root/net/netfilter/nf_tables_api.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. nft_validate_state_update
  2. nft_ctx_init
  3. nft_trans_alloc_gfp
  4. nft_trans_alloc
  5. nft_trans_destroy
  6. nft_set_trans_bind
  7. nf_tables_register_hook
  8. nf_tables_unregister_hook
  9. nft_trans_table_add
  10. nft_deltable
  11. nft_trans_chain_add
  12. nft_delchain
  13. nft_rule_expr_activate
  14. nft_rule_expr_deactivate
  15. nf_tables_delrule_deactivate
  16. nft_trans_rule_add
  17. nft_delrule
  18. nft_delrule_by_chain
  19. nft_trans_set_add
  20. nft_delset
  21. nft_trans_obj_add
  22. nft_delobj
  23. nft_trans_flowtable_add
  24. nft_delflowtable
  25. nft_table_lookup
  26. nft_table_lookup_byhandle
  27. nf_tables_alloc_handle
  28. __nft_chain_type_get
  29. __nf_tables_chain_type_lookup
  30. nft_request_module
  31. lockdep_nfnl_nft_mutex_not_held
  32. nf_tables_chain_type_lookup
  33. nf_tables_fill_table_info
  34. nf_tables_table_notify
  35. nf_tables_dump_tables
  36. nft_netlink_dump_start_rcu
  37. nf_tables_gettable
  38. nft_table_disable
  39. nf_tables_table_enable
  40. nf_tables_table_disable
  41. nf_tables_updtable
  42. nft_chain_hash
  43. nft_chain_hash_obj
  44. nft_chain_hash_cmp
  45. nft_objname_hash
  46. nft_objname_hash_obj
  47. nft_objname_hash_cmp
  48. nf_tables_newtable
  49. nft_flush_table
  50. nft_flush
  51. nf_tables_deltable
  52. nf_tables_table_destroy
  53. nft_register_chain_type
  54. nft_unregister_chain_type
  55. nft_chain_lookup_byhandle
  56. lockdep_commit_lock_is_held
  57. nft_chain_lookup
  58. nft_dump_stats
  59. nf_tables_fill_chain_info
  60. nf_tables_chain_notify
  61. nf_tables_dump_chains
  62. nf_tables_getchain
  63. nft_stats_alloc
  64. nft_chain_stats_replace
  65. nf_tables_chain_free_chain_rules
  66. nf_tables_chain_destroy
  67. nft_chain_parse_hook
  68. nft_chain_release_hook
  69. nf_tables_chain_alloc_rules
  70. nf_tables_addchain
  71. nf_tables_updchain
  72. nf_tables_newchain
  73. nf_tables_delchain
  74. nft_register_expr
  75. nft_unregister_expr
  76. __nft_expr_type_get
  77. nft_expr_type_request_module
  78. nft_expr_type_get
  79. nf_tables_fill_expr_info
  80. nft_expr_dump
  81. nf_tables_expr_parse
  82. nf_tables_newexpr
  83. nf_tables_expr_destroy
  84. nft_expr_init
  85. nft_expr_destroy
  86. __nft_rule_lookup
  87. nft_rule_lookup
  88. nf_tables_fill_rule_info
  89. nf_tables_rule_notify
  90. __nf_tables_dump_rules
  91. nf_tables_dump_rules
  92. nf_tables_dump_rules_start
  93. nf_tables_dump_rules_done
  94. nf_tables_getrule
  95. nf_tables_rule_destroy
  96. nf_tables_rule_release
  97. nft_chain_validate
  98. nft_table_validate
  99. nf_tables_newrule
  100. nft_rule_lookup_byid
  101. nf_tables_delrule
  102. nft_register_set
  103. nft_unregister_set
  104. nft_set_ops_candidate
  105. nft_select_set_ops
  106. nft_ctx_init_from_setattr
  107. nft_set_lookup
  108. nft_set_lookup_byhandle
  109. nft_set_lookup_byid
  110. nft_set_lookup_global
  111. nf_tables_set_alloc_name
  112. nf_msecs_to_jiffies64
  113. nf_jiffies64_to_msecs
  114. nf_tables_fill_set
  115. nf_tables_set_notify
  116. nf_tables_dump_sets
  117. nf_tables_dump_sets_start
  118. nf_tables_dump_sets_done
  119. nf_tables_getset
  120. nf_tables_set_desc_parse
  121. nf_tables_newset
  122. nft_set_destroy
  123. nf_tables_delset
  124. nf_tables_bind_check_setelem
  125. nf_tables_bind_set
  126. nf_tables_unbind_set
  127. nf_tables_deactivate_set
  128. nf_tables_destroy_set
  129. nft_ctx_init_from_elemattr
  130. nf_tables_fill_setelem
  131. nf_tables_dump_setelem
  132. nf_tables_dump_set
  133. nf_tables_dump_set_start
  134. nf_tables_dump_set_done
  135. nf_tables_fill_setelem_info
  136. nft_setelem_parse_flags
  137. nft_get_set_elem
  138. nf_tables_getsetelem
  139. nf_tables_setelem_notify
  140. nft_trans_elem_alloc
  141. nft_set_elem_init
  142. nft_set_elem_destroy
  143. nf_tables_set_elem_destroy
  144. nft_add_set_elem
  145. nf_tables_newsetelem
  146. nft_data_hold
  147. nft_set_elem_activate
  148. nft_set_elem_deactivate
  149. nft_del_setelem
  150. nft_flush_set
  151. nf_tables_delsetelem
  152. nft_set_gc_batch_release
  153. nft_set_gc_batch_alloc
  154. nft_register_obj
  155. nft_unregister_obj
  156. nft_obj_lookup
  157. nft_obj_lookup_byhandle
  158. nft_obj_init
  159. nft_object_dump
  160. __nft_obj_type_get
  161. nft_obj_type_get
  162. nf_tables_updobj
  163. nf_tables_newobj
  164. nf_tables_fill_obj_info
  165. nf_tables_dump_obj
  166. nf_tables_dump_obj_start
  167. nf_tables_dump_obj_done
  168. nf_tables_getobj
  169. nft_obj_destroy
  170. nf_tables_delobj
  171. nft_obj_notify
  172. nf_tables_obj_notify
  173. nft_register_flowtable_type
  174. nft_unregister_flowtable_type
  175. nft_flowtable_lookup
  176. nf_tables_deactivate_flowtable
  177. nft_flowtable_lookup_byhandle
  178. nf_tables_parse_devices
  179. nf_tables_flowtable_parse_hook
  180. __nft_flowtable_type_get
  181. nft_flowtable_type_get
  182. nft_unregister_flowtable_net_hooks
  183. nf_tables_newflowtable
  184. nf_tables_delflowtable
  185. nf_tables_fill_flowtable_info
  186. nf_tables_dump_flowtable
  187. nf_tables_dump_flowtable_start
  188. nf_tables_dump_flowtable_done
  189. nf_tables_getflowtable
  190. nf_tables_flowtable_notify
  191. nf_tables_flowtable_destroy
  192. nf_tables_fill_gen_info
  193. nft_flowtable_event
  194. nf_tables_flowtable_event
  195. nf_tables_gen_notify
  196. nf_tables_getgen
  197. nf_tables_validate
  198. nft_chain_commit_drop_policy
  199. nft_chain_commit_update
  200. nft_obj_commit_update
  201. nft_commit_release
  202. nf_tables_trans_destroy_work
  203. nf_tables_commit_chain_prepare
  204. nf_tables_commit_chain_prepare_cancel
  205. __nf_tables_commit_chain_free_rules_old
  206. nf_tables_commit_chain_free_rules_old
  207. nf_tables_commit_chain
  208. nft_obj_del
  209. nft_chain_del
  210. nf_tables_module_autoload_cleanup
  211. nf_tables_commit_release
  212. nf_tables_commit
  213. nf_tables_module_autoload
  214. nf_tables_abort_release
  215. __nf_tables_abort
  216. nf_tables_cleanup
  217. nf_tables_abort
  218. nf_tables_valid_genid
  219. nft_chain_validate_dependency
  220. nft_chain_validate_hooks
  221. nf_tables_loop_check_setelem
  222. nf_tables_check_loops
  223. nft_parse_u32_check
  224. nft_parse_register
  225. nft_dump_register
  226. nft_validate_register_load
  227. nft_validate_register_store
  228. nft_verdict_init
  229. nft_verdict_uninit
  230. nft_verdict_dump
  231. nft_value_init
  232. nft_value_dump
  233. nft_data_init
  234. nft_data_release
  235. nft_data_dump
  236. __nft_release_basechain
  237. __nft_release_tables
  238. nf_tables_init_net
  239. nf_tables_exit_net
  240. nf_tables_module_init
  241. nf_tables_module_exit

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2007-2009 Patrick McHardy <kaber@trash.net>
   4  *
   5  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   6  */
   7 
   8 #include <linux/module.h>
   9 #include <linux/init.h>
  10 #include <linux/list.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/netlink.h>
  13 #include <linux/vmalloc.h>
  14 #include <linux/rhashtable.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nfnetlink.h>
  17 #include <linux/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_flow_table.h>
  19 #include <net/netfilter/nf_tables_core.h>
  20 #include <net/netfilter/nf_tables.h>
  21 #include <net/netfilter/nf_tables_offload.h>
  22 #include <net/net_namespace.h>
  23 #include <net/sock.h>
  24 
  25 #define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
  26 
  27 static LIST_HEAD(nf_tables_expressions);
  28 static LIST_HEAD(nf_tables_objects);
  29 static LIST_HEAD(nf_tables_flowtables);
  30 static LIST_HEAD(nf_tables_destroy_list);
  31 static DEFINE_SPINLOCK(nf_tables_destroy_list_lock);
  32 static u64 table_handle;
  33 
  34 enum {
  35         NFT_VALIDATE_SKIP       = 0,
  36         NFT_VALIDATE_NEED,
  37         NFT_VALIDATE_DO,
  38 };
  39 
  40 static struct rhltable nft_objname_ht;
  41 
  42 static u32 nft_chain_hash(const void *data, u32 len, u32 seed);
  43 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed);
  44 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *, const void *);
  45 
  46 static u32 nft_objname_hash(const void *data, u32 len, u32 seed);
  47 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed);
  48 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *, const void *);
  49 
  50 static const struct rhashtable_params nft_chain_ht_params = {
  51         .head_offset            = offsetof(struct nft_chain, rhlhead),
  52         .key_offset             = offsetof(struct nft_chain, name),
  53         .hashfn                 = nft_chain_hash,
  54         .obj_hashfn             = nft_chain_hash_obj,
  55         .obj_cmpfn              = nft_chain_hash_cmp,
  56         .automatic_shrinking    = true,
  57 };
  58 
  59 static const struct rhashtable_params nft_objname_ht_params = {
  60         .head_offset            = offsetof(struct nft_object, rhlhead),
  61         .key_offset             = offsetof(struct nft_object, key),
  62         .hashfn                 = nft_objname_hash,
  63         .obj_hashfn             = nft_objname_hash_obj,
  64         .obj_cmpfn              = nft_objname_hash_cmp,
  65         .automatic_shrinking    = true,
  66 };
  67 
  68 static void nft_validate_state_update(struct net *net, u8 new_validate_state)
  69 {
  70         switch (net->nft.validate_state) {
  71         case NFT_VALIDATE_SKIP:
  72                 WARN_ON_ONCE(new_validate_state == NFT_VALIDATE_DO);
  73                 break;
  74         case NFT_VALIDATE_NEED:
  75                 break;
  76         case NFT_VALIDATE_DO:
  77                 if (new_validate_state == NFT_VALIDATE_NEED)
  78                         return;
  79         }
  80 
  81         net->nft.validate_state = new_validate_state;
  82 }
  83 static void nf_tables_trans_destroy_work(struct work_struct *w);
  84 static DECLARE_WORK(trans_destroy_work, nf_tables_trans_destroy_work);
  85 
  86 static void nft_ctx_init(struct nft_ctx *ctx,
  87                          struct net *net,
  88                          const struct sk_buff *skb,
  89                          const struct nlmsghdr *nlh,
  90                          u8 family,
  91                          struct nft_table *table,
  92                          struct nft_chain *chain,
  93                          const struct nlattr * const *nla)
  94 {
  95         ctx->net        = net;
  96         ctx->family     = family;
  97         ctx->level      = 0;
  98         ctx->table      = table;
  99         ctx->chain      = chain;
 100         ctx->nla        = nla;
 101         ctx->portid     = NETLINK_CB(skb).portid;
 102         ctx->report     = nlmsg_report(nlh);
 103         ctx->flags      = nlh->nlmsg_flags;
 104         ctx->seq        = nlh->nlmsg_seq;
 105 }
 106 
 107 static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
 108                                              int msg_type, u32 size, gfp_t gfp)
 109 {
 110         struct nft_trans *trans;
 111 
 112         trans = kzalloc(sizeof(struct nft_trans) + size, gfp);
 113         if (trans == NULL)
 114                 return NULL;
 115 
 116         trans->msg_type = msg_type;
 117         trans->ctx      = *ctx;
 118 
 119         return trans;
 120 }
 121 
 122 static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
 123                                          int msg_type, u32 size)
 124 {
 125         return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
 126 }
 127 
 128 static void nft_trans_destroy(struct nft_trans *trans)
 129 {
 130         list_del(&trans->list);
 131         kfree(trans);
 132 }
 133 
 134 static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
 135 {
 136         struct net *net = ctx->net;
 137         struct nft_trans *trans;
 138 
 139         if (!nft_set_is_anonymous(set))
 140                 return;
 141 
 142         list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
 143                 switch (trans->msg_type) {
 144                 case NFT_MSG_NEWSET:
 145                         if (nft_trans_set(trans) == set)
 146                                 nft_trans_set_bound(trans) = true;
 147                         break;
 148                 case NFT_MSG_NEWSETELEM:
 149                         if (nft_trans_elem_set(trans) == set)
 150                                 nft_trans_elem_set_bound(trans) = true;
 151                         break;
 152                 }
 153         }
 154 }
 155 
 156 static int nf_tables_register_hook(struct net *net,
 157                                    const struct nft_table *table,
 158                                    struct nft_chain *chain)
 159 {
 160         const struct nft_base_chain *basechain;
 161         const struct nf_hook_ops *ops;
 162 
 163         if (table->flags & NFT_TABLE_F_DORMANT ||
 164             !nft_is_base_chain(chain))
 165                 return 0;
 166 
 167         basechain = nft_base_chain(chain);
 168         ops = &basechain->ops;
 169 
 170         if (basechain->type->ops_register)
 171                 return basechain->type->ops_register(net, ops);
 172 
 173         return nf_register_net_hook(net, ops);
 174 }
 175 
 176 static void nf_tables_unregister_hook(struct net *net,
 177                                       const struct nft_table *table,
 178                                       struct nft_chain *chain)
 179 {
 180         const struct nft_base_chain *basechain;
 181         const struct nf_hook_ops *ops;
 182 
 183         if (table->flags & NFT_TABLE_F_DORMANT ||
 184             !nft_is_base_chain(chain))
 185                 return;
 186         basechain = nft_base_chain(chain);
 187         ops = &basechain->ops;
 188 
 189         if (basechain->type->ops_unregister)
 190                 return basechain->type->ops_unregister(net, ops);
 191 
 192         nf_unregister_net_hook(net, ops);
 193 }
 194 
 195 static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
 196 {
 197         struct nft_trans *trans;
 198 
 199         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_table));
 200         if (trans == NULL)
 201                 return -ENOMEM;
 202 
 203         if (msg_type == NFT_MSG_NEWTABLE)
 204                 nft_activate_next(ctx->net, ctx->table);
 205 
 206         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 207         return 0;
 208 }
 209 
 210 static int nft_deltable(struct nft_ctx *ctx)
 211 {
 212         int err;
 213 
 214         err = nft_trans_table_add(ctx, NFT_MSG_DELTABLE);
 215         if (err < 0)
 216                 return err;
 217 
 218         nft_deactivate_next(ctx->net, ctx->table);
 219         return err;
 220 }
 221 
 222 static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type)
 223 {
 224         struct nft_trans *trans;
 225 
 226         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_chain));
 227         if (trans == NULL)
 228                 return ERR_PTR(-ENOMEM);
 229 
 230         if (msg_type == NFT_MSG_NEWCHAIN)
 231                 nft_activate_next(ctx->net, ctx->chain);
 232 
 233         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 234         return trans;
 235 }
 236 
 237 static int nft_delchain(struct nft_ctx *ctx)
 238 {
 239         struct nft_trans *trans;
 240 
 241         trans = nft_trans_chain_add(ctx, NFT_MSG_DELCHAIN);
 242         if (IS_ERR(trans))
 243                 return PTR_ERR(trans);
 244 
 245         ctx->table->use--;
 246         nft_deactivate_next(ctx->net, ctx->chain);
 247 
 248         return 0;
 249 }
 250 
 251 static void nft_rule_expr_activate(const struct nft_ctx *ctx,
 252                                    struct nft_rule *rule)
 253 {
 254         struct nft_expr *expr;
 255 
 256         expr = nft_expr_first(rule);
 257         while (expr != nft_expr_last(rule) && expr->ops) {
 258                 if (expr->ops->activate)
 259                         expr->ops->activate(ctx, expr);
 260 
 261                 expr = nft_expr_next(expr);
 262         }
 263 }
 264 
 265 static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,
 266                                      struct nft_rule *rule,
 267                                      enum nft_trans_phase phase)
 268 {
 269         struct nft_expr *expr;
 270 
 271         expr = nft_expr_first(rule);
 272         while (expr != nft_expr_last(rule) && expr->ops) {
 273                 if (expr->ops->deactivate)
 274                         expr->ops->deactivate(ctx, expr, phase);
 275 
 276                 expr = nft_expr_next(expr);
 277         }
 278 }
 279 
 280 static int
 281 nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule)
 282 {
 283         /* You cannot delete the same rule twice */
 284         if (nft_is_active_next(ctx->net, rule)) {
 285                 nft_deactivate_next(ctx->net, rule);
 286                 ctx->chain->use--;
 287                 return 0;
 288         }
 289         return -ENOENT;
 290 }
 291 
 292 static struct nft_trans *nft_trans_rule_add(struct nft_ctx *ctx, int msg_type,
 293                                             struct nft_rule *rule)
 294 {
 295         struct nft_trans *trans;
 296 
 297         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_rule));
 298         if (trans == NULL)
 299                 return NULL;
 300 
 301         if (msg_type == NFT_MSG_NEWRULE && ctx->nla[NFTA_RULE_ID] != NULL) {
 302                 nft_trans_rule_id(trans) =
 303                         ntohl(nla_get_be32(ctx->nla[NFTA_RULE_ID]));
 304         }
 305         nft_trans_rule(trans) = rule;
 306         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 307 
 308         return trans;
 309 }
 310 
 311 static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule)
 312 {
 313         struct nft_trans *trans;
 314         int err;
 315 
 316         trans = nft_trans_rule_add(ctx, NFT_MSG_DELRULE, rule);
 317         if (trans == NULL)
 318                 return -ENOMEM;
 319 
 320         err = nf_tables_delrule_deactivate(ctx, rule);
 321         if (err < 0) {
 322                 nft_trans_destroy(trans);
 323                 return err;
 324         }
 325         nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_PREPARE);
 326 
 327         return 0;
 328 }
 329 
 330 static int nft_delrule_by_chain(struct nft_ctx *ctx)
 331 {
 332         struct nft_rule *rule;
 333         int err;
 334 
 335         list_for_each_entry(rule, &ctx->chain->rules, list) {
 336                 if (!nft_is_active_next(ctx->net, rule))
 337                         continue;
 338 
 339                 err = nft_delrule(ctx, rule);
 340                 if (err < 0)
 341                         return err;
 342         }
 343         return 0;
 344 }
 345 
 346 static int nft_trans_set_add(const struct nft_ctx *ctx, int msg_type,
 347                              struct nft_set *set)
 348 {
 349         struct nft_trans *trans;
 350 
 351         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_set));
 352         if (trans == NULL)
 353                 return -ENOMEM;
 354 
 355         if (msg_type == NFT_MSG_NEWSET && ctx->nla[NFTA_SET_ID] != NULL) {
 356                 nft_trans_set_id(trans) =
 357                         ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
 358                 nft_activate_next(ctx->net, set);
 359         }
 360         nft_trans_set(trans) = set;
 361         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 362 
 363         return 0;
 364 }
 365 
 366 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
 367 {
 368         int err;
 369 
 370         err = nft_trans_set_add(ctx, NFT_MSG_DELSET, set);
 371         if (err < 0)
 372                 return err;
 373 
 374         nft_deactivate_next(ctx->net, set);
 375         ctx->table->use--;
 376 
 377         return err;
 378 }
 379 
 380 static int nft_trans_obj_add(struct nft_ctx *ctx, int msg_type,
 381                              struct nft_object *obj)
 382 {
 383         struct nft_trans *trans;
 384 
 385         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_obj));
 386         if (trans == NULL)
 387                 return -ENOMEM;
 388 
 389         if (msg_type == NFT_MSG_NEWOBJ)
 390                 nft_activate_next(ctx->net, obj);
 391 
 392         nft_trans_obj(trans) = obj;
 393         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 394 
 395         return 0;
 396 }
 397 
 398 static int nft_delobj(struct nft_ctx *ctx, struct nft_object *obj)
 399 {
 400         int err;
 401 
 402         err = nft_trans_obj_add(ctx, NFT_MSG_DELOBJ, obj);
 403         if (err < 0)
 404                 return err;
 405 
 406         nft_deactivate_next(ctx->net, obj);
 407         ctx->table->use--;
 408 
 409         return err;
 410 }
 411 
 412 static int nft_trans_flowtable_add(struct nft_ctx *ctx, int msg_type,
 413                                    struct nft_flowtable *flowtable)
 414 {
 415         struct nft_trans *trans;
 416 
 417         trans = nft_trans_alloc(ctx, msg_type,
 418                                 sizeof(struct nft_trans_flowtable));
 419         if (trans == NULL)
 420                 return -ENOMEM;
 421 
 422         if (msg_type == NFT_MSG_NEWFLOWTABLE)
 423                 nft_activate_next(ctx->net, flowtable);
 424 
 425         nft_trans_flowtable(trans) = flowtable;
 426         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 427 
 428         return 0;
 429 }
 430 
 431 static int nft_delflowtable(struct nft_ctx *ctx,
 432                             struct nft_flowtable *flowtable)
 433 {
 434         int err;
 435 
 436         err = nft_trans_flowtable_add(ctx, NFT_MSG_DELFLOWTABLE, flowtable);
 437         if (err < 0)
 438                 return err;
 439 
 440         nft_deactivate_next(ctx->net, flowtable);
 441         ctx->table->use--;
 442 
 443         return err;
 444 }
 445 
 446 /*
 447  * Tables
 448  */
 449 
 450 static struct nft_table *nft_table_lookup(const struct net *net,
 451                                           const struct nlattr *nla,
 452                                           u8 family, u8 genmask)
 453 {
 454         struct nft_table *table;
 455 
 456         if (nla == NULL)
 457                 return ERR_PTR(-EINVAL);
 458 
 459         list_for_each_entry_rcu(table, &net->nft.tables, list) {
 460                 if (!nla_strcmp(nla, table->name) &&
 461                     table->family == family &&
 462                     nft_active_genmask(table, genmask))
 463                         return table;
 464         }
 465 
 466         return ERR_PTR(-ENOENT);
 467 }
 468 
 469 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
 470                                                    const struct nlattr *nla,
 471                                                    u8 genmask)
 472 {
 473         struct nft_table *table;
 474 
 475         list_for_each_entry(table, &net->nft.tables, list) {
 476                 if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
 477                     nft_active_genmask(table, genmask))
 478                         return table;
 479         }
 480 
 481         return ERR_PTR(-ENOENT);
 482 }
 483 
 484 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
 485 {
 486         return ++table->hgenerator;
 487 }
 488 
 489 static const struct nft_chain_type *chain_type[NFPROTO_NUMPROTO][NFT_CHAIN_T_MAX];
 490 
 491 static const struct nft_chain_type *
 492 __nft_chain_type_get(u8 family, enum nft_chain_types type)
 493 {
 494         if (family >= NFPROTO_NUMPROTO ||
 495             type >= NFT_CHAIN_T_MAX)
 496                 return NULL;
 497 
 498         return chain_type[family][type];
 499 }
 500 
 501 static const struct nft_chain_type *
 502 __nf_tables_chain_type_lookup(const struct nlattr *nla, u8 family)
 503 {
 504         const struct nft_chain_type *type;
 505         int i;
 506 
 507         for (i = 0; i < NFT_CHAIN_T_MAX; i++) {
 508                 type = __nft_chain_type_get(family, i);
 509                 if (!type)
 510                         continue;
 511                 if (!nla_strcmp(nla, type->name))
 512                         return type;
 513         }
 514         return NULL;
 515 }
 516 
 517 struct nft_module_request {
 518         struct list_head        list;
 519         char                    module[MODULE_NAME_LEN];
 520         bool                    done;
 521 };
 522 
 523 #ifdef CONFIG_MODULES
 524 static int nft_request_module(struct net *net, const char *fmt, ...)
