885                 return -EINVAL;
3886         if (reg > NFT_REG_MAX)
3887                 return -ERANGE;
3888         return 0;
3889 }
3890 EXPORT_SYMBOL_GPL(nft_validate_input_register);
3891 
3892 /**
3893  *      nft_validate_output_register - validate an expressions' output register
3894  *
3895  *      @reg: the register number
3896  *
3897  *      Validate that the output register is one of the general purpose
3898  *      registers or the verdict register.
3899  */
3900 int nft_validate_output_register(enum nft_registers reg)
3901 {
3902         if (reg < NFT_REG_VERDICT)
3903                 return -EINVAL;
3904         if (reg > NFT_REG_MAX)
3905                 return -ERANGE;
3906         return 0;
3907 }
3908 EXPORT_SYMBOL_GPL(nft_validate_output_register);
3909 
3910 /**
3911  *      nft_validate_data_load - validate an expressions' data load
3912  *
3913  *      @ctx: context of the expression performing the load
3914  *      @reg: the destination register number
3915  *      @data: the data to load
3916  *      @type: the data type
3917  *
3918  *      Validate that a data load uses the appropriate data type for
3919  *      the destination register. A value of NULL for the data means
3920  *      that its runtime gathered data, which is always of type
3921  *      NFT_DATA_VALUE.
3922  */
3923 int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
3924                            const struct nft_data *data,
3925                            enum nft_data_types type)
3926 {
3927         int err;
3928 
3929         switch (reg) {
3930         case NFT_REG_VERDICT:
3931                 if (data == NULL || type != NFT_DATA_VERDICT)
3932                         return -EINVAL;
3933 
3934                 if (data->verdict == NFT_GOTO || data->verdict == NFT_JUMP) {
3935                         err = nf_tables_check_loops(ctx, data->chain);
3936                         if (err < 0)
3937                                 return err;
3938 
3939                         if (ctx->chain->level + 1 > data->chain->level) {
3940                                 if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
3941                                         return -EMLINK;
3942                                 data->chain->level = ctx->chain->level + 1;
3943                         }
3944                 }
3945 
3946                 return 0;
3947         default:
3948                 if (data != NULL && type != NFT_DATA_VALUE)
3949                         return -EINVAL;
3950                 return 0;
3951         }
3952 }
3953 EXPORT_SYMBOL_GPL(nft_validate_data_load);
3954 
3955 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
3956         [NFTA_VERDICT_CODE]     = { .type = NLA_U32 },
3957         [NFTA_VERDICT_CHAIN]    = { .type = NLA_STRING,
3958                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
3959 };
3960 
3961 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
3962                             struct nft_data_desc *desc, const struct nlattr *nla)
3963 {
3964         struct nlattr *tb[NFTA_VERDICT_MAX + 1];
3965         struct nft_chain *chain;
3966         int err;
3967 
3968         err = nla_parse_nested(tb, NFTA_VERDICT_MAX, nla, nft_verdict_policy);
3969         if (err < 0)
3970                 return err;
3971 
3972         if (!tb[NFTA_VERDICT_CODE])
3973                 return -EINVAL;
3974         data->verdict = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
3975 
3976         switch (data->verdict) {
3977         default:
3978                 switch (data->verdict & NF_VERDICT_MASK) {
3979                 case NF_ACCEPT:
3980                 case NF_DROP:
3981                 case NF_QUEUE:
3982                         break;
3983                 default:
3984                         return -EINVAL;
3985                 }
3986                 /* fall through */
3987         case NFT_CONTINUE:
3988         case NFT_BREAK:
3989         case NFT_RETURN:
3990                 desc->len = sizeof(data->verdict);
3991                 break;
3992         case NFT_JUMP:
3993         case NFT_GOTO:
3994                 if (!tb[NFTA_VERDICT_CHAIN])
3995                         return -EINVAL;
3996                 chain = nf_tables_chain_lookup(ctx->table,
3997                                                tb[NFTA_VERDICT_CHAIN]);
3998                 if (IS_ERR(chain))
3999                         return PTR_ERR(chain);
4000                 if (chain->flags & NFT_BASE_CHAIN)
4001                         return -EOPNOTSUPP;
4002 
4003                 chain->use++;
4004                 data->chain = chain;
4005                 desc->len = sizeof(data);
4006                 break;
4007         }
4008 
4009         desc->type = NFT_DATA_VERDICT;
4010         return 0;
4011 }
4012 
4013 static void nft_verdict_uninit(const struct nft_data *data)
4014 {
4015         switch (data->verdict) {
4016         case NFT_JUMP:
4017         case NFT_GOTO:
4018                 data->chain->use--;
4019                 break;
4020         }
4021 }
4022 
4023 static int nft_verdict_dump(struct sk_buff *skb, const struct nft_data *data)
4024 {
4025         struct nlattr *nest;
4026 
4027         nest = nla_nest_start(skb, NFTA_DATA_VERDICT);
4028         if (!nest)
4029                 goto nla_put_failure;
4030 
4031         if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(data->verdict)))
4032                 goto nla_put_failure;
4033 
4034         switch (data->verdict) {
4035         case NFT_JUMP:
4036         case NFT_GOTO:
4037                 if (nla_put_string(skb, NFTA_VERDICT_CHAIN, data->chain->name))
4038                         goto nla_put_failure;
4039         }
4040         nla_nest_end(skb, nest);
4041         return 0;
4042 
4043 nla_put_failure:
4044         return -1;
4045 }
4046 
4047 static int nft_value_init(const struct nft_ctx *ctx, struct nft_data *data,
4048                           struct nft_data_desc *desc, const struct nlattr *nla)
4049 {
4050         unsigned int len;
4051 
4052         len = nla_len(nla);
4053         if (len == 0)
4054                 return -EINVAL;
4055         if (len > sizeof(data->data))
4056                 return -EOVERFLOW;
4057 
4058         nla_memcpy(data->data, nla, sizeof(data->data));
4059         desc->type = NFT_DATA_VALUE;
4060         desc->len  = len;
4061         return 0;
4062 }
4063 
4064 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
4065                           unsigned int len)
4066 {
4067         return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
4068 }
4069 
4070 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
4071         [NFTA_DATA_VALUE]       = { .type = NLA_BINARY,
4072                                     .len  = FIELD_SIZEOF(struct nft_data, data) },
4073         [NFTA_DATA_VERDICT]     = { .type = NLA_NESTED },
4074 };
4075 
4076 /**
4077  *      nft_data_init - parse nf_tables data netlink attributes
4078  *
4079  *      @ctx: context of the expression using the data
4080  *      @data: destination struct nft_data
4081  *      @desc: data description
4082  *      @nla: netlink attribute containing data
4083  *
4084  *      Parse the netlink data attributes and initialize a struct nft_data.
