1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org> |
4 | * |
5 | * This software has been sponsored by Sophos Astaro <http://www.sophos.com> |
6 | */ |
7 | |
8 | #include <linux/kernel.h> |
9 | #include <linux/init.h> |
10 | #include <linux/module.h> |
11 | #include <linux/netlink.h> |
12 | #include <linux/netfilter.h> |
13 | #include <linux/netfilter/nfnetlink.h> |
14 | #include <linux/netfilter/nf_tables.h> |
15 | #include <linux/netfilter/nf_tables_compat.h> |
16 | #include <linux/netfilter/x_tables.h> |
17 | #include <linux/netfilter_ipv4/ip_tables.h> |
18 | #include <linux/netfilter_ipv6/ip6_tables.h> |
19 | #include <linux/netfilter_bridge/ebtables.h> |
20 | #include <linux/netfilter_arp/arp_tables.h> |
21 | #include <net/netfilter/nf_tables.h> |
22 | #include <net/netfilter/nf_log.h> |
23 | |
24 | /* Used for matches where *info is larger than X byte */ |
25 | #define NFT_MATCH_LARGE_THRESH 192 |
26 | |
27 | struct nft_xt_match_priv { |
28 | void *info; |
29 | }; |
30 | |
31 | static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, |
32 | const char *tablename) |
33 | { |
34 | enum nft_chain_types type = NFT_CHAIN_T_DEFAULT; |
35 | const struct nft_chain *chain = ctx->chain; |
36 | const struct nft_base_chain *basechain; |
37 | |
38 | if (!tablename || |
39 | !nft_is_base_chain(chain)) |
40 | return 0; |
41 | |
42 | basechain = nft_base_chain(chain); |
43 | if (strcmp(tablename, "nat" ) == 0) { |
44 | if (ctx->family != NFPROTO_BRIDGE) |
45 | type = NFT_CHAIN_T_NAT; |
46 | if (basechain->type->type != type) |
47 | return -EINVAL; |
48 | } |
49 | |
50 | return 0; |
51 | } |
52 | |
53 | union nft_entry { |
54 | struct ipt_entry e4; |
55 | struct ip6t_entry e6; |
56 | struct ebt_entry ebt; |
57 | struct arpt_entry arp; |
58 | }; |
59 | |
60 | static inline void |
61 | nft_compat_set_par(struct xt_action_param *par, |
62 | const struct nft_pktinfo *pkt, |
63 | const void *xt, const void *xt_info) |
64 | { |
65 | par->state = pkt->state; |
66 | par->thoff = nft_thoff(pkt); |
67 | par->fragoff = pkt->fragoff; |
68 | par->target = xt; |
69 | par->targinfo = xt_info; |
70 | par->hotdrop = false; |
71 | } |
72 | |
73 | static void nft_target_eval_xt(const struct nft_expr *expr, |
74 | struct nft_regs *regs, |
75 | const struct nft_pktinfo *pkt) |
76 | { |
77 | void *info = nft_expr_priv(expr); |
78 | struct xt_target *target = expr->ops->data; |
79 | struct sk_buff *skb = pkt->skb; |
80 | struct xt_action_param xt; |
81 | int ret; |
82 | |
83 | nft_compat_set_par(par: &xt, pkt, xt: target, xt_info: info); |
84 | |
85 | ret = target->target(skb, &xt); |
86 | |
87 | if (xt.hotdrop) |
88 | ret = NF_DROP; |
89 | |
90 | switch (ret) { |
91 | case XT_CONTINUE: |
92 | regs->verdict.code = NFT_CONTINUE; |
93 | break; |
94 | default: |
95 | regs->verdict.code = ret; |
96 | break; |
97 | } |
98 | } |
99 | |
100 | static void nft_target_eval_bridge(const struct nft_expr *expr, |
101 | struct nft_regs *regs, |
102 | const struct nft_pktinfo *pkt) |
103 | { |
104 | void *info = nft_expr_priv(expr); |
105 | struct xt_target *target = expr->ops->data; |
106 | struct sk_buff *skb = pkt->skb; |
107 | struct xt_action_param xt; |
108 | int ret; |
109 | |
110 | nft_compat_set_par(par: &xt, pkt, xt: target, xt_info: info); |
111 | |
112 | ret = target->target(skb, &xt); |
113 | |
114 | if (xt.hotdrop) |
115 | ret = NF_DROP; |
116 | |
117 | switch (ret) { |
118 | case EBT_ACCEPT: |
119 | regs->verdict.code = NF_ACCEPT; |
120 | break; |
121 | case EBT_DROP: |
122 | regs->verdict.code = NF_DROP; |
123 | break; |
124 | case EBT_CONTINUE: |
125 | regs->verdict.code = NFT_CONTINUE; |
126 | break; |
127 | case EBT_RETURN: |
128 | regs->verdict.code = NFT_RETURN; |
129 | break; |
130 | default: |
131 | regs->verdict.code = ret; |
132 | break; |
133 | } |
134 | } |
135 | |
136 | static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { |
137 | [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, |
138 | [NFTA_TARGET_REV] = { .type = NLA_U32 }, |
139 | [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, |
140 | }; |
141 | |
142 | static void |
143 | nft_target_set_tgchk_param(struct xt_tgchk_param *par, |
144 | const struct nft_ctx *ctx, |
145 | struct xt_target *target, void *info, |
146 | union nft_entry *entry, u16 proto, bool inv) |
147 | { |
148 | par->net = ctx->net; |
149 | par->table = ctx->table->name; |
150 | switch (ctx->family) { |
151 | case AF_INET: |
152 | entry->e4.ip.proto = proto; |
153 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; |
154 | break; |
155 | case AF_INET6: |
156 | if (proto) |
157 | entry->e6.ipv6.flags |= IP6T_F_PROTO; |
158 | |
159 | entry->e6.ipv6.proto = proto; |
160 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; |
161 | break; |
162 | case NFPROTO_BRIDGE: |
163 | entry->ebt.ethproto = (__force __be16)proto; |
164 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
165 | break; |
166 | case NFPROTO_ARP: |
167 | break; |
168 | } |
169 | par->entryinfo = entry; |
170 | par->target = target; |
171 | par->targinfo = info; |
172 | if (nft_is_base_chain(chain: ctx->chain)) { |
173 | const struct nft_base_chain *basechain = |
174 | nft_base_chain(chain: ctx->chain); |
175 | const struct nf_hook_ops *ops = &basechain->ops; |
176 | |
177 | par->hook_mask = 1 << ops->hooknum; |
178 | } else { |
179 | par->hook_mask = 0; |
180 | } |
181 | par->family = ctx->family; |
182 | par->nft_compat = true; |
183 | } |
184 | |
185 | static void target_compat_from_user(struct xt_target *t, void *in, void *out) |
186 | { |
187 | int pad; |
188 | |
189 | memcpy(out, in, t->targetsize); |
190 | pad = XT_ALIGN(t->targetsize) - t->targetsize; |
191 | if (pad > 0) |
192 | memset(out + t->targetsize, 0, pad); |
193 | } |
194 | |
195 | static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = { |
196 | [NFTA_RULE_COMPAT_PROTO] = { .type = NLA_U32 }, |
197 | [NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 }, |
198 | }; |
199 | |
200 | static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) |
201 | { |
202 | struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; |
203 | u32 flags; |
204 | int err; |
205 | |
206 | err = nla_parse_nested_deprecated(tb, NFTA_RULE_COMPAT_MAX, nla: attr, |
207 | policy: nft_rule_compat_policy, NULL); |
208 | if (err < 0) |
209 | return err; |
210 | |
211 | if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS]) |
212 | return -EINVAL; |
213 | |
214 | flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS])); |
215 | if (flags & ~NFT_RULE_COMPAT_F_MASK) |
216 | return -EINVAL; |
217 | if (flags & NFT_RULE_COMPAT_F_INV) |
218 | *inv = true; |
219 | |
220 | *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); |
221 | return 0; |
222 | } |
223 | |
224 | static void nft_compat_wait_for_destructors(void) |
225 | { |
226 | /* xtables matches or targets can have side effects, e.g. |
227 | * creation/destruction of /proc files. |
228 | * The xt ->destroy functions are run asynchronously from |
229 | * work queue. If we have pending invocations we thus |
230 | * need to wait for those to finish. |
231 | */ |
232 | nf_tables_trans_destroy_flush_work(); |
233 | } |
234 | |
235 | static int |
236 | nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
237 | const struct nlattr * const tb[]) |
238 | { |
239 | void *info = nft_expr_priv(expr); |
240 | struct xt_target *target = expr->ops->data; |
241 | struct xt_tgchk_param par; |
242 | size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); |
243 | u16 proto = 0; |
244 | bool inv = false; |
245 | union nft_entry e = {}; |
246 | int ret; |
247 | |
248 | target_compat_from_user(t: target, in: nla_data(nla: tb[NFTA_TARGET_INFO]), out: info); |
249 | |
250 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
251 | ret = nft_parse_compat(attr: ctx->nla[NFTA_RULE_COMPAT], proto: &proto, inv: &inv); |
252 | if (ret < 0) |
253 | return ret; |
254 | } |
255 | |
256 | nft_target_set_tgchk_param(par: &par, ctx, target, info, entry: &e, proto, inv); |
257 | |
258 | nft_compat_wait_for_destructors(); |
259 | |
260 | ret = xt_check_target(&par, size, proto, inv_proto: inv); |
261 | if (ret < 0) { |
262 | if (ret == -ENOENT) { |
263 | const char *modname = NULL; |
264 | |
265 | if (strcmp(target->name, "LOG" ) == 0) |
266 | modname = "nf_log_syslog" ; |
267 | else if (strcmp(target->name, "NFLOG" ) == 0) |
268 | modname = "nfnetlink_log" ; |
269 | |
270 | if (modname && |
271 | nft_request_module(net: ctx->net, fmt: "%s" , modname) == -EAGAIN) |
272 | return -EAGAIN; |
273 | } |
274 | |
275 | return ret; |
276 | } |
277 | |
278 | /* The standard target cannot be used */ |
279 | if (!target->target) |
280 | return -EINVAL; |
281 | |
282 | return 0; |
283 | } |
284 | |
285 | static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr) |
286 | { |
287 | module_put(module: me); |
288 | kfree(objp: expr->ops); |
289 | } |
290 | |
291 | static void |
292 | nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
293 | { |
294 | struct xt_target *target = expr->ops->data; |
295 | void *info = nft_expr_priv(expr); |
296 | struct module *me = target->me; |
297 | struct xt_tgdtor_param par; |
298 | |
299 | par.net = ctx->net; |
300 | par.target = target; |
301 | par.targinfo = info; |
302 | par.family = ctx->family; |
303 | if (par.target->destroy != NULL) |
304 | par.target->destroy(&par); |
305 | |
306 | __nft_mt_tg_destroy(me, expr); |
307 | } |
308 | |
309 | static int nft_extension_dump_info(struct sk_buff *skb, int attr, |
310 | const void *info, |
311 | unsigned int size, unsigned int user_size) |
312 | { |
313 | unsigned int info_size, aligned_size = XT_ALIGN(size); |
314 | struct nlattr *nla; |
315 | |
316 | nla = nla_reserve(skb, attrtype: attr, attrlen: aligned_size); |
317 | if (!nla) |
318 | return -1; |
319 | |
320 | info_size = user_size ? : size; |
321 | memcpy(nla_data(nla), info, info_size); |
322 | memset(nla_data(nla) + info_size, 0, aligned_size - info_size); |
323 | |
324 | return 0; |
325 | } |
326 | |
327 | static int nft_target_dump(struct sk_buff *skb, |
328 | const struct nft_expr *expr, bool reset) |
329 | { |
330 | const struct xt_target *target = expr->ops->data; |
331 | void *info = nft_expr_priv(expr); |
332 | |
333 | if (nla_put_string(skb, attrtype: NFTA_TARGET_NAME, str: target->name) || |
334 | nla_put_be32(skb, attrtype: NFTA_TARGET_REV, htonl(target->revision)) || |
335 | nft_extension_dump_info(skb, attr: NFTA_TARGET_INFO, info, |
336 | size: target->targetsize, user_size: target->usersize)) |
337 | goto nla_put_failure; |
338 | |
339 | return 0; |
340 | |
341 | nla_put_failure: |
342 | return -1; |
343 | } |
344 | |
345 | static int nft_target_validate(const struct nft_ctx *ctx, |
346 | const struct nft_expr *expr, |
347 | const struct nft_data **data) |
348 | { |
349 | struct xt_target *target = expr->ops->data; |
350 | unsigned int hook_mask = 0; |
351 | int ret; |
352 | |
353 | if (nft_is_base_chain(chain: ctx->chain)) { |
354 | const struct nft_base_chain *basechain = |
355 | nft_base_chain(chain: ctx->chain); |
356 | const struct nf_hook_ops *ops = &basechain->ops; |
357 | |
358 | hook_mask = 1 << ops->hooknum; |
359 | if (target->hooks && !(hook_mask & target->hooks)) |
360 | return -EINVAL; |
361 | |
362 | ret = nft_compat_chain_validate_dependency(ctx, tablename: target->table); |
363 | if (ret < 0) |
364 | return ret; |
365 | } |
366 | return 0; |
367 | } |
368 | |
369 | static void __nft_match_eval(const struct nft_expr *expr, |
370 | struct nft_regs *regs, |
371 | const struct nft_pktinfo *pkt, |
372 | void *info) |
373 | { |
374 | struct xt_match *match = expr->ops->data; |
375 | struct sk_buff *skb = pkt->skb; |
376 | struct xt_action_param xt; |
377 | bool ret; |
378 | |
379 | nft_compat_set_par(par: &xt, pkt, xt: match, xt_info: info); |
380 | |
381 | ret = match->match(skb, &xt); |
382 | |
383 | if (xt.hotdrop) { |
384 | regs->verdict.code = NF_DROP; |
385 | return; |
386 | } |
387 | |
388 | switch (ret ? 1 : 0) { |
389 | case 1: |
390 | regs->verdict.code = NFT_CONTINUE; |
391 | break; |
392 | case 0: |
393 | regs->verdict.code = NFT_BREAK; |
394 | break; |
395 | } |
396 | } |
397 | |
398 | static void nft_match_large_eval(const struct nft_expr *expr, |
399 | struct nft_regs *regs, |
400 | const struct nft_pktinfo *pkt) |
401 | { |
402 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); |
403 | |
404 | __nft_match_eval(expr, regs, pkt, info: priv->info); |
405 | } |
406 | |
407 | static void nft_match_eval(const struct nft_expr *expr, |
408 | struct nft_regs *regs, |
409 | const struct nft_pktinfo *pkt) |
410 | { |
411 | __nft_match_eval(expr, regs, pkt, info: nft_expr_priv(expr)); |
412 | } |
413 | |
414 | static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { |
415 | [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, |
416 | [NFTA_MATCH_REV] = { .type = NLA_U32 }, |
417 | [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, |
418 | }; |
419 | |
420 | /* struct xt_mtchk_param and xt_tgchk_param look very similar */ |
421 | static void |
422 | nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, |
423 | struct xt_match *match, void *info, |
424 | union nft_entry *entry, u16 proto, bool inv) |
425 | { |
426 | par->net = ctx->net; |
427 | par->table = ctx->table->name; |
428 | switch (ctx->family) { |
429 | case AF_INET: |
430 | entry->e4.ip.proto = proto; |
431 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; |
432 | break; |
433 | case AF_INET6: |
434 | if (proto) |
435 | entry->e6.ipv6.flags |= IP6T_F_PROTO; |
436 | |
437 | entry->e6.ipv6.proto = proto; |
438 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; |
439 | break; |
440 | case NFPROTO_BRIDGE: |
441 | entry->ebt.ethproto = (__force __be16)proto; |
442 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
443 | break; |
444 | case NFPROTO_ARP: |
445 | break; |
446 | } |
447 | par->entryinfo = entry; |
448 | par->match = match; |
449 | par->matchinfo = info; |
450 | if (nft_is_base_chain(chain: ctx->chain)) { |
451 | const struct nft_base_chain *basechain = |
452 | nft_base_chain(chain: ctx->chain); |
453 | const struct nf_hook_ops *ops = &basechain->ops; |
454 | |
455 | par->hook_mask = 1 << ops->hooknum; |
456 | } else { |
457 | par->hook_mask = 0; |
458 | } |
459 | par->family = ctx->family; |
460 | par->nft_compat = true; |
461 | } |
462 | |
463 | static void match_compat_from_user(struct xt_match *m, void *in, void *out) |
464 | { |
465 | int pad; |
466 | |
467 | memcpy(out, in, m->matchsize); |
468 | pad = XT_ALIGN(m->matchsize) - m->matchsize; |
469 | if (pad > 0) |
470 | memset(out + m->matchsize, 0, pad); |
471 | } |
472 | |
473 | static int |
474 | __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
475 | const struct nlattr * const tb[], |
476 | void *info) |
477 | { |
478 | struct xt_match *match = expr->ops->data; |
479 | struct xt_mtchk_param par; |
480 | size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); |
481 | u16 proto = 0; |
482 | bool inv = false; |
483 | union nft_entry e = {}; |
484 | int ret; |
485 | |
486 | match_compat_from_user(m: match, in: nla_data(nla: tb[NFTA_MATCH_INFO]), out: info); |
487 | |
488 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
489 | ret = nft_parse_compat(attr: ctx->nla[NFTA_RULE_COMPAT], proto: &proto, inv: &inv); |
490 | if (ret < 0) |
491 | return ret; |
492 | } |
493 | |
494 | nft_match_set_mtchk_param(par: &par, ctx, match, info, entry: &e, proto, inv); |
495 | |
496 | nft_compat_wait_for_destructors(); |
497 | |
498 | return xt_check_match(&par, size, proto, inv_proto: inv); |
499 | } |
500 | |
501 | static int |
502 | nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
503 | const struct nlattr * const tb[]) |
504 | { |
505 | return __nft_match_init(ctx, expr, tb, info: nft_expr_priv(expr)); |
506 | } |
507 | |
508 | static int |
509 | nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
510 | const struct nlattr * const tb[]) |
511 | { |
512 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); |
513 | struct xt_match *m = expr->ops->data; |
514 | int ret; |
515 | |
516 | priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); |
517 | if (!priv->info) |
518 | return -ENOMEM; |
519 | |
520 | ret = __nft_match_init(ctx, expr, tb, info: priv->info); |
521 | if (ret) |
522 | kfree(objp: priv->info); |
523 | return ret; |
524 | } |
525 | |
526 | static void |
527 | __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, |
528 | void *info) |
529 | { |
530 | struct xt_match *match = expr->ops->data; |
531 | struct module *me = match->me; |
532 | struct xt_mtdtor_param par; |
533 | |
534 | par.net = ctx->net; |
535 | par.match = match; |
536 | par.matchinfo = info; |
537 | par.family = ctx->family; |
538 | if (par.match->destroy != NULL) |
539 | par.match->destroy(&par); |
540 | |
541 | __nft_mt_tg_destroy(me, expr); |
542 | } |
543 | |
544 | static void |
545 | nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
546 | { |
547 | __nft_match_destroy(ctx, expr, info: nft_expr_priv(expr)); |
548 | } |
549 | |
550 | static void |
551 | nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
552 | { |
553 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); |
554 | |
555 | __nft_match_destroy(ctx, expr, info: priv->info); |
556 | kfree(objp: priv->info); |
557 | } |
558 | |
559 | static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, |
560 | void *info) |
561 | { |
562 | struct xt_match *match = expr->ops->data; |
563 | |
564 | if (nla_put_string(skb, attrtype: NFTA_MATCH_NAME, str: match->name) || |
565 | nla_put_be32(skb, attrtype: NFTA_MATCH_REV, htonl(match->revision)) || |
566 | nft_extension_dump_info(skb, attr: NFTA_MATCH_INFO, info, |
567 | size: match->matchsize, user_size: match->usersize)) |
568 | goto nla_put_failure; |
569 | |
570 | return 0; |
571 | |
572 | nla_put_failure: |
573 | return -1; |
574 | } |
575 | |
576 | static int nft_match_dump(struct sk_buff *skb, |
577 | const struct nft_expr *expr, bool reset) |
578 | { |
579 | return __nft_match_dump(skb, expr, info: nft_expr_priv(expr)); |
580 | } |
581 | |
582 | static int nft_match_large_dump(struct sk_buff *skb, |
583 | const struct nft_expr *e, bool reset) |
584 | { |
585 | struct nft_xt_match_priv *priv = nft_expr_priv(expr: e); |
586 | |
587 | return __nft_match_dump(skb, expr: e, info: priv->info); |
588 | } |
589 | |
590 | static int nft_match_validate(const struct nft_ctx *ctx, |
591 | const struct nft_expr *expr, |
592 | const struct nft_data **data) |
593 | { |
594 | struct xt_match *match = expr->ops->data; |
595 | unsigned int hook_mask = 0; |
596 | int ret; |
597 | |
598 | if (nft_is_base_chain(chain: ctx->chain)) { |
599 | const struct nft_base_chain *basechain = |
600 | nft_base_chain(chain: ctx->chain); |
601 | const struct nf_hook_ops *ops = &basechain->ops; |
602 | |
603 | hook_mask = 1 << ops->hooknum; |
604 | if (match->hooks && !(hook_mask & match->hooks)) |
605 | return -EINVAL; |
606 | |
607 | ret = nft_compat_chain_validate_dependency(ctx, tablename: match->table); |
608 | if (ret < 0) |
609 | return ret; |
610 | } |
611 | return 0; |
612 | } |
613 | |
614 | static int |
615 | nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, |
616 | int event, u16 family, const char *name, |
617 | int rev, int target) |
618 | { |
619 | struct nlmsghdr *nlh; |
620 | unsigned int flags = portid ? NLM_F_MULTI : 0; |
621 | |
622 | event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, msg_type: event); |
623 | nlh = nfnl_msg_put(skb, portid, seq, type: event, flags, family, |
624 | NFNETLINK_V0, res_id: 0); |
625 | if (!nlh) |
626 | goto nlmsg_failure; |
627 | |
628 | if (nla_put_string(skb, attrtype: NFTA_COMPAT_NAME, str: name) || |
629 | nla_put_be32(skb, attrtype: NFTA_COMPAT_REV, htonl(rev)) || |
630 | nla_put_be32(skb, attrtype: NFTA_COMPAT_TYPE, htonl(target))) |
631 | goto nla_put_failure; |
632 | |
633 | nlmsg_end(skb, nlh); |
634 | return skb->len; |
635 | |
636 | nlmsg_failure: |
637 | nla_put_failure: |
638 | nlmsg_cancel(skb, nlh); |
639 | return -1; |
640 | } |
641 | |
642 | static int nfnl_compat_get_rcu(struct sk_buff *skb, |
643 | const struct nfnl_info *info, |
644 | const struct nlattr * const tb[]) |
645 | { |
646 | u8 family = info->nfmsg->nfgen_family; |
647 | const char *name, *fmt; |
648 | struct sk_buff *skb2; |
649 | int ret = 0, target; |
650 | u32 rev; |
651 | |
652 | if (tb[NFTA_COMPAT_NAME] == NULL || |
653 | tb[NFTA_COMPAT_REV] == NULL || |
654 | tb[NFTA_COMPAT_TYPE] == NULL) |
655 | return -EINVAL; |
656 | |
657 | name = nla_data(nla: tb[NFTA_COMPAT_NAME]); |
658 | rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV])); |
659 | target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE])); |
660 | |
661 | switch(family) { |
662 | case AF_INET: |
663 | fmt = "ipt_%s" ; |
664 | break; |
665 | case AF_INET6: |
666 | fmt = "ip6t_%s" ; |
667 | break; |
668 | case NFPROTO_BRIDGE: |
669 | fmt = "ebt_%s" ; |
670 | break; |
671 | case NFPROTO_ARP: |
672 | fmt = "arpt_%s" ; |
673 | break; |
674 | default: |
675 | pr_err("nft_compat: unsupported protocol %d\n" , family); |
676 | return -EINVAL; |
677 | } |
678 | |
679 | if (!try_module_get(THIS_MODULE)) |
680 | return -EINVAL; |
681 | |
682 | rcu_read_unlock(); |
683 | try_then_request_module(xt_find_revision(family, name, rev, target, &ret), |
684 | fmt, name); |
685 | if (ret < 0) |
686 | goto out_put; |
687 | |
688 | skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
689 | if (skb2 == NULL) { |
690 | ret = -ENOMEM; |
691 | goto out_put; |
692 | } |
693 | |
694 | /* include the best revision for this extension in the message */ |
695 | if (nfnl_compat_fill_info(skb: skb2, NETLINK_CB(skb).portid, |
696 | seq: info->nlh->nlmsg_seq, |
697 | NFNL_MSG_TYPE(info->nlh->nlmsg_type), |
698 | event: NFNL_MSG_COMPAT_GET, |
699 | family, name, rev: ret, target) <= 0) { |
700 | kfree_skb(skb: skb2); |
701 | goto out_put; |
702 | } |
703 | |
704 | ret = nfnetlink_unicast(skb: skb2, net: info->net, NETLINK_CB(skb).portid); |
705 | out_put: |
706 | rcu_read_lock(); |
707 | module_put(THIS_MODULE); |
708 | |
709 | return ret; |
710 | } |
711 | |
712 | static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = { |
713 | [NFTA_COMPAT_NAME] = { .type = NLA_NUL_STRING, |
714 | .len = NFT_COMPAT_NAME_MAX-1 }, |
715 | [NFTA_COMPAT_REV] = { .type = NLA_U32 }, |
716 | [NFTA_COMPAT_TYPE] = { .type = NLA_U32 }, |
717 | }; |
718 | |
719 | static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = { |
720 | [NFNL_MSG_COMPAT_GET] = { |
721 | .call = nfnl_compat_get_rcu, |
722 | .type = NFNL_CB_RCU, |
723 | .attr_count = NFTA_COMPAT_MAX, |
724 | .policy = nfnl_compat_policy_get |
725 | }, |
726 | }; |
727 | |
728 | static const struct nfnetlink_subsystem nfnl_compat_subsys = { |
729 | .name = "nft-compat" , |
730 | .subsys_id = NFNL_SUBSYS_NFT_COMPAT, |
731 | .cb_count = NFNL_MSG_COMPAT_MAX, |
732 | .cb = nfnl_nft_compat_cb, |
733 | }; |
734 | |
735 | static struct nft_expr_type nft_match_type; |
736 | |
737 | static bool nft_match_reduce(struct nft_regs_track *track, |
738 | const struct nft_expr *expr) |
739 | { |
740 | const struct xt_match *match = expr->ops->data; |
741 | |
742 | return strcmp(match->name, "comment" ) == 0; |
743 | } |
744 | |
745 | static const struct nft_expr_ops * |
746 | nft_match_select_ops(const struct nft_ctx *ctx, |
747 | const struct nlattr * const tb[]) |
748 | { |
749 | struct nft_expr_ops *ops; |
750 | struct xt_match *match; |
751 | unsigned int matchsize; |
752 | char *mt_name; |
753 | u32 rev, family; |
754 | int err; |
755 | |
756 | if (tb[NFTA_MATCH_NAME] == NULL || |
757 | tb[NFTA_MATCH_REV] == NULL || |
758 | tb[NFTA_MATCH_INFO] == NULL) |
759 | return ERR_PTR(error: -EINVAL); |
760 | |
761 | mt_name = nla_data(nla: tb[NFTA_MATCH_NAME]); |
762 | rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); |
763 | family = ctx->family; |
764 | |
765 | match = xt_request_find_match(af: family, name: mt_name, revision: rev); |
766 | if (IS_ERR(ptr: match)) |
767 | return ERR_PTR(error: -ENOENT); |
768 | |
769 | if (match->matchsize > nla_len(nla: tb[NFTA_MATCH_INFO])) { |
770 | err = -EINVAL; |
771 | goto err; |
772 | } |
773 | |
774 | ops = kzalloc(size: sizeof(struct nft_expr_ops), GFP_KERNEL); |
775 | if (!ops) { |
776 | err = -ENOMEM; |
777 | goto err; |
778 | } |
779 | |
780 | ops->type = &nft_match_type; |
781 | ops->eval = nft_match_eval; |
782 | ops->init = nft_match_init; |
783 | ops->destroy = nft_match_destroy; |
784 | ops->dump = nft_match_dump; |
785 | ops->validate = nft_match_validate; |
786 | ops->data = match; |
787 | ops->reduce = nft_match_reduce; |
788 | |
789 | matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); |
790 | if (matchsize > NFT_MATCH_LARGE_THRESH) { |
791 | matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); |
792 | |
793 | ops->eval = nft_match_large_eval; |
794 | ops->init = nft_match_large_init; |
795 | ops->destroy = nft_match_large_destroy; |
796 | ops->dump = nft_match_large_dump; |
797 | } |
798 | |
799 | ops->size = matchsize; |
800 | |
801 | return ops; |
802 | err: |
803 | module_put(module: match->me); |
804 | return ERR_PTR(error: err); |
805 | } |
806 | |
807 | static void nft_match_release_ops(const struct nft_expr_ops *ops) |
808 | { |
809 | struct xt_match *match = ops->data; |
810 | |
811 | module_put(module: match->me); |
812 | kfree(objp: ops); |
813 | } |
814 | |
815 | static struct nft_expr_type nft_match_type __read_mostly = { |
816 | .name = "match" , |
817 | .select_ops = nft_match_select_ops, |
818 | .release_ops = nft_match_release_ops, |
819 | .policy = nft_match_policy, |
820 | .maxattr = NFTA_MATCH_MAX, |
821 | .owner = THIS_MODULE, |
822 | }; |
823 | |
824 | static struct nft_expr_type nft_target_type; |
825 | |
826 | static const struct nft_expr_ops * |
827 | nft_target_select_ops(const struct nft_ctx *ctx, |
828 | const struct nlattr * const tb[]) |
829 | { |
830 | struct nft_expr_ops *ops; |
831 | struct xt_target *target; |
832 | char *tg_name; |
833 | u32 rev, family; |
834 | int err; |
835 | |
836 | if (tb[NFTA_TARGET_NAME] == NULL || |
837 | tb[NFTA_TARGET_REV] == NULL || |
838 | tb[NFTA_TARGET_INFO] == NULL) |
839 | return ERR_PTR(error: -EINVAL); |
840 | |
841 | tg_name = nla_data(nla: tb[NFTA_TARGET_NAME]); |
842 | rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); |
843 | family = ctx->family; |
844 | |
845 | if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || |
846 | strcmp(tg_name, XT_STANDARD_TARGET) == 0 || |
847 | strcmp(tg_name, "standard" ) == 0) |
848 | return ERR_PTR(error: -EINVAL); |
849 | |
850 | target = xt_request_find_target(af: family, name: tg_name, revision: rev); |
851 | if (IS_ERR(ptr: target)) |
852 | return ERR_PTR(error: -ENOENT); |
853 | |
854 | if (!target->target) { |
855 | err = -EINVAL; |
856 | goto err; |
857 | } |
858 | |
859 | if (target->targetsize > nla_len(nla: tb[NFTA_TARGET_INFO])) { |
860 | err = -EINVAL; |
861 | goto err; |
862 | } |
863 | |
864 | ops = kzalloc(size: sizeof(struct nft_expr_ops), GFP_KERNEL); |
865 | if (!ops) { |
866 | err = -ENOMEM; |
867 | goto err; |
868 | } |
869 | |
870 | ops->type = &nft_target_type; |
871 | ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); |
872 | ops->init = nft_target_init; |
873 | ops->destroy = nft_target_destroy; |
874 | ops->dump = nft_target_dump; |
875 | ops->validate = nft_target_validate; |
876 | ops->data = target; |
877 | ops->reduce = NFT_REDUCE_READONLY; |
878 | |
879 | if (family == NFPROTO_BRIDGE) |
880 | ops->eval = nft_target_eval_bridge; |
881 | else |
882 | ops->eval = nft_target_eval_xt; |
883 | |
884 | return ops; |
885 | err: |
886 | module_put(module: target->me); |
887 | return ERR_PTR(error: err); |
888 | } |
889 | |
890 | static void nft_target_release_ops(const struct nft_expr_ops *ops) |
891 | { |
892 | struct xt_target *target = ops->data; |
893 | |
894 | module_put(module: target->me); |
895 | kfree(objp: ops); |
896 | } |
897 | |
898 | static struct nft_expr_type nft_target_type __read_mostly = { |
899 | .name = "target" , |
900 | .select_ops = nft_target_select_ops, |
901 | .release_ops = nft_target_release_ops, |
902 | .policy = nft_target_policy, |
903 | .maxattr = NFTA_TARGET_MAX, |
904 | .owner = THIS_MODULE, |
905 | }; |
906 | |
907 | static int __init nft_compat_module_init(void) |
908 | { |
909 | int ret; |
910 | |
911 | ret = nft_register_expr(&nft_match_type); |
912 | if (ret < 0) |
913 | return ret; |
914 | |
915 | ret = nft_register_expr(&nft_target_type); |
916 | if (ret < 0) |
917 | goto err_match; |
918 | |
919 | ret = nfnetlink_subsys_register(n: &nfnl_compat_subsys); |
920 | if (ret < 0) { |
921 | pr_err("nft_compat: cannot register with nfnetlink.\n" ); |
922 | goto err_target; |
923 | } |
924 | |
925 | return ret; |
926 | err_target: |
927 | nft_unregister_expr(&nft_target_type); |
928 | err_match: |
929 | nft_unregister_expr(&nft_match_type); |
930 | return ret; |
931 | } |
932 | |
933 | static void __exit nft_compat_module_exit(void) |
934 | { |
935 | nfnetlink_subsys_unregister(n: &nfnl_compat_subsys); |
936 | nft_unregister_expr(&nft_target_type); |
937 | nft_unregister_expr(&nft_match_type); |
938 | } |
939 | |
940 | MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); |
941 | |
942 | module_init(nft_compat_module_init); |
943 | module_exit(nft_compat_module_exit); |
944 | |
945 | MODULE_LICENSE("GPL" ); |
946 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>" ); |
947 | MODULE_ALIAS_NFT_EXPR("match" ); |
948 | MODULE_ALIAS_NFT_EXPR("target" ); |
949 | MODULE_DESCRIPTION("x_tables over nftables support" ); |
950 | |