 525 {
 526         char module_name[MODULE_NAME_LEN];
 527         struct nft_module_request *req;
 528         va_list args;
 529         int ret;
 530 
 531         va_start(args, fmt);
 532         ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
 533         va_end(args);
 534         if (ret >= MODULE_NAME_LEN)
 535                 return 0;
 536 
 537         list_for_each_entry(req, &net->nft.module_list, list) {
 538                 if (!strcmp(req->module, module_name)) {
 539                         if (req->done)
 540                                 return 0;
 541 
 542                         /* A request to load this module already exists. */
 543                         return -EAGAIN;
 544                 }
 545         }
 546 
 547         req = kmalloc(sizeof(*req), GFP_KERNEL);
 548         if (!req)
 549                 return -ENOMEM;
 550 
 551         req->done = false;
 552         strlcpy(req->module, module_name, MODULE_NAME_LEN);
 553         list_add_tail(&req->list, &net->nft.module_list);
 554 
 555         return -EAGAIN;
 556 }
 557 #endif
 558 
 559 static void lockdep_nfnl_nft_mutex_not_held(void)
 560 {
 561 #ifdef CONFIG_PROVE_LOCKING
 562         WARN_ON_ONCE(lockdep_nfnl_is_held(NFNL_SUBSYS_NFTABLES));
 563 #endif
 564 }
 565 
 566 static const struct nft_chain_type *
 567 nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
 568                             u8 family, bool autoload)
 569 {
 570         const struct nft_chain_type *type;
 571 
 572         type = __nf_tables_chain_type_lookup(nla, family);
 573         if (type != NULL)
 574                 return type;
 575 
 576         lockdep_nfnl_nft_mutex_not_held();
 577 #ifdef CONFIG_MODULES
 578         if (autoload) {
 579                 if (nft_request_module(net, "nft-chain-%u-%.*s", family,
 580                                        nla_len(nla),
 581                                        (const char *)nla_data(nla)) == -EAGAIN)
 582                         return ERR_PTR(-EAGAIN);
 583         }
 584 #endif
 585         return ERR_PTR(-ENOENT);
 586 }
 587 
 588 static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
 589         [NFTA_TABLE_NAME]       = { .type = NLA_STRING,
 590                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
 591         [NFTA_TABLE_FLAGS]      = { .type = NLA_U32 },
 592         [NFTA_TABLE_HANDLE]     = { .type = NLA_U64 },
 593 };
 594 
 595 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
 596                                      u32 portid, u32 seq, int event, u32 flags,
 597                                      int family, const struct nft_table *table)
 598 {
 599         struct nlmsghdr *nlh;
 600         struct nfgenmsg *nfmsg;
 601 
 602         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
 603         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
 604         if (nlh == NULL)
 605                 goto nla_put_failure;
 606 
 607         nfmsg = nlmsg_data(nlh);
 608         nfmsg->nfgen_family     = family;
 609         nfmsg->version          = NFNETLINK_V0;
 610         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
 611 
 612         if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
 613             nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
 614             nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
 615             nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
 616                          NFTA_TABLE_PAD))
 617                 goto nla_put_failure;
 618 
 619         nlmsg_end(skb, nlh);
 620         return 0;
 621 
 622 nla_put_failure:
 623         nlmsg_trim(skb, nlh);
 624         return -1;
 625 }
 626 
 627 static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
 628 {
 629         struct sk_buff *skb;
 630         int err;
 631 
 632         if (!ctx->report &&
 633             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
 634                 return;
 635 
 636         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 637         if (skb == NULL)
 638                 goto err;
 639 
 640         err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq,
 641                                         event, 0, ctx->family, ctx->table);
 642         if (err < 0) {
 643                 kfree_skb(skb);
 644                 goto err;
 645         }
 646 
 647         nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
 648                        ctx->report, GFP_KERNEL);
 649         return;
 650 err:
 651         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
 652 }
 653 
 654 static int nf_tables_dump_tables(struct sk_buff *skb,
 655                                  struct netlink_callback *cb)
 656 {
 657         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 658         const struct nft_table *table;
 659         unsigned int idx = 0, s_idx = cb->args[0];
 660         struct net *net = sock_net(skb->sk);
 661         int family = nfmsg->nfgen_family;
 662 
 663         rcu_read_lock();
 664         cb->seq = net->nft.base_seq;
 665 
 666         list_for_each_entry_rcu(table, &net->nft.tables, list) {
 667                 if (family != NFPROTO_UNSPEC && family != table->family)
 668                         continue;
 669 
 670                 if (idx < s_idx)
 671                         goto cont;
 672                 if (idx > s_idx)
 673                         memset(&cb->args[1], 0,
 674                                sizeof(cb->args) - sizeof(cb->args[0]));
 675                 if (!nft_is_active(net, table))
 676                         continue;
 677                 if (nf_tables_fill_table_info(skb, net,
 678                                               NETLINK_CB(cb->skb).portid,
 679                                               cb->nlh->nlmsg_seq,
 680                                               NFT_MSG_NEWTABLE, NLM_F_MULTI,
 681                                               table->family, table) < 0)
 682                         goto done;
 683 
 684                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 685 cont:
 686                 idx++;
 687         }
 688 done:
 689         rcu_read_unlock();
 690         cb->args[0] = idx;
 691         return skb->len;
 692 }
 693 
 694 static int nft_netlink_dump_start_rcu(struct sock *nlsk, struct sk_buff *skb,
 695                                       const struct nlmsghdr *nlh,
 696                                       struct netlink_dump_control *c)
 697 {
 698         int err;
 699 
 700         if (!try_module_get(THIS_MODULE))
 701                 return -EINVAL;
 702 
 703         rcu_read_unlock();
 704         err = netlink_dump_start(nlsk, skb, nlh, c);
 705         rcu_read_lock();
 706         module_put(THIS_MODULE);
 707 
 708         return err;
 709 }
 710 
 711 /* called with rcu_read_lock held */
 712 static int nf_tables_gettable(struct net *net, struct sock *nlsk,
 713                               struct sk_buff *skb, const struct nlmsghdr *nlh,
 714                               const struct nlattr * const nla[],
 715                               struct netlink_ext_ack *extack)
 716 {
 717         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 718         u8 genmask = nft_genmask_cur(net);
 719         const struct nft_table *table;
 720         struct sk_buff *skb2;
 721         int family = nfmsg->nfgen_family;
 722         int err;
 723 
 724         if (nlh->nlmsg_flags & NLM_F_DUMP) {
 725                 struct netlink_dump_control c = {
 726                         .dump = nf_tables_dump_tables,
 727                         .module = THIS_MODULE,
 728                 };
 729 
 730                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
 731         }
 732 
 733         table = nft_table_lookup(net, nla[NFTA_TABLE_NAME], family, genmask);
 734         if (IS_ERR(table)) {
 735                 NL_SET_BAD_ATTR(extack, nla[NFTA_TABLE_NAME]);
 736                 return PTR_ERR(table);
 737         }
 738 
 739         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
 740         if (!skb2)
 741                 return -ENOMEM;
 742 
 743         err = nf_tables_fill_table_info(skb2, net, NETLINK_CB(skb).portid,
 744                                         nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0,
 745                                         family, table);
 746         if (err < 0)
 747                 goto err;
 748 
 749         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
 750 
 751 err:
 752         kfree_skb(skb2);
 753         return err;
 754 }
 755 
 756 static void nft_table_disable(struct net *net, struct nft_table *table, u32 cnt)
 757 {
 758         struct nft_chain *chain;
 759         u32 i = 0;
 760 
 761         list_for_each_entry(chain, &table->chains, list) {
 762                 if (!nft_is_active_next(net, chain))
 763                         continue;
 764                 if (!nft_is_base_chain(chain))
 765                         continue;
 766 
 767                 if (cnt && i++ == cnt)
 768                         break;
 769 
 770                 nf_unregister_net_hook(net, &nft_base_chain(chain)->ops);
 771         }
 772 }
 773 
 774 static int nf_tables_table_enable(struct net *net, struct nft_table *table)
 775 {
 776         struct nft_chain *chain;
 777         int err, i = 0;
 778 
 779         list_for_each_entry(chain, &table->chains, list) {
 780                 if (!nft_is_active_next(net, chain))
 781                         continue;
 782                 if (!nft_is_base_chain(chain))
 783                         continue;
 784 
 785                 err = nf_register_net_hook(net, &nft_base_chain(chain)->ops);
 786                 if (err < 0)
 787                         goto err;
 788 
 789                 i++;
 790         }
 791         return 0;
 792 err:
 793         if (i)
 794                 nft_table_disable(net, table, i);
 795         return err;
 796 }
 797 
 798 static void nf_tables_table_disable(struct net *net, struct nft_table *table)
 799 {
 800         nft_table_disable(net, table, 0);
 801 }
 802 
 803 static int nf_tables_updtable(struct nft_ctx *ctx)
 804 {
 805         struct nft_trans *trans;
 806         u32 flags;
 807         int ret = 0;
 808 
 809         if (!ctx->nla[NFTA_TABLE_FLAGS])
 810                 return 0;
 811 
 812         flags = ntohl(nla_get_be32(ctx->nla[NFTA_TABLE_FLAGS]));
 813         if (flags & ~NFT_TABLE_F_DORMANT)
 814                 return -EINVAL;
 815 
 816         if (flags == ctx->table->flags)
 817                 return 0;
 818 
 819         trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,
 820                                 sizeof(struct nft_trans_table));
 821         if (trans == NULL)
 822                 return -ENOMEM;
 823 
 824         if ((flags & NFT_TABLE_F_DORMANT) &&
 825             !(ctx->table->flags & NFT_TABLE_F_DORMANT)) {
 826                 nft_trans_table_enable(trans) = false;
 827         } else if (!(flags & NFT_TABLE_F_DORMANT) &&
 828                    ctx->table->flags & NFT_TABLE_F_DORMANT) {
 829                 ret = nf_tables_table_enable(ctx->net, ctx->table);
 830                 if (ret >= 0) {
 831                         ctx->table->flags &= ~NFT_TABLE_F_DORMANT;
 832                         nft_trans_table_enable(trans) = true;
 833                 }
 834         }
 835         if (ret < 0)
 836                 goto err;
 837 
 838         nft_trans_table_update(trans) = true;
 839         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 840         return 0;
 841 err:
 842         nft_trans_destroy(trans);
 843         return ret;
 844 }
 845 
 846 static u32 nft_chain_hash(const void *data, u32 len, u32 seed)
 847 {
 848         const char *name = data;
 849 
 850         return jhash(name, strlen(name), seed);
 851 }
 852 
 853 static u32 nft_chain_hash_obj(const void *data, u32 len, u32 seed)
 854 {
 855         const struct nft_chain *chain = data;
 856 
 857         return nft_chain_hash(chain->name, 0, seed);
 858 }
 859 
 860 static int nft_chain_hash_cmp(struct rhashtable_compare_arg *arg,
 861                               const void *ptr)
 862 {
 863         const struct nft_chain *chain = ptr;
 864         const char *name = arg->key;
 865 
 866         return strcmp(chain->name, name);
 867 }
 868 
 869 static u32 nft_objname_hash(const void *data, u32 len, u32 seed)
 870 {
 871         const struct nft_object_hash_key *k = data;
 872 
 873         seed ^= hash_ptr(k->table, 32);
 874 
 875         return jhash(k->name, strlen(k->name), seed);
 876 }
 877 
 878 static u32 nft_objname_hash_obj(const void *data, u32 len, u32 seed)
 879 {
 880         const struct nft_object *obj = data;
 881 
 882         return nft_objname_hash(&obj->key, 0, seed);
 883 }
 884 
 885 static int nft_objname_hash_cmp(struct rhashtable_compare_arg *arg,
 886                                 const void *ptr)
 887 {
 888         const struct nft_object_hash_key *k = arg->key;
 889         const struct nft_object *obj = ptr;
 890 
 891         if (obj->key.table != k->table)
 892                 return -1;
 893 
 894         return strcmp(obj->key.name, k->name);
 895 }
 896 
 897 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 898                               struct sk_buff *skb, const struct nlmsghdr *nlh,
 899                               const struct nlattr * const nla[],
 900                               struct netlink_ext_ack *extack)
 901 {
 902         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 903         u8 genmask = nft_genmask_next(net);
 904         int family = nfmsg->nfgen_family;
 905         const struct nlattr *attr;
 906         struct nft_table *table;
 907         u32 flags = 0;
 908         struct nft_ctx ctx;
 909         int err;
 910 
 911         lockdep_assert_held(&net->nft.commit_mutex);
 912         attr = nla[NFTA_TABLE_NAME];
 913         table = nft_table_lookup(net, attr, family, genmask);
 914         if (IS_ERR(table)) {
 915                 if (PTR_ERR(table) != -ENOENT)
 916                         return PTR_ERR(table);
 917         } else {
 918                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
 919                         NL_SET_BAD_ATTR(extack, attr);
 920                         return -EEXIST;
 921                 }
 922                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
 923                         return -EOPNOTSUPP;
 924 
 925                 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
 926                 return nf_tables_updtable(&ctx);
 927         }
 928 
 929         if (nla[NFTA_TABLE_FLAGS]) {
 930                 flags = ntohl(nla_get_be32(nla[NFTA_TABLE_FLAGS]));
 931                 if (flags & ~NFT_TABLE_F_DORMANT)
 932                         return -EINVAL;
 933         }
 934 
 935         err = -ENOMEM;
 936         table = kzalloc(sizeof(*table), GFP_KERNEL);
 937         if (table == NULL)
 938                 goto err_kzalloc;
 939 
 940         table->name = nla_strdup(attr, GFP_KERNEL);
 941         if (table->name == NULL)
 942                 goto err_strdup;
 943 
 944         err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);
 945         if (err)
 946                 goto err_chain_ht;
 947 
 948         INIT_LIST_HEAD(&table->chains);
 949         INIT_LIST_HEAD(&table->sets);
 950         INIT_LIST_HEAD(&table->objects);
 951         INIT_LIST_HEAD(&table->flowtables);
 952         table->family = family;
 953         table->flags = flags;
 954         table->handle = ++table_handle;
 955 
 956         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
 957         err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
 958         if (err < 0)
 959                 goto err_trans;
 960 
 961         list_add_tail_rcu(&table->list, &net->nft.tables);
 962         return 0;
 963 err_trans:
 964         rhltable_destroy(&table->chains_ht);
 965 err_chain_ht:
 966         kfree(table->name);
 967 err_strdup:
 968         kfree(table);
 969 err_kzalloc:
 970         return err;
 971 }
 972 
 973 static int nft_flush_table(struct nft_ctx *ctx)
 974 {
 975         struct nft_flowtable *flowtable, *nft;
 976         struct nft_chain *chain, *nc;
 977         struct nft_object *obj, *ne;
 978         struct nft_set *set, *ns;
 979         int err;
 980 
 981         list_for_each_entry(chain, &ctx->table->chains, list) {
 982                 if (!nft_is_active_next(ctx->net, chain))
 983                         continue;
 984 
 985                 ctx->chain = chain;
 986 
 987                 err = nft_delrule_by_chain(ctx);
 988                 if (err < 0)
 989                         goto out;
 990         }
 991 
 992         list_for_each_entry_safe(set, ns, &ctx->table->sets, list) {
 993                 if (!nft_is_active_next(ctx->net, set))
 994                         continue;
 995 
 996                 if (nft_set_is_anonymous(set) &&
 997                     !list_empty(&set->bindings))
 998                         continue;
 999 
1000                 err = nft_delset(ctx, set);
1001                 if (err < 0)
1002                         goto out;
1003         }
1004 
1005         list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
1006                 if (!nft_is_active_next(ctx->net, flowtable))
1007                         continue;
1008 
1009                 err = nft_delflowtable(ctx, flowtable);
1010                 if (err < 0)
1011                         goto out;
1012         }
1013 
1014         list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
1015                 if (!nft_is_active_next(ctx->net, obj))
1016                         continue;
1017 
1018                 err = nft_delobj(ctx, obj);
1019                 if (err < 0)
1020                         goto out;
1021         }
1022 
1023         list_for_each_entry_safe(chain, nc, &ctx->table->chains, list) {
1024                 if (!nft_is_active_next(ctx->net, chain))
1025                         continue;
1026 
1027                 ctx->chain = chain;
1028 
1029                 err = nft_delchain(ctx);
1030                 if (err < 0)
1031                         goto out;
1032         }
1033 
1034         err = nft_deltable(ctx);
1035 out:
1036         return err;
1037 }
1038 
1039 static int nft_flush(struct nft_ctx *ctx, int family)
1040 {
1041         struct nft_table *table, *nt;
1042         const struct nlattr * const *nla = ctx->nla;
1043         int err = 0;
1044 
1045         list_for_each_entry_safe(table, nt, &ctx->net->nft.tables, list) {
1046                 if (family != AF_UNSPEC && table->family != family)
1047                         continue;
1048 
1049                 ctx->family = table->family;
1050 
1051                 if (!nft_is_active_next(ctx->net, table))
1052                         continue;
1053 
1054                 if (nla[NFTA_TABLE_NAME] &&
1055                     nla_strcmp(nla[NFTA_TABLE_NAME], table->name) != 0)
1056                         continue;
1057 
1058                 ctx->table = table;
1059 
1060                 err = nft_flush_table(ctx);
1061                 if (err < 0)
1062                         goto out;
1063         }
1064 out:
1065         return err;
1066 }
1067 
1068 static int nf_tables_deltable(struct net *net, struct sock *nlsk,
1069                               struct sk_buff *skb, const struct nlmsghdr *nlh,
1070                               const struct nlattr * const nla[],
1071                               struct netlink_ext_ack *extack)
1072 {
1073         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1074         u8 genmask = nft_genmask_next(net);
1075         int family = nfmsg->nfgen_family;
1076         const struct nlattr *attr;
1077         struct nft_table *table;
1078         struct nft_ctx ctx;
1079 
1080         nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
1081         if (family == AF_UNSPEC ||
1082             (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
1083                 return nft_flush(&ctx, family);
1084 
1085         if (nla[NFTA_TABLE_HANDLE]) {
1086                 attr = nla[NFTA_TABLE_HANDLE];
1087                 table = nft_table_lookup_byhandle(net, attr, genmask);
1088         } else {
1089                 attr = nla[NFTA_TABLE_NAME];
1090                 table = nft_table_lookup(net, attr, family, genmask);
1091         }
1092 
1093         if (IS_ERR(table)) {
1094                 NL_SET_BAD_ATTR(extack, attr);
1095                 return PTR_ERR(table);
1096         }
1097 
1098         if (nlh->nlmsg_flags & NLM_F_NONREC &&
1099             table->use > 0)
1100                 return -EBUSY;
1101 
1102         ctx.family = family;
1103         ctx.table = table;
1104 
1105         return nft_flush_table(&ctx);
1106 }
1107 
1108 static void nf_tables_table_destroy(struct nft_ctx *ctx)
1109 {
1110         if (WARN_ON(ctx->table->use > 0))
1111                 return;
1112 
1113         rhltable_destroy(&ctx->table->chains_ht);
1114         kfree(ctx->table->name);
1115         kfree(ctx->table);
1116 }
1117 
1118 void nft_register_chain_type(const struct nft_chain_type *ctype)
1119 {
1120         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1121         if (WARN_ON(__nft_chain_type_get(ctype->family, ctype->type))) {
1122                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1123                 return;
1124         }
1125         chain_type[ctype->family][ctype->type] = ctype;
1126         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1127 }
1128 EXPORT_SYMBOL_GPL(nft_register_chain_type);
1129 
1130 void nft_unregister_chain_type(const struct nft_chain_type *ctype)
1131 {
1132         nfnl_lock(NFNL_SUBSYS_NFTABLES);
1133         chain_type[ctype->family][ctype->type] = NULL;
1134         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
1135 }
1136 EXPORT_SYMBOL_GPL(nft_unregister_chain_type);
1137 
1138 /*
1139  * Chains
1140  */
1141 
1142 static struct nft_chain *
1143 nft_chain_lookup_byhandle(const struct nft_table *table, u64 handle, u8 genmask)
1144 {
1145         struct nft_chain *chain;
1146 
1147         list_for_each_entry(chain, &table->chains, list) {
1148                 if (chain->handle == handle &&
1149                     nft_active_genmask(chain, genmask))
1150                         return chain;
1151         }
1152 
1153         return ERR_PTR(-ENOENT);
1154 }
1155 
1156 static bool lockdep_commit_lock_is_held(const struct net *net)
1157 {
1158 #ifdef CONFIG_PROVE_LOCKING
1159         return lockdep_is_held(&net->nft.commit_mutex);
1160 #else
1161         return true;
1162 #endif
1163 }
1164 
1165 static struct nft_chain *nft_chain_lookup(struct net *net,
1166                                           struct nft_table *table,
1167                                           const struct nlattr *nla, u8 genmask)
1168 {
1169         char search[NFT_CHAIN_MAXNAMELEN + 1];
1170         struct rhlist_head *tmp, *list;
1171         struct nft_chain *chain;
1172 
1173         if (nla == NULL)
1174                 return ERR_PTR(-EINVAL);
1175 
1176         nla_strlcpy(search, nla, sizeof(search));
1177 
1178         WARN_ON(!rcu_read_lock_held() &&
1179                 !lockdep_commit_lock_is_held(net));
1180 
1181         chain = ERR_PTR(-ENOENT);
1182         rcu_read_lock();
1183         list = rhltable_lookup(&table->chains_ht, search, nft_chain_ht_params);
1184         if (!list)
1185                 goto out_unlock;
1186 
1187         rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
1188                 if (nft_active_genmask(chain, genmask))
1189                         goto out_unlock;
1190         }
1191         chain = ERR_PTR(-ENOENT);
1192 out_unlock:
1193         rcu_read_unlock();
1194         return chain;
1195 }
1196 
1197 static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
1198         [NFTA_CHAIN_TABLE]      = { .type = NLA_STRING,
1199                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
1200         [NFTA_CHAIN_HANDLE]     = { .type = NLA_U64 },
1201         [NFTA_CHAIN_NAME]       = { .type = NLA_STRING,
1202                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
1203         [NFTA_CHAIN_HOOK]       = { .type = NLA_NESTED },
1204         [NFTA_CHAIN_POLICY]     = { .type = NLA_U32 },
1205         [NFTA_CHAIN_TYPE]       = { .type = NLA_STRING,
1206                                     .len = NFT_MODULE_AUTOLOAD_LIMIT },
1207         [NFTA_CHAIN_COUNTERS]   = { .type = NLA_NESTED },
1208         [NFTA_CHAIN_FLAGS]      = { .type = NLA_U32 },
1209 };
1210 
1211 static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
1212         [NFTA_HOOK_HOOKNUM]     = { .type = NLA_U32 },
1213         [NFTA_HOOK_PRIORITY]    = { .type = NLA_U32 },
1214         [NFTA_HOOK_DEV]         = { .type = NLA_STRING,
1215                                     .len = IFNAMSIZ - 1 },
1216 };
1217 
1218 static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats)
1219 {
1220         struct nft_stats *cpu_stats, total;
1221         struct nlattr *nest;
1222         unsigned int seq;
1223         u64 pkts, bytes;
1224         int cpu;
1225 
1226         if (!stats)
1227                 return 0;
1228 
1229         memset(&total, 0, sizeof(total));
1230         for_each_possible_cpu(cpu) {
1231                 cpu_stats = per_cpu_ptr(stats, cpu);
1232                 do {
1233                         seq = u64_stats_fetch_begin_irq(&cpu_stats->syncp);
1234                         pkts = cpu_stats->pkts;
1235                         bytes = cpu_stats->bytes;
1236                 } while (u64_stats_fetch_retry_irq(&cpu_stats->syncp, seq));
1237                 total.pkts += pkts;
1238                 total.bytes += bytes;
1239         }
1240         nest = nla_nest_start_noflag(skb, NFTA_CHAIN_COUNTERS);
1241         if (nest == NULL)
1242                 goto nla_put_failure;
1243 
1244         if (nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.pkts),
1245                          NFTA_COUNTER_PAD) ||
1246             nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes),
1247                          NFTA_COUNTER_PAD))
1248                 goto nla_put_failure;
1249 
1250         nla_nest_end(skb, nest);
1251         return 0;
1252 
1253 nla_put_failure:
1254         return -ENOSPC;
1255 }
1256 
1257 static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
1258                                      u32 portid, u32 seq, int event, u32 flags,
1259                                      int family, const struct nft_table *table,
1260                                      const struct nft_chain *chain)
1261 {
1262         struct nlmsghdr *nlh;
1263         struct nfgenmsg *nfmsg;
1264 
1265         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
1266         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
1267         if (nlh == NULL)
1268                 goto nla_put_failure;
1269 
1270         nfmsg = nlmsg_data(nlh);
1271         nfmsg->nfgen_family     = family;
1272         nfmsg->version          = NFNETLINK_V0;
1273         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
1274 
1275         if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
1276                 goto nla_put_failure;
1277         if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
1278                          NFTA_CHAIN_PAD))
1279                 goto nla_put_failure;
1280         if (nla_put_string(skb, NFTA_CHAIN_NAME, chain->name))
1281                 goto nla_put_failure;
1282 
1283         if (nft_is_base_chain(chain)) {
1284                 const struct nft_base_chain *basechain = nft_base_chain(chain);
1285                 const struct nf_hook_ops *ops = &basechain->ops;
1286                 struct nft_stats __percpu *stats;
1287                 struct nlattr *nest;
1288 
1289                 nest = nla_nest_start_noflag(skb, NFTA_CHAIN_HOOK);
1290                 if (nest == NULL)
1291                         goto nla_put_failure;
1292                 if (nla_put_be32(skb, NFTA_HOOK_HOOKNUM, htonl(ops->hooknum)))
1293                         goto nla_put_failure;
1294                 if (nla_put_be32(skb, NFTA_HOOK_PRIORITY, htonl(ops->priority)))
1295                         goto nla_put_failure;
1296                 if (basechain->dev_name[0] &&
1297                     nla_put_string(skb, NFTA_HOOK_DEV, basechain->dev_name))
1298                         goto nla_put_failure;
1299                 nla_nest_end(skb, nest);
1300 
1301                 if (nla_put_be32(skb, NFTA_CHAIN_POLICY,
1302                                  htonl(basechain->policy)))
1303                         goto nla_put_failure;
1304 
1305                 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1306                         goto nla_put_failure;
1307 
1308                 stats = rcu_dereference_check(basechain->stats,
1309                                               lockdep_commit_lock_is_held(net));
1310                 if (nft_dump_stats(skb, stats))
1311                         goto nla_put_failure;
1312 
1313                 if ((chain->flags & NFT_CHAIN_HW_OFFLOAD) &&
1314                     nla_put_be32(skb, NFTA_CHAIN_FLAGS,
1315                                  htonl(NFT_CHAIN_HW_OFFLOAD)))
1316                         goto nla_put_failure;
1317         }
1318 
1319         if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))
1320                 goto nla_put_failure;
1321 
1322         nlmsg_end(skb, nlh);
1323         return 0;
1324 
1325 nla_put_failure:
1326         nlmsg_trim(skb, nlh);
1327         return -1;
1328 }
1329 
1330 static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
1331 {
1332         struct sk_buff *skb;
1333         int err;
1334 
1335         if (!ctx->report &&
1336             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
1337                 return;
1338 
1339         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1340         if (skb == NULL)
1341                 goto err;
1342 
1343         err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq,
1344                                         event, 0, ctx->family, ctx->table,
1345                                         ctx->chain);
1346         if (err < 0) {
1347                 kfree_skb(skb);
1348                 goto err;
1349         }
1350 
1351         nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
1352                        ctx->report, GFP_KERNEL);
1353         return;
1354 err:
1355         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
1356 }
1357 
1358 static int nf_tables_dump_chains(struct sk_buff *skb,
1359                                  struct netlink_callback *cb)
1360 {
1361         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1362         const struct nft_table *table;
1363         const struct nft_chain *chain;
1364         unsigned int idx = 0, s_idx = cb->args[0];
1365         struct net *net = sock_net(skb->sk);
1366         int family = nfmsg->nfgen_family;
1367 
1368         rcu_read_lock();
1369         cb->seq = net->nft.base_seq;
1370 
1371         list_for_each_entry_rcu(table, &net->nft.tables, list) {
1372                 if (family != NFPROTO_UNSPEC && family != table->family)
1373                         continue;
1374 
1375                 list_for_each_entry_rcu(chain, &table->chains, list) {
1376                         if (idx < s_idx)
1377                                 goto cont;
1378                         if (idx > s_idx)
1379                                 memset(&cb->args[1], 0,
1380                                        sizeof(cb->args) - sizeof(cb->args[0]));
1381                         if (!nft_is_active(net, chain))
1382                                 continue;
1383                         if (nf_tables_fill_chain_info(skb, net,
1384                                                       NETLINK_CB(cb->skb).portid,
1385                                                       cb->nlh->nlmsg_seq,
1386                                                       NFT_MSG_NEWCHAIN,
1387                                                       NLM_F_MULTI,
1388                                                       table->family, table,
1389                                                       chain) < 0)
1390                                 goto done;
1391 
1392                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
1393 cont:
1394                         idx++;
1395                 }
1396         }
1397 done:
1398         rcu_read_unlock();
1399         cb->args[0] = idx;
1400         return skb->len;
1401 }
1402 
1403 /* called with rcu_read_lock held */
1404 static int nf_tables_getchain(struct net *net, struct sock *nlsk,
1405                               struct sk_buff *skb, const struct nlmsghdr *nlh,
1406                               const struct nlattr * const nla[],
1407                               struct netlink_ext_ack *extack)
1408 {
1409         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1410         u8 genmask = nft_genmask_cur(net);
1411         const struct nft_chain *chain;
1412         struct nft_table *table;
1413         struct sk_buff *skb2;
1414         int family = nfmsg->nfgen_family;
1415         int err;
1416 
1417         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1418                 struct netlink_dump_control c = {
1419                         .dump = nf_tables_dump_chains,
1420                         .module = THIS_MODULE,
1421                 };
1422 
1423                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
1424         }
1425 
1426         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1427         if (IS_ERR(table)) {
1428                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1429                 return PTR_ERR(table);
1430         }
1431 
1432         chain = nft_chain_lookup(net, table, nla[NFTA_CHAIN_NAME], genmask);
1433         if (IS_ERR(chain)) {
1434                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
1435                 return PTR_ERR(chain);
1436         }
1437 
1438         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1439         if (!skb2)
1440                 return -ENOMEM;
1441 
1442         err = nf_tables_fill_chain_info(skb2, net, NETLINK_CB(skb).portid,
1443                                         nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0,
1444                                         family, table, chain);
1445         if (err < 0)
1446                 goto err;
1447 
1448         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
1449 
1450 err:
1451         kfree_skb(skb2);
1452         return err;
1453 }
1454 
1455 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = {
1456         [NFTA_COUNTER_PACKETS]  = { .type = NLA_U64 },
1457         [NFTA_COUNTER_BYTES]    = { .type = NLA_U64 },
1458 };
1459 
1460 static struct nft_stats __percpu *nft_stats_alloc(const struct nlattr *attr)
1461 {
1462         struct nlattr *tb[NFTA_COUNTER_MAX+1];
1463         struct nft_stats __percpu *newstats;
1464         struct nft_stats *stats;
1465         int err;
1466 
1467         err = nla_parse_nested_deprecated(tb, NFTA_COUNTER_MAX, attr,
1468                                           nft_counter_policy, NULL);
1469         if (err < 0)
1470                 return ERR_PTR(err);
1471 
1472         if (!tb[NFTA_COUNTER_BYTES] || !tb[NFTA_COUNTER_PACKETS])
1473                 return ERR_PTR(-EINVAL);
1474 
1475         newstats = netdev_alloc_pcpu_stats(struct nft_stats);
1476         if (newstats == NULL)
1477                 return ERR_PTR(-ENOMEM);
1478 
1479         /* Restore old counters on this cpu, no problem. Per-cpu statistics
1480          * are not exposed to userspace.
1481          */
1482         preempt_disable();
1483         stats = this_cpu_ptr(newstats);
1484         stats->bytes = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES]));
1485         stats->pkts = be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS]));
1486         preempt_enable();
1487 
1488         return newstats;
1489 }
1490 
1491 static void nft_chain_stats_replace(struct nft_trans *trans)
1492 {
1493         struct nft_base_chain *chain = nft_base_chain(trans->ctx.chain);
1494 
1495         if (!nft_trans_chain_stats(trans))
1496                 return;
1497 
1498         rcu_swap_protected(chain->stats, nft_trans_chain_stats(trans),
1499                            lockdep_commit_lock_is_held(trans->ctx.net));
1500 
1501         if (!nft_trans_chain_stats(trans))
1502                 static_branch_inc(&nft_counters_enabled);
1503 }
1504 
1505 static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
1506 {
1507         struct nft_rule **g0 = rcu_dereference_raw(chain->rules_gen_0);
1508         struct nft_rule **g1 = rcu_dereference_raw(chain->rules_gen_1);
1509 
1510         if (g0 != g1)
1511                 kvfree(g1);
1512         kvfree(g0);
1513 
1514         /* should be NULL either via abort or via successful commit */
1515         WARN_ON_ONCE(chain->rules_next);
1516         kvfree(chain->rules_next);
1517 }
1518 
1519 static void nf_tables_chain_destroy(struct nft_ctx *ctx)
1520 {
1521         struct nft_chain *chain = ctx->chain;
1522 
1523         if (WARN_ON(chain->use > 0))
1524                 return;
1525 
1526         /* no concurrent access possible anymore */
1527         nf_tables_chain_free_chain_rules(chain);
1528 
1529         if (nft_is_base_chain(chain)) {
1530                 struct nft_base_chain *basechain = nft_base_chain(chain);
1531 
1532                 module_put(basechain->type->owner);
1533                 if (rcu_access_pointer(basechain->stats)) {
1534                         static_branch_dec(&nft_counters_enabled);
1535                         free_percpu(rcu_dereference_raw(basechain->stats));
1536                 }
1537                 kfree(chain->name);
1538                 kfree(basechain);
1539         } else {
1540                 kfree(chain->name);
1541                 kfree(chain);
1542         }
1543 }
1544 
1545 struct nft_chain_hook {
1546         u32                             num;
1547         s32                             priority;
1548         const struct nft_chain_type     *type;
1549         struct net_device               *dev;
1550 };
1551 
1552 static int nft_chain_parse_hook(struct net *net,
1553                                 const struct nlattr * const nla[],
1554                                 struct nft_chain_hook *hook, u8 family,
1555                                 bool autoload)
1556 {
1557         struct nlattr *ha[NFTA_HOOK_MAX + 1];
1558         const struct nft_chain_type *type;
1559         struct net_device *dev;
1560         int err;
1561 
1562         lockdep_assert_held(&net->nft.commit_mutex);
1563         lockdep_nfnl_nft_mutex_not_held();
1564 
1565         err = nla_parse_nested_deprecated(ha, NFTA_HOOK_MAX,
1566                                           nla[NFTA_CHAIN_HOOK],
1567                                           nft_hook_policy, NULL);
1568         if (err < 0)
1569                 return err;
1570 
1571         if (ha[NFTA_HOOK_HOOKNUM] == NULL ||
1572             ha[NFTA_HOOK_PRIORITY] == NULL)
1573                 return -EINVAL;
1574 
1575         hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
1576         hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
1577 
1578         type = __nft_chain_type_get(family, NFT_CHAIN_T_DEFAULT);
1579         if (!type)
1580                 return -EOPNOTSUPP;
1581 
1582         if (nla[NFTA_CHAIN_TYPE]) {
1583                 type = nf_tables_chain_type_lookup(net, nla[NFTA_CHAIN_TYPE],
1584                                                    family, autoload);
1585                 if (IS_ERR(type))
1586                         return PTR_ERR(type);
1587         }
1588         if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
1589                 return -EOPNOTSUPP;
1590 
1591         if (type->type == NFT_CHAIN_T_NAT &&
1592             hook->priority <= NF_IP_PRI_CONNTRACK)
1593                 return -EOPNOTSUPP;
1594 
1595         if (!try_module_get(type->owner))
1596                 return -ENOENT;
1597 
1598         hook->type = type;
1599 
1600         hook->dev = NULL;
1601         if (family == NFPROTO_NETDEV) {
1602                 char ifname[IFNAMSIZ];
1603 
1604                 if (!ha[NFTA_HOOK_DEV]) {
1605                         module_put(type->owner);
1606                         return -EOPNOTSUPP;
1607                 }
1608 
1609                 nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
1610                 dev = __dev_get_by_name(net, ifname);
1611                 if (!dev) {
1612                         module_put(type->owner);
1613                         return -ENOENT;
1614                 }
1615                 hook->dev = dev;
1616         } else if (ha[NFTA_HOOK_DEV]) {
1617                 module_put(type->owner);
1618                 return -EOPNOTSUPP;
1619         }
1620 
1621         return 0;
1622 }
1623 
1624 static void nft_chain_release_hook(struct nft_chain_hook *hook)
1625 {
1626         module_put(hook->type->owner);
1627 }
1628 
1629 struct nft_rules_old {
1630         struct rcu_head h;
1631         struct nft_rule **start;
1632 };
1633 
1634 static struct nft_rule **nf_tables_chain_alloc_rules(const struct nft_chain *chain,
1635                                                      unsigned int alloc)
1636 {
1637         if (alloc > INT_MAX)
1638                 return NULL;
1639 
1640         alloc += 1;     /* NULL, ends rules */
1641         if (sizeof(struct nft_rule *) > INT_MAX / alloc)
1642                 return NULL;
1643 
1644         alloc *= sizeof(struct nft_rule *);
1645         alloc += sizeof(struct nft_rules_old);
1646 
1647         return kvmalloc(alloc, GFP_KERNEL);
1648 }
1649 
1650 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
1651                               u8 policy, u32 flags)
1652 {
1653         const struct nlattr * const *nla = ctx->nla;
1654         struct nft_table *table = ctx->table;
1655         struct nft_base_chain *basechain;
1656         struct nft_stats __percpu *stats;
1657         struct net *net = ctx->net;
1658         struct nft_trans *trans;
1659         struct nft_chain *chain;
1660         struct nft_rule **rules;
1661         int err;
1662 
1663         if (table->use == UINT_MAX)
1664                 return -EOVERFLOW;
1665 
1666         if (nla[NFTA_CHAIN_HOOK]) {
1667                 struct nft_chain_hook hook;
1668                 struct nf_hook_ops *ops;
1669 
1670                 err = nft_chain_parse_hook(net, nla, &hook, family, true);
1671                 if (err < 0)
1672                         return err;
1673 
1674                 basechain = kzalloc(sizeof(*basechain), GFP_KERNEL);
1675                 if (basechain == NULL) {
1676                         nft_chain_release_hook(&hook);
1677                         return -ENOMEM;
1678                 }
1679 
1680                 if (hook.dev != NULL)
1681                         strncpy(basechain->dev_name, hook.dev->name, IFNAMSIZ);
1682 
1683                 if (nla[NFTA_CHAIN_COUNTERS]) {
1684                         stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1685                         if (IS_ERR(stats)) {
1686                                 nft_chain_release_hook(&hook);
1687                                 kfree(basechain);
1688                                 return PTR_ERR(stats);
1689                         }
1690                         rcu_assign_pointer(basechain->stats, stats);
1691                         static_branch_inc(&nft_counters_enabled);
1692                 }
1693 
1694                 basechain->type = hook.type;
1695                 chain = &basechain->chain;
1696 
1697                 ops             = &basechain->ops;
1698                 ops->pf         = family;
1699                 ops->hooknum    = hook.num;
1700                 ops->priority   = hook.priority;
1701                 ops->priv       = chain;
1702                 ops->hook       = hook.type->hooks[ops->hooknum];
1703                 ops->dev        = hook.dev;
1704 
1705                 chain->flags |= NFT_BASE_CHAIN | flags;
1706                 basechain->policy = NF_ACCEPT;
1707                 if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
1708                     nft_chain_offload_priority(basechain) < 0)
1709                         return -EOPNOTSUPP;
1710 
1711                 flow_block_init(&basechain->flow_block);
1712         } else {
1713                 chain = kzalloc(sizeof(*chain), GFP_KERNEL);
1714                 if (chain == NULL)
1715                         return -ENOMEM;
1716         }
1717         ctx->chain = chain;
1718 
1719         INIT_LIST_HEAD(&chain->rules);
1720         chain->handle = nf_tables_alloc_handle(table);
1721         chain->table = table;
1722         chain->name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1723         if (!chain->name) {
1724                 err = -ENOMEM;
1725                 goto err1;
1726         }
1727 
1728         rules = nf_tables_chain_alloc_rules(chain, 0);
1729         if (!rules) {
1730                 err = -ENOMEM;
1731                 goto err1;
1732         }
1733 
1734         *rules = NULL;
1735         rcu_assign_pointer(chain->rules_gen_0, rules);
1736         rcu_assign_pointer(chain->rules_gen_1, rules);
1737 
1738         err = nf_tables_register_hook(net, table, chain);
1739         if (err < 0)
1740                 goto err1;
1741 
1742         err = rhltable_insert_key(&table->chains_ht, chain->name,
1743                                   &chain->rhlhead, nft_chain_ht_params);
1744         if (err)
1745                 goto err2;
1746 
1747         trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);
1748         if (IS_ERR(trans)) {
1749                 err = PTR_ERR(trans);
1750                 rhltable_remove(&table->chains_ht, &chain->rhlhead,
1751                                 nft_chain_ht_params);
1752                 goto err2;
1753         }
1754 
1755         nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
1756         if (nft_is_base_chain(chain))
1757                 nft_trans_chain_policy(trans) = policy;
1758 
1759         table->use++;
1760         list_add_tail_rcu(&chain->list, &table->chains);
1761 
1762         return 0;
1763 err2:
1764         nf_tables_unregister_hook(net, table, chain);
1765 err1:
1766         nf_tables_chain_destroy(ctx);
1767 
1768         return err;
1769 }
1770 
1771 static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
1772                               u32 flags)
1773 {
1774         const struct nlattr * const *nla = ctx->nla;
1775         struct nft_table *table = ctx->table;
1776         struct nft_chain *chain = ctx->chain;
1777         struct nft_base_chain *basechain;
1778         struct nft_stats *stats = NULL;
1779         struct nft_chain_hook hook;
1780         struct nf_hook_ops *ops;
1781         struct nft_trans *trans;
1782         int err;
1783 
1784         if (chain->flags ^ flags)
1785                 return -EOPNOTSUPP;
1786 
1787         if (nla[NFTA_CHAIN_HOOK]) {
1788                 if (!nft_is_base_chain(chain))
1789                         return -EBUSY;
1790 
1791                 err = nft_chain_parse_hook(ctx->net, nla, &hook, ctx->family,
1792                                            false);
1793                 if (err < 0)
1794                         return err;
1795 
1796                 basechain = nft_base_chain(chain);
1797                 if (basechain->type != hook.type) {
1798                         nft_chain_release_hook(&hook);
1799                         return -EBUSY;
1800                 }
1801 
1802                 ops = &basechain->ops;
1803                 if (ops->hooknum != hook.num ||
1804                     ops->priority != hook.priority ||
1805                     ops->dev != hook.dev) {
1806                         nft_chain_release_hook(&hook);
1807                         return -EBUSY;
1808                 }
1809                 nft_chain_release_hook(&hook);
1810         }
1811 
1812         if (nla[NFTA_CHAIN_HANDLE] &&
1813             nla[NFTA_CHAIN_NAME]) {
1814                 struct nft_chain *chain2;
1815 
1816                 chain2 = nft_chain_lookup(ctx->net, table,
1817                                           nla[NFTA_CHAIN_NAME], genmask);
1818                 if (!IS_ERR(chain2))
1819                         return -EEXIST;
1820         }
1821 
1822         if (nla[NFTA_CHAIN_COUNTERS]) {
1823                 if (!nft_is_base_chain(chain))
1824                         return -EOPNOTSUPP;
1825 
1826                 stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]);
1827                 if (IS_ERR(stats))
1828                         return PTR_ERR(stats);
1829         }
1830 
1831         err = -ENOMEM;
1832         trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN,
1833                                 sizeof(struct nft_trans_chain));
1834         if (trans == NULL)
1835                 goto err;
1836 
1837         nft_trans_chain_stats(trans) = stats;
1838         nft_trans_chain_update(trans) = true;
1839 
1840         if (nla[NFTA_CHAIN_POLICY])
1841                 nft_trans_chain_policy(trans) = policy;
1842         else
1843                 nft_trans_chain_policy(trans) = -1;
1844 
1845         if (nla[NFTA_CHAIN_HANDLE] &&
1846             nla[NFTA_CHAIN_NAME]) {
1847                 struct nft_trans *tmp;
1848                 char *name;
1849 
1850                 err = -ENOMEM;
1851                 name = nla_strdup(nla[NFTA_CHAIN_NAME], GFP_KERNEL);
1852                 if (!name)
1853                         goto err;
1854 
1855                 err = -EEXIST;
1856                 list_for_each_entry(tmp, &ctx->net->nft.commit_list, list) {
1857                         if (tmp->msg_type == NFT_MSG_NEWCHAIN &&
1858                             tmp->ctx.table == table &&
1859                             nft_trans_chain_update(tmp) &&
1860                             nft_trans_chain_name(tmp) &&
1861                             strcmp(name, nft_trans_chain_name(tmp)) == 0) {
1862                                 kfree(name);
1863                                 goto err;
1864                         }
1865                 }
1866 
1867                 nft_trans_chain_name(trans) = name;
1868         }
1869         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
1870 
1871         return 0;
1872 err:
1873         free_percpu(stats);
1874         kfree(trans);
1875         return err;
1876 }
1877 
1878 static int nf_tables_newchain(struct net *net, struct sock *nlsk,
1879                               struct sk_buff *skb, const struct nlmsghdr *nlh,
1880                               const struct nlattr * const nla[],
1881                               struct netlink_ext_ack *extack)
1882 {
1883         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1884         u8 genmask = nft_genmask_next(net);
1885         int family = nfmsg->nfgen_family;
1886         const struct nlattr *attr;
1887         struct nft_table *table;
1888         struct nft_chain *chain;
1889         u8 policy = NF_ACCEPT;
1890         struct nft_ctx ctx;
1891         u64 handle = 0;
1892         u32 flags = 0;
1893 
1894         lockdep_assert_held(&net->nft.commit_mutex);
1895 
1896         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1897         if (IS_ERR(table)) {
1898                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1899                 return PTR_ERR(table);
1900         }
1901 
1902         chain = NULL;
1903         attr = nla[NFTA_CHAIN_NAME];
1904 
1905         if (nla[NFTA_CHAIN_HANDLE]) {
1906                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1907                 chain = nft_chain_lookup_byhandle(table, handle, genmask);
1908                 if (IS_ERR(chain)) {
1909                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_HANDLE]);
1910                         return PTR_ERR(chain);
1911                 }
1912                 attr = nla[NFTA_CHAIN_HANDLE];
1913         } else {
1914                 chain = nft_chain_lookup(net, table, attr, genmask);
1915                 if (IS_ERR(chain)) {
1916                         if (PTR_ERR(chain) != -ENOENT) {
1917                                 NL_SET_BAD_ATTR(extack, attr);
1918                                 return PTR_ERR(chain);
1919                         }
1920                         chain = NULL;
1921                 }
1922         }
1923 
1924         if (nla[NFTA_CHAIN_POLICY]) {
1925                 if (chain != NULL &&
1926                     !nft_is_base_chain(chain)) {
1927                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
1928                         return -EOPNOTSUPP;
1929                 }
1930 
1931                 if (chain == NULL &&
1932                     nla[NFTA_CHAIN_HOOK] == NULL) {
1933                         NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_POLICY]);
1934                         return -EOPNOTSUPP;
1935                 }
1936 
1937                 policy = ntohl(nla_get_be32(nla[NFTA_CHAIN_POLICY]));
1938                 switch (policy) {
1939                 case NF_DROP:
1940                 case NF_ACCEPT:
1941                         break;
1942                 default:
1943                         return -EINVAL;
1944                 }
1945         }
1946 
1947         if (nla[NFTA_CHAIN_FLAGS])
1948                 flags = ntohl(nla_get_be32(nla[NFTA_CHAIN_FLAGS]));
1949         else if (chain)
1950                 flags = chain->flags;
1951 
1952         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
1953 
1954         if (chain != NULL) {
1955                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
1956                         NL_SET_BAD_ATTR(extack, attr);
1957                         return -EEXIST;
1958                 }
1959                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
1960                         return -EOPNOTSUPP;
1961 
1962                 flags |= chain->flags & NFT_BASE_CHAIN;
1963                 return nf_tables_updchain(&ctx, genmask, policy, flags);
1964         }
1965 
1966         return nf_tables_addchain(&ctx, family, genmask, policy, flags);
1967 }
1968 
1969 static int nf_tables_delchain(struct net *net, struct sock *nlsk,
1970                               struct sk_buff *skb, const struct nlmsghdr *nlh,
1971                               const struct nlattr * const nla[],
1972                               struct netlink_ext_ack *extack)
1973 {
1974         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1975         u8 genmask = nft_genmask_next(net);
1976         int family = nfmsg->nfgen_family;
1977         const struct nlattr *attr;
1978         struct nft_table *table;
1979         struct nft_chain *chain;
1980         struct nft_rule *rule;
1981         struct nft_ctx ctx;
1982         u64 handle;
1983         u32 use;
1984         int err;
1985 
1986         table = nft_table_lookup(net, nla[NFTA_CHAIN_TABLE], family, genmask);
1987         if (IS_ERR(table)) {
1988                 NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TABLE]);
1989                 return PTR_ERR(table);
1990         }
1991 
1992         if (nla[NFTA_CHAIN_HANDLE]) {
1993                 attr = nla[NFTA_CHAIN_HANDLE];
1994                 handle = be64_to_cpu(nla_get_be64(attr));
1995                 chain = nft_chain_lookup_byhandle(table, handle, genmask);
1996         } else {
1997                 attr = nla[NFTA_CHAIN_NAME];
1998                 chain = nft_chain_lookup(net, table, attr, genmask);
1999         }
2000         if (IS_ERR(chain)) {
2001                 NL_SET_BAD_ATTR(extack, attr);
2002                 return PTR_ERR(chain);
2003         }
2004 
2005         if (nlh->nlmsg_flags & NLM_F_NONREC &&
2006             chain->use > 0)
2007                 return -EBUSY;
2008 
2009         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2010 
2011         use = chain->use;
2012         list_for_each_entry(rule, &chain->rules, list) {
2013                 if (!nft_is_active_next(net, rule))
2014                         continue;
2015                 use--;
2016 
2017                 err = nft_delrule(&ctx, rule);
2018                 if (err < 0)
2019                         return err;
2020         }
2021 
2022         /* There are rules and elements that are still holding references to us,
2023          * we cannot do a recursive removal in this case.
2024          */
2025         if (use > 0) {
2026                 NL_SET_BAD_ATTR(extack, attr);
2027                 return -EBUSY;
2028         }
2029 
2030         return nft_delchain(&ctx);
2031 }
2032 
2033 /*
2034  * Expressions
2035  */
2036 
2037 /**
2038  *      nft_register_expr - register nf_tables expr type
2039  *      @ops: expr type
2040  *
2041  *      Registers the expr type for use with nf_tables. Returns zero on
2042  *      success or a negative errno code otherwise.
2043  */
2044 int nft_register_expr(struct nft_expr_type *type)
2045 {
2046         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2047         if (type->family == NFPROTO_UNSPEC)
2048                 list_add_tail_rcu(&type->list, &nf_tables_expressions);
2049         else
2050                 list_add_rcu(&type->list, &nf_tables_expressions);
2051         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2052         return 0;
2053 }
2054 EXPORT_SYMBOL_GPL(nft_register_expr);
2055 
2056 /**
2057  *      nft_unregister_expr - unregister nf_tables expr type
2058  *      @ops: expr type
2059  *
2060  *      Unregisters the expr typefor use with nf_tables.
2061  */
2062 void nft_unregister_expr(struct nft_expr_type *type)
2063 {
2064         nfnl_lock(NFNL_SUBSYS_NFTABLES);
2065         list_del_rcu(&type->list);
2066         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
2067 }
2068 EXPORT_SYMBOL_GPL(nft_unregister_expr);
2069 
2070 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
2071                                                        struct nlattr *nla)
2072 {
2073         const struct nft_expr_type *type, *candidate = NULL;
2074 
2075         list_for_each_entry(type, &nf_tables_expressions, list) {
2076                 if (!nla_strcmp(nla, type->name)) {
2077                         if (!type->family && !candidate)
2078                                 candidate = type;
2079                         else if (type->family == family)
2080                                 candidate = type;
2081                 }
2082         }
2083         return candidate;
2084 }
2085 
2086 #ifdef CONFIG_MODULES
2087 static int nft_expr_type_request_module(struct net *net, u8 family,
2088                                         struct nlattr *nla)
2089 {
2090         if (nft_request_module(net, "nft-expr-%u-%.*s", family,
2091                                nla_len(nla), (char *)nla_data(nla)) == -EAGAIN)
2092                 return -EAGAIN;
2093 
2094         return 0;
2095 }
2096 #endif
2097 
2098 static const struct nft_expr_type *nft_expr_type_get(struct net *net,
2099                                                      u8 family,
2100                                                      struct nlattr *nla)
2101 {
2102         const struct nft_expr_type *type;
2103 
2104         if (nla == NULL)
2105                 return ERR_PTR(-EINVAL);
2106 
2107         type = __nft_expr_type_get(family, nla);
2108         if (type != NULL && try_module_get(type->owner))
2109                 return type;
2110 
2111         lockdep_nfnl_nft_mutex_not_held();
2112 #ifdef CONFIG_MODULES
2113         if (type == NULL) {
2114                 if (nft_expr_type_request_module(net, family, nla) == -EAGAIN)
2115                         return ERR_PTR(-EAGAIN);
2116 
2117                 if (nft_request_module(net, "nft-expr-%.*s",
2118                                        nla_len(nla),
2119                                        (char *)nla_data(nla)) == -EAGAIN)
2120                         return ERR_PTR(-EAGAIN);
2121         }
2122 #endif
2123         return ERR_PTR(-ENOENT);
2124 }
2125 
2126 static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
2127         [NFTA_EXPR_NAME]        = { .type = NLA_STRING,
2128                                     .len = NFT_MODULE_AUTOLOAD_LIMIT },
2129         [NFTA_EXPR_DATA]        = { .type = NLA_NESTED },
2130 };
2131 
2132 static int nf_tables_fill_expr_info(struct sk_buff *skb,
2133                                     const struct nft_expr *expr)
2134 {
2135         if (nla_put_string(skb, NFTA_EXPR_NAME, expr->ops->type->name))
2136                 goto nla_put_failure;
2137 
2138         if (expr->ops->dump) {
2139                 struct nlattr *data = nla_nest_start_noflag(skb,
2140                                                             NFTA_EXPR_DATA);
2141                 if (data == NULL)
2142                         goto nla_put_failure;
2143                 if (expr->ops->dump(skb, expr) < 0)
2144                         goto nla_put_failure;
2145                 nla_nest_end(skb, data);
2146         }
2147 
2148         return skb->len;
2149 
2150 nla_put_failure:
2151         return -1;
2152 };
2153 
2154 int nft_expr_dump(struct sk_buff *skb, unsigned int attr,
2155                   const struct nft_expr *expr)
2156 {
2157         struct nlattr *nest;
2158 
2159         nest = nla_nest_start_noflag(skb, attr);
2160         if (!nest)
2161                 goto nla_put_failure;
2162         if (nf_tables_fill_expr_info(skb, expr) < 0)
2163                 goto nla_put_failure;
2164         nla_nest_end(skb, nest);
2165         return 0;
2166 
2167 nla_put_failure:
2168         return -1;
2169 }
2170 
2171 struct nft_expr_info {
2172         const struct nft_expr_ops       *ops;
2173         struct nlattr                   *tb[NFT_EXPR_MAXATTR + 1];
2174 };
2175 
2176 static int nf_tables_expr_parse(const struct nft_ctx *ctx,
2177                                 const struct nlattr *nla,
2178                                 struct nft_expr_info *info)
2179 {
2180         const struct nft_expr_type *type;
2181         const struct nft_expr_ops *ops;
2182         struct nlattr *tb[NFTA_EXPR_MAX + 1];
2183         int err;
2184 
2185         err = nla_parse_nested_deprecated(tb, NFTA_EXPR_MAX, nla,
2186                                           nft_expr_policy, NULL);
2187         if (err < 0)
2188                 return err;
2189 
2190         type = nft_expr_type_get(ctx->net, ctx->family, tb[NFTA_EXPR_NAME]);
2191         if (IS_ERR(type))
2192                 return PTR_ERR(type);
2193 
2194         if (tb[NFTA_EXPR_DATA]) {
2195                 err = nla_parse_nested_deprecated(info->tb, type->maxattr,
2196                                                   tb[NFTA_EXPR_DATA],
2197                                                   type->policy, NULL);
2198                 if (err < 0)
2199                         goto err1;
2200         } else
2201                 memset(info->tb, 0, sizeof(info->tb[0]) * (type->maxattr + 1));
2202 
2203         if (type->select_ops != NULL) {
2204                 ops = type->select_ops(ctx,
2205                                        (const struct nlattr * const *)info->tb);
2206                 if (IS_ERR(ops)) {
2207                         err = PTR_ERR(ops);
2208 #ifdef CONFIG_MODULES
2209                         if (err == -EAGAIN)
2210                                 if (nft_expr_type_request_module(ctx->net,
2211                                                                  ctx->family,
2212                                                                  tb[NFTA_EXPR_NAME]) != -EAGAIN)
2213                                         err = -ENOENT;
2214 #endif
2215                         goto err1;
2216                 }
2217         } else
2218                 ops = type->ops;
2219 
2220         info->ops = ops;
2221         return 0;
2222 
2223 err1:
2224         module_put(type->owner);
2225         return err;
2226 }
2227 
2228 static int nf_tables_newexpr(const struct nft_ctx *ctx,
2229                              const struct nft_expr_info *info,
2230                              struct nft_expr *expr)
2231 {
2232         const struct nft_expr_ops *ops = info->ops;
2233         int err;
2234 
2235         expr->ops = ops;
2236         if (ops->init) {
2237                 err = ops->init(ctx, expr, (const struct nlattr **)info->tb);
2238                 if (err < 0)
2239                         goto err1;
2240         }
2241 
2242         return 0;
2243 err1:
2244         expr->ops = NULL;
2245         return err;
2246 }
2247 
2248 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
2249                                    struct nft_expr *expr)
2250 {
2251         const struct nft_expr_type *type = expr->ops->type;
2252 
2253         if (expr->ops->destroy)
2254                 expr->ops->destroy(ctx, expr);
2255         module_put(type->owner);
2256 }
2257 
2258 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
2259                                const struct nlattr *nla)
2260 {
2261         struct nft_expr_info info;
2262         struct nft_expr *expr;
2263         struct module *owner;
2264         int err;
2265 
2266         err = nf_tables_expr_parse(ctx, nla, &info);
2267         if (err < 0)
2268                 goto err1;
2269 
2270         err = -ENOMEM;
2271         expr = kzalloc(info.ops->size, GFP_KERNEL);
2272         if (expr == NULL)
2273                 goto err2;
2274 
2275         err = nf_tables_newexpr(ctx, &info, expr);
2276         if (err < 0)
2277                 goto err3;
2278 
2279         return expr;
2280 err3:
2281         kfree(expr);
2282 err2:
2283         owner = info.ops->type->owner;
2284         if (info.ops->type->release_ops)
2285                 info.ops->type->release_ops(info.ops);
2286 
2287         module_put(owner);
2288 err1:
2289         return ERR_PTR(err);
2290 }
2291 
2292 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
2293 {
2294         nf_tables_expr_destroy(ctx, expr);
2295         kfree(expr);
2296 }
2297 
2298 /*
2299  * Rules
2300  */
2301 
2302 static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
2303                                           u64 handle)
2304 {
2305         struct nft_rule *rule;
2306 
2307         // FIXME: this sucks
2308         list_for_each_entry_rcu(rule, &chain->rules, list) {
2309                 if (handle == rule->handle)
2310                         return rule;
2311         }
2312 
2313         return ERR_PTR(-ENOENT);
2314 }
2315 
2316 static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain,
2317                                         const struct nlattr *nla)
2318 {
2319         if (nla == NULL)
2320                 return ERR_PTR(-EINVAL);
2321 
2322         return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla)));
2323 }
2324 
2325 static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
2326         [NFTA_RULE_TABLE]       = { .type = NLA_STRING,
2327                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
2328         [NFTA_RULE_CHAIN]       = { .type = NLA_STRING,
2329                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
2330         [NFTA_RULE_HANDLE]      = { .type = NLA_U64 },
2331         [NFTA_RULE_EXPRESSIONS] = { .type = NLA_NESTED },
2332         [NFTA_RULE_COMPAT]      = { .type = NLA_NESTED },
2333         [NFTA_RULE_POSITION]    = { .type = NLA_U64 },
2334         [NFTA_RULE_USERDATA]    = { .type = NLA_BINARY,
2335                                     .len = NFT_USERDATA_MAXLEN },
2336         [NFTA_RULE_ID]          = { .type = NLA_U32 },
2337         [NFTA_RULE_POSITION_ID] = { .type = NLA_U32 },
2338 };
2339 
2340 static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
2341                                     u32 portid, u32 seq, int event,
2342                                     u32 flags, int family,
2343                                     const struct nft_table *table,
2344                                     const struct nft_chain *chain,
2345                                     const struct nft_rule *rule,
2346                                     const struct nft_rule *prule)
2347 {
2348         struct nlmsghdr *nlh;
2349         struct nfgenmsg *nfmsg;
2350         const struct nft_expr *expr, *next;
2351         struct nlattr *list;
2352         u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
2353 
2354         nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
2355         if (nlh == NULL)
2356                 goto nla_put_failure;
2357 
2358         nfmsg = nlmsg_data(nlh);
2359         nfmsg->nfgen_family     = family;
2360         nfmsg->version          = NFNETLINK_V0;
2361         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
2362 
2363         if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
2364                 goto nla_put_failure;
2365         if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
2366                 goto nla_put_failure;
2367         if (nla_put_be64(skb, NFTA_RULE_HANDLE, cpu_to_be64(rule->handle),
2368                          NFTA_RULE_PAD))
2369                 goto nla_put_failure;
2370 
2371         if (event != NFT_MSG_DELRULE && prule) {
2372                 if (nla_put_be64(skb, NFTA_RULE_POSITION,
2373                                  cpu_to_be64(prule->handle),
2374                                  NFTA_RULE_PAD))
2375                         goto nla_put_failure;
2376         }
2377 
2378         list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS);
2379         if (list == NULL)
2380                 goto nla_put_failure;
2381         nft_rule_for_each_expr(expr, next, rule) {
2382                 if (nft_expr_dump(skb, NFTA_LIST_ELEM, expr) < 0)
2383                         goto nla_put_failure;
2384         }
2385         nla_nest_end(skb, list);
2386 
2387         if (rule->udata) {
2388                 struct nft_userdata *udata = nft_userdata(rule);
2389                 if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
2390                             udata->data) < 0)
2391                         goto nla_put_failure;
2392         }
2393 
2394         nlmsg_end(skb, nlh);
2395         return 0;
2396 
2397 nla_put_failure:
2398         nlmsg_trim(skb, nlh);
2399         return -1;
2400 }
2401 
2402 static void nf_tables_rule_notify(const struct nft_ctx *ctx,
2403                                   const struct nft_rule *rule, int event)
2404 {
2405         struct sk_buff *skb;
2406         int err;
2407 
2408         if (!ctx->report &&
2409             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
2410                 return;
2411 
2412         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2413         if (skb == NULL)
2414                 goto err;
2415 
2416         err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq,
2417                                        event, 0, ctx->family, ctx->table,
2418                                        ctx->chain, rule, NULL);
2419         if (err < 0) {
2420                 kfree_skb(skb);
2421                 goto err;
2422         }
2423 
2424         nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
2425                        ctx->report, GFP_KERNEL);
2426         return;
2427 err:
2428         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
2429 }
2430 
2431 struct nft_rule_dump_ctx {
2432         char *table;
2433         char *chain;
2434 };
2435 
2436 static int __nf_tables_dump_rules(struct sk_buff *skb,
2437                                   unsigned int *idx,
2438                                   struct netlink_callback *cb,
2439                                   const struct nft_table *table,
2440                                   const struct nft_chain *chain)
2441 {
2442         struct net *net = sock_net(skb->sk);
2443         const struct nft_rule *rule, *prule;
2444         unsigned int s_idx = cb->args[0];
2445 
2446         prule = NULL;
2447         list_for_each_entry_rcu(rule, &chain->rules, list) {
2448                 if (!nft_is_active(net, rule))
2449                         goto cont_skip;
2450                 if (*idx < s_idx)
2451                         goto cont;
2452                 if (*idx > s_idx) {
2453                         memset(&cb->args[1], 0,
2454                                         sizeof(cb->args) - sizeof(cb->args[0]));
2455                 }
2456                 if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid,
2457                                         cb->nlh->nlmsg_seq,
2458                                         NFT_MSG_NEWRULE,
2459                                         NLM_F_MULTI | NLM_F_APPEND,
2460                                         table->family,
2461                                         table, chain, rule, prule) < 0)
2462                         return 1;
2463 
2464                 nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2465 cont:
2466                 prule = rule;
2467 cont_skip:
2468                 (*idx)++;
2469         }
2470         return 0;
2471 }
2472 
2473 static int nf_tables_dump_rules(struct sk_buff *skb,
2474                                 struct netlink_callback *cb)
2475 {
2476         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2477         const struct nft_rule_dump_ctx *ctx = cb->data;
2478         struct nft_table *table;
2479         const struct nft_chain *chain;
2480         unsigned int idx = 0;
2481         struct net *net = sock_net(skb->sk);
2482         int family = nfmsg->nfgen_family;
2483 
2484         rcu_read_lock();
2485         cb->seq = net->nft.base_seq;
2486 
2487         list_for_each_entry_rcu(table, &net->nft.tables, list) {
2488                 if (family != NFPROTO_UNSPEC && family != table->family)
2489                         continue;
2490 
2491                 if (ctx && ctx->table && strcmp(ctx->table, table->name) != 0)
2492                         continue;
2493 
2494                 if (ctx && ctx->table && ctx->chain) {
2495                         struct rhlist_head *list, *tmp;
2496 
2497                         list = rhltable_lookup(&table->chains_ht, ctx->chain,
2498                                                nft_chain_ht_params);
2499                         if (!list)
2500                                 goto done;
2501 
2502                         rhl_for_each_entry_rcu(chain, tmp, list, rhlhead) {
2503                                 if (!nft_is_active(net, chain))
2504                                         continue;
2505                                 __nf_tables_dump_rules(skb, &idx,
2506                                                        cb, table, chain);
2507                                 break;
2508                         }
2509                         goto done;
2510                 }
2511 
2512                 list_for_each_entry_rcu(chain, &table->chains, list) {
2513                         if (__nf_tables_dump_rules(skb, &idx, cb, table, chain))
2514                                 goto done;
2515                 }
2516 
2517                 if (ctx && ctx->table)
2518                         break;
2519         }
2520 done:
2521         rcu_read_unlock();
2522 
2523         cb->args[0] = idx;
2524         return skb->len;
2525 }
2526 
2527 static int nf_tables_dump_rules_start(struct netlink_callback *cb)
2528 {
2529         const struct nlattr * const *nla = cb->data;
2530         struct nft_rule_dump_ctx *ctx = NULL;
2531 
2532         if (nla[NFTA_RULE_TABLE] || nla[NFTA_RULE_CHAIN]) {
2533                 ctx = kzalloc(sizeof(*ctx), GFP_ATOMIC);
2534                 if (!ctx)
2535                         return -ENOMEM;
2536 
2537                 if (nla[NFTA_RULE_TABLE]) {
2538                         ctx->table = nla_strdup(nla[NFTA_RULE_TABLE],
2539                                                         GFP_ATOMIC);
2540                         if (!ctx->table) {
2541                                 kfree(ctx);
2542                                 return -ENOMEM;
2543                         }
2544                 }
2545                 if (nla[NFTA_RULE_CHAIN]) {
2546                         ctx->chain = nla_strdup(nla[NFTA_RULE_CHAIN],
2547                                                 GFP_ATOMIC);
2548                         if (!ctx->chain) {
2549                                 kfree(ctx->table);
2550                                 kfree(ctx);
2551                                 return -ENOMEM;
2552                         }
2553                 }
2554         }
2555 
2556         cb->data = ctx;
2557         return 0;
2558 }
2559 
2560 static int nf_tables_dump_rules_done(struct netlink_callback *cb)
2561 {
2562         struct nft_rule_dump_ctx *ctx = cb->data;
2563 
2564         if (ctx) {
2565                 kfree(ctx->table);
2566                 kfree(ctx->chain);
2567                 kfree(ctx);
2568         }
2569         return 0;
2570 }
2571 
2572 /* called with rcu_read_lock held */
2573 static int nf_tables_getrule(struct net *net, struct sock *nlsk,
2574                              struct sk_buff *skb, const struct nlmsghdr *nlh,
2575                              const struct nlattr * const nla[],
2576                              struct netlink_ext_ack *extack)
2577 {
2578         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2579         u8 genmask = nft_genmask_cur(net);
2580         const struct nft_chain *chain;
2581         const struct nft_rule *rule;
2582         struct nft_table *table;
2583         struct sk_buff *skb2;
2584         int family = nfmsg->nfgen_family;
2585         int err;
2586 
2587         if (nlh->nlmsg_flags & NLM_F_DUMP) {
2588                 struct netlink_dump_control c = {
2589                         .start= nf_tables_dump_rules_start,
2590                         .dump = nf_tables_dump_rules,
2591                         .done = nf_tables_dump_rules_done,
2592                         .module = THIS_MODULE,
2593                         .data = (void *)nla,
2594                 };
2595 
2596                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
2597         }
2598 
2599         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2600         if (IS_ERR(table)) {
2601                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2602                 return PTR_ERR(table);
2603         }
2604 
2605         chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
2606         if (IS_ERR(chain)) {
2607                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2608                 return PTR_ERR(chain);
2609         }
2610 
2611         rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2612         if (IS_ERR(rule)) {
2613                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2614                 return PTR_ERR(rule);
2615         }
2616 
2617         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
2618         if (!skb2)
2619                 return -ENOMEM;
2620 
2621         err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid,
2622                                        nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0,
2623                                        family, table, chain, rule, NULL);
2624         if (err < 0)
2625                 goto err;
2626 
2627         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
2628 
2629 err:
2630         kfree_skb(skb2);
2631         return err;
2632 }
2633 
2634 static void nf_tables_rule_destroy(const struct nft_ctx *ctx,
2635                                    struct nft_rule *rule)
2636 {
2637         struct nft_expr *expr, *next;
2638 
2639         /*
2640          * Careful: some expressions might not be initialized in case this
2641          * is called on error from nf_tables_newrule().
2642          */
2643         expr = nft_expr_first(rule);
2644         while (expr != nft_expr_last(rule) && expr->ops) {
2645                 next = nft_expr_next(expr);
2646                 nf_tables_expr_destroy(ctx, expr);
2647                 expr = next;
2648         }
2649         kfree(rule);
2650 }
2651 
2652 static void nf_tables_rule_release(const struct nft_ctx *ctx,
2653                                    struct nft_rule *rule)
2654 {
2655         nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);
2656         nf_tables_rule_destroy(ctx, rule);
2657 }
2658 
2659 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
2660 {
2661         struct nft_expr *expr, *last;
2662         const struct nft_data *data;
2663         struct nft_rule *rule;
2664         int err;
2665 
2666         if (ctx->level == NFT_JUMP_STACK_SIZE)
2667                 return -EMLINK;
2668 
2669         list_for_each_entry(rule, &chain->rules, list) {
2670                 if (!nft_is_active_next(ctx->net, rule))
2671                         continue;
2672 
2673                 nft_rule_for_each_expr(expr, last, rule) {
2674                         if (!expr->ops->validate)
2675                                 continue;
2676 
2677                         err = expr->ops->validate(ctx, expr, &data);
2678                         if (err < 0)
2679                                 return err;
2680                 }
2681         }
2682 
2683         return 0;
2684 }
2685 EXPORT_SYMBOL_GPL(nft_chain_validate);
2686 
2687 static int nft_table_validate(struct net *net, const struct nft_table *table)
2688 {
2689         struct nft_chain *chain;
2690         struct nft_ctx ctx = {
2691                 .net    = net,
2692                 .family = table->family,
2693         };
2694         int err;
2695 
2696         list_for_each_entry(chain, &table->chains, list) {
2697                 if (!nft_is_base_chain(chain))
2698                         continue;
2699 
2700                 ctx.chain = chain;
2701                 err = nft_chain_validate(&ctx, chain);
2702                 if (err < 0)
2703                         return err;
2704         }
2705 
2706         return 0;
2707 }
2708 
2709 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2710                                              const struct nlattr *nla);
2711 
2712 #define NFT_RULE_MAXEXPRS       128
2713 
2714 static int nf_tables_newrule(struct net *net, struct sock *nlsk,
2715                              struct sk_buff *skb, const struct nlmsghdr *nlh,
2716                              const struct nlattr * const nla[],
2717                              struct netlink_ext_ack *extack)
2718 {
2719         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2720         u8 genmask = nft_genmask_next(net);
2721         struct nft_expr_info *info = NULL;
2722         int family = nfmsg->nfgen_family;
2723         struct nft_flow_rule *flow;
2724         struct nft_table *table;
2725         struct nft_chain *chain;
2726         struct nft_rule *rule, *old_rule = NULL;
2727         struct nft_userdata *udata;
2728         struct nft_trans *trans = NULL;
2729         struct nft_expr *expr;
2730         struct nft_ctx ctx;
2731         struct nlattr *tmp;
2732         unsigned int size, i, n, ulen = 0, usize = 0;
2733         int err, rem;
2734         u64 handle, pos_handle;
2735 
2736         lockdep_assert_held(&net->nft.commit_mutex);
2737 
2738         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2739         if (IS_ERR(table)) {
2740                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2741                 return PTR_ERR(table);
2742         }
2743 
2744         chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);
2745         if (IS_ERR(chain)) {
2746                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2747                 return PTR_ERR(chain);
2748         }
2749 
2750         if (nla[NFTA_RULE_HANDLE]) {
2751                 handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
2752                 rule = __nft_rule_lookup(chain, handle);
2753                 if (IS_ERR(rule)) {
2754                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2755                         return PTR_ERR(rule);
2756                 }
2757 
2758                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
2759                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2760                         return -EEXIST;
2761                 }
2762                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
2763                         old_rule = rule;
2764                 else
2765                         return -EOPNOTSUPP;
2766         } else {
2767                 if (!(nlh->nlmsg_flags & NLM_F_CREATE) ||
2768                     nlh->nlmsg_flags & NLM_F_REPLACE)
2769                         return -EINVAL;
2770                 handle = nf_tables_alloc_handle(table);
2771 
2772                 if (chain->use == UINT_MAX)
2773                         return -EOVERFLOW;
2774 
2775                 if (nla[NFTA_RULE_POSITION]) {
2776                         pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
2777                         old_rule = __nft_rule_lookup(chain, pos_handle);
2778                         if (IS_ERR(old_rule)) {
2779                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
2780                                 return PTR_ERR(old_rule);
2781                         }
2782                 } else if (nla[NFTA_RULE_POSITION_ID]) {
2783                         old_rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]);
2784                         if (IS_ERR(old_rule)) {
2785                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]);
2786                                 return PTR_ERR(old_rule);
2787                         }
2788                 }
2789         }
2790 
2791         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2792 
2793         n = 0;
2794         size = 0;
2795         if (nla[NFTA_RULE_EXPRESSIONS]) {
2796                 info = kvmalloc_array(NFT_RULE_MAXEXPRS,
2797                                       sizeof(struct nft_expr_info),
2798                                       GFP_KERNEL);
2799                 if (!info)
2800                         return -ENOMEM;
2801 
2802                 nla_for_each_nested(tmp, nla[NFTA_RULE_EXPRESSIONS], rem) {
2803                         err = -EINVAL;
2804                         if (nla_type(tmp) != NFTA_LIST_ELEM)
2805                                 goto err1;
2806                         if (n == NFT_RULE_MAXEXPRS)
2807                                 goto err1;
2808                         err = nf_tables_expr_parse(&ctx, tmp, &info[n]);
2809                         if (err < 0)
2810                                 goto err1;
2811                         size += info[n].ops->size;
2812                         n++;
2813                 }
2814         }
2815         /* Check for overflow of dlen field */
2816         err = -EFBIG;
2817         if (size >= 1 << 12)
2818                 goto err1;
2819 
2820         if (nla[NFTA_RULE_USERDATA]) {
2821                 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
2822                 if (ulen > 0)
2823                         usize = sizeof(struct nft_userdata) + ulen;
2824         }
2825 
2826         err = -ENOMEM;
2827         rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
2828         if (rule == NULL)
2829                 goto err1;
2830 
2831         nft_activate_next(net, rule);
2832 
2833         rule->handle = handle;
2834         rule->dlen   = size;
2835         rule->udata  = ulen ? 1 : 0;
2836 
2837         if (ulen) {
2838                 udata = nft_userdata(rule);
2839                 udata->len = ulen - 1;
2840                 nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
2841         }
2842 
2843         expr = nft_expr_first(rule);
2844         for (i = 0; i < n; i++) {
2845                 err = nf_tables_newexpr(&ctx, &info[i], expr);
2846                 if (err < 0)
2847                         goto err2;
2848 
2849                 if (info[i].ops->validate)
2850                         nft_validate_state_update(net, NFT_VALIDATE_NEED);
2851 
2852                 info[i].ops = NULL;
2853                 expr = nft_expr_next(expr);
2854         }
2855 
2856         if (nlh->nlmsg_flags & NLM_F_REPLACE) {
2857                 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
2858                 if (trans == NULL) {
2859                         err = -ENOMEM;
2860                         goto err2;
2861                 }
2862                 err = nft_delrule(&ctx, old_rule);
2863                 if (err < 0) {
2864                         nft_trans_destroy(trans);
2865                         goto err2;
2866                 }
2867 
2868                 list_add_tail_rcu(&rule->list, &old_rule->list);
2869         } else {
2870                 trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
2871                 if (!trans) {
2872                         err = -ENOMEM;
2873                         goto err2;
2874                 }
2875 
2876                 if (nlh->nlmsg_flags & NLM_F_APPEND) {
2877                         if (old_rule)
2878                                 list_add_rcu(&rule->list, &old_rule->list);
2879                         else
2880                                 list_add_tail_rcu(&rule->list, &chain->rules);
2881                  } else {
2882                         if (old_rule)
2883                                 list_add_tail_rcu(&rule->list, &old_rule->list);
2884                         else
2885                                 list_add_rcu(&rule->list, &chain->rules);
2886                 }
2887         }
2888         kvfree(info);
2889         chain->use++;
2890 
2891         if (net->nft.validate_state == NFT_VALIDATE_DO)
2892                 return nft_table_validate(net, table);
2893 
2894         if (chain->flags & NFT_CHAIN_HW_OFFLOAD) {
2895                 flow = nft_flow_rule_create(net, rule);
2896                 if (IS_ERR(flow))
2897                         return PTR_ERR(flow);
2898 
2899                 nft_trans_flow_rule(trans) = flow;
2900         }
2901 
2902         return 0;
2903 err2:
2904         nf_tables_rule_release(&ctx, rule);
2905 err1:
2906         for (i = 0; i < n; i++) {
2907                 if (info[i].ops) {
2908                         module_put(info[i].ops->type->owner);
2909                         if (info[i].ops->type->release_ops)
2910                                 info[i].ops->type->release_ops(info[i].ops);
2911                 }
2912         }
2913         kvfree(info);
2914         return err;
2915 }
2916 
2917 static struct nft_rule *nft_rule_lookup_byid(const struct net *net,
2918                                              const struct nlattr *nla)
2919 {
2920         u32 id = ntohl(nla_get_be32(nla));
2921         struct nft_trans *trans;
2922 
2923         list_for_each_entry(trans, &net->nft.commit_list, list) {
2924                 struct nft_rule *rule = nft_trans_rule(trans);
2925 
2926                 if (trans->msg_type == NFT_MSG_NEWRULE &&
2927                     id == nft_trans_rule_id(trans))
2928                         return rule;
2929         }
2930         return ERR_PTR(-ENOENT);
2931 }
2932 
2933 static int nf_tables_delrule(struct net *net, struct sock *nlsk,
2934                              struct sk_buff *skb, const struct nlmsghdr *nlh,
2935                              const struct nlattr * const nla[],
2936                              struct netlink_ext_ack *extack)
2937 {
2938         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2939         u8 genmask = nft_genmask_next(net);
2940         struct nft_table *table;
2941         struct nft_chain *chain = NULL;
2942         struct nft_rule *rule;
2943         int family = nfmsg->nfgen_family, err = 0;
2944         struct nft_ctx ctx;
2945 
2946         table = nft_table_lookup(net, nla[NFTA_RULE_TABLE], family, genmask);
2947         if (IS_ERR(table)) {
2948                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_TABLE]);
2949                 return PTR_ERR(table);
2950         }
2951 
2952         if (nla[NFTA_RULE_CHAIN]) {
2953                 chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],
2954                                          genmask);
2955                 if (IS_ERR(chain)) {
2956                         NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
2957                         return PTR_ERR(chain);
2958                 }
2959         }
2960 
2961         nft_ctx_init(&ctx, net, skb, nlh, family, table, chain, nla);
2962 
2963         if (chain) {
2964                 if (nla[NFTA_RULE_HANDLE]) {
2965                         rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
2966                         if (IS_ERR(rule)) {
2967                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
2968                                 return PTR_ERR(rule);
2969                         }
2970 
2971                         err = nft_delrule(&ctx, rule);
2972                 } else if (nla[NFTA_RULE_ID]) {
2973                         rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]);
2974                         if (IS_ERR(rule)) {
2975                                 NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]);
2976                                 return PTR_ERR(rule);
2977                         }
2978 
2979                         err = nft_delrule(&ctx, rule);
2980                 } else {
2981                         err = nft_delrule_by_chain(&ctx);
2982                 }
2983         } else {
2984                 list_for_each_entry(chain, &table->chains, list) {
2985                         if (!nft_is_active_next(net, chain))
2986                                 continue;
2987 
2988                         ctx.chain = chain;
2989                         err = nft_delrule_by_chain(&ctx);
2990                         if (err < 0)
2991                                 break;
2992                 }
2993         }
2994 
2995         return err;
2996 }
2997 
2998 /*
2999  * Sets
3000  */
3001 
3002 static LIST_HEAD(nf_tables_set_types);
3003 
3004 int nft_register_set(struct nft_set_type *type)
3005 {
3006         nfnl_lock(NFNL_SUBSYS_NFTABLES);
3007         list_add_tail_rcu(&type->list, &nf_tables_set_types);
3008         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
3009         return 0;
3010 }
3011 EXPORT_SYMBOL_GPL(nft_register_set);
3012 
3013 void nft_unregister_set(struct nft_set_type *type)
3014 {
3015         nfnl_lock(NFNL_SUBSYS_NFTABLES);
3016         list_del_rcu(&type->list);
3017         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
3018 }
3019 EXPORT_SYMBOL_GPL(nft_unregister_set);
3020 
3021 #define NFT_SET_FEATURES        (NFT_SET_INTERVAL | NFT_SET_MAP | \
3022                                  NFT_SET_TIMEOUT | NFT_SET_OBJECT | \
3023                                  NFT_SET_EVAL)
3024 
3025 static bool nft_set_ops_candidate(const struct nft_set_type *type, u32 flags)
3026 {
3027         return (flags & type->features) == (flags & NFT_SET_FEATURES);
3028 }
3029 
3030 /*
3031  * Select a set implementation based on the data characteristics and the
3032  * given policy. The total memory use might not be known if no size is
3033  * given, in that case the amount of memory per element is used.
3034  */
3035 static const struct nft_set_ops *
3036 nft_select_set_ops(const struct nft_ctx *ctx,
3037                    const struct nlattr * const nla[],
3038                    const struct nft_set_desc *desc,
3039                    enum nft_set_policies policy)
3040 {
3041         const struct nft_set_ops *ops, *bops;
3042         struct nft_set_estimate est, best;
3043         const struct nft_set_type *type;
3044         u32 flags = 0;
3045 
3046         lockdep_assert_held(&ctx->net->nft.commit_mutex);
3047         lockdep_nfnl_nft_mutex_not_held();
3048 #ifdef CONFIG_MODULES
3049         if (list_empty(&nf_tables_set_types)) {
3050                 if (nft_request_module(ctx->net, "nft-set") == -EAGAIN)
3051                         return ERR_PTR(-EAGAIN);
3052         }
3053 #endif
3054         if (nla[NFTA_SET_FLAGS] != NULL)
3055                 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3056 
3057         bops        = NULL;
3058         best.size   = ~0;
3059         best.lookup = ~0;
3060         best.space  = ~0;
3061 
3062         list_for_each_entry(type, &nf_tables_set_types, list) {
3063                 ops = &type->ops;
3064 
3065                 if (!nft_set_ops_candidate(type, flags))
3066                         continue;
3067                 if (!ops->estimate(desc, flags, &est))
3068                         continue;
3069 
3070                 switch (policy) {
3071                 case NFT_SET_POL_PERFORMANCE:
3072                         if (est.lookup < best.lookup)
3073                                 break;
3074                         if (est.lookup == best.lookup &&
3075                             est.space < best.space)
3076                                 break;
3077                         continue;
3078                 case NFT_SET_POL_MEMORY:
3079                         if (!desc->size) {
3080                                 if (est.space < best.space)
3081                                         break;
3082                                 if (est.space == best.space &&
3083                                     est.lookup < best.lookup)
3084                                         break;
3085                         } else if (est.size < best.size || !bops) {
3086                                 break;
3087                         }
3088                         continue;
3089                 default:
3090                         break;
3091                 }
3092 
3093                 if (!try_module_get(type->owner))
3094                         continue;
3095                 if (bops != NULL)
3096                         module_put(to_set_type(bops)->owner);
3097 
3098                 bops = ops;
3099                 best = est;
3100         }
3101 
3102         if (bops != NULL)
3103                 return bops;
3104 
3105         return ERR_PTR(-EOPNOTSUPP);
3106 }
3107 
3108 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
3109         [NFTA_SET_TABLE]                = { .type = NLA_STRING,
3110                                             .len = NFT_TABLE_MAXNAMELEN - 1 },
3111         [NFTA_SET_NAME]                 = { .type = NLA_STRING,
3112                                             .len = NFT_SET_MAXNAMELEN - 1 },
3113         [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
3114         [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
3115         [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
3116         [NFTA_SET_DATA_TYPE]            = { .type = NLA_U32 },
3117         [NFTA_SET_DATA_LEN]             = { .type = NLA_U32 },
3118         [NFTA_SET_POLICY]               = { .type = NLA_U32 },
3119         [NFTA_SET_DESC]                 = { .type = NLA_NESTED },
3120         [NFTA_SET_ID]                   = { .type = NLA_U32 },
3121         [NFTA_SET_TIMEOUT]              = { .type = NLA_U64 },
3122         [NFTA_SET_GC_INTERVAL]          = { .type = NLA_U32 },
3123         [NFTA_SET_USERDATA]             = { .type = NLA_BINARY,
3124                                             .len  = NFT_USERDATA_MAXLEN },
3125         [NFTA_SET_OBJ_TYPE]             = { .type = NLA_U32 },
3126         [NFTA_SET_HANDLE]               = { .type = NLA_U64 },
3127 };
3128 
3129 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
3130         [NFTA_SET_DESC_SIZE]            = { .type = NLA_U32 },
3131 };
3132 
3133 static int nft_ctx_init_from_setattr(struct nft_ctx *ctx, struct net *net,
3134                                      const struct sk_buff *skb,
3135                                      const struct nlmsghdr *nlh,
3136                                      const struct nlattr * const nla[],
3137                                      struct netlink_ext_ack *extack,
3138                                      u8 genmask)
3139 {
3140         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3141         int family = nfmsg->nfgen_family;
3142         struct nft_table *table = NULL;
3143 
3144         if (nla[NFTA_SET_TABLE] != NULL) {
3145                 table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family,
3146                                          genmask);
3147                 if (IS_ERR(table)) {
3148                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
3149                         return PTR_ERR(table);
3150                 }
3151         }
3152 
3153         nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
3154         return 0;
3155 }
3156 
3157 static struct nft_set *nft_set_lookup(const struct nft_table *table,
3158                                       const struct nlattr *nla, u8 genmask)
3159 {
3160         struct nft_set *set;
3161 
3162         if (nla == NULL)
3163                 return ERR_PTR(-EINVAL);
3164 
3165         list_for_each_entry_rcu(set, &table->sets, list) {
3166                 if (!nla_strcmp(nla, set->name) &&
3167                     nft_active_genmask(set, genmask))
3168                         return set;
3169         }
3170         return ERR_PTR(-ENOENT);
3171 }
3172 
3173 static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table,
3174                                                const struct nlattr *nla,
3175                                                u8 genmask)
3176 {
3177         struct nft_set *set;
3178 
3179         list_for_each_entry(set, &table->sets, list) {
3180                 if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
3181                     nft_active_genmask(set, genmask))
3182                         return set;
3183         }
3184         return ERR_PTR(-ENOENT);
3185 }
3186 
3187 static struct nft_set *nft_set_lookup_byid(const struct net *net,
3188                                            const struct nlattr *nla, u8 genmask)
3189 {
3190         struct nft_trans *trans;
3191         u32 id = ntohl(nla_get_be32(nla));
3192 
3193         list_for_each_entry(trans, &net->nft.commit_list, list) {
3194                 if (trans->msg_type == NFT_MSG_NEWSET) {
3195                         struct nft_set *set = nft_trans_set(trans);
3196 
3197                         if (id == nft_trans_set_id(trans) &&
3198                             nft_active_genmask(set, genmask))
3199                                 return set;
3200                 }
3201         }
3202         return ERR_PTR(-ENOENT);
3203 }
3204 
3205 struct nft_set *nft_set_lookup_global(const struct net *net,
3206                                       const struct nft_table *table,
3207                                       const struct nlattr *nla_set_name,
3208                                       const struct nlattr *nla_set_id,
3209                                       u8 genmask)
3210 {
3211         struct nft_set *set;
3212 
3213         set = nft_set_lookup(table, nla_set_name, genmask);
3214         if (IS_ERR(set)) {
3215                 if (!nla_set_id)
3216                         return set;
3217 
3218                 set = nft_set_lookup_byid(net, nla_set_id, genmask);
3219         }
3220         return set;
3221 }
3222 EXPORT_SYMBOL_GPL(nft_set_lookup_global);
3223 
3224 static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
3225                                     const char *name)
3226 {
3227         const struct nft_set *i;
3228         const char *p;
3229         unsigned long *inuse;
3230         unsigned int n = 0, min = 0;
3231 
3232         p = strchr(name, '%');
3233         if (p != NULL) {
3234                 if (p[1] != 'd' || strchr(p + 2, '%'))
3235                         return -EINVAL;
3236 
3237                 inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
3238                 if (inuse == NULL)
3239                         return -ENOMEM;
3240 cont:
3241                 list_for_each_entry(i, &ctx->table->sets, list) {
3242                         int tmp;
3243 
3244                         if (!nft_is_active_next(ctx->net, set))
3245                                 continue;
3246                         if (!sscanf(i->name, name, &tmp))
3247                                 continue;
3248                         if (tmp < min || tmp >= min + BITS_PER_BYTE * PAGE_SIZE)
3249                                 continue;
3250 
3251                         set_bit(tmp - min, inuse);
3252                 }
3253 
3254                 n = find_first_zero_bit(inuse, BITS_PER_BYTE * PAGE_SIZE);
3255                 if (n >= BITS_PER_BYTE * PAGE_SIZE) {
3256                         min += BITS_PER_BYTE * PAGE_SIZE;
3257                         memset(inuse, 0, PAGE_SIZE);
3258                         goto cont;
3259                 }
3260                 free_page((unsigned long)inuse);
3261         }
3262 
3263         set->name = kasprintf(GFP_KERNEL, name, min + n);
3264         if (!set->name)
3265                 return -ENOMEM;
3266 
3267         list_for_each_entry(i, &ctx->table->sets, list) {
3268                 if (!nft_is_active_next(ctx->net, i))
3269                         continue;
3270                 if (!strcmp(set->name, i->name)) {
3271                         kfree(set->name);
3272                         return -ENFILE;
3273                 }
3274         }
3275         return 0;
3276 }
3277 
3278 static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
3279 {
3280         u64 ms = be64_to_cpu(nla_get_be64(nla));
3281         u64 max = (u64)(~((u64)0));
3282 
3283         max = div_u64(max, NSEC_PER_MSEC);
3284         if (ms >= max)
3285                 return -ERANGE;
3286 
3287         ms *= NSEC_PER_MSEC;
3288         *result = nsecs_to_jiffies64(ms);
3289         return 0;
3290 }
3291 
3292 static __be64 nf_jiffies64_to_msecs(u64 input)
3293 {
3294         return cpu_to_be64(jiffies64_to_msecs(input));
3295 }
3296 
3297 static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
3298                               const struct nft_set *set, u16 event, u16 flags)
3299 {
3300         struct nfgenmsg *nfmsg;
3301         struct nlmsghdr *nlh;
3302         struct nlattr *desc;
3303         u32 portid = ctx->portid;
3304         u32 seq = ctx->seq;
3305 
3306         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
3307         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
3308                         flags);
3309         if (nlh == NULL)
3310                 goto nla_put_failure;
3311 
3312         nfmsg = nlmsg_data(nlh);
3313         nfmsg->nfgen_family     = ctx->family;
3314         nfmsg->version          = NFNETLINK_V0;
3315         nfmsg->res_id           = htons(ctx->net->nft.base_seq & 0xffff);
3316 
3317         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
3318                 goto nla_put_failure;
3319         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
3320                 goto nla_put_failure;
3321         if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
3322                          NFTA_SET_PAD))
3323                 goto nla_put_failure;
3324         if (set->flags != 0)
3325                 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
3326                         goto nla_put_failure;
3327 
3328         if (nla_put_be32(skb, NFTA_SET_KEY_TYPE, htonl(set->ktype)))
3329                 goto nla_put_failure;
3330         if (nla_put_be32(skb, NFTA_SET_KEY_LEN, htonl(set->klen)))
3331                 goto nla_put_failure;
3332         if (set->flags & NFT_SET_MAP) {
3333                 if (nla_put_be32(skb, NFTA_SET_DATA_TYPE, htonl(set->dtype)))
3334                         goto nla_put_failure;
3335                 if (nla_put_be32(skb, NFTA_SET_DATA_LEN, htonl(set->dlen)))
3336                         goto nla_put_failure;
3337         }
3338         if (set->flags & NFT_SET_OBJECT &&
3339             nla_put_be32(skb, NFTA_SET_OBJ_TYPE, htonl(set->objtype)))
3340                 goto nla_put_failure;
3341 
3342         if (set->timeout &&
3343             nla_put_be64(skb, NFTA_SET_TIMEOUT,
3344                          nf_jiffies64_to_msecs(set->timeout),
3345                          NFTA_SET_PAD))
3346                 goto nla_put_failure;
3347         if (set->gc_int &&
3348             nla_put_be32(skb, NFTA_SET_GC_INTERVAL, htonl(set->gc_int)))
3349                 goto nla_put_failure;
3350 
3351         if (set->policy != NFT_SET_POL_PERFORMANCE) {
3352                 if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
3353                         goto nla_put_failure;
3354         }
3355 
3356         if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
3357                 goto nla_put_failure;
3358 
3359         desc = nla_nest_start_noflag(skb, NFTA_SET_DESC);
3360         if (desc == NULL)
3361                 goto nla_put_failure;
3362         if (set->size &&
3363             nla_put_be32(skb, NFTA_SET_DESC_SIZE, htonl(set->size)))
3364                 goto nla_put_failure;
3365         nla_nest_end(skb, desc);
3366 
3367         nlmsg_end(skb, nlh);
3368         return 0;
3369 
3370 nla_put_failure:
3371         nlmsg_trim(skb, nlh);
3372         return -1;
3373 }
3374 
3375 static void nf_tables_set_notify(const struct nft_ctx *ctx,
3376                                  const struct nft_set *set, int event,
3377                                  gfp_t gfp_flags)
3378 {
3379         struct sk_buff *skb;
3380         u32 portid = ctx->portid;
3381         int err;
3382 
3383         if (!ctx->report &&
3384             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
3385                 return;
3386 
3387         skb = nlmsg_new(NLMSG_GOODSIZE, gfp_flags);
3388         if (skb == NULL)
3389                 goto err;
3390 
3391         err = nf_tables_fill_set(skb, ctx, set, event, 0);
3392         if (err < 0) {
3393                 kfree_skb(skb);
3394                 goto err;
3395         }
3396 
3397         nfnetlink_send(skb, ctx->net, portid, NFNLGRP_NFTABLES, ctx->report,
3398                        gfp_flags);
3399         return;
3400 err:
3401         nfnetlink_set_err(ctx->net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
3402 }
3403 
3404 static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
3405 {
3406         const struct nft_set *set;
3407         unsigned int idx, s_idx = cb->args[0];
3408         struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
3409         struct net *net = sock_net(skb->sk);
3410         struct nft_ctx *ctx = cb->data, ctx_set;
3411 
3412         if (cb->args[1])
3413                 return skb->len;
3414 
3415         rcu_read_lock();
3416         cb->seq = net->nft.base_seq;
3417 
3418         list_for_each_entry_rcu(table, &net->nft.tables, list) {
3419                 if (ctx->family != NFPROTO_UNSPEC &&
3420                     ctx->family != table->family)
3421                         continue;
3422 
3423                 if (ctx->table && ctx->table != table)
3424                         continue;
3425 
3426                 if (cur_table) {
3427                         if (cur_table != table)
3428                                 continue;
3429 
3430                         cur_table = NULL;
3431                 }
3432                 idx = 0;
3433                 list_for_each_entry_rcu(set, &table->sets, list) {
3434                         if (idx < s_idx)
3435                                 goto cont;
3436                         if (!nft_is_active(net, set))
3437                                 goto cont;
3438 
3439                         ctx_set = *ctx;
3440                         ctx_set.table = table;
3441                         ctx_set.family = table->family;
3442 
3443                         if (nf_tables_fill_set(skb, &ctx_set, set,
3444                                                NFT_MSG_NEWSET,
3445                                                NLM_F_MULTI) < 0) {
3446                                 cb->args[0] = idx;
3447                                 cb->args[2] = (unsigned long) table;
3448                                 goto done;
3449                         }
3450                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
3451 cont:
3452                         idx++;
3453                 }
3454                 if (s_idx)
3455                         s_idx = 0;
3456         }
3457         cb->args[1] = 1;
3458 done:
3459         rcu_read_unlock();
3460         return skb->len;
3461 }
3462 
3463 static int nf_tables_dump_sets_start(struct netlink_callback *cb)
3464 {
3465         struct nft_ctx *ctx_dump = NULL;
3466 
3467         ctx_dump = kmemdup(cb->data, sizeof(*ctx_dump), GFP_ATOMIC);
3468         if (ctx_dump == NULL)
3469                 return -ENOMEM;
3470 
3471         cb->data = ctx_dump;
3472         return 0;
3473 }
3474 
3475 static int nf_tables_dump_sets_done(struct netlink_callback *cb)
3476 {
3477         kfree(cb->data);
3478         return 0;
3479 }
3480 
3481 /* called with rcu_read_lock held */
3482 static int nf_tables_getset(struct net *net, struct sock *nlsk,
3483                             struct sk_buff *skb, const struct nlmsghdr *nlh,
3484                             const struct nlattr * const nla[],
3485                             struct netlink_ext_ack *extack)
3486 {
3487         u8 genmask = nft_genmask_cur(net);
3488         const struct nft_set *set;
3489         struct nft_ctx ctx;
3490         struct sk_buff *skb2;
3491         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3492         int err;
3493 
3494         /* Verify existence before starting dump */
3495         err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3496                                         genmask);
3497         if (err < 0)
3498                 return err;
3499 
3500         if (nlh->nlmsg_flags & NLM_F_DUMP) {
3501                 struct netlink_dump_control c = {
3502                         .start = nf_tables_dump_sets_start,
3503                         .dump = nf_tables_dump_sets,
3504                         .done = nf_tables_dump_sets_done,
3505                         .data = &ctx,
3506                         .module = THIS_MODULE,
3507                 };
3508 
3509                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
3510         }
3511 
3512         /* Only accept unspec with dump */
3513         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3514                 return -EAFNOSUPPORT;
3515         if (!nla[NFTA_SET_TABLE])
3516                 return -EINVAL;
3517 
3518         set = nft_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
3519         if (IS_ERR(set))
3520                 return PTR_ERR(set);
3521 
3522         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
3523         if (skb2 == NULL)
3524                 return -ENOMEM;
3525 
3526         err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
3527         if (err < 0)
3528                 goto err;
3529 
3530         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
3531 
3532 err:
3533         kfree_skb(skb2);
3534         return err;
3535 }
3536 
3537 static int nf_tables_set_desc_parse(struct nft_set_desc *desc,
3538                                     const struct nlattr *nla)
3539 {
3540         struct nlattr *da[NFTA_SET_DESC_MAX + 1];
3541         int err;
3542 
3543         err = nla_parse_nested_deprecated(da, NFTA_SET_DESC_MAX, nla,
3544                                           nft_set_desc_policy, NULL);
3545         if (err < 0)
3546                 return err;
3547 
3548         if (da[NFTA_SET_DESC_SIZE] != NULL)
3549                 desc->size = ntohl(nla_get_be32(da[NFTA_SET_DESC_SIZE]));
3550 
3551         return 0;
3552 }
3553 
3554 static int nf_tables_newset(struct net *net, struct sock *nlsk,
3555                             struct sk_buff *skb, const struct nlmsghdr *nlh,
3556                             const struct nlattr * const nla[],
3557                             struct netlink_ext_ack *extack)
3558 {
3559         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3560         u8 genmask = nft_genmask_next(net);
3561         int family = nfmsg->nfgen_family;
3562         const struct nft_set_ops *ops;
3563         struct nft_table *table;
3564         struct nft_set *set;
3565         struct nft_ctx ctx;
3566         char *name;
3567         u64 size;
3568         u64 timeout;
3569         u32 ktype, dtype, flags, policy, gc_int, objtype;
3570         struct nft_set_desc desc;
3571         unsigned char *udata;
3572         u16 udlen;
3573         int err;
3574 
3575         if (nla[NFTA_SET_TABLE] == NULL ||
3576             nla[NFTA_SET_NAME] == NULL ||
3577             nla[NFTA_SET_KEY_LEN] == NULL ||
3578             nla[NFTA_SET_ID] == NULL)
3579                 return -EINVAL;
3580 
3581         memset(&desc, 0, sizeof(desc));
3582 
3583         ktype = NFT_DATA_VALUE;
3584         if (nla[NFTA_SET_KEY_TYPE] != NULL) {
3585                 ktype = ntohl(nla_get_be32(nla[NFTA_SET_KEY_TYPE]));
3586                 if ((ktype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK)
3587                         return -EINVAL;
3588         }
3589 
3590         desc.klen = ntohl(nla_get_be32(nla[NFTA_SET_KEY_LEN]));
3591         if (desc.klen == 0 || desc.klen > NFT_DATA_VALUE_MAXLEN)
3592                 return -EINVAL;
3593 
3594         flags = 0;
3595         if (nla[NFTA_SET_FLAGS] != NULL) {
3596                 flags = ntohl(nla_get_be32(nla[NFTA_SET_FLAGS]));
3597                 if (flags & ~(NFT_SET_ANONYMOUS | NFT_SET_CONSTANT |
3598                               NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
3599                               NFT_SET_MAP | NFT_SET_EVAL |
3600                               NFT_SET_OBJECT))
3601                         return -EOPNOTSUPP;
3602                 /* Only one of these operations is supported */
3603                 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
3604                              (NFT_SET_MAP | NFT_SET_OBJECT))
3605                         return -EOPNOTSUPP;
3606                 if ((flags & (NFT_SET_EVAL | NFT_SET_OBJECT)) ==
3607                              (NFT_SET_EVAL | NFT_SET_OBJECT))
3608                         return -EOPNOTSUPP;
3609         }
3610 
3611         dtype = 0;
3612         if (nla[NFTA_SET_DATA_TYPE] != NULL) {
3613                 if (!(flags & NFT_SET_MAP))
3614                         return -EINVAL;
3615 
3616                 dtype = ntohl(nla_get_be32(nla[NFTA_SET_DATA_TYPE]));
3617                 if ((dtype & NFT_DATA_RESERVED_MASK) == NFT_DATA_RESERVED_MASK &&
3618                     dtype != NFT_DATA_VERDICT)
3619                         return -EINVAL;
3620 
3621                 if (dtype != NFT_DATA_VERDICT) {
3622                         if (nla[NFTA_SET_DATA_LEN] == NULL)
3623                                 return -EINVAL;
3624                         desc.dlen = ntohl(nla_get_be32(nla[NFTA_SET_DATA_LEN]));
3625                         if (desc.dlen == 0 || desc.dlen > NFT_DATA_VALUE_MAXLEN)
3626                                 return -EINVAL;
3627                 } else
3628                         desc.dlen = sizeof(struct nft_verdict);
3629         } else if (flags & NFT_SET_MAP)
3630                 return -EINVAL;
3631 
3632         if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
3633                 if (!(flags & NFT_SET_OBJECT))
3634                         return -EINVAL;
3635 
3636                 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
3637                 if (objtype == NFT_OBJECT_UNSPEC ||
3638                     objtype > NFT_OBJECT_MAX)
3639                         return -EOPNOTSUPP;
3640         } else if (flags & NFT_SET_OBJECT)
3641                 return -EINVAL;
3642         else
3643                 objtype = NFT_OBJECT_UNSPEC;
3644 
3645         timeout = 0;
3646         if (nla[NFTA_SET_TIMEOUT] != NULL) {
3647                 if (!(flags & NFT_SET_TIMEOUT))
3648                         return -EINVAL;
3649 
3650                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_TIMEOUT], &timeout);
3651                 if (err)
3652                         return err;
3653         }
3654         gc_int = 0;
3655         if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
3656                 if (!(flags & NFT_SET_TIMEOUT))
3657                         return -EINVAL;
3658                 gc_int = ntohl(nla_get_be32(nla[NFTA_SET_GC_INTERVAL]));
3659         }
3660 
3661         policy = NFT_SET_POL_PERFORMANCE;
3662         if (nla[NFTA_SET_POLICY] != NULL)
3663                 policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
3664 
3665         if (nla[NFTA_SET_DESC] != NULL) {
3666                 err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
3667                 if (err < 0)
3668                         return err;
3669         }
3670 
3671         table = nft_table_lookup(net, nla[NFTA_SET_TABLE], family, genmask);
3672         if (IS_ERR(table)) {
3673                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_TABLE]);
3674                 return PTR_ERR(table);
3675         }
3676 
3677         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
3678 
3679         set = nft_set_lookup(table, nla[NFTA_SET_NAME], genmask);
3680         if (IS_ERR(set)) {
3681                 if (PTR_ERR(set) != -ENOENT) {
3682                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
3683                         return PTR_ERR(set);
3684                 }
3685         } else {
3686                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
3687                         NL_SET_BAD_ATTR(extack, nla[NFTA_SET_NAME]);
3688                         return -EEXIST;
3689                 }
3690                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
3691                         return -EOPNOTSUPP;
3692 
3693                 return 0;
3694         }
3695 
3696         if (!(nlh->nlmsg_flags & NLM_F_CREATE))
3697                 return -ENOENT;
3698 
3699         ops = nft_select_set_ops(&ctx, nla, &desc, policy);
3700         if (IS_ERR(ops))
3701                 return PTR_ERR(ops);
3702 
3703         udlen = 0;
3704         if (nla[NFTA_SET_USERDATA])
3705                 udlen = nla_len(nla[NFTA_SET_USERDATA]);
3706 
3707         size = 0;
3708         if (ops->privsize != NULL)
3709                 size = ops->privsize(nla, &desc);
3710 
3711         set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
3712         if (!set) {
3713                 err = -ENOMEM;
3714                 goto err1;
3715         }
3716 
3717         name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
3718         if (!name) {
3719                 err = -ENOMEM;
3720                 goto err2;
3721         }
3722 
3723         err = nf_tables_set_alloc_name(&ctx, set, name);
3724         kfree(name);
3725         if (err < 0)
3726                 goto err2;
3727 
3728         udata = NULL;
3729         if (udlen) {
3730                 udata = set->data + size;
3731                 nla_memcpy(udata, nla[NFTA_SET_USERDATA], udlen);
3732         }
3733 
3734         INIT_LIST_HEAD(&set->bindings);
3735         set->table = table;
3736         write_pnet(&set->net, net);
3737         set->ops   = ops;
3738         set->ktype = ktype;
3739         set->klen  = desc.klen;
3740         set->dtype = dtype;
3741         set->objtype = objtype;
3742         set->dlen  = desc.dlen;
3743         set->flags = flags;
3744         set->size  = desc.size;
3745         set->policy = policy;
3746         set->udlen  = udlen;
3747         set->udata  = udata;
3748         set->timeout = timeout;
3749         set->gc_int = gc_int;
3750         set->handle = nf_tables_alloc_handle(table);
3751 
3752         err = ops->init(set, &desc, nla);
3753         if (err < 0)
3754                 goto err3;
3755 
3756         err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
3757         if (err < 0)
3758                 goto err4;
3759 
3760         list_add_tail_rcu(&set->list, &table->sets);
3761         table->use++;
3762         return 0;
3763 
3764 err4:
3765         ops->destroy(set);
3766 err3:
3767         kfree(set->name);
3768 err2:
3769         kvfree(set);
3770 err1:
3771         module_put(to_set_type(ops)->owner);
3772         return err;
3773 }
3774 
3775 static void nft_set_destroy(struct nft_set *set)
3776 {
3777         if (WARN_ON(set->use > 0))
3778                 return;
3779 
3780         set->ops->destroy(set);
3781         module_put(to_set_type(set->ops)->owner);
3782         kfree(set->name);
3783         kvfree(set);
3784 }
3785 
3786 static int nf_tables_delset(struct net *net, struct sock *nlsk,
3787                             struct sk_buff *skb, const struct nlmsghdr *nlh,
3788                             const struct nlattr * const nla[],
3789                             struct netlink_ext_ack *extack)
3790 {
3791         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3792         u8 genmask = nft_genmask_next(net);
3793         const struct nlattr *attr;
3794         struct nft_set *set;
3795         struct nft_ctx ctx;
3796         int err;
3797 
3798         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
3799                 return -EAFNOSUPPORT;
3800         if (nla[NFTA_SET_TABLE] == NULL)
3801                 return -EINVAL;
3802 
3803         err = nft_ctx_init_from_setattr(&ctx, net, skb, nlh, nla, extack,
3804                                         genmask);
3805         if (err < 0)
3806                 return err;
3807 
3808         if (nla[NFTA_SET_HANDLE]) {
3809                 attr = nla[NFTA_SET_HANDLE];
3810                 set = nft_set_lookup_byhandle(ctx.table, attr, genmask);
3811         } else {
3812                 attr = nla[NFTA_SET_NAME];
3813                 set = nft_set_lookup(ctx.table, attr, genmask);
3814         }
3815 
3816         if (IS_ERR(set)) {
3817                 NL_SET_BAD_ATTR(extack, attr);
3818                 return PTR_ERR(set);
3819         }
3820         if (set->use ||
3821             (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) {
3822                 NL_SET_BAD_ATTR(extack, attr);
3823                 return -EBUSY;
3824         }
3825 
3826         return nft_delset(&ctx, set);
3827 }
3828 
3829 static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
3830                                         struct nft_set *set,
3831                                         const struct nft_set_iter *iter,
3832                                         struct nft_set_elem *elem)
3833 {
3834         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
3835         enum nft_registers dreg;
3836 
3837         dreg = nft_type_to_reg(set->dtype);
3838         return nft_validate_register_store(ctx, dreg, nft_set_ext_data(ext),
3839                                            set->dtype == NFT_DATA_VERDICT ?
3840                                            NFT_DATA_VERDICT : NFT_DATA_VALUE,
3841                                            set->dlen);
3842 }
3843 
3844 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
3845                        struct nft_set_binding *binding)
3846 {
3847         struct nft_set_binding *i;
3848         struct nft_set_iter iter;
3849 
3850         if (set->use == UINT_MAX)
3851                 return -EOVERFLOW;
3852 
3853         if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
3854                 return -EBUSY;
3855 
3856         if (binding->flags & NFT_SET_MAP) {
3857                 /* If the set is already bound to the same chain all
3858                  * jumps are already validated for that chain.
3859                  */
3860                 list_for_each_entry(i, &set->bindings, list) {
3861                         if (i->flags & NFT_SET_MAP &&
3862                             i->chain == binding->chain)
3863                                 goto bind;
3864                 }
3865 
3866                 iter.genmask    = nft_genmask_next(ctx->net);
3867                 iter.skip       = 0;
3868                 iter.count      = 0;
3869                 iter.err        = 0;
3870                 iter.fn         = nf_tables_bind_check_setelem;
3871 
3872                 set->ops->walk(ctx, set, &iter);
3873                 if (iter.err < 0)
3874                         return iter.err;
3875         }
3876 bind:
3877         binding->chain = ctx->chain;
3878         list_add_tail_rcu(&binding->list, &set->bindings);
3879         nft_set_trans_bind(ctx, set);
3880         set->use++;
3881 
3882         return 0;
3883 }
3884 EXPORT_SYMBOL_GPL(nf_tables_bind_set);
3885 
3886 static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
3887                                  struct nft_set_binding *binding, bool event)
3888 {
3889         list_del_rcu(&binding->list);
3890 
3891         if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
3892                 list_del_rcu(&set->list);
3893                 if (event)
3894                         nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
3895                                              GFP_KERNEL);
3896         }
3897 }
3898 
3899 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
3900                               struct nft_set_binding *binding,
3901                               enum nft_trans_phase phase)
3902 {
3903         switch (phase) {
3904         case NFT_TRANS_PREPARE:
3905                 set->use--;
3906                 return;
3907         case NFT_TRANS_ABORT:
3908         case NFT_TRANS_RELEASE:
3909                 set->use--;
3910                 /* fall through */
3911         default:
3912                 nf_tables_unbind_set(ctx, set, binding,
3913                                      phase == NFT_TRANS_COMMIT);
3914         }
3915 }
3916 EXPORT_SYMBOL_GPL(nf_tables_deactivate_set);
3917 
3918 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
3919 {
3920         if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
3921                 nft_set_destroy(set);
3922 }
3923 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
3924 
3925 const struct nft_set_ext_type nft_set_ext_types[] = {
3926         [NFT_SET_EXT_KEY]               = {
3927                 .align  = __alignof__(u32),
3928         },
3929         [NFT_SET_EXT_DATA]              = {
3930                 .align  = __alignof__(u32),
3931         },
3932         [NFT_SET_EXT_EXPR]              = {
3933                 .align  = __alignof__(struct nft_expr),
3934         },
3935         [NFT_SET_EXT_OBJREF]            = {
3936                 .len    = sizeof(struct nft_object *),
3937                 .align  = __alignof__(struct nft_object *),
3938         },
3939         [NFT_SET_EXT_FLAGS]             = {
3940                 .len    = sizeof(u8),
3941                 .align  = __alignof__(u8),
3942         },
3943         [NFT_SET_EXT_TIMEOUT]           = {
3944                 .len    = sizeof(u64),
3945                 .align  = __alignof__(u64),
3946         },
3947         [NFT_SET_EXT_EXPIRATION]        = {
3948                 .len    = sizeof(u64),
3949                 .align  = __alignof__(u64),
3950         },
3951         [NFT_SET_EXT_USERDATA]          = {
3952                 .len    = sizeof(struct nft_userdata),
3953                 .align  = __alignof__(struct nft_userdata),
3954         },
3955 };
3956 EXPORT_SYMBOL_GPL(nft_set_ext_types);
3957 
3958 /*
3959  * Set elements
3960  */
3961 
3962 static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
3963         [NFTA_SET_ELEM_KEY]             = { .type = NLA_NESTED },
3964         [NFTA_SET_ELEM_DATA]            = { .type = NLA_NESTED },
3965         [NFTA_SET_ELEM_FLAGS]           = { .type = NLA_U32 },
3966         [NFTA_SET_ELEM_TIMEOUT]         = { .type = NLA_U64 },
3967         [NFTA_SET_ELEM_EXPIRATION]      = { .type = NLA_U64 },
3968         [NFTA_SET_ELEM_USERDATA]        = { .type = NLA_BINARY,
3969                                             .len = NFT_USERDATA_MAXLEN },
3970         [NFTA_SET_ELEM_EXPR]            = { .type = NLA_NESTED },
3971         [NFTA_SET_ELEM_OBJREF]          = { .type = NLA_STRING,
3972                                             .len = NFT_OBJ_MAXNAMELEN - 1 },
3973 };
3974 
3975 static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
3976         [NFTA_SET_ELEM_LIST_TABLE]      = { .type = NLA_STRING,
3977                                             .len = NFT_TABLE_MAXNAMELEN - 1 },
3978         [NFTA_SET_ELEM_LIST_SET]        = { .type = NLA_STRING,
3979                                             .len = NFT_SET_MAXNAMELEN - 1 },
3980         [NFTA_SET_ELEM_LIST_ELEMENTS]   = { .type = NLA_NESTED },
3981         [NFTA_SET_ELEM_LIST_SET_ID]     = { .type = NLA_U32 },
3982 };
3983 
3984 static int nft_ctx_init_from_elemattr(struct nft_ctx *ctx, struct net *net,
3985                                       const struct sk_buff *skb,
3986                                       const struct nlmsghdr *nlh,
3987                                       const struct nlattr * const nla[],
3988                                       struct netlink_ext_ack *extack,
3989                                       u8 genmask)
3990 {
3991         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3992         int family = nfmsg->nfgen_family;
3993         struct nft_table *table;
3994 
3995         table = nft_table_lookup(net, nla[NFTA_SET_ELEM_LIST_TABLE], family,
3996                                  genmask);
3997         if (IS_ERR(table)) {
3998                 NL_SET_BAD_ATTR(extack, nla[NFTA_SET_ELEM_LIST_TABLE]);
3999                 return PTR_ERR(table);
4000         }
4001 
4002         nft_ctx_init(ctx, net, skb, nlh, family, table, NULL, nla);
4003         return 0;
4004 }
4005 
4006 static int nf_tables_fill_setelem(struct sk_buff *skb,
4007                                   const struct nft_set *set,
4008                                   const struct nft_set_elem *elem)
4009 {
4010         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4011         unsigned char *b = skb_tail_pointer(skb);
4012         struct nlattr *nest;
4013 
4014         nest = nla_nest_start_noflag(skb, NFTA_LIST_ELEM);
4015         if (nest == NULL)
4016                 goto nla_put_failure;
4017 
4018         if (nft_data_dump(skb, NFTA_SET_ELEM_KEY, nft_set_ext_key(ext),
4019                           NFT_DATA_VALUE, set->klen) < 0)
4020                 goto nla_put_failure;
4021 
4022         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4023             nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
4024                           set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
4025                           set->dlen) < 0)
4026                 goto nla_put_failure;
4027 
4028         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
4029             nft_expr_dump(skb, NFTA_SET_ELEM_EXPR, nft_set_ext_expr(ext)) < 0)
4030                 goto nla_put_failure;
4031 
4032         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4033             nla_put_string(skb, NFTA_SET_ELEM_OBJREF,
4034                            (*nft_set_ext_obj(ext))->key.name) < 0)
4035                 goto nla_put_failure;
4036 
4037         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
4038             nla_put_be32(skb, NFTA_SET_ELEM_FLAGS,
4039                          htonl(*nft_set_ext_flags(ext))))
4040                 goto nla_put_failure;
4041 
4042         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
4043             nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
4044                          nf_jiffies64_to_msecs(*nft_set_ext_timeout(ext)),
4045                          NFTA_SET_ELEM_PAD))
4046                 goto nla_put_failure;
4047 
4048         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4049                 u64 expires, now = get_jiffies_64();
4050 
4051                 expires = *nft_set_ext_expiration(ext);
4052                 if (time_before64(now, expires))
4053                         expires -= now;
4054                 else
4055                         expires = 0;
4056 
4057                 if (nla_put_be64(skb, NFTA_SET_ELEM_EXPIRATION,
4058                                  nf_jiffies64_to_msecs(expires),
4059                                  NFTA_SET_ELEM_PAD))
4060                         goto nla_put_failure;
4061         }
4062 
4063         if (nft_set_ext_exists(ext, NFT_SET_EXT_USERDATA)) {
4064                 struct nft_userdata *udata;
4065 
4066                 udata = nft_set_ext_userdata(ext);
4067                 if (nla_put(skb, NFTA_SET_ELEM_USERDATA,
4068                             udata->len + 1, udata->data))
4069                         goto nla_put_failure;
4070         }
4071 
4072         nla_nest_end(skb, nest);
4073         return 0;
4074 
4075 nla_put_failure:
4076         nlmsg_trim(skb, b);
4077         return -EMSGSIZE;
4078 }
4079 
4080 struct nft_set_dump_args {
4081         const struct netlink_callback   *cb;
4082         struct nft_set_iter             iter;
4083         struct sk_buff                  *skb;
4084 };
4085 
4086 static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
4087                                   struct nft_set *set,
4088                                   const struct nft_set_iter *iter,
4089                                   struct nft_set_elem *elem)
4090 {
4091         struct nft_set_dump_args *args;
4092 
4093         args = container_of(iter, struct nft_set_dump_args, iter);
4094         return nf_tables_fill_setelem(args->skb, set, elem);
4095 }
4096 
4097 struct nft_set_dump_ctx {
4098         const struct nft_set    *set;
4099         struct nft_ctx          ctx;
4100 };
4101 
4102 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
4103 {
4104         struct nft_set_dump_ctx *dump_ctx = cb->data;
4105         struct net *net = sock_net(skb->sk);
4106         struct nft_table *table;
4107         struct nft_set *set;
4108         struct nft_set_dump_args args;
4109         bool set_found = false;
4110         struct nfgenmsg *nfmsg;
4111         struct nlmsghdr *nlh;
4112         struct nlattr *nest;
4113         u32 portid, seq;
4114         int event;
4115 
4116         rcu_read_lock();
4117         list_for_each_entry_rcu(table, &net->nft.tables, list) {
4118                 if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
4119                     dump_ctx->ctx.family != table->family)
4120                         continue;
4121 
4122                 if (table != dump_ctx->ctx.table)
4123                         continue;
4124 
4125                 list_for_each_entry_rcu(set, &table->sets, list) {
4126                         if (set == dump_ctx->set) {
4127                                 set_found = true;
4128                                 break;
4129                         }
4130                 }
4131                 break;
4132         }
4133 
4134         if (!set_found) {
4135                 rcu_read_unlock();
4136                 return -ENOENT;
4137         }
4138 
4139         event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
4140         portid = NETLINK_CB(cb->skb).portid;
4141         seq    = cb->nlh->nlmsg_seq;
4142 
4143         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4144                         NLM_F_MULTI);
4145         if (nlh == NULL)
4146                 goto nla_put_failure;
4147 
4148         nfmsg = nlmsg_data(nlh);
4149         nfmsg->nfgen_family = table->family;
4150         nfmsg->version      = NFNETLINK_V0;
4151         nfmsg->res_id       = htons(net->nft.base_seq & 0xffff);
4152 
4153         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
4154                 goto nla_put_failure;
4155         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
4156                 goto nla_put_failure;
4157 
4158         nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4159         if (nest == NULL)
4160                 goto nla_put_failure;
4161 
4162         args.cb                 = cb;
4163         args.skb                = skb;
4164         args.iter.genmask       = nft_genmask_cur(net);
4165         args.iter.skip          = cb->args[0];
4166         args.iter.count         = 0;
4167         args.iter.err           = 0;
4168         args.iter.fn            = nf_tables_dump_setelem;
4169         set->ops->walk(&dump_ctx->ctx, set, &args.iter);
4170         rcu_read_unlock();
4171 
4172         nla_nest_end(skb, nest);
4173         nlmsg_end(skb, nlh);
4174 
4175         if (args.iter.err && args.iter.err != -EMSGSIZE)
4176                 return args.iter.err;
4177         if (args.iter.count == cb->args[0])
4178                 return 0;
4179 
4180         cb->args[0] = args.iter.count;
4181         return skb->len;
4182 
4183 nla_put_failure:
4184         rcu_read_unlock();
4185         return -ENOSPC;
4186 }
4187 
4188 static int nf_tables_dump_set_start(struct netlink_callback *cb)
4189 {
4190         struct nft_set_dump_ctx *dump_ctx = cb->data;
4191 
4192         cb->data = kmemdup(dump_ctx, sizeof(*dump_ctx), GFP_ATOMIC);
4193 
4194         return cb->data ? 0 : -ENOMEM;
4195 }
4196 
4197 static int nf_tables_dump_set_done(struct netlink_callback *cb)
4198 {
4199         kfree(cb->data);
4200         return 0;
4201 }
4202 
4203 static int nf_tables_fill_setelem_info(struct sk_buff *skb,
4204                                        const struct nft_ctx *ctx, u32 seq,
4205                                        u32 portid, int event, u16 flags,
4206                                        const struct nft_set *set,
4207                                        const struct nft_set_elem *elem)
4208 {
4209         struct nfgenmsg *nfmsg;
4210         struct nlmsghdr *nlh;
4211         struct nlattr *nest;
4212         int err;
4213 
4214         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
4215         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
4216                         flags);
4217         if (nlh == NULL)
4218                 goto nla_put_failure;
4219 
4220         nfmsg = nlmsg_data(nlh);
4221         nfmsg->nfgen_family     = ctx->family;
4222         nfmsg->version          = NFNETLINK_V0;
4223         nfmsg->res_id           = htons(ctx->net->nft.base_seq & 0xffff);
4224 
4225         if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
4226                 goto nla_put_failure;
4227         if (nla_put_string(skb, NFTA_SET_NAME, set->name))
4228                 goto nla_put_failure;
4229 
4230         nest = nla_nest_start_noflag(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
4231         if (nest == NULL)
4232                 goto nla_put_failure;
4233 
4234         err = nf_tables_fill_setelem(skb, set, elem);
4235         if (err < 0)
4236                 goto nla_put_failure;
4237 
4238         nla_nest_end(skb, nest);
4239 
4240         nlmsg_end(skb, nlh);
4241         return 0;
4242 
4243 nla_put_failure:
4244         nlmsg_trim(skb, nlh);
4245         return -1;
4246 }
4247 
4248 static int nft_setelem_parse_flags(const struct nft_set *set,
4249                                    const struct nlattr *attr, u32 *flags)
4250 {
4251         if (attr == NULL)
4252                 return 0;
4253 
4254         *flags = ntohl(nla_get_be32(attr));
4255         if (*flags & ~NFT_SET_ELEM_INTERVAL_END)
4256                 return -EINVAL;
4257         if (!(set->flags & NFT_SET_INTERVAL) &&
4258             *flags & NFT_SET_ELEM_INTERVAL_END)
4259                 return -EINVAL;
4260 
4261         return 0;
4262 }
4263 
4264 static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4265                             const struct nlattr *attr)
4266 {
4267         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4268         struct nft_data_desc desc;
4269         struct nft_set_elem elem;
4270         struct sk_buff *skb;
4271         uint32_t flags = 0;
4272         void *priv;
4273         int err;
4274 
4275         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4276                                           nft_set_elem_policy, NULL);
4277         if (err < 0)
4278                 return err;
4279 
4280         if (!nla[NFTA_SET_ELEM_KEY])
4281                 return -EINVAL;
4282 
4283         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4284         if (err < 0)
4285                 return err;
4286 
4287         err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4288                             nla[NFTA_SET_ELEM_KEY]);
4289         if (err < 0)
4290                 return err;
4291 
4292         err = -EINVAL;
4293         if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
4294                 nft_data_release(&elem.key.val, desc.type);
4295                 return err;
4296         }
4297 
4298         priv = set->ops->get(ctx->net, set, &elem, flags);
4299         if (IS_ERR(priv))
4300                 return PTR_ERR(priv);
4301 
4302         elem.priv = priv;
4303 
4304         err = -ENOMEM;
4305         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
4306         if (skb == NULL)
4307                 goto err1;
4308 
4309         err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid,
4310                                           NFT_MSG_NEWSETELEM, 0, set, &elem);
4311         if (err < 0)
4312                 goto err2;
4313 
4314         err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT);
4315         /* This avoids a loop in nfnetlink. */
4316         if (err < 0)
4317                 goto err1;
4318 
4319         return 0;
4320 err2:
4321         kfree_skb(skb);
4322 err1:
4323         /* this avoids a loop in nfnetlink. */
4324         return err == -EAGAIN ? -ENOBUFS : err;
4325 }
4326 
4327 /* called with rcu_read_lock held */
4328 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
4329                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
4330                                 const struct nlattr * const nla[],
4331                                 struct netlink_ext_ack *extack)
4332 {
4333         u8 genmask = nft_genmask_cur(net);
4334         struct nft_set *set;
4335         struct nlattr *attr;
4336         struct nft_ctx ctx;
4337         int rem, err = 0;
4338 
4339         err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4340                                          genmask);
4341         if (err < 0)
4342                 return err;
4343 
4344         set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
4345         if (IS_ERR(set))
4346                 return PTR_ERR(set);
4347 
4348         if (nlh->nlmsg_flags & NLM_F_DUMP) {
4349                 struct netlink_dump_control c = {
4350                         .start = nf_tables_dump_set_start,
4351                         .dump = nf_tables_dump_set,
4352                         .done = nf_tables_dump_set_done,
4353                         .module = THIS_MODULE,
4354                 };
4355                 struct nft_set_dump_ctx dump_ctx = {
4356                         .set = set,
4357                         .ctx = ctx,
4358                 };
4359 
4360                 c.data = &dump_ctx;
4361                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
4362         }
4363 
4364         if (!nla[NFTA_SET_ELEM_LIST_ELEMENTS])
4365                 return -EINVAL;
4366 
4367         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4368                 err = nft_get_set_elem(&ctx, set, attr);
4369                 if (err < 0)
4370                         break;
4371         }
4372 
4373         return err;
4374 }
4375 
4376 static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
4377                                      const struct nft_set *set,
4378                                      const struct nft_set_elem *elem,
4379                                      int event, u16 flags)
4380 {
4381         struct net *net = ctx->net;
4382         u32 portid = ctx->portid;
4383         struct sk_buff *skb;
4384         int err;
4385 
4386         if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
4387                 return;
4388 
4389         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4390         if (skb == NULL)
4391                 goto err;
4392 
4393         err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags,
4394                                           set, elem);
4395         if (err < 0) {
4396                 kfree_skb(skb);
4397                 goto err;
4398         }
4399 
4400         nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, ctx->report,
4401                        GFP_KERNEL);
4402         return;
4403 err:
4404         nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
4405 }
4406 
4407 static struct nft_trans *nft_trans_elem_alloc(struct nft_ctx *ctx,
4408                                               int msg_type,
4409                                               struct nft_set *set)
4410 {
4411         struct nft_trans *trans;
4412 
4413         trans = nft_trans_alloc(ctx, msg_type, sizeof(struct nft_trans_elem));
4414         if (trans == NULL)
4415                 return NULL;
4416 
4417         nft_trans_elem_set(trans) = set;
4418         return trans;
4419 }
4420 
4421 void *nft_set_elem_init(const struct nft_set *set,
4422                         const struct nft_set_ext_tmpl *tmpl,
4423                         const u32 *key, const u32 *data,
4424                         u64 timeout, u64 expiration, gfp_t gfp)
4425 {
4426         struct nft_set_ext *ext;
4427         void *elem;
4428 
4429         elem = kzalloc(set->ops->elemsize + tmpl->len, gfp);
4430         if (elem == NULL)
4431                 return NULL;
4432 
4433         ext = nft_set_elem_ext(set, elem);
4434         nft_set_ext_init(ext, tmpl);
4435 
4436         memcpy(nft_set_ext_key(ext), key, set->klen);
4437         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4438                 memcpy(nft_set_ext_data(ext), data, set->dlen);
4439         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
4440                 *nft_set_ext_expiration(ext) = get_jiffies_64() + expiration;
4441                 if (expiration == 0)
4442                         *nft_set_ext_expiration(ext) += timeout;
4443         }
4444         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
4445                 *nft_set_ext_timeout(ext) = timeout;
4446 
4447         return elem;
4448 }
4449 
4450 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
4451                           bool destroy_expr)
4452 {
4453         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4454         struct nft_ctx ctx = {
4455                 .net    = read_pnet(&set->net),
4456                 .family = set->table->family,
4457         };
4458 
4459         nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
4460         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4461                 nft_data_release(nft_set_ext_data(ext), set->dtype);
4462         if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
4463                 struct nft_expr *expr = nft_set_ext_expr(ext);
4464 
4465                 if (expr->ops->destroy_clone) {
4466                         expr->ops->destroy_clone(&ctx, expr);
4467                         module_put(expr->ops->type->owner);
4468                 } else {
4469                         nf_tables_expr_destroy(&ctx, expr);
4470                 }
4471         }
4472         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4473                 (*nft_set_ext_obj(ext))->use--;
4474         kfree(elem);
4475 }
4476 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
4477 
4478 /* Only called from commit path, nft_set_elem_deactivate() already deals with
4479  * the refcounting from the preparation phase.
4480  */
4481 static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
4482                                        const struct nft_set *set, void *elem)
4483 {
4484         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
4485 
4486         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
4487                 nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
4488         kfree(elem);
4489 }
4490 
4491 static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
4492                             const struct nlattr *attr, u32 nlmsg_flags)
4493 {
4494         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4495         u8 genmask = nft_genmask_next(ctx->net);
4496         struct nft_data_desc d1, d2;
4497         struct nft_set_ext_tmpl tmpl;
4498         struct nft_set_ext *ext, *ext2;
4499         struct nft_set_elem elem;
4500         struct nft_set_binding *binding;
4501         struct nft_object *obj = NULL;
4502         struct nft_userdata *udata;
4503         struct nft_data data;
4504         enum nft_registers dreg;
4505         struct nft_trans *trans;
4506         u32 flags = 0;
4507         u64 timeout;
4508         u64 expiration;
4509         u8 ulen;
4510         int err;
4511 
4512         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4513                                           nft_set_elem_policy, NULL);
4514         if (err < 0)
4515                 return err;
4516 
4517         if (nla[NFTA_SET_ELEM_KEY] == NULL)
4518                 return -EINVAL;
4519 
4520         nft_set_ext_prepare(&tmpl);
4521 
4522         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4523         if (err < 0)
4524                 return err;
4525         if (flags != 0)
4526                 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4527 
4528         if (set->flags & NFT_SET_MAP) {
4529                 if (nla[NFTA_SET_ELEM_DATA] == NULL &&
4530                     !(flags & NFT_SET_ELEM_INTERVAL_END))
4531                         return -EINVAL;
4532         } else {
4533                 if (nla[NFTA_SET_ELEM_DATA] != NULL)
4534                         return -EINVAL;
4535         }
4536 
4537         if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
4538              (nla[NFTA_SET_ELEM_DATA] ||
4539               nla[NFTA_SET_ELEM_OBJREF] ||
4540               nla[NFTA_SET_ELEM_TIMEOUT] ||
4541               nla[NFTA_SET_ELEM_EXPIRATION] ||
4542               nla[NFTA_SET_ELEM_USERDATA] ||
4543               nla[NFTA_SET_ELEM_EXPR]))
4544                 return -EINVAL;
4545 
4546         timeout = 0;
4547         if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
4548                 if (!(set->flags & NFT_SET_TIMEOUT))
4549                         return -EINVAL;
4550                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_TIMEOUT],
4551                                             &timeout);
4552                 if (err)
4553                         return err;
4554         } else if (set->flags & NFT_SET_TIMEOUT) {
4555                 timeout = set->timeout;
4556         }
4557 
4558         expiration = 0;
4559         if (nla[NFTA_SET_ELEM_EXPIRATION] != NULL) {
4560                 if (!(set->flags & NFT_SET_TIMEOUT))
4561                         return -EINVAL;
4562                 err = nf_msecs_to_jiffies64(nla[NFTA_SET_ELEM_EXPIRATION],
4563                                             &expiration);
4564                 if (err)
4565                         return err;
4566         }
4567 
4568         err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1,
4569                             nla[NFTA_SET_ELEM_KEY]);
4570         if (err < 0)
4571                 goto err1;
4572         err = -EINVAL;
4573         if (d1.type != NFT_DATA_VALUE || d1.len != set->klen)
4574                 goto err2;
4575 
4576         nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len);
4577         if (timeout > 0) {
4578                 nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION);
4579                 if (timeout != set->timeout)
4580                         nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
4581         }
4582 
4583         if (nla[NFTA_SET_ELEM_OBJREF] != NULL) {
4584                 if (!(set->flags & NFT_SET_OBJECT)) {
4585                         err = -EINVAL;
4586                         goto err2;
4587                 }
4588                 obj = nft_obj_lookup(ctx->net, ctx->table,
4589                                      nla[NFTA_SET_ELEM_OBJREF],
4590                                      set->objtype, genmask);
4591                 if (IS_ERR(obj)) {
4592                         err = PTR_ERR(obj);
4593                         goto err2;
4594                 }
4595                 nft_set_ext_add(&tmpl, NFT_SET_EXT_OBJREF);
4596         }
4597 
4598         if (nla[NFTA_SET_ELEM_DATA] != NULL) {
4599                 err = nft_data_init(ctx, &data, sizeof(data), &d2,
4600                                     nla[NFTA_SET_ELEM_DATA]);
4601                 if (err < 0)
4602                         goto err2;
4603 
4604                 err = -EINVAL;
4605                 if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen)
4606                         goto err3;
4607 
4608                 dreg = nft_type_to_reg(set->dtype);
4609                 list_for_each_entry(binding, &set->bindings, list) {
4610                         struct nft_ctx bind_ctx = {
4611                                 .net    = ctx->net,
4612                                 .family = ctx->family,
4613                                 .table  = ctx->table,
4614                                 .chain  = (struct nft_chain *)binding->chain,
4615                         };
4616 
4617                         if (!(binding->flags & NFT_SET_MAP))
4618                                 continue;
4619 
4620                         err = nft_validate_register_store(&bind_ctx, dreg,
4621                                                           &data,
4622                                                           d2.type, d2.len);
4623                         if (err < 0)
4624                                 goto err3;
4625 
4626                         if (d2.type == NFT_DATA_VERDICT &&
4627                             (data.verdict.code == NFT_GOTO ||
4628                              data.verdict.code == NFT_JUMP))
4629                                 nft_validate_state_update(ctx->net,
4630                                                           NFT_VALIDATE_NEED);
4631                 }
4632 
4633                 nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len);
4634         }
4635 
4636         /* The full maximum length of userdata can exceed the maximum
4637          * offset value (U8_MAX) for following extensions, therefor it
4638          * must be the last extension added.
4639          */
4640         ulen = 0;
4641         if (nla[NFTA_SET_ELEM_USERDATA] != NULL) {
4642                 ulen = nla_len(nla[NFTA_SET_ELEM_USERDATA]);
4643                 if (ulen > 0)
4644                         nft_set_ext_add_length(&tmpl, NFT_SET_EXT_USERDATA,
4645                                                ulen);
4646         }
4647 
4648         err = -ENOMEM;
4649         elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data,
4650                                       timeout, expiration, GFP_KERNEL);
4651         if (elem.priv == NULL)
4652                 goto err3;
4653 
4654         ext = nft_set_elem_ext(set, elem.priv);
4655         if (flags)
4656                 *nft_set_ext_flags(ext) = flags;
4657         if (ulen > 0) {
4658                 udata = nft_set_ext_userdata(ext);
4659                 udata->len = ulen - 1;
4660                 nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
4661         }
4662         if (obj) {
4663                 *nft_set_ext_obj(ext) = obj;
4664                 obj->use++;
4665         }
4666 
4667         trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
4668         if (trans == NULL)
4669                 goto err4;
4670 
4671         ext->genmask = nft_genmask_cur(ctx->net) | NFT_SET_ELEM_BUSY_MASK;
4672         err = set->ops->insert(ctx->net, set, &elem, &ext2);
4673         if (err) {
4674                 if (err == -EEXIST) {
4675                         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^
4676                             nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) ||
4677                             nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^
4678                             nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) {
4679                                 err = -EBUSY;
4680                                 goto err5;
4681                         }
4682                         if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
4683                              nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) &&
4684                              memcmp(nft_set_ext_data(ext),
4685                                     nft_set_ext_data(ext2), set->dlen) != 0) ||
4686                             (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) &&
4687                              nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF) &&
4688                              *nft_set_ext_obj(ext) != *nft_set_ext_obj(ext2)))
4689                                 err = -EBUSY;
4690                         else if (!(nlmsg_flags & NLM_F_EXCL))
4691                                 err = 0;
4692                 }
4693                 goto err5;
4694         }
4695 
4696         if (set->size &&
4697             !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
4698                 err = -ENFILE;
4699                 goto err6;
4700         }
4701 
4702         nft_trans_elem(trans) = elem;
4703         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4704         return 0;
4705 
4706 err6:
4707         set->ops->remove(ctx->net, set, &elem);
4708 err5:
4709         kfree(trans);
4710 err4:
4711         if (obj)
4712                 obj->use--;
4713         kfree(elem.priv);
4714 err3:
4715         if (nla[NFTA_SET_ELEM_DATA] != NULL)
4716                 nft_data_release(&data, d2.type);
4717 err2:
4718         nft_data_release(&elem.key.val, d1.type);
4719 err1:
4720         return err;
4721 }
4722 
4723 static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
4724                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
4725                                 const struct nlattr * const nla[],
4726                                 struct netlink_ext_ack *extack)
4727 {
4728         u8 genmask = nft_genmask_next(net);
4729         const struct nlattr *attr;
4730         struct nft_set *set;
4731         struct nft_ctx ctx;
4732         int rem, err;
4733 
4734         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL)
4735                 return -EINVAL;
4736 
4737         err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4738                                          genmask);
4739         if (err < 0)
4740                 return err;
4741 
4742         set = nft_set_lookup_global(net, ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
4743                                     nla[NFTA_SET_ELEM_LIST_SET_ID], genmask);
4744         if (IS_ERR(set))
4745                 return PTR_ERR(set);
4746 
4747         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4748                 return -EBUSY;
4749 
4750         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4751                 err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
4752                 if (err < 0)
4753                         return err;
4754         }
4755 
4756         if (net->nft.validate_state == NFT_VALIDATE_DO)
4757                 return nft_table_validate(net, ctx.table);
4758 
4759         return 0;
4760 }
4761 
4762 /**
4763  *      nft_data_hold - hold a nft_data item
4764  *
4765  *      @data: struct nft_data to release
4766  *      @type: type of data
4767  *
4768  *      Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
4769  *      NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
4770  *      NFT_GOTO verdicts. This function must be called on active data objects
4771  *      from the second phase of the commit protocol.
4772  */
4773 void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
4774 {
4775         if (type == NFT_DATA_VERDICT) {
4776                 switch (data->verdict.code) {
4777                 case NFT_JUMP:
4778                 case NFT_GOTO:
4779                         data->verdict.chain->use++;
4780                         break;
4781                 }
4782         }
4783 }
4784 
4785 static void nft_set_elem_activate(const struct net *net,
4786                                   const struct nft_set *set,
4787                                   struct nft_set_elem *elem)
4788 {
4789         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4790 
4791         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4792                 nft_data_hold(nft_set_ext_data(ext), set->dtype);
4793         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4794                 (*nft_set_ext_obj(ext))->use++;
4795 }
4796 
4797 static void nft_set_elem_deactivate(const struct net *net,
4798                                     const struct nft_set *set,
4799                                     struct nft_set_elem *elem)
4800 {
4801         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
4802 
4803         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
4804                 nft_data_release(nft_set_ext_data(ext), set->dtype);
4805         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
4806                 (*nft_set_ext_obj(ext))->use--;
4807 }
4808 
4809 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
4810                            const struct nlattr *attr)
4811 {
4812         struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
4813         struct nft_set_ext_tmpl tmpl;
4814         struct nft_data_desc desc;
4815         struct nft_set_elem elem;
4816         struct nft_set_ext *ext;
4817         struct nft_trans *trans;
4818         u32 flags = 0;
4819         void *priv;
4820         int err;
4821 
4822         err = nla_parse_nested_deprecated(nla, NFTA_SET_ELEM_MAX, attr,
4823                                           nft_set_elem_policy, NULL);
4824         if (err < 0)
4825                 goto err1;
4826 
4827         err = -EINVAL;
4828         if (nla[NFTA_SET_ELEM_KEY] == NULL)
4829                 goto err1;
4830 
4831         nft_set_ext_prepare(&tmpl);
4832 
4833         err = nft_setelem_parse_flags(set, nla[NFTA_SET_ELEM_FLAGS], &flags);
4834         if (err < 0)
4835                 return err;
4836         if (flags != 0)
4837                 nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS);
4838 
4839         err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc,
4840                             nla[NFTA_SET_ELEM_KEY]);
4841         if (err < 0)
4842                 goto err1;
4843 
4844         err = -EINVAL;
4845         if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
4846                 goto err2;
4847 
4848         nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len);
4849 
4850         err = -ENOMEM;
4851         elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0,
4852                                       0, GFP_KERNEL);
4853         if (elem.priv == NULL)
4854                 goto err2;
4855 
4856         ext = nft_set_elem_ext(set, elem.priv);
4857         if (flags)
4858                 *nft_set_ext_flags(ext) = flags;
4859 
4860         trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set);
4861         if (trans == NULL) {
4862                 err = -ENOMEM;
4863                 goto err3;
4864         }
4865 
4866         priv = set->ops->deactivate(ctx->net, set, &elem);
4867         if (priv == NULL) {
4868                 err = -ENOENT;
4869                 goto err4;
4870         }
4871         kfree(elem.priv);
4872         elem.priv = priv;
4873 
4874         nft_set_elem_deactivate(ctx->net, set, &elem);
4875 
4876         nft_trans_elem(trans) = elem;
4877         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4878         return 0;
4879 
4880 err4:
4881         kfree(trans);
4882 err3:
4883         kfree(elem.priv);
4884 err2:
4885         nft_data_release(&elem.key.val, desc.type);
4886 err1:
4887         return err;
4888 }
4889 
4890 static int nft_flush_set(const struct nft_ctx *ctx,
4891                          struct nft_set *set,
4892                          const struct nft_set_iter *iter,
4893                          struct nft_set_elem *elem)
4894 {
4895         struct nft_trans *trans;
4896         int err;
4897 
4898         trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
4899                                     sizeof(struct nft_trans_elem), GFP_ATOMIC);
4900         if (!trans)
4901                 return -ENOMEM;
4902 
4903         if (!set->ops->flush(ctx->net, set, elem->priv)) {
4904                 err = -ENOENT;
4905                 goto err1;
4906         }
4907         set->ndeact++;
4908 
4909         nft_set_elem_deactivate(ctx->net, set, elem);
4910         nft_trans_elem_set(trans) = set;
4911         nft_trans_elem(trans) = *elem;
4912         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
4913 
4914         return 0;
4915 err1:
4916         kfree(trans);
4917         return err;
4918 }
4919 
4920 static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
4921                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
4922                                 const struct nlattr * const nla[],
4923                                 struct netlink_ext_ack *extack)
4924 {
4925         u8 genmask = nft_genmask_next(net);
4926         const struct nlattr *attr;
4927         struct nft_set *set;
4928         struct nft_ctx ctx;
4929         int rem, err = 0;
4930 
4931         err = nft_ctx_init_from_elemattr(&ctx, net, skb, nlh, nla, extack,
4932                                          genmask);
4933         if (err < 0)
4934                 return err;
4935 
4936         set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
4937         if (IS_ERR(set))
4938                 return PTR_ERR(set);
4939         if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
4940                 return -EBUSY;
4941 
4942         if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {
4943                 struct nft_set_iter iter = {
4944                         .genmask        = genmask,
4945                         .fn             = nft_flush_set,
4946                 };
4947                 set->ops->walk(&ctx, set, &iter);
4948 
4949                 return iter.err;
4950         }
4951 
4952         nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
4953                 err = nft_del_setelem(&ctx, set, attr);
4954                 if (err < 0)
4955                         break;
4956 
4957                 set->ndeact++;
4958         }
4959         return err;
4960 }
4961 
4962 void nft_set_gc_batch_release(struct rcu_head *rcu)
4963 {
4964         struct nft_set_gc_batch *gcb;
4965         unsigned int i;
4966 
4967         gcb = container_of(rcu, struct nft_set_gc_batch, head.rcu);
4968         for (i = 0; i < gcb->head.cnt; i++)
4969                 nft_set_elem_destroy(gcb->head.set, gcb->elems[i], true);
4970         kfree(gcb);
4971 }
4972 EXPORT_SYMBOL_GPL(nft_set_gc_batch_release);
4973 
4974 struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
4975                                                 gfp_t gfp)
4976 {
4977         struct nft_set_gc_batch *gcb;
4978 
4979         gcb = kzalloc(sizeof(*gcb), gfp);
4980         if (gcb == NULL)
4981                 return gcb;
4982         gcb->head.set = set;
4983         return gcb;
4984 }
4985 EXPORT_SYMBOL_GPL(nft_set_gc_batch_alloc);
4986 
4987 /*
4988  * Stateful objects
4989  */
4990 
4991 /**
4992  *      nft_register_obj- register nf_tables stateful object type
4993  *      @obj: object type
4994  *
4995  *      Registers the object type for use with nf_tables. Returns zero on
4996  *      success or a negative errno code otherwise.
4997  */
4998 int nft_register_obj(struct nft_object_type *obj_type)
4999 {
5000         if (obj_type->type == NFT_OBJECT_UNSPEC)
5001                 return -EINVAL;
5002 
5003         nfnl_lock(NFNL_SUBSYS_NFTABLES);
5004         list_add_rcu(&obj_type->list, &nf_tables_objects);
5005         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5006         return 0;
5007 }
5008 EXPORT_SYMBOL_GPL(nft_register_obj);
5009 
5010 /**
5011  *      nft_unregister_obj - unregister nf_tables object type
5012  *      @obj: object type
5013  *
5014  *      Unregisters the object type for use with nf_tables.
5015  */
5016 void nft_unregister_obj(struct nft_object_type *obj_type)
5017 {
5018         nfnl_lock(NFNL_SUBSYS_NFTABLES);
5019         list_del_rcu(&obj_type->list);
5020         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5021 }
5022 EXPORT_SYMBOL_GPL(nft_unregister_obj);
5023 
5024 struct nft_object *nft_obj_lookup(const struct net *net,
5025                                   const struct nft_table *table,
5026                                   const struct nlattr *nla, u32 objtype,
5027                                   u8 genmask)
5028 {
5029         struct nft_object_hash_key k = { .table = table };
5030         char search[NFT_OBJ_MAXNAMELEN];
5031         struct rhlist_head *tmp, *list;
5032         struct nft_object *obj;
5033 
5034         nla_strlcpy(search, nla, sizeof(search));
5035         k.name = search;
5036 
5037         WARN_ON_ONCE(!rcu_read_lock_held() &&
5038                      !lockdep_commit_lock_is_held(net));
5039 
5040         rcu_read_lock();
5041         list = rhltable_lookup(&nft_objname_ht, &k, nft_objname_ht_params);
5042         if (!list)
5043                 goto out;
5044 
5045         rhl_for_each_entry_rcu(obj, tmp, list, rhlhead) {
5046                 if (objtype == obj->ops->type->type &&
5047                     nft_active_genmask(obj, genmask)) {
5048                         rcu_read_unlock();
5049                         return obj;
5050                 }
5051         }
5052 out:
5053         rcu_read_unlock();
5054         return ERR_PTR(-ENOENT);
5055 }
5056 EXPORT_SYMBOL_GPL(nft_obj_lookup);
5057 
5058 static struct nft_object *nft_obj_lookup_byhandle(const struct nft_table *table,
5059                                                   const struct nlattr *nla,
5060                                                   u32 objtype, u8 genmask)
5061 {
5062         struct nft_object *obj;
5063 
5064         list_for_each_entry(obj, &table->objects, list) {
5065                 if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
5066                     objtype == obj->ops->type->type &&
5067                     nft_active_genmask(obj, genmask))
5068                         return obj;
5069         }
5070         return ERR_PTR(-ENOENT);
5071 }
5072 
5073 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
5074         [NFTA_OBJ_TABLE]        = { .type = NLA_STRING,
5075                                     .len = NFT_TABLE_MAXNAMELEN - 1 },
5076         [NFTA_OBJ_NAME]         = { .type = NLA_STRING,
5077                                     .len = NFT_OBJ_MAXNAMELEN - 1 },
5078         [NFTA_OBJ_TYPE]         = { .type = NLA_U32 },
5079         [NFTA_OBJ_DATA]         = { .type = NLA_NESTED },
5080         [NFTA_OBJ_HANDLE]       = { .type = NLA_U64},
5081 };
5082 
5083 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
5084                                        const struct nft_object_type *type,
5085                                        const struct nlattr *attr)
5086 {
5087         struct nlattr **tb;
5088         const struct nft_object_ops *ops;
5089         struct nft_object *obj;
5090         int err = -ENOMEM;
5091 
5092         tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
5093         if (!tb)
5094                 goto err1;
5095 
5096         if (attr) {
5097                 err = nla_parse_nested_deprecated(tb, type->maxattr, attr,
5098                                                   type->policy, NULL);
5099                 if (err < 0)
5100                         goto err2;
5101         } else {
5102                 memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
5103         }
5104 
5105         if (type->select_ops) {
5106                 ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
5107                 if (IS_ERR(ops)) {
5108                         err = PTR_ERR(ops);
5109                         goto err2;
5110                 }
5111         } else {
5112                 ops = type->ops;
5113         }
5114 
5115         err = -ENOMEM;
5116         obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
5117         if (!obj)
5118                 goto err2;
5119 
5120         err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
5121         if (err < 0)
5122                 goto err3;
5123 
5124         obj->ops = ops;
5125 
5126         kfree(tb);
5127         return obj;
5128 err3:
5129         kfree(obj);
5130 err2:
5131         kfree(tb);
5132 err1:
5133         return ERR_PTR(err);
5134 }
5135 
5136 static int nft_object_dump(struct sk_buff *skb, unsigned int attr,
5137                            struct nft_object *obj, bool reset)
5138 {
5139         struct nlattr *nest;
5140 
5141         nest = nla_nest_start_noflag(skb, attr);
5142         if (!nest)
5143                 goto nla_put_failure;
5144         if (obj->ops->dump(skb, obj, reset) < 0)
5145                 goto nla_put_failure;
5146         nla_nest_end(skb, nest);
5147         return 0;
5148 
5149 nla_put_failure:
5150         return -1;
5151 }
5152 
5153 static const struct nft_object_type *__nft_obj_type_get(u32 objtype)
5154 {
5155         const struct nft_object_type *type;
5156 
5157         list_for_each_entry(type, &nf_tables_objects, list) {
5158                 if (objtype == type->type)
5159                         return type;
5160         }
5161         return NULL;
5162 }
5163 
5164 static const struct nft_object_type *
5165 nft_obj_type_get(struct net *net, u32 objtype)
5166 {
5167         const struct nft_object_type *type;
5168 
5169         type = __nft_obj_type_get(objtype);
5170         if (type != NULL && try_module_get(type->owner))
5171                 return type;
5172 
5173         lockdep_nfnl_nft_mutex_not_held();
5174 #ifdef CONFIG_MODULES
5175         if (type == NULL) {
5176                 if (nft_request_module(net, "nft-obj-%u", objtype) == -EAGAIN)
5177                         return ERR_PTR(-EAGAIN);
5178         }
5179 #endif
5180         return ERR_PTR(-ENOENT);
5181 }
5182 
5183 static int nf_tables_updobj(const struct nft_ctx *ctx,
5184                             const struct nft_object_type *type,
5185                             const struct nlattr *attr,
5186                             struct nft_object *obj)
5187 {
5188         struct nft_object *newobj;
5189         struct nft_trans *trans;
5190         int err;
5191 
5192         trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ,
5193                                 sizeof(struct nft_trans_obj));
5194         if (!trans)
5195                 return -ENOMEM;
5196 
5197         newobj = nft_obj_init(ctx, type, attr);
5198         if (IS_ERR(newobj)) {
5199                 err = PTR_ERR(newobj);
5200                 goto err_free_trans;
5201         }
5202 
5203         nft_trans_obj(trans) = obj;
5204         nft_trans_obj_update(trans) = true;
5205         nft_trans_obj_newobj(trans) = newobj;
5206         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
5207 
5208         return 0;
5209 
5210 err_free_trans:
5211         kfree(trans);
5212         return err;
5213 }
5214 
5215 static int nf_tables_newobj(struct net *net, struct sock *nlsk,
5216                             struct sk_buff *skb, const struct nlmsghdr *nlh,
5217                             const struct nlattr * const nla[],
5218                             struct netlink_ext_ack *extack)
5219 {
5220         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5221         const struct nft_object_type *type;
5222         u8 genmask = nft_genmask_next(net);
5223         int family = nfmsg->nfgen_family;
5224         struct nft_table *table;
5225         struct nft_object *obj;
5226         struct nft_ctx ctx;
5227         u32 objtype;
5228         int err;
5229 
5230         if (!nla[NFTA_OBJ_TYPE] ||
5231             !nla[NFTA_OBJ_NAME] ||
5232             !nla[NFTA_OBJ_DATA])
5233                 return -EINVAL;
5234 
5235         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
5236         if (IS_ERR(table)) {
5237                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
5238                 return PTR_ERR(table);
5239         }
5240 
5241         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5242         obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
5243         if (IS_ERR(obj)) {
5244                 err = PTR_ERR(obj);
5245                 if (err != -ENOENT) {
5246                         NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
5247                         return err;
5248                 }
5249         } else {
5250                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5251                         NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
5252                         return -EEXIST;
5253                 }
5254                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
5255                         return -EOPNOTSUPP;
5256 
5257                 type = __nft_obj_type_get(objtype);
5258                 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5259 
5260                 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
5261         }
5262 
5263         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5264 
5265         type = nft_obj_type_get(net, objtype);
5266         if (IS_ERR(type))
5267                 return PTR_ERR(type);
5268 
5269         obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
5270         if (IS_ERR(obj)) {
5271                 err = PTR_ERR(obj);
5272                 goto err1;
5273         }
5274         obj->key.table = table;
5275         obj->handle = nf_tables_alloc_handle(table);
5276 
5277         obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
5278         if (!obj->key.name) {
5279                 err = -ENOMEM;
5280                 goto err2;
5281         }
5282 
5283         err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
5284         if (err < 0)
5285                 goto err3;
5286 
5287         err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
5288                               nft_objname_ht_params);
5289         if (err < 0)
5290                 goto err4;
5291 
5292         list_add_tail_rcu(&obj->list, &table->objects);
5293         table->use++;
5294         return 0;
5295 err4:
5296         /* queued in transaction log */
5297         INIT_LIST_HEAD(&obj->list);
5298         return err;
5299 err3:
5300         kfree(obj->key.name);
5301 err2:
5302         if (obj->ops->destroy)
5303                 obj->ops->destroy(&ctx, obj);
5304         kfree(obj);
5305 err1:
5306         module_put(type->owner);
5307         return err;
5308 }
5309 
5310 static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
5311                                    u32 portid, u32 seq, int event, u32 flags,
5312                                    int family, const struct nft_table *table,
5313                                    struct nft_object *obj, bool reset)
5314 {
5315         struct nfgenmsg *nfmsg;
5316         struct nlmsghdr *nlh;
5317 
5318         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5319         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5320         if (nlh == NULL)
5321                 goto nla_put_failure;
5322 
5323         nfmsg = nlmsg_data(nlh);
5324         nfmsg->nfgen_family     = family;
5325         nfmsg->version          = NFNETLINK_V0;
5326         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
5327 
5328         if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
5329             nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
5330             nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
5331             nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
5332             nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
5333             nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
5334                          NFTA_OBJ_PAD))
5335                 goto nla_put_failure;
5336 
5337         nlmsg_end(skb, nlh);
5338         return 0;
5339 
5340 nla_put_failure:
5341         nlmsg_trim(skb, nlh);
5342         return -1;
5343 }
5344 
5345 struct nft_obj_filter {
5346         char            *table;
5347         u32             type;
5348 };
5349 
5350 static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
5351 {
5352         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
5353         const struct nft_table *table;
5354         unsigned int idx = 0, s_idx = cb->args[0];
5355         struct nft_obj_filter *filter = cb->data;
5356         struct net *net = sock_net(skb->sk);
5357         int family = nfmsg->nfgen_family;
5358         struct nft_object *obj;
5359         bool reset = false;
5360 
5361         if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5362                 reset = true;
5363 
5364         rcu_read_lock();
5365         cb->seq = net->nft.base_seq;
5366 
5367         list_for_each_entry_rcu(table, &net->nft.tables, list) {
5368                 if (family != NFPROTO_UNSPEC && family != table->family)
5369                         continue;
5370 
5371                 list_for_each_entry_rcu(obj, &table->objects, list) {
5372                         if (!nft_is_active(net, obj))
5373                                 goto cont;
5374                         if (idx < s_idx)
5375                                 goto cont;
5376                         if (idx > s_idx)
5377                                 memset(&cb->args[1], 0,
5378                                        sizeof(cb->args) - sizeof(cb->args[0]));
5379                         if (filter && filter->table &&
5380                             strcmp(filter->table, table->name))
5381                                 goto cont;
5382                         if (filter &&
5383                             filter->type != NFT_OBJECT_UNSPEC &&
5384                             obj->ops->type->type != filter->type)
5385                                 goto cont;
5386 
5387                         if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
5388                                                     cb->nlh->nlmsg_seq,
5389                                                     NFT_MSG_NEWOBJ,
5390                                                     NLM_F_MULTI | NLM_F_APPEND,
5391                                                     table->family, table,
5392                                                     obj, reset) < 0)
5393                                 goto done;
5394 
5395                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
5396 cont:
5397                         idx++;
5398                 }
5399         }
5400 done:
5401         rcu_read_unlock();
5402 
5403         cb->args[0] = idx;
5404         return skb->len;
5405 }
5406 
5407 static int nf_tables_dump_obj_start(struct netlink_callback *cb)
5408 {
5409         const struct nlattr * const *nla = cb->data;
5410         struct nft_obj_filter *filter = NULL;
5411 
5412         if (nla[NFTA_OBJ_TABLE] || nla[NFTA_OBJ_TYPE]) {
5413                 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
5414                 if (!filter)
5415                         return -ENOMEM;
5416 
5417                 if (nla[NFTA_OBJ_TABLE]) {
5418                         filter->table = nla_strdup(nla[NFTA_OBJ_TABLE], GFP_ATOMIC);
5419                         if (!filter->table) {
5420                                 kfree(filter);
5421                                 return -ENOMEM;
5422                         }
5423                 }
5424 
5425                 if (nla[NFTA_OBJ_TYPE])
5426                         filter->type = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5427         }
5428 
5429         cb->data = filter;
5430         return 0;
5431 }
5432 
5433 static int nf_tables_dump_obj_done(struct netlink_callback *cb)
5434 {
5435         struct nft_obj_filter *filter = cb->data;
5436 
5437         if (filter) {
5438                 kfree(filter->table);
5439                 kfree(filter);
5440         }
5441 
5442         return 0;
5443 }
5444 
5445 /* called with rcu_read_lock held */
5446 static int nf_tables_getobj(struct net *net, struct sock *nlsk,
5447                             struct sk_buff *skb, const struct nlmsghdr *nlh,
5448                             const struct nlattr * const nla[],
5449                             struct netlink_ext_ack *extack)
5450 {
5451         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5452         u8 genmask = nft_genmask_cur(net);
5453         int family = nfmsg->nfgen_family;
5454         const struct nft_table *table;
5455         struct nft_object *obj;
5456         struct sk_buff *skb2;
5457         bool reset = false;
5458         u32 objtype;
5459         int err;
5460 
5461         if (nlh->nlmsg_flags & NLM_F_DUMP) {
5462                 struct netlink_dump_control c = {
5463                         .start = nf_tables_dump_obj_start,
5464                         .dump = nf_tables_dump_obj,
5465                         .done = nf_tables_dump_obj_done,
5466                         .module = THIS_MODULE,
5467                         .data = (void *)nla,
5468                 };
5469 
5470                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
5471         }
5472 
5473         if (!nla[NFTA_OBJ_NAME] ||
5474             !nla[NFTA_OBJ_TYPE])
5475                 return -EINVAL;
5476 
5477         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
5478         if (IS_ERR(table)) {
5479                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
5480                 return PTR_ERR(table);
5481         }
5482 
5483         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5484         obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
5485         if (IS_ERR(obj)) {
5486                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
5487                 return PTR_ERR(obj);
5488         }
5489 
5490         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
5491         if (!skb2)
5492                 return -ENOMEM;
5493 
5494         if (NFNL_MSG_TYPE(nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
5495                 reset = true;
5496 
5497         err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid,
5498                                       nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
5499                                       family, table, obj, reset);
5500         if (err < 0)
5501                 goto err;
5502 
5503         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
5504 err:
5505         kfree_skb(skb2);
5506         return err;
5507 }
5508 
5509 static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)
5510 {
5511         if (obj->ops->destroy)
5512                 obj->ops->destroy(ctx, obj);
5513 
5514         module_put(obj->ops->type->owner);
5515         kfree(obj->key.name);
5516         kfree(obj);
5517 }
5518 
5519 static int nf_tables_delobj(struct net *net, struct sock *nlsk,
5520                             struct sk_buff *skb, const struct nlmsghdr *nlh,
5521                             const struct nlattr * const nla[],
5522                             struct netlink_ext_ack *extack)
5523 {
5524         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5525         u8 genmask = nft_genmask_next(net);
5526         int family = nfmsg->nfgen_family;
5527         const struct nlattr *attr;
5528         struct nft_table *table;
5529         struct nft_object *obj;
5530         struct nft_ctx ctx;
5531         u32 objtype;
5532 
5533         if (!nla[NFTA_OBJ_TYPE] ||
5534             (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
5535                 return -EINVAL;
5536 
5537         table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask);
5538         if (IS_ERR(table)) {
5539                 NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
5540                 return PTR_ERR(table);
5541         }
5542 
5543         objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
5544         if (nla[NFTA_OBJ_HANDLE]) {
5545                 attr = nla[NFTA_OBJ_HANDLE];
5546                 obj = nft_obj_lookup_byhandle(table, attr, objtype, genmask);
5547         } else {
5548                 attr = nla[NFTA_OBJ_NAME];
5549                 obj = nft_obj_lookup(net, table, attr, objtype, genmask);
5550         }
5551 
5552         if (IS_ERR(obj)) {
5553                 NL_SET_BAD_ATTR(extack, attr);
5554                 return PTR_ERR(obj);
5555         }
5556         if (obj->use > 0) {
5557                 NL_SET_BAD_ATTR(extack, attr);
5558                 return -EBUSY;
5559         }
5560 
5561         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5562 
5563         return nft_delobj(&ctx, obj);
5564 }
5565 
5566 void nft_obj_notify(struct net *net, const struct nft_table *table,
5567                     struct nft_object *obj, u32 portid, u32 seq, int event,
5568                     int family, int report, gfp_t gfp)
5569 {
5570         struct sk_buff *skb;
5571         int err;
5572 
5573         if (!report &&
5574             !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
5575                 return;
5576 
5577         skb = nlmsg_new(NLMSG_GOODSIZE, gfp);
5578         if (skb == NULL)
5579                 goto err;
5580 
5581         err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family,
5582                                       table, obj, false);
5583         if (err < 0) {
5584                 kfree_skb(skb);
5585                 goto err;
5586         }
5587 
5588         nfnetlink_send(skb, net, portid, NFNLGRP_NFTABLES, report, gfp);
5589         return;
5590 err:
5591         nfnetlink_set_err(net, portid, NFNLGRP_NFTABLES, -ENOBUFS);
5592 }
5593 EXPORT_SYMBOL_GPL(nft_obj_notify);
5594 
5595 static void nf_tables_obj_notify(const struct nft_ctx *ctx,
5596                                  struct nft_object *obj, int event)
5597 {
5598         nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event,
5599                        ctx->family, ctx->report, GFP_KERNEL);
5600 }
5601 
5602 /*
5603  * Flow tables
5604  */
5605 void nft_register_flowtable_type(struct nf_flowtable_type *type)
5606 {
5607         nfnl_lock(NFNL_SUBSYS_NFTABLES);
5608         list_add_tail_rcu(&type->list, &nf_tables_flowtables);
5609         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5610 }
5611 EXPORT_SYMBOL_GPL(nft_register_flowtable_type);
5612 
5613 void nft_unregister_flowtable_type(struct nf_flowtable_type *type)
5614 {
5615         nfnl_lock(NFNL_SUBSYS_NFTABLES);
5616         list_del_rcu(&type->list);
5617         nfnl_unlock(NFNL_SUBSYS_NFTABLES);
5618 }
5619 EXPORT_SYMBOL_GPL(nft_unregister_flowtable_type);
5620 
5621 static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = {
5622         [NFTA_FLOWTABLE_TABLE]          = { .type = NLA_STRING,
5623                                             .len = NFT_NAME_MAXLEN - 1 },
5624         [NFTA_FLOWTABLE_NAME]           = { .type = NLA_STRING,
5625                                             .len = NFT_NAME_MAXLEN - 1 },
5626         [NFTA_FLOWTABLE_HOOK]           = { .type = NLA_NESTED },
5627         [NFTA_FLOWTABLE_HANDLE]         = { .type = NLA_U64 },
5628 };
5629 
5630 struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,
5631                                            const struct nlattr *nla, u8 genmask)
5632 {
5633         struct nft_flowtable *flowtable;
5634 
5635         list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
5636                 if (!nla_strcmp(nla, flowtable->name) &&
5637                     nft_active_genmask(flowtable, genmask))
5638                         return flowtable;
5639         }
5640         return ERR_PTR(-ENOENT);
5641 }
5642 EXPORT_SYMBOL_GPL(nft_flowtable_lookup);
5643 
5644 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,
5645                                     struct nft_flowtable *flowtable,
5646                                     enum nft_trans_phase phase)
5647 {
5648         switch (phase) {
5649         case NFT_TRANS_PREPARE:
5650         case NFT_TRANS_ABORT:
5651         case NFT_TRANS_RELEASE:
5652                 flowtable->use--;
5653                 /* fall through */
5654         default:
5655                 return;
5656         }
5657 }
5658 EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);
5659 
5660 static struct nft_flowtable *
5661 nft_flowtable_lookup_byhandle(const struct nft_table *table,
5662                               const struct nlattr *nla, u8 genmask)
5663 {
5664        struct nft_flowtable *flowtable;
5665 
5666        list_for_each_entry(flowtable, &table->flowtables, list) {
5667                if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
5668                    nft_active_genmask(flowtable, genmask))
5669                        return flowtable;
5670        }
5671        return ERR_PTR(-ENOENT);
5672 }
5673 
5674 static int nf_tables_parse_devices(const struct nft_ctx *ctx,
5675                                    const struct nlattr *attr,
5676                                    struct net_device *dev_array[], int *len)
5677 {
5678         const struct nlattr *tmp;
5679         struct net_device *dev;
5680         char ifname[IFNAMSIZ];
5681         int rem, n = 0, err;
5682 
5683         nla_for_each_nested(tmp, attr, rem) {
5684                 if (nla_type(tmp) != NFTA_DEVICE_NAME) {
5685                         err = -EINVAL;
5686                         goto err1;
5687                 }
5688 
5689                 nla_strlcpy(ifname, tmp, IFNAMSIZ);
5690                 dev = __dev_get_by_name(ctx->net, ifname);
5691                 if (!dev) {
5692                         err = -ENOENT;
5693                         goto err1;
5694                 }
5695 
5696                 dev_array[n++] = dev;
5697                 if (n == NFT_FLOWTABLE_DEVICE_MAX) {
5698                         err = -EFBIG;
5699                         goto err1;
5700                 }
5701         }
5702         if (!len)
5703                 return -EINVAL;
5704 
5705         err = 0;
5706 err1:
5707         *len = n;
5708         return err;
5709 }
5710 
5711 static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX + 1] = {
5712         [NFTA_FLOWTABLE_HOOK_NUM]       = { .type = NLA_U32 },
5713         [NFTA_FLOWTABLE_HOOK_PRIORITY]  = { .type = NLA_U32 },
5714         [NFTA_FLOWTABLE_HOOK_DEVS]      = { .type = NLA_NESTED },
5715 };
5716 
5717 static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
5718                                           const struct nlattr *attr,
5719                                           struct nft_flowtable *flowtable)
5720 {
5721         struct net_device *dev_array[NFT_FLOWTABLE_DEVICE_MAX];
5722         struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1];
5723         struct nf_hook_ops *ops;
5724         int hooknum, priority;
5725         int err, n = 0, i;
5726 
5727         err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
5728                                           nft_flowtable_hook_policy, NULL);
5729         if (err < 0)
5730                 return err;
5731 
5732         if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
5733             !tb[NFTA_FLOWTABLE_HOOK_PRIORITY] ||
5734             !tb[NFTA_FLOWTABLE_HOOK_DEVS])
5735                 return -EINVAL;
5736 
5737         hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
5738         if (hooknum != NF_NETDEV_INGRESS)
5739                 return -EINVAL;
5740 
5741         priority = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
5742 
5743         err = nf_tables_parse_devices(ctx, tb[NFTA_FLOWTABLE_HOOK_DEVS],
5744                                       dev_array, &n);
5745         if (err < 0)
5746                 return err;
5747 
5748         ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
5749         if (!ops)
5750                 return -ENOMEM;
5751 
5752         flowtable->hooknum      = hooknum;
5753         flowtable->priority     = priority;
5754         flowtable->ops          = ops;
5755         flowtable->ops_len      = n;
5756 
5757         for (i = 0; i < n; i++) {
5758                 flowtable->ops[i].pf            = NFPROTO_NETDEV;
5759                 flowtable->ops[i].hooknum       = hooknum;
5760                 flowtable->ops[i].priority      = priority;
5761                 flowtable->ops[i].priv          = &flowtable->data;
5762                 flowtable->ops[i].hook          = flowtable->data.type->hook;
5763                 flowtable->ops[i].dev           = dev_array[i];
5764         }
5765 
5766         return err;
5767 }
5768 
5769 static const struct nf_flowtable_type *__nft_flowtable_type_get(u8 family)
5770 {
5771         const struct nf_flowtable_type *type;
5772 
5773         list_for_each_entry(type, &nf_tables_flowtables, list) {
5774                 if (family == type->family)
5775                         return type;
5776         }
5777         return NULL;
5778 }
5779 
5780 static const struct nf_flowtable_type *
5781 nft_flowtable_type_get(struct net *net, u8 family)
5782 {
5783         const struct nf_flowtable_type *type;
5784 
5785         type = __nft_flowtable_type_get(family);
5786         if (type != NULL && try_module_get(type->owner))
5787                 return type;
5788 
5789         lockdep_nfnl_nft_mutex_not_held();
5790 #ifdef CONFIG_MODULES
5791         if (type == NULL) {
5792                 if (nft_request_module(net, "nf-flowtable-%u", family) == -EAGAIN)
5793                         return ERR_PTR(-EAGAIN);
5794         }
5795 #endif
5796         return ERR_PTR(-ENOENT);
5797 }
5798 
5799 static void nft_unregister_flowtable_net_hooks(struct net *net,
5800                                                struct nft_flowtable *flowtable)
5801 {
5802         int i;
5803 
5804         for (i = 0; i < flowtable->ops_len; i++) {
5805                 if (!flowtable->ops[i].dev)
5806                         continue;
5807 
5808                 nf_unregister_net_hook(net, &flowtable->ops[i]);
5809         }
5810 }
5811 
5812 static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
5813                                   struct sk_buff *skb,
5814                                   const struct nlmsghdr *nlh,
5815                                   const struct nlattr * const nla[],
5816                                   struct netlink_ext_ack *extack)
5817 {
5818         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5819         const struct nf_flowtable_type *type;
5820         struct nft_flowtable *flowtable, *ft;
5821         u8 genmask = nft_genmask_next(net);
5822         int family = nfmsg->nfgen_family;
5823         struct nft_table *table;
5824         struct nft_ctx ctx;
5825         int err, i, k;
5826 
5827         if (!nla[NFTA_FLOWTABLE_TABLE] ||
5828             !nla[NFTA_FLOWTABLE_NAME] ||
5829             !nla[NFTA_FLOWTABLE_HOOK])
5830                 return -EINVAL;
5831 
5832         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5833                                  genmask);
5834         if (IS_ERR(table)) {
5835                 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
5836                 return PTR_ERR(table);
5837         }
5838 
5839         flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5840                                          genmask);
5841         if (IS_ERR(flowtable)) {
5842                 err = PTR_ERR(flowtable);
5843                 if (err != -ENOENT) {
5844                         NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
5845                         return err;
5846                 }
5847         } else {
5848                 if (nlh->nlmsg_flags & NLM_F_EXCL) {
5849                         NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
5850                         return -EEXIST;
5851                 }
5852 
5853                 return 0;
5854         }
5855 
5856         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5857 
5858         flowtable = kzalloc(sizeof(*flowtable), GFP_KERNEL);
5859         if (!flowtable)
5860                 return -ENOMEM;
5861 
5862         flowtable->table = table;
5863         flowtable->handle = nf_tables_alloc_handle(table);
5864 
5865         flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
5866         if (!flowtable->name) {
5867                 err = -ENOMEM;
5868                 goto err1;
5869         }
5870 
5871         type = nft_flowtable_type_get(net, family);
5872         if (IS_ERR(type)) {
5873                 err = PTR_ERR(type);
5874                 goto err2;
5875         }
5876 
5877         flowtable->data.type = type;
5878         err = type->init(&flowtable->data);
5879         if (err < 0)
5880                 goto err3;
5881 
5882         err = nf_tables_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
5883                                              flowtable);
5884         if (err < 0)
5885                 goto err4;
5886 
5887         for (i = 0; i < flowtable->ops_len; i++) {
5888                 if (!flowtable->ops[i].dev)
5889                         continue;
5890 
5891                 list_for_each_entry(ft, &table->flowtables, list) {
5892                         for (k = 0; k < ft->ops_len; k++) {
5893                                 if (!ft->ops[k].dev)
5894                                         continue;
5895 
5896                                 if (flowtable->ops[i].dev == ft->ops[k].dev &&
5897                                     flowtable->ops[i].pf == ft->ops[k].pf) {
5898                                         err = -EBUSY;
5899                                         goto err5;
5900                                 }
5901                         }
5902                 }
5903 
5904                 err = nf_register_net_hook(net, &flowtable->ops[i]);
5905                 if (err < 0)
5906                         goto err5;
5907         }
5908 
5909         err = nft_trans_flowtable_add(&ctx, NFT_MSG_NEWFLOWTABLE, flowtable);
5910         if (err < 0)
5911                 goto err6;
5912 
5913         list_add_tail_rcu(&flowtable->list, &table->flowtables);
5914         table->use++;
5915 
5916         return 0;
5917 err6:
5918         i = flowtable->ops_len;
5919 err5:
5920         for (k = i - 1; k >= 0; k--)
5921                 nf_unregister_net_hook(net, &flowtable->ops[k]);
5922 
5923         kfree(flowtable->ops);
5924 err4:
5925         flowtable->data.type->free(&flowtable->data);
5926 err3:
5927         module_put(type->owner);
5928 err2:
5929         kfree(flowtable->name);
5930 err1:
5931         kfree(flowtable);
5932         return err;
5933 }
5934 
5935 static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
5936                                   struct sk_buff *skb,
5937                                   const struct nlmsghdr *nlh,
5938                                   const struct nlattr * const nla[],
5939                                   struct netlink_ext_ack *extack)
5940 {
5941         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
5942         u8 genmask = nft_genmask_next(net);
5943         int family = nfmsg->nfgen_family;
5944         struct nft_flowtable *flowtable;
5945         const struct nlattr *attr;
5946         struct nft_table *table;
5947         struct nft_ctx ctx;
5948 
5949         if (!nla[NFTA_FLOWTABLE_TABLE] ||
5950             (!nla[NFTA_FLOWTABLE_NAME] &&
5951              !nla[NFTA_FLOWTABLE_HANDLE]))
5952                 return -EINVAL;
5953 
5954         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
5955                                  genmask);
5956         if (IS_ERR(table)) {
5957                 NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_TABLE]);
5958                 return PTR_ERR(table);
5959         }
5960 
5961         if (nla[NFTA_FLOWTABLE_HANDLE]) {
5962                 attr = nla[NFTA_FLOWTABLE_HANDLE];
5963                 flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);
5964         } else {
5965                 attr = nla[NFTA_FLOWTABLE_NAME];
5966                 flowtable = nft_flowtable_lookup(table, attr, genmask);
5967         }
5968 
5969         if (IS_ERR(flowtable)) {
5970                 NL_SET_BAD_ATTR(extack, attr);
5971                 return PTR_ERR(flowtable);
5972         }
5973         if (flowtable->use > 0) {
5974                 NL_SET_BAD_ATTR(extack, attr);
5975                 return -EBUSY;
5976         }
5977 
5978         nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
5979 
5980         return nft_delflowtable(&ctx, flowtable);
5981 }
5982 
5983 static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
5984                                          u32 portid, u32 seq, int event,
5985                                          u32 flags, int family,
5986                                          struct nft_flowtable *flowtable)
5987 {
5988         struct nlattr *nest, *nest_devs;
5989         struct nfgenmsg *nfmsg;
5990         struct nlmsghdr *nlh;
5991         int i;
5992 
5993         event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
5994         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
5995         if (nlh == NULL)
5996                 goto nla_put_failure;
5997 
5998         nfmsg = nlmsg_data(nlh);
5999         nfmsg->nfgen_family     = family;
6000         nfmsg->version          = NFNETLINK_V0;
6001         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
6002 
6003         if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
6004             nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
6005             nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
6006             nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
6007                          NFTA_FLOWTABLE_PAD))
6008                 goto nla_put_failure;
6009 
6010         nest = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK);
6011         if (!nest)
6012                 goto nla_put_failure;
6013         if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
6014             nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
6015                 goto nla_put_failure;
6016 
6017         nest_devs = nla_nest_start_noflag(skb, NFTA_FLOWTABLE_HOOK_DEVS);
6018         if (!nest_devs)
6019                 goto nla_put_failure;
6020 
6021         for (i = 0; i < flowtable->ops_len; i++) {
6022                 const struct net_device *dev = READ_ONCE(flowtable->ops[i].dev);
6023 
6024                 if (dev &&
6025                     nla_put_string(skb, NFTA_DEVICE_NAME, dev->name))
6026                         goto nla_put_failure;
6027         }
6028         nla_nest_end(skb, nest_devs);
6029         nla_nest_end(skb, nest);
6030 
6031         nlmsg_end(skb, nlh);
6032         return 0;
6033 
6034 nla_put_failure:
6035         nlmsg_trim(skb, nlh);
6036         return -1;
6037 }
6038 
6039 struct nft_flowtable_filter {
6040         char            *table;
6041 };
6042 
6043 static int nf_tables_dump_flowtable(struct sk_buff *skb,
6044                                     struct netlink_callback *cb)
6045 {
6046         const struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
6047         struct nft_flowtable_filter *filter = cb->data;
6048         unsigned int idx = 0, s_idx = cb->args[0];
6049         struct net *net = sock_net(skb->sk);
6050         int family = nfmsg->nfgen_family;
6051         struct nft_flowtable *flowtable;
6052         const struct nft_table *table;
6053 
6054         rcu_read_lock();
6055         cb->seq = net->nft.base_seq;
6056 
6057         list_for_each_entry_rcu(table, &net->nft.tables, list) {
6058                 if (family != NFPROTO_UNSPEC && family != table->family)
6059                         continue;
6060 
6061                 list_for_each_entry_rcu(flowtable, &table->flowtables, list) {
6062                         if (!nft_is_active(net, flowtable))
6063                                 goto cont;
6064                         if (idx < s_idx)
6065                                 goto cont;
6066                         if (idx > s_idx)
6067                                 memset(&cb->args[1], 0,
6068                                        sizeof(cb->args) - sizeof(cb->args[0]));
6069                         if (filter && filter->table &&
6070                             strcmp(filter->table, table->name))
6071                                 goto cont;
6072 
6073                         if (nf_tables_fill_flowtable_info(skb, net, NETLINK_CB(cb->skb).portid,
6074                                                           cb->nlh->nlmsg_seq,
6075                                                           NFT_MSG_NEWFLOWTABLE,
6076                                                           NLM_F_MULTI | NLM_F_APPEND,
6077                                                           table->family, flowtable) < 0)
6078                                 goto done;
6079 
6080                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
6081 cont:
6082                         idx++;
6083                 }
6084         }
6085 done:
6086         rcu_read_unlock();
6087 
6088         cb->args[0] = idx;
6089         return skb->len;
6090 }
6091 
6092 static int nf_tables_dump_flowtable_start(struct netlink_callback *cb)
6093 {
6094         const struct nlattr * const *nla = cb->data;
6095         struct nft_flowtable_filter *filter = NULL;
6096 
6097         if (nla[NFTA_FLOWTABLE_TABLE]) {
6098                 filter = kzalloc(sizeof(*filter), GFP_ATOMIC);
6099                 if (!filter)
6100                         return -ENOMEM;
6101 
6102                 filter->table = nla_strdup(nla[NFTA_FLOWTABLE_TABLE],
6103                                            GFP_ATOMIC);
6104                 if (!filter->table) {
6105                         kfree(filter);
6106                         return -ENOMEM;
6107                 }
6108         }
6109 
6110         cb->data = filter;
6111         return 0;
6112 }
6113 
6114 static int nf_tables_dump_flowtable_done(struct netlink_callback *cb)
6115 {
6116         struct nft_flowtable_filter *filter = cb->data;
6117 
6118         if (!filter)
6119                 return 0;
6120 
6121         kfree(filter->table);
6122         kfree(filter);
6123 
6124         return 0;
6125 }
6126 
6127 /* called with rcu_read_lock held */
6128 static int nf_tables_getflowtable(struct net *net, struct sock *nlsk,
6129                                   struct sk_buff *skb,
6130                                   const struct nlmsghdr *nlh,
6131                                   const struct nlattr * const nla[],
6132                                   struct netlink_ext_ack *extack)
6133 {
6134         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
6135         u8 genmask = nft_genmask_cur(net);
6136         int family = nfmsg->nfgen_family;
6137         struct nft_flowtable *flowtable;
6138         const struct nft_table *table;
6139         struct sk_buff *skb2;
6140         int err;
6141 
6142         if (nlh->nlmsg_flags & NLM_F_DUMP) {
6143                 struct netlink_dump_control c = {
6144                         .start = nf_tables_dump_flowtable_start,
6145                         .dump = nf_tables_dump_flowtable,
6146                         .done = nf_tables_dump_flowtable_done,
6147                         .module = THIS_MODULE,
6148                         .data = (void *)nla,
6149                 };
6150 
6151                 return nft_netlink_dump_start_rcu(nlsk, skb, nlh, &c);
6152         }
6153 
6154         if (!nla[NFTA_FLOWTABLE_NAME])
6155                 return -EINVAL;
6156 
6157         table = nft_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE], family,
6158                                  genmask);
6159         if (IS_ERR(table))
6160                 return PTR_ERR(table);
6161 
6162         flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
6163                                          genmask);
6164         if (IS_ERR(flowtable))
6165                 return PTR_ERR(flowtable);
6166 
6167         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
6168         if (!skb2)
6169                 return -ENOMEM;
6170 
6171         err = nf_tables_fill_flowtable_info(skb2, net, NETLINK_CB(skb).portid,
6172                                             nlh->nlmsg_seq,
6173                                             NFT_MSG_NEWFLOWTABLE, 0, family,
6174                                             flowtable);
6175         if (err < 0)
6176                 goto err;
6177 
6178         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6179 err:
6180         kfree_skb(skb2);
6181         return err;
6182 }
6183 
6184 static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
6185                                        struct nft_flowtable *flowtable,
6186                                        int event)
6187 {
6188         struct sk_buff *skb;
6189         int err;
6190 
6191         if (ctx->report &&
6192             !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
6193                 return;
6194 
6195         skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6196         if (skb == NULL)
6197                 goto err;
6198 
6199         err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid,
6200                                             ctx->seq, event, 0,
6201                                             ctx->family, flowtable);
6202         if (err < 0) {
6203                 kfree_skb(skb);
6204                 goto err;
6205         }
6206 
6207         nfnetlink_send(skb, ctx->net, ctx->portid, NFNLGRP_NFTABLES,
6208                        ctx->report, GFP_KERNEL);
6209         return;
6210 err:
6211         nfnetlink_set_err(ctx->net, ctx->portid, NFNLGRP_NFTABLES, -ENOBUFS);
6212 }
6213 
6214 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
6215 {
6216         kfree(flowtable->ops);
6217         kfree(flowtable->name);
6218         flowtable->data.type->free(&flowtable->data);
6219         module_put(flowtable->data.type->owner);
6220         kfree(flowtable);
6221 }
6222 
6223 static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
6224                                    u32 portid, u32 seq)
6225 {
6226         struct nlmsghdr *nlh;
6227         struct nfgenmsg *nfmsg;
6228         char buf[TASK_COMM_LEN];
6229         int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
6230 
6231         nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
6232         if (nlh == NULL)
6233                 goto nla_put_failure;
6234 
6235         nfmsg = nlmsg_data(nlh);
6236         nfmsg->nfgen_family     = AF_UNSPEC;
6237         nfmsg->version          = NFNETLINK_V0;
6238         nfmsg->res_id           = htons(net->nft.base_seq & 0xffff);
6239 
6240         if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
6241             nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
6242             nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
6243                 goto nla_put_failure;
6244 
6245         nlmsg_end(skb, nlh);
6246         return 0;
6247 
6248 nla_put_failure:
6249         nlmsg_trim(skb, nlh);
6250         return -EMSGSIZE;
6251 }
6252 
6253 static void nft_flowtable_event(unsigned long event, struct net_device *dev,
6254                                 struct nft_flowtable *flowtable)
6255 {
6256         int i;
6257 
6258         for (i = 0; i < flowtable->ops_len; i++) {
6259                 if (flowtable->ops[i].dev != dev)
6260                         continue;
6261 
6262                 nf_unregister_net_hook(dev_net(dev), &flowtable->ops[i]);
6263                 flowtable->ops[i].dev = NULL;
6264                 break;
6265         }
6266 }
6267 
6268 static int nf_tables_flowtable_event(struct notifier_block *this,
6269                                      unsigned long event, void *ptr)
6270 {
6271         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
6272         struct nft_flowtable *flowtable;
6273         struct nft_table *table;
6274         struct net *net;
6275 
6276         if (event != NETDEV_UNREGISTER)
6277                 return 0;
6278 
6279         net = dev_net(dev);
6280         mutex_lock(&net->nft.commit_mutex);
6281         list_for_each_entry(table, &net->nft.tables, list) {
6282                 list_for_each_entry(flowtable, &table->flowtables, list) {
6283                         nft_flowtable_event(event, dev, flowtable);
6284                 }
6285         }
6286         mutex_unlock(&net->nft.commit_mutex);
6287 
6288         return NOTIFY_DONE;
6289 }
6290 
6291 static struct notifier_block nf_tables_flowtable_notifier = {
6292         .notifier_call  = nf_tables_flowtable_event,
6293 };
6294 
6295 static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
6296                                  int event)
6297 {
6298         struct nlmsghdr *nlh = nlmsg_hdr(skb);
6299         struct sk_buff *skb2;
6300         int err;
6301 
6302         if (nlmsg_report(nlh) &&
6303             !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
6304                 return;
6305 
6306         skb2 = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
6307         if (skb2 == NULL)
6308                 goto err;
6309 
6310         err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6311                                       nlh->nlmsg_seq);
6312         if (err < 0) {
6313                 kfree_skb(skb2);
6314                 goto err;
6315         }
6316 
6317         nfnetlink_send(skb2, net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6318                        nlmsg_report(nlh), GFP_KERNEL);
6319         return;
6320 err:
6321         nfnetlink_set_err(net, NETLINK_CB(skb).portid, NFNLGRP_NFTABLES,
6322                           -ENOBUFS);
6323 }
6324 
6325 static int nf_tables_getgen(struct net *net, struct sock *nlsk,
6326                             struct sk_buff *skb, const struct nlmsghdr *nlh,
6327                             const struct nlattr * const nla[],
6328                             struct netlink_ext_ack *extack)
6329 {
6330         struct sk_buff *skb2;
6331         int err;
6332 
6333         skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
6334         if (skb2 == NULL)
6335                 return -ENOMEM;
6336 
6337         err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid,
6338                                       nlh->nlmsg_seq);
6339         if (err < 0)
6340                 goto err;
6341 
6342         return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
6343 err:
6344         kfree_skb(skb2);
6345         return err;
6346 }
6347 
6348 static const struct nfnl_callback nf_tables_cb[NFT_MSG_MAX] = {
6349         [NFT_MSG_NEWTABLE] = {
6350                 .call_batch     = nf_tables_newtable,
6351                 .attr_count     = NFTA_TABLE_MAX,
6352                 .policy         = nft_table_policy,
6353         },
6354         [NFT_MSG_GETTABLE] = {
6355                 .call_rcu       = nf_tables_gettable,
6356                 .attr_count     = NFTA_TABLE_MAX,
6357                 .policy         = nft_table_policy,
6358         },
6359         [NFT_MSG_DELTABLE] = {
6360                 .call_batch     = nf_tables_deltable,
6361                 .attr_count     = NFTA_TABLE_MAX,
6362                 .policy         = nft_table_policy,
6363         },
6364         [NFT_MSG_NEWCHAIN] = {
6365                 .call_batch     = nf_tables_newchain,
6366                 .attr_count     = NFTA_CHAIN_MAX,
6367                 .policy         = nft_chain_policy,
6368         },
6369         [NFT_MSG_GETCHAIN] = {
6370                 .call_rcu       = nf_tables_getchain,
6371                 .attr_count     = NFTA_CHAIN_MAX,
6372                 .policy         = nft_chain_policy,
6373         },
6374         [NFT_MSG_DELCHAIN] = {
6375                 .call_batch     = nf_tables_delchain,
6376                 .attr_count     = NFTA_CHAIN_MAX,
6377                 .policy         = nft_chain_policy,
6378         },
6379         [NFT_MSG_NEWRULE] = {
6380                 .call_batch     = nf_tables_newrule,
6381                 .attr_count     = NFTA_RULE_MAX,
6382                 .policy         = nft_rule_policy,
6383         },
6384         [NFT_MSG_GETRULE] = {
6385                 .call_rcu       = nf_tables_getrule,
6386                 .attr_count     = NFTA_RULE_MAX,
6387                 .policy         = nft_rule_policy,
6388         },
6389         [NFT_MSG_DELRULE] = {
6390                 .call_batch     = nf_tables_delrule,
6391                 .attr_count     = NFTA_RULE_MAX,
6392                 .policy         = nft_rule_policy,
6393         },
6394         [NFT_MSG_NEWSET] = {
6395                 .call_batch     = nf_tables_newset,
6396                 .attr_count     = NFTA_SET_MAX,
6397                 .policy         = nft_set_policy,
6398         },
6399         [NFT_MSG_GETSET] = {
6400                 .call_rcu       = nf_tables_getset,
6401                 .attr_count     = NFTA_SET_MAX,
6402                 .policy         = nft_set_policy,
6403         },
6404         [NFT_MSG_DELSET] = {
6405                 .call_batch     = nf_tables_delset,
6406                 .attr_count     = NFTA_SET_MAX,
6407                 .policy         = nft_set_policy,
6408         },
6409         [NFT_MSG_NEWSETELEM] = {
6410                 .call_batch     = nf_tables_newsetelem,
6411                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
6412                 .policy         = nft_set_elem_list_policy,
6413         },
6414         [NFT_MSG_GETSETELEM] = {
6415                 .call_rcu       = nf_tables_getsetelem,
6416                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
6417                 .policy         = nft_set_elem_list_policy,
6418         },
6419         [NFT_MSG_DELSETELEM] = {
6420                 .call_batch     = nf_tables_delsetelem,
6421                 .attr_count     = NFTA_SET_ELEM_LIST_MAX,
6422                 .policy         = nft_set_elem_list_policy,
6423         },
6424         [NFT_MSG_GETGEN] = {
6425                 .call_rcu       = nf_tables_getgen,
6426         },
6427         [NFT_MSG_NEWOBJ] = {
6428                 .call_batch     = nf_tables_newobj,
6429                 .attr_count     = NFTA_OBJ_MAX,
6430                 .policy         = nft_obj_policy,
6431         },
6432         [NFT_MSG_GETOBJ] = {
6433                 .call_rcu       = nf_tables_getobj,
6434                 .attr_count     = NFTA_OBJ_MAX,
6435                 .policy         = nft_obj_policy,
6436         },
6437         [NFT_MSG_DELOBJ] = {
6438                 .call_batch     = nf_tables_delobj,
6439                 .attr_count     = NFTA_OBJ_MAX,
6440                 .policy         = nft_obj_policy,
6441         },
6442         [NFT_MSG_GETOBJ_RESET] = {
6443                 .call_rcu       = nf_tables_getobj,
6444                 .attr_count     = NFTA_OBJ_MAX,
6445                 .policy         = nft_obj_policy,
6446         },
6447         [NFT_MSG_NEWFLOWTABLE] = {
6448                 .call_batch     = nf_tables_newflowtable,
6449                 .attr_count     = NFTA_FLOWTABLE_MAX,
6450                 .policy         = nft_flowtable_policy,
6451         },
6452         [NFT_MSG_GETFLOWTABLE] = {
6453                 .call_rcu       = nf_tables_getflowtable,
6454                 .attr_count     = NFTA_FLOWTABLE_MAX,
6455                 .policy         = nft_flowtable_policy,
6456         },
6457         [NFT_MSG_DELFLOWTABLE] = {
6458                 .call_batch     = nf_tables_delflowtable,
6459                 .attr_count     = NFTA_FLOWTABLE_MAX,
6460                 .policy         = nft_flowtable_policy,
6461         },
6462 };
6463 
6464 static int nf_tables_validate(struct net *net)
6465 {
6466         struct nft_table *table;
6467 
6468         switch (net->nft.validate_state) {
6469         case NFT_VALIDATE_SKIP:
6470                 break;
6471         case NFT_VALIDATE_NEED:
6472                 nft_validate_state_update(net, NFT_VALIDATE_DO);
6473                 /* fall through */
6474         case NFT_VALIDATE_DO:
6475                 list_for_each_entry(table, &net->nft.tables, list) {
6476                         if (nft_table_validate(net, table) < 0)
6477                                 return -EAGAIN;
6478                 }
6479                 break;
6480         }
6481 
6482         return 0;
6483 }
6484 
6485 /* a drop policy has to be deferred until all rules have been activated,
6486  * otherwise a large ruleset that contains a drop-policy base chain will
6487  * cause all packets to get dropped until the full transaction has been
6488  * processed.
6489  *
6490  * We defer the drop policy until the transaction has been finalized.
6491  */
6492 static void nft_chain_commit_drop_policy(struct nft_trans *trans)
6493 {
6494         struct nft_base_chain *basechain;
6495 
6496         if (nft_trans_chain_policy(trans) != NF_DROP)
6497                 return;
6498 
6499         if (!nft_is_base_chain(trans->ctx.chain))
6500                 return;
6501 
6502         basechain = nft_base_chain(trans->ctx.chain);
6503         basechain->policy = NF_DROP;
6504 }
6505 
6506 static void nft_chain_commit_update(struct nft_trans *trans)
6507 {
6508         struct nft_base_chain *basechain;
6509 
6510         if (nft_trans_chain_name(trans)) {
6511                 rhltable_remove(&trans->ctx.table->chains_ht,
6512                                 &trans->ctx.chain->rhlhead,
6513                                 nft_chain_ht_params);
6514                 swap(trans->ctx.chain->name, nft_trans_chain_name(trans));
6515                 rhltable_insert_key(&trans->ctx.table->chains_ht,
6516                                     trans->ctx.chain->name,
6517                                     &trans->ctx.chain->rhlhead,
6518                                     nft_chain_ht_params);
6519         }
6520 
6521         if (!nft_is_base_chain(trans->ctx.chain))
6522                 return;
6523 
6524         nft_chain_stats_replace(trans);
6525 
6526         basechain = nft_base_chain(trans->ctx.chain);
6527 
6528         switch (nft_trans_chain_policy(trans)) {
6529         case NF_DROP:
6530         case NF_ACCEPT:
6531                 basechain->policy = nft_trans_chain_policy(trans);
6532                 break;
6533         }
6534 }
6535 
6536 static void nft_obj_commit_update(struct nft_trans *trans)
6537 {
6538         struct nft_object *newobj;
6539         struct nft_object *obj;
6540 
6541         obj = nft_trans_obj(trans);
6542         newobj = nft_trans_obj_newobj(trans);
6543 
6544         if (obj->ops->update)
6545                 obj->ops->update(obj, newobj);
6546 
6547         kfree(newobj);
6548 }
6549 
6550 static void nft_commit_release(struct nft_trans *trans)
6551 {
6552         switch (trans->msg_type) {
6553         case NFT_MSG_DELTABLE:
6554                 nf_tables_table_destroy(&trans->ctx);
6555                 break;
6556         case NFT_MSG_NEWCHAIN:
6557                 free_percpu(nft_trans_chain_stats(trans));
6558                 kfree(nft_trans_chain_name(trans));
6559                 break;
6560         case NFT_MSG_DELCHAIN:
6561                 nf_tables_chain_destroy(&trans->ctx);
6562                 break;
6563         case NFT_MSG_DELRULE:
6564                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6565                 break;
6566         case NFT_MSG_DELSET:
6567                 nft_set_destroy(nft_trans_set(trans));
6568                 break;
6569         case NFT_MSG_DELSETELEM:
6570                 nf_tables_set_elem_destroy(&trans->ctx,
6571                                            nft_trans_elem_set(trans),
6572                                            nft_trans_elem(trans).priv);
6573                 break;
6574         case NFT_MSG_DELOBJ:
6575                 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
6576                 break;
6577         case NFT_MSG_DELFLOWTABLE:
6578                 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
6579                 break;
6580         }
6581 
6582         if (trans->put_net)
6583                 put_net(trans->ctx.net);
6584 
6585         kfree(trans);
6586 }
6587 
6588 static void nf_tables_trans_destroy_work(struct work_struct *w)
6589 {
6590         struct nft_trans *trans, *next;
6591         LIST_HEAD(head);
6592 
6593         spin_lock(&nf_tables_destroy_list_lock);
6594         list_splice_init(&nf_tables_destroy_list, &head);
6595         spin_unlock(&nf_tables_destroy_list_lock);
6596 
6597         if (list_empty(&head))
6598                 return;
6599 
6600         synchronize_rcu();
6601 
6602         list_for_each_entry_safe(trans, next, &head, list) {
6603                 list_del(&trans->list);
6604                 nft_commit_release(trans);
6605         }
6606 }
6607 
6608 static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
6609 {
6610         struct nft_rule *rule;
6611         unsigned int alloc = 0;
6612         int i;
6613 
6614         /* already handled or inactive chain? */
6615         if (chain->rules_next || !nft_is_active_next(net, chain))
6616                 return 0;
6617 
6618         rule = list_entry(&chain->rules, struct nft_rule, list);
6619         i = 0;
6620 
6621         list_for_each_entry_continue(rule, &chain->rules, list) {
6622                 if (nft_is_active_next(net, rule))
6623                         alloc++;
6624         }
6625 
6626         chain->rules_next = nf_tables_chain_alloc_rules(chain, alloc);
6627         if (!chain->rules_next)
6628                 return -ENOMEM;
6629 
6630         list_for_each_entry_continue(rule, &chain->rules, list) {
6631                 if (nft_is_active_next(net, rule))
6632                         chain->rules_next[i++] = rule;
6633         }
6634 
6635         chain->rules_next[i] = NULL;
6636         return 0;
6637 }
6638 
6639 static void nf_tables_commit_chain_prepare_cancel(struct net *net)
6640 {
6641         struct nft_trans *trans, *next;
6642 
6643         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6644                 struct nft_chain *chain = trans->ctx.chain;
6645 
6646                 if (trans->msg_type == NFT_MSG_NEWRULE ||
6647                     trans->msg_type == NFT_MSG_DELRULE) {
6648                         kvfree(chain->rules_next);
6649                         chain->rules_next = NULL;
6650                 }
6651         }
6652 }
6653 
6654 static void __nf_tables_commit_chain_free_rules_old(struct rcu_head *h)
6655 {
6656         struct nft_rules_old *o = container_of(h, struct nft_rules_old, h);
6657 
6658         kvfree(o->start);
6659 }
6660 
6661 static void nf_tables_commit_chain_free_rules_old(struct nft_rule **rules)
6662 {
6663         struct nft_rule **r = rules;
6664         struct nft_rules_old *old;
6665 
6666         while (*r)
6667                 r++;
6668 
6669         r++;    /* rcu_head is after end marker */
6670         old = (void *) r;
6671         old->start = rules;
6672 
6673         call_rcu(&old->h, __nf_tables_commit_chain_free_rules_old);
6674 }
6675 
6676 static void nf_tables_commit_chain(struct net *net, struct nft_chain *chain)
6677 {
6678         struct nft_rule **g0, **g1;
6679         bool next_genbit;
6680 
6681         next_genbit = nft_gencursor_next(net);
6682 
6683         g0 = rcu_dereference_protected(chain->rules_gen_0,
6684                                        lockdep_commit_lock_is_held(net));
6685         g1 = rcu_dereference_protected(chain->rules_gen_1,
6686                                        lockdep_commit_lock_is_held(net));
6687 
6688         /* No changes to this chain? */
6689         if (chain->rules_next == NULL) {
6690                 /* chain had no change in last or next generation */
6691                 if (g0 == g1)
6692                         return;
6693                 /*
6694                  * chain had no change in this generation; make sure next
6695                  * one uses same rules as current generation.
6696                  */
6697                 if (next_genbit) {
6698                         rcu_assign_pointer(chain->rules_gen_1, g0);
6699                         nf_tables_commit_chain_free_rules_old(g1);
6700                 } else {
6701                         rcu_assign_pointer(chain->rules_gen_0, g1);
6702                         nf_tables_commit_chain_free_rules_old(g0);
6703                 }
6704 
6705                 return;
6706         }
6707 
6708         if (next_genbit)
6709                 rcu_assign_pointer(chain->rules_gen_1, chain->rules_next);
6710         else
6711                 rcu_assign_pointer(chain->rules_gen_0, chain->rules_next);
6712 
6713         chain->rules_next = NULL;
6714 
6715         if (g0 == g1)
6716                 return;
6717 
6718         if (next_genbit)
6719                 nf_tables_commit_chain_free_rules_old(g1);
6720         else
6721                 nf_tables_commit_chain_free_rules_old(g0);
6722 }
6723 
6724 static void nft_obj_del(struct nft_object *obj)
6725 {
6726         rhltable_remove(&nft_objname_ht, &obj->rhlhead, nft_objname_ht_params);
6727         list_del_rcu(&obj->list);
6728 }
6729 
6730 static void nft_chain_del(struct nft_chain *chain)
6731 {
6732         struct nft_table *table = chain->table;
6733 
6734         WARN_ON_ONCE(rhltable_remove(&table->chains_ht, &chain->rhlhead,
6735                                      nft_chain_ht_params));
6736         list_del_rcu(&chain->list);
6737 }
6738 
6739 static void nf_tables_module_autoload_cleanup(struct net *net)
6740 {
6741         struct nft_module_request *req, *next;
6742 
6743         WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
6744         list_for_each_entry_safe(req, next, &net->nft.module_list, list) {
6745                 WARN_ON_ONCE(!req->done);
6746                 list_del(&req->list);
6747                 kfree(req);
6748         }
6749 }
6750 
6751 static void nf_tables_commit_release(struct net *net)
6752 {
6753         struct nft_trans *trans;
6754 
6755         /* all side effects have to be made visible.
6756          * For example, if a chain named 'foo' has been deleted, a
6757          * new transaction must not find it anymore.
6758          *
6759          * Memory reclaim happens asynchronously from work queue
6760          * to prevent expensive synchronize_rcu() in commit phase.
6761          */
6762         if (list_empty(&net->nft.commit_list)) {
6763                 nf_tables_module_autoload_cleanup(net);
6764                 mutex_unlock(&net->nft.commit_mutex);
6765                 return;
6766         }
6767 
6768         trans = list_last_entry(&net->nft.commit_list,
6769                                 struct nft_trans, list);
6770         get_net(trans->ctx.net);
6771         WARN_ON_ONCE(trans->put_net);
6772 
6773         trans->put_net = true;
6774         spin_lock(&nf_tables_destroy_list_lock);
6775         list_splice_tail_init(&net->nft.commit_list, &nf_tables_destroy_list);
6776         spin_unlock(&nf_tables_destroy_list_lock);
6777 
6778         nf_tables_module_autoload_cleanup(net);
6779         mutex_unlock(&net->nft.commit_mutex);
6780 
6781         schedule_work(&trans_destroy_work);
6782 }
6783 
6784 static int nf_tables_commit(struct net *net, struct sk_buff *skb)
6785 {
6786         struct nft_trans *trans, *next;
6787         struct nft_trans_elem *te;
6788         struct nft_chain *chain;
6789         struct nft_table *table;
6790         int err;
6791 
6792         if (list_empty(&net->nft.commit_list)) {
6793                 mutex_unlock(&net->nft.commit_mutex);
6794                 return 0;
6795         }
6796 
6797         /* 0. Validate ruleset, otherwise roll back for error reporting. */
6798         if (nf_tables_validate(net) < 0)
6799                 return -EAGAIN;
6800 
6801         err = nft_flow_rule_offload_commit(net);
6802         if (err < 0)
6803                 return err;
6804 
6805         /* 1.  Allocate space for next generation rules_gen_X[] */
6806         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6807                 int ret;
6808 
6809                 if (trans->msg_type == NFT_MSG_NEWRULE ||
6810                     trans->msg_type == NFT_MSG_DELRULE) {
6811                         chain = trans->ctx.chain;
6812 
6813                         ret = nf_tables_commit_chain_prepare(net, chain);
6814                         if (ret < 0) {
6815                                 nf_tables_commit_chain_prepare_cancel(net);
6816                                 return ret;
6817                         }
6818                 }
6819         }
6820 
6821         /* step 2.  Make rules_gen_X visible to packet path */
6822         list_for_each_entry(table, &net->nft.tables, list) {
6823                 list_for_each_entry(chain, &table->chains, list)
6824                         nf_tables_commit_chain(net, chain);
6825         }
6826 
6827         /*
6828          * Bump generation counter, invalidate any dump in progress.
6829          * Cannot fail after this point.
6830          */
6831         while (++net->nft.base_seq == 0);
6832 
6833         /* step 3. Start new generation, rules_gen_X now in use. */
6834         net->nft.gencursor = nft_gencursor_next(net);
6835 
6836         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
6837                 switch (trans->msg_type) {
6838                 case NFT_MSG_NEWTABLE:
6839                         if (nft_trans_table_update(trans)) {
6840                                 if (!nft_trans_table_enable(trans)) {
6841                                         nf_tables_table_disable(net,
6842                                                                 trans->ctx.table);
6843                                         trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
6844                                 }
6845                         } else {
6846                                 nft_clear(net, trans->ctx.table);
6847                         }
6848                         nf_tables_table_notify(&trans->ctx, NFT_MSG_NEWTABLE);
6849                         nft_trans_destroy(trans);
6850                         break;
6851                 case NFT_MSG_DELTABLE:
6852                         list_del_rcu(&trans->ctx.table->list);
6853                         nf_tables_table_notify(&trans->ctx, NFT_MSG_DELTABLE);
6854                         break;
6855                 case NFT_MSG_NEWCHAIN:
6856                         if (nft_trans_chain_update(trans)) {
6857                                 nft_chain_commit_update(trans);
6858                                 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6859                                 /* trans destroyed after rcu grace period */
6860                         } else {
6861                                 nft_chain_commit_drop_policy(trans);
6862                                 nft_clear(net, trans->ctx.chain);
6863                                 nf_tables_chain_notify(&trans->ctx, NFT_MSG_NEWCHAIN);
6864                                 nft_trans_destroy(trans);
6865                         }
6866                         break;
6867                 case NFT_MSG_DELCHAIN:
6868                         nft_chain_del(trans->ctx.chain);
6869                         nf_tables_chain_notify(&trans->ctx, NFT_MSG_DELCHAIN);
6870                         nf_tables_unregister_hook(trans->ctx.net,
6871                                                   trans->ctx.table,
6872                                                   trans->ctx.chain);
6873                         break;
6874                 case NFT_MSG_NEWRULE:
6875                         nft_clear(trans->ctx.net, nft_trans_rule(trans));
6876                         nf_tables_rule_notify(&trans->ctx,
6877                                               nft_trans_rule(trans),
6878                                               NFT_MSG_NEWRULE);
6879                         nft_trans_destroy(trans);
6880                         break;
6881                 case NFT_MSG_DELRULE:
6882                         list_del_rcu(&nft_trans_rule(trans)->list);
6883                         nf_tables_rule_notify(&trans->ctx,
6884                                               nft_trans_rule(trans),
6885                                               NFT_MSG_DELRULE);
6886                         nft_rule_expr_deactivate(&trans->ctx,
6887                                                  nft_trans_rule(trans),
6888                                                  NFT_TRANS_COMMIT);
6889                         break;
6890                 case NFT_MSG_NEWSET:
6891                         nft_clear(net, nft_trans_set(trans));
6892                         /* This avoids hitting -EBUSY when deleting the table
6893                          * from the transaction.
6894                          */
6895                         if (nft_set_is_anonymous(nft_trans_set(trans)) &&
6896                             !list_empty(&nft_trans_set(trans)->bindings))
6897                                 trans->ctx.table->use--;
6898 
6899                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
6900                                              NFT_MSG_NEWSET, GFP_KERNEL);
6901                         nft_trans_destroy(trans);
6902                         break;
6903                 case NFT_MSG_DELSET:
6904                         list_del_rcu(&nft_trans_set(trans)->list);
6905                         nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),
6906                                              NFT_MSG_DELSET, GFP_KERNEL);
6907                         break;
6908                 case NFT_MSG_NEWSETELEM:
6909                         te = (struct nft_trans_elem *)trans->data;
6910 
6911                         te->set->ops->activate(net, te->set, &te->elem);
6912                         nf_tables_setelem_notify(&trans->ctx, te->set,
6913                                                  &te->elem,
6914                                                  NFT_MSG_NEWSETELEM, 0);
6915                         nft_trans_destroy(trans);
6916                         break;
6917                 case NFT_MSG_DELSETELEM:
6918                         te = (struct nft_trans_elem *)trans->data;
6919 
6920                         nf_tables_setelem_notify(&trans->ctx, te->set,
6921                                                  &te->elem,
6922                                                  NFT_MSG_DELSETELEM, 0);
6923                         te->set->ops->remove(net, te->set, &te->elem);
6924                         atomic_dec(&te->set->nelems);
6925                         te->set->ndeact--;
6926                         break;
6927                 case NFT_MSG_NEWOBJ:
6928                         if (nft_trans_obj_update(trans)) {
6929                                 nft_obj_commit_update(trans);
6930                                 nf_tables_obj_notify(&trans->ctx,
6931                                                      nft_trans_obj(trans),
6932                                                      NFT_MSG_NEWOBJ);
6933                         } else {
6934                                 nft_clear(net, nft_trans_obj(trans));
6935                                 nf_tables_obj_notify(&trans->ctx,
6936                                                      nft_trans_obj(trans),
6937                                                      NFT_MSG_NEWOBJ);
6938                                 nft_trans_destroy(trans);
6939                         }
6940                         break;
6941                 case NFT_MSG_DELOBJ:
6942                         nft_obj_del(nft_trans_obj(trans));
6943                         nf_tables_obj_notify(&trans->ctx, nft_trans_obj(trans),
6944                                              NFT_MSG_DELOBJ);
6945                         break;
6946                 case NFT_MSG_NEWFLOWTABLE:
6947                         nft_clear(net, nft_trans_flowtable(trans));
6948                         nf_tables_flowtable_notify(&trans->ctx,
6949                                                    nft_trans_flowtable(trans),
6950                                                    NFT_MSG_NEWFLOWTABLE);
6951                         nft_trans_destroy(trans);
6952                         break;
6953                 case NFT_MSG_DELFLOWTABLE:
6954                         list_del_rcu(&nft_trans_flowtable(trans)->list);
6955                         nf_tables_flowtable_notify(&trans->ctx,
6956                                                    nft_trans_flowtable(trans),
6957                                                    NFT_MSG_DELFLOWTABLE);
6958                         nft_unregister_flowtable_net_hooks(net,
6959                                         nft_trans_flowtable(trans));
6960                         break;
6961                 }
6962         }
6963 
6964         nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
6965         nf_tables_commit_release(net);
6966 
6967         return 0;
6968 }
6969 
6970 static void nf_tables_module_autoload(struct net *net)
6971 {
6972         struct nft_module_request *req, *next;
6973         LIST_HEAD(module_list);
6974 
6975         list_splice_init(&net->nft.module_list, &module_list);
6976         mutex_unlock(&net->nft.commit_mutex);
6977         list_for_each_entry_safe(req, next, &module_list, list) {
6978                 request_module("%s", req->module);
6979                 req->done = true;
6980         }
6981         mutex_lock(&net->nft.commit_mutex);
6982         list_splice(&module_list, &net->nft.module_list);
6983 }
6984 
6985 static void nf_tables_abort_release(struct nft_trans *trans)
6986 {
6987         switch (trans->msg_type) {
6988         case NFT_MSG_NEWTABLE:
6989                 nf_tables_table_destroy(&trans->ctx);
6990                 break;
6991         case NFT_MSG_NEWCHAIN:
6992                 nf_tables_chain_destroy(&trans->ctx);
6993                 break;
6994         case NFT_MSG_NEWRULE:
6995                 nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
6996                 break;
6997         case NFT_MSG_NEWSET:
6998                 nft_set_destroy(nft_trans_set(trans));
6999                 break;
7000         case NFT_MSG_NEWSETELEM:
7001                 nft_set_elem_destroy(nft_trans_elem_set(trans),
7002                                      nft_trans_elem(trans).priv, true);
7003                 break;
7004         case NFT_MSG_NEWOBJ:
7005                 nft_obj_destroy(&trans->ctx, nft_trans_obj(trans));
7006                 break;
7007         case NFT_MSG_NEWFLOWTABLE:
7008                 nf_tables_flowtable_destroy(nft_trans_flowtable(trans));
7009                 break;
7010         }
7011         kfree(trans);
7012 }
7013 
7014 static int __nf_tables_abort(struct net *net, bool autoload)
7015 {
7016         struct nft_trans *trans, *next;
7017         struct nft_trans_elem *te;
7018 
7019         list_for_each_entry_safe_reverse(trans, next, &net->nft.commit_list,
7020                                          list) {
7021                 switch (trans->msg_type) {
7022                 case NFT_MSG_NEWTABLE:
7023                         if (nft_trans_table_update(trans)) {
7024                                 if (nft_trans_table_enable(trans)) {
7025                                         nf_tables_table_disable(net,
7026                                                                 trans->ctx.table);
7027                                         trans->ctx.table->flags |= NFT_TABLE_F_DORMANT;
7028                                 }
7029                                 nft_trans_destroy(trans);
7030                         } else {
7031                                 list_del_rcu(&trans->ctx.table->list);
7032                         }
7033                         break;
7034                 case NFT_MSG_DELTABLE:
7035                         nft_clear(trans->ctx.net, trans->ctx.table);
7036                         nft_trans_destroy(trans);
7037                         break;
7038                 case NFT_MSG_NEWCHAIN:
7039                         if (nft_trans_chain_update(trans)) {
7040                                 free_percpu(nft_trans_chain_stats(trans));
7041                                 kfree(nft_trans_chain_name(trans));
7042                                 nft_trans_destroy(trans);
7043                         } else {
7044                                 trans->ctx.table->use--;
7045                                 nft_chain_del(trans->ctx.chain);
7046                                 nf_tables_unregister_hook(trans->ctx.net,
7047                                                           trans->ctx.table,
7048                                                           trans->ctx.chain);
7049                         }
7050                         break;
7051                 case NFT_MSG_DELCHAIN:
7052                         trans->ctx.table->use++;
7053                         nft_clear(trans->ctx.net, trans->ctx.chain);
7054                         nft_trans_destroy(trans);
7055                         break;
7056                 case NFT_MSG_NEWRULE:
7057                         trans->ctx.chain->use--;
7058                         list_del_rcu(&nft_trans_rule(trans)->list);
7059                         nft_rule_expr_deactivate(&trans->ctx,
7060                                                  nft_trans_rule(trans),
7061                                                  NFT_TRANS_ABORT);
7062                         break;
7063                 case NFT_MSG_DELRULE:
7064                         trans->ctx.chain->use++;
7065                         nft_clear(trans->ctx.net, nft_trans_rule(trans));
7066                         nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans));
7067                         nft_trans_destroy(trans);
7068                         break;
7069                 case NFT_MSG_NEWSET:
7070                         trans->ctx.table->use--;
7071                         if (nft_trans_set_bound(trans)) {
7072                                 nft_trans_destroy(trans);
7073                                 break;
7074                         }
7075                         list_del_rcu(&nft_trans_set(trans)->list);
7076                         break;
7077                 case NFT_MSG_DELSET:
7078                         trans->ctx.table->use++;
7079                         nft_clear(trans->ctx.net, nft_trans_set(trans));
7080                         nft_trans_destroy(trans);
7081                         break;
7082                 case NFT_MSG_NEWSETELEM:
7083                         if (nft_trans_elem_set_bound(trans)) {
7084                                 nft_trans_destroy(trans);
7085                                 break;
7086                         }
7087                         te = (struct nft_trans_elem *)trans->data;
7088                         te->set->ops->remove(net, te->set, &te->elem);
7089                         atomic_dec(&te->set->nelems);
7090                         break;
7091                 case NFT_MSG_DELSETELEM:
7092                         te = (struct nft_trans_elem *)trans->data;
7093 
7094                         nft_set_elem_activate(net, te->set, &te->elem);
7095                         te->set->ops->activate(net, te->set, &te->elem);
7096                         te->set->ndeact--;
7097 
7098                         nft_trans_destroy(trans);
7099                         break;
7100                 case NFT_MSG_NEWOBJ:
7101                         if (nft_trans_obj_update(trans)) {
7102                                 kfree(nft_trans_obj_newobj(trans));
7103                                 nft_trans_destroy(trans);
7104                         } else {
7105                                 trans->ctx.table->use--;
7106                                 nft_obj_del(nft_trans_obj(trans));
7107                         }
7108                         break;
7109                 case NFT_MSG_DELOBJ:
7110                         trans->ctx.table->use++;
7111                         nft_clear(trans->ctx.net, nft_trans_obj(trans));
7112                         nft_trans_destroy(trans);
7113                         break;
7114                 case NFT_MSG_NEWFLOWTABLE:
7115                         trans->ctx.table->use--;
7116                         list_del_rcu(&nft_trans_flowtable(trans)->list);
7117                         nft_unregister_flowtable_net_hooks(net,
7118                                         nft_trans_flowtable(trans));
7119                         break;
7120                 case NFT_MSG_DELFLOWTABLE:
7121                         trans->ctx.table->use++;
7122                         nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
7123                         nft_trans_destroy(trans);
7124                         break;
7125                 }
7126         }
7127 
7128         synchronize_rcu();
7129 
7130         list_for_each_entry_safe_reverse(trans, next,
7131                                          &net->nft.commit_list, list) {
7132                 list_del(&trans->list);
7133                 nf_tables_abort_release(trans);
7134         }
7135 
7136         if (autoload)
7137                 nf_tables_module_autoload(net);
7138         else
7139                 nf_tables_module_autoload_cleanup(net);
7140 
7141         return 0;
7142 }
7143 
7144 static void nf_tables_cleanup(struct net *net)
7145 {
7146         nft_validate_state_update(net, NFT_VALIDATE_SKIP);
7147 }
7148 
7149 static int nf_tables_abort(struct net *net, struct sk_buff *skb, bool autoload)
7150 {
7151         int ret = __nf_tables_abort(net, autoload);
7152 
7153         mutex_unlock(&net->nft.commit_mutex);
7154 
7155         return ret;
7156 }
7157 
7158 static bool nf_tables_valid_genid(struct net *net, u32 genid)
7159 {
7160         bool genid_ok;
7161 
7162         mutex_lock(&net->nft.commit_mutex);
7163 
7164         genid_ok = genid == 0 || net->nft.base_seq == genid;
7165         if (!genid_ok)
7166                 mutex_unlock(&net->nft.commit_mutex);
7167 
7168         /* else, commit mutex has to be released by commit or abort function */
7169         return genid_ok;
7170 }
7171 
7172 static const struct nfnetlink_subsystem nf_tables_subsys = {
7173         .name           = "nf_tables",
7174         .subsys_id      = NFNL_SUBSYS_NFTABLES,
7175         .cb_count       = NFT_MSG_MAX,
7176         .cb             = nf_tables_cb,
7177         .commit         = nf_tables_commit,
7178         .abort          = nf_tables_abort,
7179         .cleanup        = nf_tables_cleanup,
7180         .valid_genid    = nf_tables_valid_genid,
7181         .owner          = THIS_MODULE,
7182 };
7183 
7184 int nft_chain_validate_dependency(const struct nft_chain *chain,
7185                                   enum nft_chain_types type)
7186 {
7187         const struct nft_base_chain *basechain;
7188 
7189         if (nft_is_base_chain(chain)) {
7190                 basechain = nft_base_chain(chain);
7191                 if (basechain->type->type != type)
7192                         return -EOPNOTSUPP;
7193         }
7194         return 0;
7195 }
7196 EXPORT_SYMBOL_GPL(nft_chain_validate_dependency);
7197 
7198 int nft_chain_validate_hooks(const struct nft_chain *chain,
7199                              unsigned int hook_flags)
7200 {
7201         struct nft_base_chain *basechain;
7202 
7203         if (nft_is_base_chain(chain)) {
7204                 basechain = nft_base_chain(chain);
7205 
7206                 if ((1 << basechain->ops.hooknum) & hook_flags)
7207                         return 0;
7208 
7209                 return -EOPNOTSUPP;
7210         }
7211 
7212         return 0;
7213 }
7214 EXPORT_SYMBOL_GPL(nft_chain_validate_hooks);
7215 
7216 /*
7217  * Loop detection - walk through the ruleset beginning at the destination chain
7218  * of a new jump until either the source chain is reached (loop) or all
7219  * reachable chains have been traversed.
7220  *
7221  * The loop check is performed whenever a new jump verdict is added to an
7222  * expression or verdict map or a verdict map is bound to a new chain.
7223  */
7224 
7225 static int nf_tables_check_loops(const struct nft_ctx *ctx,
7226                                  const struct nft_chain *chain);
7227 
7228 static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
7229                                         struct nft_set *set,
7230                                         const struct nft_set_iter *iter,
7231                                         struct nft_set_elem *elem)
7232 {
7233         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
7234         const struct nft_data *data;
7235 
7236         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
7237             *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
7238                 return 0;
7239 
7240         data = nft_set_ext_data(ext);
7241         switch (data->verdict.code) {
7242         case NFT_JUMP:
7243         case NFT_GOTO:
7244                 return nf_tables_check_loops(ctx, data->verdict.chain);
7245         default:
7246                 return 0;
7247         }
7248 }
7249 
7250 static int nf_tables_check_loops(const struct nft_ctx *ctx,
7251                                  const struct nft_chain *chain)
7252 {
7253         const struct nft_rule *rule;
7254         const struct nft_expr *expr, *last;
7255         struct nft_set *set;
7256         struct nft_set_binding *binding;
7257         struct nft_set_iter iter;
7258 
7259         if (ctx->chain == chain)
7260                 return -ELOOP;
7261 
7262         list_for_each_entry(rule, &chain->rules, list) {
7263                 nft_rule_for_each_expr(expr, last, rule) {
7264                         struct nft_immediate_expr *priv;
7265                         const struct nft_data *data;
7266                         int err;
7267 
7268                         if (strcmp(expr->ops->type->name, "immediate"))
7269                                 continue;
7270 
7271                         priv = nft_expr_priv(expr);
7272                         if (priv->dreg != NFT_REG_VERDICT)
7273                                 continue;
7274 
7275                         data = &priv->data;
7276                         switch (data->verdict.code) {
7277                         case NFT_JUMP:
7278                         case NFT_GOTO:
7279                                 err = nf_tables_check_loops(ctx,
7280                                                         data->verdict.chain);
7281                                 if (err < 0)
7282                                         return err;
7283                         default:
7284                                 break;
7285                         }
7286                 }
7287         }
7288 
7289         list_for_each_entry(set, &ctx->table->sets, list) {
7290                 if (!nft_is_active_next(ctx->net, set))
7291                         continue;
7292                 if (!(set->flags & NFT_SET_MAP) ||
7293                     set->dtype != NFT_DATA_VERDICT)
7294                         continue;
7295 
7296                 list_for_each_entry(binding, &set->bindings, list) {
7297                         if (!(binding->flags & NFT_SET_MAP) ||
7298                             binding->chain != chain)
7299                                 continue;
7300 
7301                         iter.genmask    = nft_genmask_next(ctx->net);
7302                         iter.skip       = 0;
7303                         iter.count      = 0;
7304                         iter.err        = 0;
7305                         iter.fn         = nf_tables_loop_check_setelem;
7306 
7307                         set->ops->walk(ctx, set, &iter);
7308                         if (iter.err < 0)
7309                                 return iter.err;
7310                 }
7311         }
7312 
7313         return 0;
7314 }
7315 
7316 /**
7317  *      nft_parse_u32_check - fetch u32 attribute and check for maximum value
7318  *
7319  *      @attr: netlink attribute to fetch value from
7320  *      @max: maximum value to be stored in dest
7321  *      @dest: pointer to the variable
7322  *
7323  *      Parse, check and store a given u32 netlink attribute into variable.
7324  *      This function returns -ERANGE if the value goes over maximum value.
7325  *      Otherwise a 0 is returned and the attribute value is stored in the
7326  *      destination variable.
7327  */
7328 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
7329 {
7330         u32 val;
7331 
7332         val = ntohl(nla_get_be32(attr));
7333         if (val > max)
7334                 return -ERANGE;
7335 
7336         *dest = val;
7337         return 0;
7338 }
7339 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
7340 
7341 /**
7342  *      nft_parse_register - parse a register value from a netlink attribute
7343  *
7344  *      @attr: netlink attribute
7345  *
7346  *      Parse and translate a register value from a netlink attribute.
7347  *      Registers used to be 128 bit wide, these register numbers will be
7348  *      mapped to the corresponding 32 bit register numbers.
7349  */
7350 unsigned int nft_parse_register(const struct nlattr *attr)
7351 {
7352         unsigned int reg;
7353 
7354         reg = ntohl(nla_get_be32(attr));
7355         switch (reg) {
7356         case NFT_REG_VERDICT...NFT_REG_4:
7357                 return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
7358         default:
7359                 return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
7360         }
7361 }
7362 EXPORT_SYMBOL_GPL(nft_parse_register);
7363 
7364 /**
7365  *      nft_dump_register - dump a register value to a netlink attribute
7366  *
7367  *      @skb: socket buffer
7368  *      @attr: attribute number
7369  *      @reg: register number
7370  *
7371  *      Construct a netlink attribute containing the register number. For
7372  *      compatibility reasons, register numbers being a multiple of 4 are
7373  *      translated to the corresponding 128 bit register numbers.
7374  */
7375 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg)
7376 {
7377         if (reg % (NFT_REG_SIZE / NFT_REG32_SIZE) == 0)
7378                 reg = reg / (NFT_REG_SIZE / NFT_REG32_SIZE);
7379         else
7380                 reg = reg - NFT_REG_SIZE / NFT_REG32_SIZE + NFT_REG32_00;
7381 
7382         return nla_put_be32(skb, attr, htonl(reg));
7383 }
7384 EXPORT_SYMBOL_GPL(nft_dump_register);
7385 
7386 /**
7387  *      nft_validate_register_load - validate a load from a register
7388  *
7389  *      @reg: the register number
7390  *      @len: the length of the data
7391  *
7392  *      Validate that the input register is one of the general purpose
7393  *      registers and that the length of the load is within the bounds.
7394  */
7395 int nft_validate_register_load(enum nft_registers reg, unsigned int len)
7396 {
7397         if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
7398                 return -EINVAL;
7399         if (len == 0)
7400                 return -EINVAL;
7401         if (reg * NFT_REG32_SIZE + len > FIELD_SIZEOF(struct nft_regs, data))
7402                 return -ERANGE;
7403 
7404         return 0;
7405 }
7406 EXPORT_SYMBOL_GPL(nft_validate_register_load);
7407 
7408 /**
7409  *      nft_validate_register_store - validate an expressions' register store
7410  *
7411  *      @ctx: context of the expression performing the load
7412  *      @reg: the destination register number
7413  *      @data: the data to load
7414  *      @type: the data type
7415  *      @len: the length of the data
7416  *
7417  *      Validate that a data load uses the appropriate data type for
7418  *      the destination register and the length is within the bounds.
7419  *      A value of NULL for the data means that its runtime gathered
7420  *      data.
7421  */
7422 int nft_validate_register_store(const struct nft_ctx *ctx,
7423                                 enum nft_registers reg,
7424                                 const struct nft_data *data,
7425                                 enum nft_data_types type, unsigned int len)
7426 {
7427         int err;
7428 
7429         switch (reg) {
7430         case NFT_REG_VERDICT:
7431                 if (type != NFT_DATA_VERDICT)
7432                         return -EINVAL;
7433 
7434                 if (data != NULL &&
7435                     (data->verdict.code == NFT_GOTO ||
7436                      data->verdict.code == NFT_JUMP)) {
7437                         err = nf_tables_check_loops(ctx, data->verdict.chain);
7438                         if (err < 0)
7439                                 return err;
7440                 }
7441 
7442                 return 0;
7443         default:
7444                 if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
7445                         return -EINVAL;
7446                 if (len == 0)
7447                         return -EINVAL;
7448                 if (reg * NFT_REG32_SIZE + len >
7449                     FIELD_SIZEOF(struct nft_regs, data))
7450                         return -ERANGE;
7451 
7452                 if (data != NULL && type != NFT_DATA_VALUE)
7453                         return -EINVAL;
7454                 return 0;
7455         }
7456 }
7457 EXPORT_SYMBOL_GPL(nft_validate_register_store);
7458 
7459 static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = {
7460         [NFTA_VERDICT_CODE]     = { .type = NLA_U32 },
7461         [NFTA_VERDICT_CHAIN]    = { .type = NLA_STRING,
7462                                     .len = NFT_CHAIN_MAXNAMELEN - 1 },
7463 };
7464 
7465 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
7466                             struct nft_data_desc *desc, const struct nlattr *nla)
7467 {
7468         u8 genmask = nft_genmask_next(ctx->net);
7469         struct nlattr *tb[NFTA_VERDICT_MAX + 1];
7470         struct nft_chain *chain;
7471         int err;
7472 
7473         err = nla_parse_nested_deprecated(tb, NFTA_VERDICT_MAX, nla,
7474                                           nft_verdict_policy, NULL);
7475         if (err < 0)
7476                 return err;
7477 
7478         if (!tb[NFTA_VERDICT_CODE])
7479                 return -EINVAL;
7480         data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
7481 
7482         switch (data->verdict.code) {
7483         default:
7484                 switch (data->verdict.code & NF_VERDICT_MASK) {
7485                 case NF_ACCEPT:
7486                 case NF_DROP:
7487                 case NF_QUEUE:
7488                         break;
7489                 default:
7490                         return -EINVAL;
7491                 }
7492                 /* fall through */
7493         case NFT_CONTINUE:
7494         case NFT_BREAK:
7495         case NFT_RETURN:
7496                 break;
7497         case NFT_JUMP:
7498         case NFT_GOTO:
7499                 if (!tb[NFTA_VERDICT_CHAIN])
7500                         return -EINVAL;
7501                 chain = nft_chain_lookup(ctx->net, ctx->table,
7502                                          tb[NFTA_VERDICT_CHAIN], genmask);
7503                 if (IS_ERR(chain))
7504                         return PTR_ERR(chain);
7505                 if (nft_is_base_chain(chain))
7506                         return -EOPNOTSUPP;
7507 
7508                 chain->use++;
7509                 data->verdict.chain = chain;
7510                 break;
7511         }
7512 
7513         desc->len = sizeof(data->verdict);
7514         desc->type = NFT_DATA_VERDICT;
7515         return 0;
7516 }
7517 
7518 static void nft_verdict_uninit(const struct nft_data *data)
7519 {
7520         switch (data->verdict.code) {
7521         case NFT_JUMP:
7522         case NFT_GOTO:
7523                 data->verdict.chain->use--;
7524                 break;
7525         }
7526 }
7527 
7528 int nft_verdict_dump(struct sk_buff *skb, int type, const struct nft_verdict *v)
7529 {
7530         struct nlattr *nest;
7531 
7532         nest = nla_nest_start_noflag(skb, type);
7533         if (!nest)
7534                 goto nla_put_failure;
7535 
7536         if (nla_put_be32(skb, NFTA_VERDICT_CODE, htonl(v->code)))
7537                 goto nla_put_failure;
7538 
7539         switch (v->code) {
7540         case NFT_JUMP:
7541         case NFT_GOTO:
7542                 if (nla_put_string(skb, NFTA_VERDICT_CHAIN,
7543                                    v->chain->name))
7544                         goto nla_put_failure;
7545         }
7546         nla_nest_end(skb, nest);
7547         return 0;
7548 
7549 nla_put_failure:
7550         return -1;
7551 }
7552 
7553 static int nft_value_init(const struct nft_ctx *ctx,
7554                           struct nft_data *data, unsigned int size,
7555                           struct nft_data_desc *desc, const struct nlattr *nla)
7556 {
7557         unsigned int len;
7558 
7559         len = nla_len(nla);
7560         if (len == 0)
7561                 return -EINVAL;
7562         if (len > size)
7563                 return -EOVERFLOW;
7564 
7565         nla_memcpy(data->data, nla, len);
7566         desc->type = NFT_DATA_VALUE;
7567         desc->len  = len;
7568         return 0;
7569 }
7570 
7571 static int nft_value_dump(struct sk_buff *skb, const struct nft_data *data,
7572                           unsigned int len)
7573 {
7574         return nla_put(skb, NFTA_DATA_VALUE, len, data->data);
7575 }
7576 
7577 static const struct nla_policy nft_data_policy[NFTA_DATA_MAX + 1] = {
7578         [NFTA_DATA_VALUE]       = { .type = NLA_BINARY },
7579         [NFTA_DATA_VERDICT]     = { .type = NLA_NESTED },
7580 };
7581 
7582 /**
7583  *      nft_data_init - parse nf_tables data netlink attributes
7584  *
7585  *      @ctx: context of the expression using the data
7586  *      @data: destination struct nft_data
7587  *      @size: maximum data length
7588  *      @desc: data description
7589  *      @nla: netlink attribute containing data
7590  *
7591  *      Parse the netlink data attributes and initialize a struct nft_data.
7592  *      The type and length of data are returned in the data description.
7593  *
7594  *      The caller can indicate that it only wants to accept data of type
7595  *      NFT_DATA_VALUE by passing NULL for the ctx argument.
7596  */
7597 int nft_data_init(const struct nft_ctx *ctx,
7598                   struct nft_data *data, unsigned int size,
7599                   struct nft_data_desc *desc, const struct nlattr *nla)
7600 {
7601         struct nlattr *tb[NFTA_DATA_MAX + 1];
7602         int err;
7603 
7604         err = nla_parse_nested_deprecated(tb, NFTA_DATA_MAX, nla,
7605                                           nft_data_policy, NULL);
7606         if (err < 0)
7607                 return err;
7608 
7609         if (tb[NFTA_DATA_VALUE])
7610                 return nft_value_init(ctx, data, size, desc,
7611                                       tb[NFTA_DATA_VALUE]);
7612         if (tb[NFTA_DATA_VERDICT] && ctx != NULL)
7613                 return nft_verdict_init(ctx, data, desc, tb[NFTA_DATA_VERDICT]);
7614         return -EINVAL;
7615 }
7616 EXPORT_SYMBOL_GPL(nft_data_init);
7617 
7618 /**
7619  *      nft_data_release - release a nft_data item
7620  *
7621  *      @data: struct nft_data to release
7622  *      @type: type of data
7623  *
7624  *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
7625  *      all others need to be released by calling this function.
7626  */
7627 void nft_data_release(const struct nft_data *data, enum nft_data_types type)
7628 {
7629         if (type < NFT_DATA_VERDICT)
7630                 return;
7631         switch (type) {
7632         case NFT_DATA_VERDICT:
7633                 return nft_verdict_uninit(data);
7634         default:
7635                 WARN_ON(1);
7636         }
7637 }
7638 EXPORT_SYMBOL_GPL(nft_data_release);
7639 
7640 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
7641                   enum nft_data_types type, unsigned int len)
7642 {
7643         struct nlattr *nest;
7644         int err;
7645 
7646         nest = nla_nest_start_noflag(skb, attr);
7647         if (nest == NULL)
7648                 return -1;
7649 
7650         switch (type) {
7651         case NFT_DATA_VALUE:
7652                 err = nft_value_dump(skb, data, len);
7653                 break;
7654         case NFT_DATA_VERDICT:
7655                 err = nft_verdict_dump(skb, NFTA_DATA_VERDICT, &data->verdict);
7656                 break;
7657         default:
7658                 err = -EINVAL;
7659                 WARN_ON(1);
7660         }
7661 
7662         nla_nest_end(skb, nest);
7663         return err;
7664 }
7665 EXPORT_SYMBOL_GPL(nft_data_dump);
7666 
7667 int __nft_release_basechain(struct nft_ctx *ctx)
7668 {
7669         struct nft_rule *rule, *nr;
7670 
7671         if (WARN_ON(!nft_is_base_chain(ctx->chain)))
7672                 return 0;
7673 
7674         nf_tables_unregister_hook(ctx->net, ctx->chain->table, ctx->chain);
7675         list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) {
7676                 list_del(&rule->list);
7677                 ctx->chain->use--;
7678                 nf_tables_rule_release(ctx, rule);
7679         }
7680         nft_chain_del(ctx->chain);
7681         ctx->table->use--;
7682         nf_tables_chain_destroy(ctx);
7683 
7684         return 0;
7685 }
7686 EXPORT_SYMBOL_GPL(__nft_release_basechain);
7687 
7688 static void __nft_release_tables(struct net *net)
7689 {
7690         struct nft_flowtable *flowtable, *nf;
7691         struct nft_table *table, *nt;
7692         struct nft_chain *chain, *nc;
7693         struct nft_object *obj, *ne;
7694         struct nft_rule *rule, *nr;
7695         struct nft_set *set, *ns;
7696         struct nft_ctx ctx = {
7697                 .net    = net,
7698                 .family = NFPROTO_NETDEV,
7699         };
7700 
7701         list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
7702                 ctx.family = table->family;
7703 
7704                 list_for_each_entry(chain, &table->chains, list)
7705                         nf_tables_unregister_hook(net, table, chain);
7706                 /* No packets are walking on these chains anymore. */
7707                 ctx.table = table;
7708                 list_for_each_entry(chain, &table->chains, list) {
7709                         ctx.chain = chain;
7710                         list_for_each_entry_safe(rule, nr, &chain->rules, list) {
7711                                 list_del(&rule->list);
7712                                 chain->use--;
7713                                 nf_tables_rule_release(&ctx, rule);
7714                         }
7715                 }
7716                 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) {
7717                         list_del(&flowtable->list);
7718                         table->use--;
7719                         nf_tables_flowtable_destroy(flowtable);
7720                 }
7721                 list_for_each_entry_safe(set, ns, &table->sets, list) {
7722                         list_del(&set->list);
7723                         table->use--;
7724                         nft_set_destroy(set);
7725                 }
7726                 list_for_each_entry_safe(obj, ne, &table->objects, list) {
7727                         nft_obj_del(obj);
7728                         table->use--;
7729                         nft_obj_destroy(&ctx, obj);
7730                 }
7731                 list_for_each_entry_safe(chain, nc, &table->chains, list) {
7732                         ctx.chain = chain;
7733                         nft_chain_del(chain);
7734                         table->use--;
7735                         nf_tables_chain_destroy(&ctx);
7736                 }
7737                 list_del(&table->list);
7738                 nf_tables_table_destroy(&ctx);
7739         }
7740 }
7741 
7742 static int __net_init nf_tables_init_net(struct net *net)
7743 {
7744         INIT_LIST_HEAD(&net->nft.tables);
7745         INIT_LIST_HEAD(&net->nft.commit_list);
7746         INIT_LIST_HEAD(&net->nft.module_list);
7747         mutex_init(&net->nft.commit_mutex);
7748         net->nft.base_seq = 1;
7749         net->nft.validate_state = NFT_VALIDATE_SKIP;
7750 
7751         return 0;
7752 }
7753 
7754 static void __net_exit nf_tables_exit_net(struct net *net)
7755 {
7756         mutex_lock(&net->nft.commit_mutex);
7757         if (!list_empty(&net->nft.commit_list))
7758                 __nf_tables_abort(net, false);
7759         __nft_release_tables(net);
7760         mutex_unlock(&net->nft.commit_mutex);
7761         WARN_ON_ONCE(!list_empty(&net->nft.tables));
7762         WARN_ON_ONCE(!list_empty(&net->nft.module_list));
7763 }
7764 
7765 static struct pernet_operations nf_tables_net_ops = {
7766         .init   = nf_tables_init_net,
7767         .exit   = nf_tables_exit_net,
7768 };
7769 
7770 static int __init nf_tables_module_init(void)
7771 {
7772         int err;
7773 
7774         spin_lock_init(&nf_tables_destroy_list_lock);
7775         err = register_pernet_subsys(&nf_tables_net_ops);
7776         if (err < 0)
7777                 return err;
7778 
7779         err = nft_chain_filter_init();
7780         if (err < 0)
7781                 goto err1;
7782 
7783         err = nf_tables_core_module_init();
7784         if (err < 0)
7785                 goto err2;
7786 
7787         err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
7788         if (err < 0)
7789                 goto err3;
7790 
7791         err = rhltable_init(&nft_objname_ht, &nft_objname_ht_params);
7792         if (err < 0)
7793                 goto err4;
7794 
7795         err = nft_offload_init();
7796         if (err < 0)
7797                 goto err5;
7798 
7799         /* must be last */
7800         err = nfnetlink_subsys_register(&nf_tables_subsys);
7801         if (err < 0)
7802                 goto err6;
7803 
7804         nft_chain_route_init();
7805 
7806         return err;
7807 err6:
7808         nft_offload_exit();
7809 err5:
7810         rhltable_destroy(&nft_objname_ht);
7811 err4:
7812         unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7813 err3:
7814         nf_tables_core_module_exit();
7815 err2:
7816         nft_chain_filter_fini();
7817 err1:
7818         unregister_pernet_subsys(&nf_tables_net_ops);
7819         return err;
7820 }
7821 
7822 static void __exit nf_tables_module_exit(void)
7823 {
7824         nfnetlink_subsys_unregister(&nf_tables_subsys);
7825         nft_offload_exit();
7826         unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
7827         nft_chain_filter_fini();
7828         nft_chain_route_fini();
7829         unregister_pernet_subsys(&nf_tables_net_ops);
7830         cancel_work_sync(&trans_destroy_work);
7831         rcu_barrier();
7832         rhltable_destroy(&nft_objname_ht);
7833         nf_tables_core_module_exit();
7834 }
7835 
7836 module_init(nf_tables_module_init);
7837 module_exit(nf_tables_module_exit);
7838 
7839 MODULE_LICENSE("GPL");
7840 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
7841 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFTABLES);

/* [<][>][^][v][top][bottom][index][help] */