4085  *      The type and length of data are returned in the data description.
4086  *
4087  *      The caller can indicate that it only wants to accept data of type
4088  *      NFT_DATA_VALUE by passing NULL for the ctx argument.
4089  */
4090 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,
4091                   struct nft_data_desc *desc, const struct nlattr *nla)
4092 {
4093         struct nlattr *tb[NFTA_DATA_MAX + 1];
4094         int err;
4095 
4096         err = nla_parse_nested(tb, NFTA_DATA_MAX, nla, nft_data_policy);
4097         if (err < 0)
4098                 return err;
4099 
4100         if (tb[NFTA_DATA_VALUE])
4101                 return nft_value_init(ctx, data, desc, tb[NFTA_DATA_VALUE]);
4102         if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
4103                 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
4104         return -EINVAL;
4105 }
4106 EXPORT_SYMBOL_GPL(nft_data_init);
4107 
4108 /**
4109  *      nft_data_uninit - release a nft_data item
4110  *
4111  *      @data: struct nft_data to release
4112  *      @type: type of data
4113  *
4114  *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4115  *      all others need to be released by calling this function.
4116  */
4117 void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
4118 {
4119         switch (type) {
4120         case NFT_DATA_VALUE:
4121                 return;
4122         case NFT_DATA_VERDICT:
4123                 return nft_verdict_uninit(data);
4124         default:
4125                 WARN_ON(1);
4126         }
4127 }
4128 EXPORT_SYMBOL_GPL(nft_data_uninit);
4129 
4130 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
4131                   enum nft_data_types type, unsigned int len)
4132 {
4133         struct nlattr *nest;
4134         int err;
4135 
4136         nest = nla_nest_start(skb, attr);
4137         if (nest == NULL)
4138                 return -1;
4139 
4140         switch (type) {
4141         case NFT_DATA_VALUE:
4142                 err = nft_value_dump(skb, data, len);
4143                 break;
4144         case NFT_DATA_VERDICT:
4145                 err = nft_verdict_dump(skb, data);
4146                 break;
4147         default:
4148                 err = -EINVAL;
4149                 WARN_ON(1);
4150         }
4151 
4152         nla_nest_end(skb, nest);
4153         return err;
4154 }
4155 EXPORT_SYMBOL_GPL(nft_data_dump);
4156 
4157 static int nf_tables_init_net(struct net *net)
4158 {
4159         INIT_LIST_HEAD(&net->nft.af_info);
4160         INIT_LIST_HEAD(&net->nft.commit_list);
4161         net->nft.base_seq = 1;
4162         return 0;
4163 }
4164 
4165 static struct pernet_operations nf_tables_net_ops = {
4166         .init   = nf_tables_init_net,
4167 };
4168 
4169 static int __init nf_tables_module_init(void)
4170 {
4171         int err;
4172 
4173         info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
4174                        GFP_KERNEL);
4175         if (info == NULL) {
4176                 err = -ENOMEM;
4177                 goto err1;
4178         }
4179 
4180         err = nf_tables_core_module_init();
4181         if (err < 0)
4182                 goto err2;
4183 
4184         err = nfnetlink_subsys_register(&nf_tables_subsys);
4185         if (err < 0)
4186                 goto err3;
4187 
4188         pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>\n");
4189         return register_pernet_subsys(&nf_tables_net_ops);
4190 err3:
4191         nf_tables_core_module_exit();
4192 err2:
4193         kfree(info);
4194 err1:
4195         return err;
4196 }
4197 
4198 static void __exit nf_tables_module_exit(void)
4199 {
4200         unregister_pernet_subsys(&nf_tables_net_ops);
4201         nfnetlink_subsys_unregister(&nf_tables_subsys);
4202         rcu_barrier();
4203         nf_tables_core_module_exit();
4204         kfree(info);
4205 }
4206 
4207 module_init(nf_tables_module_init);
4208 module_exit(nf_tables_module_exit);
4209 
4210 MODULE_LICENSE("GPL");
4211 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
4212 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);
4213 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp