1 /* SPDX-License-Identifier: GPL-2.0 */ 2 #ifndef _NET_NF_TABLES_H 3 #define _NET_NF_TABLES_H 4 5 #include <linux/unaligned.h> 6 #include <linux/list.h> 7 #include <linux/netfilter.h> 8 #include <linux/netfilter/nfnetlink.h> 9 #include <linux/netfilter/nf_tables.h> 10 #include <linux/u64_stats_sync.h> 11 #include <linux/rhashtable.h> 12 #include <net/netfilter/nf_flow_table.h> 13 #include <net/netlink.h> 14 #include <net/flow_offload.h> 15 #include <net/netns/generic.h> 16 17 #define NFT_MAX_HOOKS (NF_INET_INGRESS + 1) 18 19 struct module; 20 21 #define NFT_JUMP_STACK_SIZE 16 22 23 enum { 24 NFT_PKTINFO_L4PROTO = (1 << 0), 25 NFT_PKTINFO_INNER = (1 << 1), 26 NFT_PKTINFO_INNER_FULL = (1 << 2), 27 }; 28 29 struct nft_pktinfo { 30 struct sk_buff *skb; 31 const struct nf_hook_state *state; 32 u8 flags; 33 u8 tprot; 34 __be16 ethertype; 35 u16 fragoff; 36 u16 nhoff; 37 u16 thoff; 38 u16 inneroff; 39 }; 40 41 static inline struct sock *nft_sk(const struct nft_pktinfo *pkt) 42 { 43 return pkt->state->sk; 44 } 45 46 static inline unsigned int nft_thoff(const struct nft_pktinfo *pkt) 47 { 48 return pkt->thoff; 49 } 50 51 static inline struct net *nft_net(const struct nft_pktinfo *pkt) 52 { 53 return pkt->state->net; 54 } 55 56 static inline unsigned int nft_hook(const struct nft_pktinfo *pkt) 57 { 58 return pkt->state->hook; 59 } 60 61 static inline u8 nft_pf(const struct nft_pktinfo *pkt) 62 { 63 return pkt->state->pf; 64 } 65 66 static inline const struct net_device *nft_in(const struct nft_pktinfo *pkt) 67 { 68 return pkt->state->in; 69 } 70 71 static inline const struct net_device *nft_out(const struct nft_pktinfo *pkt) 72 { 73 return pkt->state->out; 74 } 75 76 static inline void nft_set_pktinfo(struct nft_pktinfo *pkt, 77 struct sk_buff *skb, 78 const struct nf_hook_state *state) 79 { 80 pkt->skb = skb; 81 pkt->state = state; 82 } 83 84 static inline void nft_set_pktinfo_unspec(struct nft_pktinfo *pkt) 85 { 86 pkt->flags = 0; 87 pkt->tprot = 0; 88 pkt->ethertype = pkt->skb->protocol; 89 pkt->nhoff = 0; 90 pkt->thoff = 0; 91 pkt->fragoff = 0; 92 } 93 94 /** 95 * struct nft_verdict - nf_tables verdict 96 * 97 * @code: nf_tables/netfilter verdict code 98 * @chain: destination chain for NFT_JUMP/NFT_GOTO 99 */ 100 struct nft_verdict { 101 u32 code; 102 struct nft_chain *chain; 103 }; 104 105 struct nft_data { 106 union { 107 u32 data[4]; 108 struct nft_verdict verdict; 109 }; 110 } __attribute__((aligned(__alignof__(u64)))); 111 112 #define NFT_REG32_NUM 20 113 114 /** 115 * struct nft_regs - nf_tables register set 116 * 117 * @data: data registers 118 * @verdict: verdict register 119 * 120 * The first four data registers alias to the verdict register. 121 */ 122 struct nft_regs { 123 union { 124 u32 data[NFT_REG32_NUM]; 125 struct nft_verdict verdict; 126 }; 127 }; 128 129 /* Store/load an u8, u16 or u64 integer to/from the u32 data register. 130 * 131 * Note, when using concatenations, register allocation happens at 32-bit 132 * level. So for store instruction, pad the rest part with zero to avoid 133 * garbage values. 134 */ 135 136 static inline void nft_reg_store8(u32 *dreg, u8 val) 137 { 138 *dreg = 0; 139 *(u8 *)dreg = val; 140 } 141 142 static inline u8 nft_reg_load8(const u32 *sreg) 143 { 144 return *(u8 *)sreg; 145 } 146 147 static inline void nft_reg_store16(u32 *dreg, u16 val) 148 { 149 *dreg = 0; 150 *(u16 *)dreg = val; 151 } 152 153 static inline void nft_reg_store_be16(u32 *dreg, __be16 val) 154 { 155 nft_reg_store16(dreg, (__force __u16)val); 156 } 157 158 static inline u16 nft_reg_load16(const u32 *sreg) 159 { 160 return *(u16 *)sreg; 161 } 162 163 static inline __be16 nft_reg_load_be16(const u32 *sreg) 164 { 165 return (__force __be16)nft_reg_load16(sreg); 166 } 167 168 static inline __be32 nft_reg_load_be32(const u32 *sreg) 169 { 170 return *(__force __be32 *)sreg; 171 } 172 173 static inline void nft_reg_store64(u64 *dreg, u64 val) 174 { 175 put_unaligned(val, dreg); 176 } 177 178 static inline u64 nft_reg_load64(const u32 *sreg) 179 { 180 return get_unaligned((u64 *)sreg); 181 } 182 183 static inline void nft_data_copy(u32 *dst, const struct nft_data *src, 184 unsigned int len) 185 { 186 if (len % NFT_REG32_SIZE) 187 dst[len / NFT_REG32_SIZE] = 0; 188 memcpy(dst, src, len); 189 } 190 191 /** 192 * struct nft_ctx - nf_tables rule/set context 193 * 194 * @net: net namespace 195 * @table: the table the chain is contained in 196 * @chain: the chain the rule is contained in 197 * @nla: netlink attributes 198 * @portid: netlink portID of the original message 199 * @seq: netlink sequence number 200 * @flags: modifiers to new request 201 * @family: protocol family 202 * @level: depth of the chains 203 * @report: notify via unicast netlink message 204 * @reg_inited: bitmap of initialised registers 205 */ 206 struct nft_ctx { 207 struct net *net; 208 struct nft_table *table; 209 struct nft_chain *chain; 210 const struct nlattr * const *nla; 211 u32 portid; 212 u32 seq; 213 u16 flags; 214 u8 family; 215 u8 level; 216 bool report; 217 DECLARE_BITMAP(reg_inited, NFT_REG32_NUM); 218 }; 219 220 enum nft_data_desc_flags { 221 NFT_DATA_DESC_SETELEM = (1 << 0), 222 }; 223 224 struct nft_data_desc { 225 enum nft_data_types type; 226 unsigned int size; 227 unsigned int len; 228 unsigned int flags; 229 }; 230 231 int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, 232 struct nft_data_desc *desc, const struct nlattr *nla); 233 void nft_data_hold(const struct nft_data *data, enum nft_data_types type); 234 void nft_data_release(const struct nft_data *data, enum nft_data_types type); 235 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, 236 enum nft_data_types type, unsigned int len); 237 238 static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg) 239 { 240 return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; 241 } 242 243 static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) 244 { 245 return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE; 246 } 247 248 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest); 249 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg); 250 251 int nft_parse_register_load(const struct nft_ctx *ctx, 252 const struct nlattr *attr, u8 *sreg, u32 len); 253 int nft_parse_register_store(const struct nft_ctx *ctx, 254 const struct nlattr *attr, u8 *dreg, 255 const struct nft_data *data, 256 enum nft_data_types type, unsigned int len); 257 258 /** 259 * struct nft_userdata - user defined data associated with an object 260 * 261 * @len: length of the data 262 * @data: content 263 * 264 * The presence of user data is indicated in an object specific fashion, 265 * so a length of zero can't occur and the value "len" indicates data 266 * of length len + 1. 267 */ 268 struct nft_userdata { 269 u8 len; 270 unsigned char data[]; 271 }; 272 273 /* placeholder structure for opaque set element backend representation. */ 274 struct nft_elem_priv { }; 275 276 /** 277 * struct nft_set_elem - generic representation of set elements 278 * 279 * @key: element key 280 * @key_end: closing element key 281 * @data: element data 282 * @priv: element private data and extensions 283 */ 284 struct nft_set_elem { 285 union { 286 u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; 287 struct nft_data val; 288 } key; 289 union { 290 u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; 291 struct nft_data val; 292 } key_end; 293 union { 294 u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; 295 struct nft_data val; 296 } data; 297 struct nft_elem_priv *priv; 298 }; 299 300 static inline void *nft_elem_priv_cast(const struct nft_elem_priv *priv) 301 { 302 return (void *)priv; 303 } 304 305 306 /** 307 * enum nft_iter_type - nftables set iterator type 308 * 309 * @NFT_ITER_UNSPEC: unspecified, to catch errors 310 * @NFT_ITER_READ: read-only iteration over set elements 311 * @NFT_ITER_UPDATE: iteration under mutex to update set element state 312 * @NFT_ITER_UPDATE_CLONE: clone set before iteration under mutex to update element 313 */ 314 enum nft_iter_type { 315 NFT_ITER_UNSPEC, 316 NFT_ITER_READ, 317 NFT_ITER_UPDATE, 318 NFT_ITER_UPDATE_CLONE, 319 }; 320 321 struct nft_set; 322 struct nft_set_iter { 323 u8 genmask; 324 enum nft_iter_type type:8; 325 unsigned int count; 326 unsigned int skip; 327 int err; 328 int (*fn)(const struct nft_ctx *ctx, 329 struct nft_set *set, 330 const struct nft_set_iter *iter, 331 struct nft_elem_priv *elem_priv); 332 }; 333 334 /** 335 * struct nft_set_desc - description of set elements 336 * 337 * @ktype: key type 338 * @klen: key length 339 * @dtype: data type 340 * @dlen: data length 341 * @objtype: object type 342 * @size: number of set elements 343 * @policy: set policy 344 * @gc_int: garbage collector interval 345 * @timeout: element timeout 346 * @field_len: length of each field in concatenation, bytes 347 * @field_count: number of concatenated fields in element 348 * @expr: set must support for expressions 349 */ 350 struct nft_set_desc { 351 u32 ktype; 352 unsigned int klen; 353 u32 dtype; 354 unsigned int dlen; 355 u32 objtype; 356 unsigned int size; 357 u32 policy; 358 u32 gc_int; 359 u64 timeout; 360 u8 field_len[NFT_REG32_COUNT]; 361 u8 field_count; 362 bool expr; 363 }; 364 365 /** 366 * enum nft_set_class - performance class 367 * 368 * @NFT_SET_CLASS_O_1: constant, O(1) 369 * @NFT_SET_CLASS_O_LOG_N: logarithmic, O(log N) 370 * @NFT_SET_CLASS_O_N: linear, O(N) 371 */ 372 enum nft_set_class { 373 NFT_SET_CLASS_O_1, 374 NFT_SET_CLASS_O_LOG_N, 375 NFT_SET_CLASS_O_N, 376 }; 377 378 /** 379 * struct nft_set_estimate - estimation of memory and performance 380 * characteristics 381 * 382 * @size: required memory 383 * @lookup: lookup performance class 384 * @space: memory class 385 */ 386 struct nft_set_estimate { 387 u64 size; 388 enum nft_set_class lookup; 389 enum nft_set_class space; 390 }; 391 392 #define NFT_EXPR_MAXATTR 16 393 #define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \ 394 ALIGN(size, __alignof__(struct nft_expr))) 395 396 /** 397 * struct nft_expr - nf_tables expression 398 * 399 * @ops: expression ops 400 * @data: expression private data 401 */ 402 struct nft_expr { 403 const struct nft_expr_ops *ops; 404 unsigned char data[] 405 __attribute__((aligned(__alignof__(u64)))); 406 }; 407 408 static inline void *nft_expr_priv(const struct nft_expr *expr) 409 { 410 return (void *)expr->data; 411 } 412 413 struct nft_expr_info; 414 415 int nft_expr_inner_parse(const struct nft_ctx *ctx, const struct nlattr *nla, 416 struct nft_expr_info *info); 417 int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src, gfp_t gfp); 418 void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr); 419 int nft_expr_dump(struct sk_buff *skb, unsigned int attr, 420 const struct nft_expr *expr, bool reset); 421 422 struct nft_set_ext; 423 424 /** 425 * struct nft_set_ops - nf_tables set operations 426 * 427 * @lookup: look up an element within the set 428 * @update: update an element if exists, add it if doesn't exist 429 * @delete: delete an element 430 * @insert: insert new element into set 431 * @activate: activate new element in the next generation 432 * @deactivate: lookup for element and deactivate it in the next generation 433 * @flush: deactivate element in the next generation 434 * @remove: remove element from set 435 * @walk: iterate over all set elements 436 * @get: get set elements 437 * @ksize: kernel set size 438 * @usize: userspace set size 439 * @adjust_maxsize: delta to adjust maximum set size 440 * @commit: commit set elements 441 * @abort: abort set elements 442 * @privsize: function to return size of set private data 443 * @estimate: estimate the required memory size and the lookup complexity class 444 * @init: initialize private data of new set instance 445 * @destroy: destroy private data of set instance 446 * @gc_init: initialize garbage collection 447 * @abort_skip_removal: skip removal of elements from abort path 448 * @elemsize: element private size 449 * 450 * Operations lookup, update and delete have simpler interfaces, are faster 451 * and currently only used in the packet path. All the rest are slower, 452 * control plane functions. 453 */ 454 struct nft_set_ops { 455 const struct nft_set_ext * (*lookup)(const struct net *net, 456 const struct nft_set *set, 457 const u32 *key); 458 const struct nft_set_ext * (*update)(struct nft_set *set, 459 const u32 *key, 460 const struct nft_expr *expr, 461 struct nft_regs *regs); 462 bool (*delete)(const struct nft_set *set, 463 const u32 *key); 464 465 int (*insert)(const struct net *net, 466 const struct nft_set *set, 467 const struct nft_set_elem *elem, 468 struct nft_elem_priv **priv); 469 void (*activate)(const struct net *net, 470 const struct nft_set *set, 471 struct nft_elem_priv *elem_priv); 472 struct nft_elem_priv * (*deactivate)(const struct net *net, 473 const struct nft_set *set, 474 const struct nft_set_elem *elem); 475 void (*flush)(const struct net *net, 476 const struct nft_set *set, 477 struct nft_elem_priv *priv); 478 void (*remove)(const struct net *net, 479 const struct nft_set *set, 480 struct nft_elem_priv *elem_priv); 481 void (*walk)(const struct nft_ctx *ctx, 482 struct nft_set *set, 483 struct nft_set_iter *iter); 484 struct nft_elem_priv * (*get)(const struct net *net, 485 const struct nft_set *set, 486 const struct nft_set_elem *elem, 487 unsigned int flags); 488 u32 (*ksize)(u32 size); 489 u32 (*usize)(u32 size); 490 u32 (*adjust_maxsize)(const struct nft_set *set); 491 void (*commit)(struct nft_set *set); 492 void (*abort)(const struct nft_set *set); 493 u64 (*privsize)(const struct nlattr * const nla[], 494 const struct nft_set_desc *desc); 495 bool (*estimate)(const struct nft_set_desc *desc, 496 u32 features, 497 struct nft_set_estimate *est); 498 int (*init)(const struct nft_set *set, 499 const struct nft_set_desc *desc, 500 const struct nlattr * const nla[]); 501 void (*destroy)(const struct nft_ctx *ctx, 502 const struct nft_set *set); 503 void (*gc_init)(const struct nft_set *set); 504 505 bool abort_skip_removal; 506 unsigned int elemsize; 507 }; 508 509 /** 510 * struct nft_set_type - nf_tables set type 511 * 512 * @ops: set ops for this type 513 * @features: features supported by the implementation 514 */ 515 struct nft_set_type { 516 const struct nft_set_ops ops; 517 u32 features; 518 }; 519 #define to_set_type(o) container_of(o, struct nft_set_type, ops) 520 521 struct nft_set_elem_expr { 522 u8 size; 523 unsigned char data[] 524 __attribute__((aligned(__alignof__(struct nft_expr)))); 525 }; 526 527 #define nft_setelem_expr_at(__elem_expr, __offset) \ 528 ((struct nft_expr *)&__elem_expr->data[__offset]) 529 530 #define nft_setelem_expr_foreach(__expr, __elem_expr, __size) \ 531 for (__expr = nft_setelem_expr_at(__elem_expr, 0), __size = 0; \ 532 __size < (__elem_expr)->size; \ 533 __size += (__expr)->ops->size, __expr = ((void *)(__expr)) + (__expr)->ops->size) 534 535 #define NFT_SET_EXPR_MAX 2 536 537 /** 538 * struct nft_set - nf_tables set instance 539 * 540 * @list: table set list node 541 * @bindings: list of set bindings 542 * @refs: internal refcounting for async set destruction 543 * @table: table this set belongs to 544 * @net: netnamespace this set belongs to 545 * @name: name of the set 546 * @handle: unique handle of the set 547 * @ktype: key type (numeric type defined by userspace, not used in the kernel) 548 * @dtype: data type (verdict or numeric type defined by userspace) 549 * @objtype: object type (see NFT_OBJECT_* definitions) 550 * @size: maximum set size 551 * @field_len: length of each field in concatenation, bytes 552 * @field_count: number of concatenated fields in element 553 * @in_update_walk: true during ->walk() in transaction phase 554 * @use: number of rules references to this set 555 * @nelems: number of elements 556 * @ndeact: number of deactivated elements queued for removal 557 * @timeout: default timeout value in jiffies 558 * @gc_int: garbage collection interval in msecs 559 * @policy: set parameterization (see enum nft_set_policies) 560 * @udlen: user data length 561 * @udata: user data 562 * @pending_update: list of pending update set element 563 * @ops: set ops 564 * @flags: set flags 565 * @dead: set will be freed, never cleared 566 * @genmask: generation mask 567 * @klen: key length 568 * @dlen: data length 569 * @num_exprs: numbers of exprs 570 * @exprs: stateful expression 571 * @catchall_list: list of catch-all set element 572 * @data: private set data 573 */ 574 struct nft_set { 575 struct list_head list; 576 struct list_head bindings; 577 refcount_t refs; 578 struct nft_table *table; 579 possible_net_t net; 580 char *name; 581 u64 handle; 582 u32 ktype; 583 u32 dtype; 584 u32 objtype; 585 u32 size; 586 u8 field_len[NFT_REG32_COUNT]; 587 u8 field_count; 588 bool in_update_walk; 589 u32 use; 590 atomic_t nelems; 591 u32 ndeact; 592 u64 timeout; 593 u32 gc_int; 594 u16 policy; 595 u16 udlen; 596 unsigned char *udata; 597 struct list_head pending_update; 598 /* runtime data below here */ 599 const struct nft_set_ops *ops ____cacheline_aligned; 600 u16 flags:13, 601 dead:1, 602 genmask:2; 603 u8 klen; 604 u8 dlen; 605 u8 num_exprs; 606 struct nft_expr *exprs[NFT_SET_EXPR_MAX]; 607 struct list_head catchall_list; 608 unsigned char data[] 609 __attribute__((aligned(__alignof__(u64)))); 610 }; 611 612 static inline bool nft_set_is_anonymous(const struct nft_set *set) 613 { 614 return set->flags & NFT_SET_ANONYMOUS; 615 } 616 617 static inline void *nft_set_priv(const struct nft_set *set) 618 { 619 return (void *)set->data; 620 } 621 622 static inline enum nft_data_types nft_set_datatype(const struct nft_set *set) 623 { 624 return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE; 625 } 626 627 static inline bool nft_set_gc_is_pending(const struct nft_set *s) 628 { 629 return refcount_read(&s->refs) != 1; 630 } 631 632 static inline struct nft_set *nft_set_container_of(const void *priv) 633 { 634 return (void *)priv - offsetof(struct nft_set, data); 635 } 636 637 struct nft_set *nft_set_lookup_global(const struct net *net, 638 const struct nft_table *table, 639 const struct nlattr *nla_set_name, 640 const struct nlattr *nla_set_id, 641 u8 genmask); 642 643 struct nft_set_ext *nft_set_catchall_lookup(const struct net *net, 644 const struct nft_set *set); 645 646 static inline unsigned long nft_set_gc_interval(const struct nft_set *set) 647 { 648 u32 gc_int = READ_ONCE(set->gc_int); 649 650 return gc_int ? msecs_to_jiffies(gc_int) : HZ; 651 } 652 653 /** 654 * struct nft_set_binding - nf_tables set binding 655 * 656 * @list: set bindings list node 657 * @chain: chain containing the rule bound to the set 658 * @flags: set action flags 659 * 660 * A set binding contains all information necessary for validation 661 * of new elements added to a bound set. 662 */ 663 struct nft_set_binding { 664 struct list_head list; 665 const struct nft_chain *chain; 666 u32 flags; 667 }; 668 669 enum nft_trans_phase; 670 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set); 671 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, 672 struct nft_set_binding *binding, 673 enum nft_trans_phase phase); 674 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, 675 struct nft_set_binding *binding); 676 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set); 677 678 /** 679 * enum nft_set_extensions - set extension type IDs 680 * 681 * @NFT_SET_EXT_KEY: element key 682 * @NFT_SET_EXT_KEY_END: upper bound element key, for ranges 683 * @NFT_SET_EXT_DATA: mapping data 684 * @NFT_SET_EXT_FLAGS: element flags 685 * @NFT_SET_EXT_TIMEOUT: element timeout 686 * @NFT_SET_EXT_USERDATA: user data associated with the element 687 * @NFT_SET_EXT_EXPRESSIONS: expressions associated with the element 688 * @NFT_SET_EXT_OBJREF: stateful object reference associated with element 689 * @NFT_SET_EXT_NUM: number of extension types 690 */ 691 enum nft_set_extensions { 692 NFT_SET_EXT_KEY, 693 NFT_SET_EXT_KEY_END, 694 NFT_SET_EXT_DATA, 695 NFT_SET_EXT_FLAGS, 696 NFT_SET_EXT_TIMEOUT, 697 NFT_SET_EXT_USERDATA, 698 NFT_SET_EXT_EXPRESSIONS, 699 NFT_SET_EXT_OBJREF, 700 NFT_SET_EXT_NUM 701 }; 702 703 /** 704 * struct nft_set_ext_type - set extension type 705 * 706 * @len: fixed part length of the extension 707 * @align: alignment requirements of the extension 708 */ 709 struct nft_set_ext_type { 710 u8 len; 711 u8 align; 712 }; 713 714 extern const struct nft_set_ext_type nft_set_ext_types[]; 715 716 /** 717 * struct nft_set_ext_tmpl - set extension template 718 * 719 * @len: length of extension area 720 * @offset: offsets of individual extension types 721 * @ext_len: length of the expected extension(used to sanity check) 722 */ 723 struct nft_set_ext_tmpl { 724 u16 len; 725 u8 offset[NFT_SET_EXT_NUM]; 726 u8 ext_len[NFT_SET_EXT_NUM]; 727 }; 728 729 /** 730 * struct nft_set_ext - set extensions 731 * 732 * @genmask: generation mask, but also flags (see NFT_SET_ELEM_DEAD_BIT) 733 * @offset: offsets of individual extension types 734 * @data: beginning of extension data 735 * 736 * This structure must be aligned to word size, otherwise atomic bitops 737 * on genmask field can cause alignment failure on some archs. 738 */ 739 struct nft_set_ext { 740 u8 genmask; 741 u8 offset[NFT_SET_EXT_NUM]; 742 char data[]; 743 } __aligned(BITS_PER_LONG / 8); 744 745 static inline void nft_set_ext_prepare(struct nft_set_ext_tmpl *tmpl) 746 { 747 memset(tmpl, 0, sizeof(*tmpl)); 748 tmpl->len = sizeof(struct nft_set_ext); 749 } 750 751 static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, 752 unsigned int len) 753 { 754 tmpl->len = ALIGN(tmpl->len, nft_set_ext_types[id].align); 755 if (tmpl->len > U8_MAX) 756 return -EINVAL; 757 758 tmpl->offset[id] = tmpl->len; 759 tmpl->ext_len[id] = nft_set_ext_types[id].len + len; 760 tmpl->len += tmpl->ext_len[id]; 761 762 return 0; 763 } 764 765 static inline int nft_set_ext_add(struct nft_set_ext_tmpl *tmpl, u8 id) 766 { 767 return nft_set_ext_add_length(tmpl, id, 0); 768 } 769 770 static inline void nft_set_ext_init(struct nft_set_ext *ext, 771 const struct nft_set_ext_tmpl *tmpl) 772 { 773 memcpy(ext->offset, tmpl->offset, sizeof(ext->offset)); 774 } 775 776 static inline bool __nft_set_ext_exists(const struct nft_set_ext *ext, u8 id) 777 { 778 return !!ext->offset[id]; 779 } 780 781 static inline bool nft_set_ext_exists(const struct nft_set_ext *ext, u8 id) 782 { 783 return ext && __nft_set_ext_exists(ext, id); 784 } 785 786 static inline void *nft_set_ext(const struct nft_set_ext *ext, u8 id) 787 { 788 return (void *)ext + ext->offset[id]; 789 } 790 791 static inline struct nft_data *nft_set_ext_key(const struct nft_set_ext *ext) 792 { 793 return nft_set_ext(ext, NFT_SET_EXT_KEY); 794 } 795 796 static inline struct nft_data *nft_set_ext_key_end(const struct nft_set_ext *ext) 797 { 798 return nft_set_ext(ext, NFT_SET_EXT_KEY_END); 799 } 800 801 static inline struct nft_data *nft_set_ext_data(const struct nft_set_ext *ext) 802 { 803 return nft_set_ext(ext, NFT_SET_EXT_DATA); 804 } 805 806 static inline u8 *nft_set_ext_flags(const struct nft_set_ext *ext) 807 { 808 return nft_set_ext(ext, NFT_SET_EXT_FLAGS); 809 } 810 811 struct nft_timeout { 812 u64 timeout; 813 u64 expiration; 814 }; 815 816 static inline struct nft_timeout *nft_set_ext_timeout(const struct nft_set_ext *ext) 817 { 818 return nft_set_ext(ext, NFT_SET_EXT_TIMEOUT); 819 } 820 821 static inline struct nft_userdata *nft_set_ext_userdata(const struct nft_set_ext *ext) 822 { 823 return nft_set_ext(ext, NFT_SET_EXT_USERDATA); 824 } 825 826 static inline struct nft_set_elem_expr *nft_set_ext_expr(const struct nft_set_ext *ext) 827 { 828 return nft_set_ext(ext, NFT_SET_EXT_EXPRESSIONS); 829 } 830 831 static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext, 832 u64 tstamp) 833 { 834 if (!nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) || 835 READ_ONCE(nft_set_ext_timeout(ext)->timeout) == 0) 836 return false; 837 838 return time_after_eq64(tstamp, READ_ONCE(nft_set_ext_timeout(ext)->expiration)); 839 } 840 841 static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) 842 { 843 return __nft_set_elem_expired(ext, get_jiffies_64()); 844 } 845 846 static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set, 847 const struct nft_elem_priv *elem_priv) 848 { 849 return (void *)elem_priv + set->ops->elemsize; 850 } 851 852 static inline struct nft_object **nft_set_ext_obj(const struct nft_set_ext *ext) 853 { 854 return nft_set_ext(ext, NFT_SET_EXT_OBJREF); 855 } 856 857 struct nft_expr *nft_set_elem_expr_alloc(const struct nft_ctx *ctx, 858 const struct nft_set *set, 859 const struct nlattr *attr); 860 861 struct nft_elem_priv *nft_set_elem_init(const struct nft_set *set, 862 const struct nft_set_ext_tmpl *tmpl, 863 const u32 *key, const u32 *key_end, 864 const u32 *data, 865 u64 timeout, u64 expiration, gfp_t gfp); 866 int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, 867 struct nft_expr *expr_array[]); 868 void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, 869 struct nft_set_elem_expr *elem_expr); 870 void nft_set_elem_destroy(const struct nft_set *set, 871 const struct nft_elem_priv *elem_priv, 872 bool destroy_expr); 873 void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, 874 const struct nft_set *set, 875 const struct nft_elem_priv *elem_priv); 876 877 struct nft_expr_ops; 878 /** 879 * struct nft_expr_type - nf_tables expression type 880 * 881 * @select_ops: function to select nft_expr_ops 882 * @release_ops: release nft_expr_ops 883 * @ops: default ops, used when no select_ops functions is present 884 * @inner_ops: inner ops, used for inner packet operation 885 * @list: used internally 886 * @name: Identifier 887 * @owner: module reference 888 * @policy: netlink attribute policy 889 * @maxattr: highest netlink attribute number 890 * @family: address family for AF-specific types 891 * @flags: expression type flags 892 */ 893 struct nft_expr_type { 894 const struct nft_expr_ops *(*select_ops)(const struct nft_ctx *, 895 const struct nlattr * const tb[]); 896 void (*release_ops)(const struct nft_expr_ops *ops); 897 const struct nft_expr_ops *ops; 898 const struct nft_expr_ops *inner_ops; 899 struct list_head list; 900 const char *name; 901 struct module *owner; 902 const struct nla_policy *policy; 903 unsigned int maxattr; 904 u8 family; 905 u8 flags; 906 }; 907 908 #define NFT_EXPR_STATEFUL 0x1 909 #define NFT_EXPR_GC 0x2 910 911 enum nft_trans_phase { 912 NFT_TRANS_PREPARE, 913 NFT_TRANS_PREPARE_ERROR, 914 NFT_TRANS_ABORT, 915 NFT_TRANS_COMMIT, 916 NFT_TRANS_RELEASE 917 }; 918 919 struct nft_flow_rule; 920 struct nft_offload_ctx; 921 922 /** 923 * struct nft_expr_ops - nf_tables expression operations 924 * 925 * @eval: Expression evaluation function 926 * @clone: Expression clone function 927 * @size: full expression size, including private data size 928 * @init: initialization function 929 * @activate: activate expression in the next generation 930 * @deactivate: deactivate expression in next generation 931 * @destroy: destruction function, called after synchronize_rcu 932 * @destroy_clone: destruction clone function 933 * @dump: function to dump parameters 934 * @validate: validate expression, called during loop detection 935 * @gc: garbage collection expression 936 * @offload: hardware offload expression 937 * @offload_action: function to report true/false to allocate one slot or not in the flow 938 * offload array 939 * @offload_stats: function to synchronize hardware stats via updating the counter expression 940 * @type: expression type 941 * @data: extra data to attach to this expression operation 942 */ 943 struct nft_expr_ops { 944 void (*eval)(const struct nft_expr *expr, 945 struct nft_regs *regs, 946 const struct nft_pktinfo *pkt); 947 int (*clone)(struct nft_expr *dst, 948 const struct nft_expr *src, gfp_t gfp); 949 unsigned int size; 950 951 int (*init)(const struct nft_ctx *ctx, 952 const struct nft_expr *expr, 953 const struct nlattr * const tb[]); 954 void (*activate)(const struct nft_ctx *ctx, 955 const struct nft_expr *expr); 956 void (*deactivate)(const struct nft_ctx *ctx, 957 const struct nft_expr *expr, 958 enum nft_trans_phase phase); 959 void (*destroy)(const struct nft_ctx *ctx, 960 const struct nft_expr *expr); 961 void (*destroy_clone)(const struct nft_ctx *ctx, 962 const struct nft_expr *expr); 963 int (*dump)(struct sk_buff *skb, 964 const struct nft_expr *expr, 965 bool reset); 966 int (*validate)(const struct nft_ctx *ctx, 967 const struct nft_expr *expr); 968 bool (*gc)(struct net *net, 969 const struct nft_expr *expr); 970 int (*offload)(struct nft_offload_ctx *ctx, 971 struct nft_flow_rule *flow, 972 const struct nft_expr *expr); 973 bool (*offload_action)(const struct nft_expr *expr); 974 void (*offload_stats)(struct nft_expr *expr, 975 const struct flow_stats *stats); 976 const struct nft_expr_type *type; 977 void *data; 978 }; 979 980 /** 981 * struct nft_rule - nf_tables rule 982 * 983 * @list: used internally 984 * @handle: rule handle 985 * @genmask: generation mask 986 * @dlen: length of expression data 987 * @udata: user data is appended to the rule 988 * @data: expression data 989 */ 990 struct nft_rule { 991 struct list_head list; 992 u64 handle:42, 993 genmask:2, 994 dlen:12, 995 udata:1; 996 unsigned char data[] 997 __attribute__((aligned(__alignof__(struct nft_expr)))); 998 }; 999 1000 static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule) 1001 { 1002 return (struct nft_expr *)&rule->data[0]; 1003 } 1004 1005 static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr) 1006 { 1007 return ((void *)expr) + expr->ops->size; 1008 } 1009 1010 static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule) 1011 { 1012 return (struct nft_expr *)&rule->data[rule->dlen]; 1013 } 1014 1015 static inline bool nft_expr_more(const struct nft_rule *rule, 1016 const struct nft_expr *expr) 1017 { 1018 return expr != nft_expr_last(rule) && expr->ops; 1019 } 1020 1021 static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule) 1022 { 1023 return (void *)&rule->data[rule->dlen]; 1024 } 1025 1026 void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule); 1027 void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule, 1028 enum nft_trans_phase phase); 1029 void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule); 1030 1031 static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext, 1032 struct nft_regs *regs, 1033 const struct nft_pktinfo *pkt) 1034 { 1035 struct nft_set_elem_expr *elem_expr; 1036 struct nft_expr *expr; 1037 u32 size; 1038 1039 if (__nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS)) { 1040 elem_expr = nft_set_ext_expr(ext); 1041 nft_setelem_expr_foreach(expr, elem_expr, size) { 1042 expr->ops->eval(expr, regs, pkt); 1043 if (regs->verdict.code == NFT_BREAK) 1044 return; 1045 } 1046 } 1047 } 1048 1049 /* 1050 * The last pointer isn't really necessary, but the compiler isn't able to 1051 * determine that the result of nft_expr_last() is always the same since it 1052 * can't assume that the dlen value wasn't changed within calls in the loop. 1053 */ 1054 #define nft_rule_for_each_expr(expr, last, rule) \ 1055 for ((expr) = nft_expr_first(rule), (last) = nft_expr_last(rule); \ 1056 (expr) != (last); \ 1057 (expr) = nft_expr_next(expr)) 1058 1059 #define NFT_CHAIN_POLICY_UNSET U8_MAX 1060 1061 struct nft_rule_dp { 1062 u64 is_last:1, 1063 dlen:12, 1064 handle:42; /* for tracing */ 1065 unsigned char data[] 1066 __attribute__((aligned(__alignof__(struct nft_expr)))); 1067 }; 1068 1069 struct nft_rule_dp_last { 1070 struct nft_rule_dp end; /* end of nft_rule_blob marker */ 1071 struct rcu_head h; /* call_rcu head */ 1072 struct nft_rule_blob *blob; /* ptr to free via call_rcu */ 1073 const struct nft_chain *chain; /* for nftables tracing */ 1074 }; 1075 1076 static inline const struct nft_rule_dp *nft_rule_next(const struct nft_rule_dp *rule) 1077 { 1078 return (void *)rule + sizeof(*rule) + rule->dlen; 1079 } 1080 1081 struct nft_rule_blob { 1082 unsigned long size; 1083 unsigned char data[] 1084 __attribute__((aligned(__alignof__(struct nft_rule_dp)))); 1085 }; 1086 1087 enum nft_chain_types { 1088 NFT_CHAIN_T_DEFAULT = 0, 1089 NFT_CHAIN_T_ROUTE, 1090 NFT_CHAIN_T_NAT, 1091 NFT_CHAIN_T_MAX 1092 }; 1093 1094 /** 1095 * struct nft_chain_validate_state - validation state 1096 * 1097 * If a chain is encountered again during table validation it is 1098 * possible to avoid revalidation provided the calling context is 1099 * compatible. This structure stores relevant calling context of 1100 * previous validations. 1101 * 1102 * @hook_mask: the hook numbers and locations the chain is linked to 1103 * @depth: the deepest call chain level the chain is linked to 1104 */ 1105 struct nft_chain_validate_state { 1106 u8 hook_mask[NFT_CHAIN_T_MAX]; 1107 u8 depth; 1108 }; 1109 1110 /** 1111 * struct nft_chain - nf_tables chain 1112 * 1113 * @blob_gen_0: rule blob pointer to the current generation 1114 * @blob_gen_1: rule blob pointer to the future generation 1115 * @rules: list of rules in the chain 1116 * @list: used internally 1117 * @rhlhead: used internally 1118 * @table: table that this chain belongs to 1119 * @handle: chain handle 1120 * @use: number of jump references to this chain 1121 * @flags: bitmask of enum NFTA_CHAIN_FLAGS 1122 * @bound: bind or not 1123 * @genmask: generation mask 1124 * @name: name of the chain 1125 * @udlen: user data length 1126 * @udata: user data in the chain 1127 * @blob_next: rule blob pointer to the next in the chain 1128 * @vstate: validation state 1129 */ 1130 struct nft_chain { 1131 struct nft_rule_blob __rcu *blob_gen_0; 1132 struct nft_rule_blob __rcu *blob_gen_1; 1133 struct list_head rules; 1134 struct list_head list; 1135 struct rhlist_head rhlhead; 1136 struct nft_table *table; 1137 u64 handle; 1138 u32 use; 1139 u8 flags:5, 1140 bound:1, 1141 genmask:2; 1142 char *name; 1143 u16 udlen; 1144 u8 *udata; 1145 1146 /* Only used during control plane commit phase: */ 1147 struct nft_rule_blob *blob_next; 1148 struct nft_chain_validate_state vstate; 1149 }; 1150 1151 int nft_chain_validate(const struct nft_ctx *ctx, struct nft_chain *chain); 1152 int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, 1153 const struct nft_set_iter *iter, 1154 struct nft_elem_priv *elem_priv); 1155 int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set); 1156 int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); 1157 void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain); 1158 1159 /** 1160 * struct nft_chain_type - nf_tables chain type info 1161 * 1162 * @name: name of the type 1163 * @type: numeric identifier 1164 * @family: address family 1165 * @owner: module owner 1166 * @hook_mask: mask of valid hooks 1167 * @hooks: array of hook functions 1168 * @ops_register: base chain register function 1169 * @ops_unregister: base chain unregister function 1170 */ 1171 struct nft_chain_type { 1172 const char *name; 1173 enum nft_chain_types type; 1174 int family; 1175 struct module *owner; 1176 unsigned int hook_mask; 1177 nf_hookfn *hooks[NFT_MAX_HOOKS]; 1178 int (*ops_register)(struct net *net, const struct nf_hook_ops *ops); 1179 void (*ops_unregister)(struct net *net, const struct nf_hook_ops *ops); 1180 }; 1181 1182 int nft_chain_validate_dependency(const struct nft_chain *chain, 1183 enum nft_chain_types type); 1184 int nft_chain_validate_hooks(const struct nft_chain *chain, 1185 unsigned int hook_flags); 1186 1187 static inline bool nft_chain_binding(const struct nft_chain *chain) 1188 { 1189 return chain->flags & NFT_CHAIN_BINDING; 1190 } 1191 1192 static inline bool nft_chain_is_bound(struct nft_chain *chain) 1193 { 1194 return (chain->flags & NFT_CHAIN_BINDING) && chain->bound; 1195 } 1196 1197 int nft_chain_add(struct nft_table *table, struct nft_chain *chain); 1198 void nft_chain_del(struct nft_chain *chain); 1199 void nf_tables_chain_destroy(struct nft_chain *chain); 1200 1201 struct nft_stats { 1202 u64 bytes; 1203 u64 pkts; 1204 struct u64_stats_sync syncp; 1205 }; 1206 1207 struct nft_hook { 1208 struct list_head list; 1209 struct list_head ops_list; 1210 struct rcu_head rcu; 1211 char ifname[IFNAMSIZ]; 1212 u8 ifnamelen; 1213 }; 1214 1215 struct nf_hook_ops *nft_hook_find_ops(const struct nft_hook *hook, 1216 const struct net_device *dev); 1217 struct nf_hook_ops *nft_hook_find_ops_rcu(const struct nft_hook *hook, 1218 const struct net_device *dev); 1219 1220 /** 1221 * struct nft_base_chain - nf_tables base chain 1222 * 1223 * @ops: netfilter hook ops 1224 * @hook_list: list of netfilter hooks (for NFPROTO_NETDEV family) 1225 * @type: chain type 1226 * @policy: default policy 1227 * @flags: indicate the base chain disabled or not 1228 * @stats: per-cpu chain stats 1229 * @chain: the chain 1230 * @flow_block: flow block (for hardware offload) 1231 */ 1232 struct nft_base_chain { 1233 struct nf_hook_ops ops; 1234 struct list_head hook_list; 1235 const struct nft_chain_type *type; 1236 u8 policy; 1237 u8 flags; 1238 struct nft_stats __percpu *stats; 1239 struct nft_chain chain; 1240 struct flow_block flow_block; 1241 }; 1242 1243 static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chain) 1244 { 1245 return container_of(chain, struct nft_base_chain, chain); 1246 } 1247 1248 static inline bool nft_is_base_chain(const struct nft_chain *chain) 1249 { 1250 return chain->flags & NFT_CHAIN_BASE; 1251 } 1252 1253 unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv); 1254 1255 static inline bool nft_use_inc(u32 *use) 1256 { 1257 if (*use == UINT_MAX) 1258 return false; 1259 1260 (*use)++; 1261 1262 return true; 1263 } 1264 1265 static inline void nft_use_dec(u32 *use) 1266 { 1267 WARN_ON_ONCE((*use)-- == 0); 1268 } 1269 1270 /* For error and abort path: restore use counter to previous state. */ 1271 static inline void nft_use_inc_restore(u32 *use) 1272 { 1273 WARN_ON_ONCE(!nft_use_inc(use)); 1274 } 1275 1276 #define nft_use_dec_restore nft_use_dec 1277 1278 /** 1279 * struct nft_table - nf_tables table 1280 * 1281 * @list: used internally 1282 * @chains_ht: chains in the table 1283 * @chains: same, for stable walks 1284 * @sets: sets in the table 1285 * @objects: stateful objects in the table 1286 * @flowtables: flow tables in the table 1287 * @hgenerator: handle generator state 1288 * @handle: table handle 1289 * @use: number of chain references to this table 1290 * @family:address family 1291 * @flags: table flag (see enum nft_table_flags) 1292 * @genmask: generation mask 1293 * @nlpid: netlink port ID 1294 * @name: name of the table 1295 * @udlen: length of the user data 1296 * @udata: user data 1297 * @validate_state: internal, set when transaction adds jumps 1298 */ 1299 struct nft_table { 1300 struct list_head list; 1301 struct rhltable chains_ht; 1302 struct list_head chains; 1303 struct list_head sets; 1304 struct list_head objects; 1305 struct list_head flowtables; 1306 u64 hgenerator; 1307 u64 handle; 1308 u32 use; 1309 u16 family:6, 1310 flags:8, 1311 genmask:2; 1312 u32 nlpid; 1313 char *name; 1314 u16 udlen; 1315 u8 *udata; 1316 u8 validate_state; 1317 }; 1318 1319 static inline bool nft_table_has_owner(const struct nft_table *table) 1320 { 1321 return table->flags & NFT_TABLE_F_OWNER; 1322 } 1323 1324 static inline bool nft_table_is_orphan(const struct nft_table *table) 1325 { 1326 return (table->flags & (NFT_TABLE_F_OWNER | NFT_TABLE_F_PERSIST)) == 1327 NFT_TABLE_F_PERSIST; 1328 } 1329 1330 static inline bool nft_base_chain_netdev(int family, u32 hooknum) 1331 { 1332 return family == NFPROTO_NETDEV || 1333 (family == NFPROTO_INET && hooknum == NF_INET_INGRESS); 1334 } 1335 1336 void nft_register_chain_type(const struct nft_chain_type *); 1337 void nft_unregister_chain_type(const struct nft_chain_type *); 1338 1339 int nft_register_expr(struct nft_expr_type *); 1340 void nft_unregister_expr(struct nft_expr_type *); 1341 1342 int nft_verdict_dump(struct sk_buff *skb, int type, 1343 const struct nft_verdict *v); 1344 1345 /** 1346 * struct nft_object_hash_key - key to lookup nft_object 1347 * 1348 * @name: name of the stateful object to look up 1349 * @table: table the object belongs to 1350 */ 1351 struct nft_object_hash_key { 1352 const char *name; 1353 const struct nft_table *table; 1354 }; 1355 1356 /** 1357 * struct nft_object - nf_tables stateful object 1358 * 1359 * @list: table stateful object list node 1360 * @rhlhead: nft_objname_ht node 1361 * @key: keys that identify this object 1362 * @genmask: generation mask 1363 * @use: number of references to this stateful object 1364 * @handle: unique object handle 1365 * @udlen: length of user data 1366 * @udata: user data 1367 * @ops: object operations 1368 * @data: object data, layout depends on type 1369 */ 1370 struct nft_object { 1371 struct list_head list; 1372 struct rhlist_head rhlhead; 1373 struct nft_object_hash_key key; 1374 u32 genmask:2; 1375 u32 use; 1376 u64 handle; 1377 u16 udlen; 1378 u8 *udata; 1379 /* runtime data below here */ 1380 const struct nft_object_ops *ops ____cacheline_aligned; 1381 unsigned char data[] 1382 __attribute__((aligned(__alignof__(u64)))); 1383 }; 1384 1385 static inline void *nft_obj_data(const struct nft_object *obj) 1386 { 1387 return (void *)obj->data; 1388 } 1389 1390 #define nft_expr_obj(expr) *((struct nft_object **)nft_expr_priv(expr)) 1391 1392 struct nft_object *nft_obj_lookup(const struct net *net, 1393 const struct nft_table *table, 1394 const struct nlattr *nla, u32 objtype, 1395 u8 genmask); 1396 1397 void nft_obj_notify(struct net *net, const struct nft_table *table, 1398 struct nft_object *obj, u32 portid, u32 seq, 1399 int event, u16 flags, int family, int report, gfp_t gfp); 1400 1401 /** 1402 * struct nft_object_type - stateful object type 1403 * 1404 * @select_ops: function to select nft_object_ops 1405 * @ops: default ops, used when no select_ops functions is present 1406 * @list: list node in list of object types 1407 * @type: stateful object numeric type 1408 * @owner: module owner 1409 * @maxattr: maximum netlink attribute 1410 * @family: address family for AF-specific object types 1411 * @policy: netlink attribute policy 1412 */ 1413 struct nft_object_type { 1414 const struct nft_object_ops *(*select_ops)(const struct nft_ctx *, 1415 const struct nlattr * const tb[]); 1416 const struct nft_object_ops *ops; 1417 struct list_head list; 1418 u32 type; 1419 unsigned int maxattr; 1420 u8 family; 1421 struct module *owner; 1422 const struct nla_policy *policy; 1423 }; 1424 1425 /** 1426 * struct nft_object_ops - stateful object operations 1427 * 1428 * @eval: stateful object evaluation function 1429 * @size: stateful object size 1430 * @init: initialize object from netlink attributes 1431 * @destroy: release existing stateful object 1432 * @dump: netlink dump stateful object 1433 * @update: update stateful object 1434 * @type: pointer to object type 1435 */ 1436 struct nft_object_ops { 1437 void (*eval)(struct nft_object *obj, 1438 struct nft_regs *regs, 1439 const struct nft_pktinfo *pkt); 1440 unsigned int size; 1441 int (*init)(const struct nft_ctx *ctx, 1442 const struct nlattr *const tb[], 1443 struct nft_object *obj); 1444 void (*destroy)(const struct nft_ctx *ctx, 1445 struct nft_object *obj); 1446 int (*dump)(struct sk_buff *skb, 1447 struct nft_object *obj, 1448 bool reset); 1449 void (*update)(struct nft_object *obj, 1450 struct nft_object *newobj); 1451 const struct nft_object_type *type; 1452 }; 1453 1454 int nft_register_obj(struct nft_object_type *obj_type); 1455 void nft_unregister_obj(struct nft_object_type *obj_type); 1456 1457 #define NFT_NETDEVICE_MAX 256 1458 1459 /** 1460 * struct nft_flowtable - nf_tables flow table 1461 * 1462 * @list: flow table list node in table list 1463 * @table: the table the flow table is contained in 1464 * @name: name of this flow table 1465 * @hooknum: hook number 1466 * @ops_len: number of hooks in array 1467 * @genmask: generation mask 1468 * @use: number of references to this flow table 1469 * @handle: unique object handle 1470 * @hook_list: hook list for hooks per net_device in flowtables 1471 * @data: rhashtable and garbage collector 1472 */ 1473 struct nft_flowtable { 1474 struct list_head list; 1475 struct nft_table *table; 1476 char *name; 1477 int hooknum; 1478 int ops_len; 1479 u32 genmask:2; 1480 u32 use; 1481 u64 handle; 1482 /* runtime data below here */ 1483 struct list_head hook_list ____cacheline_aligned; 1484 struct nf_flowtable data; 1485 }; 1486 1487 struct nft_flowtable *nft_flowtable_lookup(const struct net *net, 1488 const struct nft_table *table, 1489 const struct nlattr *nla, 1490 u8 genmask); 1491 1492 void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx, 1493 struct nft_flowtable *flowtable, 1494 enum nft_trans_phase phase); 1495 1496 void nft_register_flowtable_type(struct nf_flowtable_type *type); 1497 void nft_unregister_flowtable_type(struct nf_flowtable_type *type); 1498 1499 /** 1500 * struct nft_traceinfo - nft tracing information and state 1501 * 1502 * @trace: other struct members are initialised 1503 * @nf_trace: copy of skb->nf_trace before rule evaluation 1504 * @type: event type (enum nft_trace_types) 1505 * @skbid: hash of skb to be used as trace id 1506 * @packet_dumped: packet headers sent in a previous traceinfo message 1507 * @basechain: base chain currently processed 1508 */ 1509 struct nft_traceinfo { 1510 bool trace; 1511 bool nf_trace; 1512 bool packet_dumped; 1513 enum nft_trace_types type:8; 1514 u32 skbid; 1515 const struct nft_base_chain *basechain; 1516 }; 1517 1518 void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, 1519 const struct nft_chain *basechain); 1520 1521 void nft_trace_notify(const struct nft_pktinfo *pkt, 1522 const struct nft_verdict *verdict, 1523 const struct nft_rule_dp *rule, 1524 struct nft_traceinfo *info); 1525 1526 #define MODULE_ALIAS_NFT_CHAIN(family, name) \ 1527 MODULE_ALIAS("nft-chain-" __stringify(family) "-" name) 1528 1529 #define MODULE_ALIAS_NFT_AF_EXPR(family, name) \ 1530 MODULE_ALIAS("nft-expr-" __stringify(family) "-" name) 1531 1532 #define MODULE_ALIAS_NFT_EXPR(name) \ 1533 MODULE_ALIAS("nft-expr-" name) 1534 1535 #define MODULE_ALIAS_NFT_OBJ(type) \ 1536 MODULE_ALIAS("nft-obj-" __stringify(type)) 1537 1538 #if IS_ENABLED(CONFIG_NF_TABLES) 1539 1540 /* 1541 * The gencursor defines two generations, the currently active and the 1542 * next one. Objects contain a bitmask of 2 bits specifying the generations 1543 * they're active in. A set bit means they're inactive in the generation 1544 * represented by that bit. 1545 * 1546 * New objects start out as inactive in the current and active in the 1547 * next generation. When committing the ruleset the bitmask is cleared, 1548 * meaning they're active in all generations. When removing an object, 1549 * it is set inactive in the next generation. After committing the ruleset, 1550 * the objects are removed. 1551 */ 1552 static inline unsigned int nft_gencursor_next(const struct net *net) 1553 { 1554 return net->nft.gencursor + 1 == 1 ? 1 : 0; 1555 } 1556 1557 static inline u8 nft_genmask_next(const struct net *net) 1558 { 1559 return 1 << nft_gencursor_next(net); 1560 } 1561 1562 static inline u8 nft_genmask_cur(const struct net *net) 1563 { 1564 /* Use READ_ONCE() to prevent refetching the value for atomicity */ 1565 return 1 << READ_ONCE(net->nft.gencursor); 1566 } 1567 1568 #define NFT_GENMASK_ANY ((1 << 0) | (1 << 1)) 1569 1570 /* 1571 * Generic transaction helpers 1572 */ 1573 1574 /* Check if this object is currently active. */ 1575 #define nft_is_active(__net, __obj) \ 1576 (((__obj)->genmask & nft_genmask_cur(__net)) == 0) 1577 1578 /* Check if this object is active in the next generation. */ 1579 #define nft_is_active_next(__net, __obj) \ 1580 (((__obj)->genmask & nft_genmask_next(__net)) == 0) 1581 1582 /* This object becomes active in the next generation. */ 1583 #define nft_activate_next(__net, __obj) \ 1584 (__obj)->genmask = nft_genmask_cur(__net) 1585 1586 /* This object becomes inactive in the next generation. */ 1587 #define nft_deactivate_next(__net, __obj) \ 1588 (__obj)->genmask = nft_genmask_next(__net) 1589 1590 /* After committing the ruleset, clear the stale generation bit. */ 1591 #define nft_clear(__net, __obj) \ 1592 (__obj)->genmask &= ~nft_genmask_next(__net) 1593 #define nft_active_genmask(__obj, __genmask) \ 1594 !((__obj)->genmask & __genmask) 1595 1596 /* 1597 * Set element transaction helpers 1598 */ 1599 1600 static inline bool nft_set_elem_active(const struct nft_set_ext *ext, 1601 u8 genmask) 1602 { 1603 return !(ext->genmask & genmask); 1604 } 1605 1606 static inline void nft_set_elem_change_active(const struct net *net, 1607 const struct nft_set *set, 1608 struct nft_set_ext *ext) 1609 { 1610 ext->genmask ^= nft_genmask_next(net); 1611 } 1612 1613 #endif /* IS_ENABLED(CONFIG_NF_TABLES) */ 1614 1615 #define NFT_SET_ELEM_DEAD_MASK (1 << 2) 1616 1617 #if defined(__LITTLE_ENDIAN_BITFIELD) 1618 #define NFT_SET_ELEM_DEAD_BIT 2 1619 #elif defined(__BIG_ENDIAN_BITFIELD) 1620 #define NFT_SET_ELEM_DEAD_BIT (BITS_PER_LONG - BITS_PER_BYTE + 2) 1621 #else 1622 #error 1623 #endif 1624 1625 static inline void nft_set_elem_dead(struct nft_set_ext *ext) 1626 { 1627 unsigned long *word = (unsigned long *)ext; 1628 1629 BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0); 1630 set_bit(NFT_SET_ELEM_DEAD_BIT, word); 1631 } 1632 1633 static inline int nft_set_elem_is_dead(const struct nft_set_ext *ext) 1634 { 1635 unsigned long *word = (unsigned long *)ext; 1636 1637 BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0); 1638 return test_bit(NFT_SET_ELEM_DEAD_BIT, word); 1639 } 1640 1641 /** 1642 * struct nft_trans - nf_tables object update in transaction 1643 * 1644 * @list: used internally 1645 * @net: struct net 1646 * @table: struct nft_table the object resides in 1647 * @msg_type: message type 1648 * @seq: netlink sequence number 1649 * @flags: modifiers to new request 1650 * @report: notify via unicast netlink message 1651 * @put_net: net needs to be put 1652 * 1653 * This is the information common to all objects in the transaction, 1654 * this must always be the first member of derived sub-types. 1655 */ 1656 struct nft_trans { 1657 struct list_head list; 1658 struct net *net; 1659 struct nft_table *table; 1660 int msg_type; 1661 u32 seq; 1662 u16 flags; 1663 u8 report:1; 1664 u8 put_net:1; 1665 }; 1666 1667 /** 1668 * struct nft_trans_binding - nf_tables object with binding support in transaction 1669 * @nft_trans: base structure, MUST be first member 1670 * @binding_list: list of objects with possible bindings 1671 * 1672 * This is the base type used by objects that can be bound to a chain. 1673 */ 1674 struct nft_trans_binding { 1675 struct nft_trans nft_trans; 1676 struct list_head binding_list; 1677 }; 1678 1679 struct nft_trans_rule { 1680 struct nft_trans nft_trans; 1681 struct nft_rule *rule; 1682 struct nft_chain *chain; 1683 struct nft_flow_rule *flow; 1684 u32 rule_id; 1685 bool bound; 1686 }; 1687 1688 #define nft_trans_container_rule(trans) \ 1689 container_of(trans, struct nft_trans_rule, nft_trans) 1690 #define nft_trans_rule(trans) \ 1691 nft_trans_container_rule(trans)->rule 1692 #define nft_trans_flow_rule(trans) \ 1693 nft_trans_container_rule(trans)->flow 1694 #define nft_trans_rule_id(trans) \ 1695 nft_trans_container_rule(trans)->rule_id 1696 #define nft_trans_rule_bound(trans) \ 1697 nft_trans_container_rule(trans)->bound 1698 #define nft_trans_rule_chain(trans) \ 1699 nft_trans_container_rule(trans)->chain 1700 1701 struct nft_trans_set { 1702 struct nft_trans_binding nft_trans_binding; 1703 struct list_head list_trans_newset; 1704 struct nft_set *set; 1705 u32 set_id; 1706 u32 gc_int; 1707 u64 timeout; 1708 bool update; 1709 bool bound; 1710 u32 size; 1711 }; 1712 1713 #define nft_trans_container_set(t) \ 1714 container_of(t, struct nft_trans_set, nft_trans_binding.nft_trans) 1715 #define nft_trans_set(trans) \ 1716 nft_trans_container_set(trans)->set 1717 #define nft_trans_set_id(trans) \ 1718 nft_trans_container_set(trans)->set_id 1719 #define nft_trans_set_bound(trans) \ 1720 nft_trans_container_set(trans)->bound 1721 #define nft_trans_set_update(trans) \ 1722 nft_trans_container_set(trans)->update 1723 #define nft_trans_set_timeout(trans) \ 1724 nft_trans_container_set(trans)->timeout 1725 #define nft_trans_set_gc_int(trans) \ 1726 nft_trans_container_set(trans)->gc_int 1727 #define nft_trans_set_size(trans) \ 1728 nft_trans_container_set(trans)->size 1729 1730 struct nft_trans_chain { 1731 struct nft_trans_binding nft_trans_binding; 1732 struct nft_chain *chain; 1733 char *name; 1734 struct nft_stats __percpu *stats; 1735 u8 policy; 1736 bool update; 1737 bool bound; 1738 u32 chain_id; 1739 struct nft_base_chain *basechain; 1740 struct list_head hook_list; 1741 }; 1742 1743 #define nft_trans_container_chain(t) \ 1744 container_of(t, struct nft_trans_chain, nft_trans_binding.nft_trans) 1745 #define nft_trans_chain(trans) \ 1746 nft_trans_container_chain(trans)->chain 1747 #define nft_trans_chain_update(trans) \ 1748 nft_trans_container_chain(trans)->update 1749 #define nft_trans_chain_name(trans) \ 1750 nft_trans_container_chain(trans)->name 1751 #define nft_trans_chain_stats(trans) \ 1752 nft_trans_container_chain(trans)->stats 1753 #define nft_trans_chain_policy(trans) \ 1754 nft_trans_container_chain(trans)->policy 1755 #define nft_trans_chain_bound(trans) \ 1756 nft_trans_container_chain(trans)->bound 1757 #define nft_trans_chain_id(trans) \ 1758 nft_trans_container_chain(trans)->chain_id 1759 #define nft_trans_basechain(trans) \ 1760 nft_trans_container_chain(trans)->basechain 1761 #define nft_trans_chain_hooks(trans) \ 1762 nft_trans_container_chain(trans)->hook_list 1763 1764 struct nft_trans_table { 1765 struct nft_trans nft_trans; 1766 bool update; 1767 }; 1768 1769 #define nft_trans_container_table(trans) \ 1770 container_of(trans, struct nft_trans_table, nft_trans) 1771 #define nft_trans_table_update(trans) \ 1772 nft_trans_container_table(trans)->update 1773 1774 enum nft_trans_elem_flags { 1775 NFT_TRANS_UPD_TIMEOUT = (1 << 0), 1776 NFT_TRANS_UPD_EXPIRATION = (1 << 1), 1777 }; 1778 1779 struct nft_elem_update { 1780 u64 timeout; 1781 u64 expiration; 1782 u8 flags; 1783 }; 1784 1785 struct nft_trans_one_elem { 1786 struct nft_elem_priv *priv; 1787 struct nft_elem_update *update; 1788 }; 1789 1790 struct nft_trans_elem { 1791 struct nft_trans nft_trans; 1792 struct nft_set *set; 1793 bool bound; 1794 unsigned int nelems; 1795 struct nft_trans_one_elem elems[] __counted_by(nelems); 1796 }; 1797 1798 #define nft_trans_container_elem(t) \ 1799 container_of(t, struct nft_trans_elem, nft_trans) 1800 #define nft_trans_elem_set(trans) \ 1801 nft_trans_container_elem(trans)->set 1802 #define nft_trans_elem_set_bound(trans) \ 1803 nft_trans_container_elem(trans)->bound 1804 1805 struct nft_trans_obj { 1806 struct nft_trans nft_trans; 1807 struct nft_object *obj; 1808 struct nft_object *newobj; 1809 bool update; 1810 }; 1811 1812 #define nft_trans_container_obj(t) \ 1813 container_of(t, struct nft_trans_obj, nft_trans) 1814 #define nft_trans_obj(trans) \ 1815 nft_trans_container_obj(trans)->obj 1816 #define nft_trans_obj_newobj(trans) \ 1817 nft_trans_container_obj(trans)->newobj 1818 #define nft_trans_obj_update(trans) \ 1819 nft_trans_container_obj(trans)->update 1820 1821 struct nft_trans_flowtable { 1822 struct nft_trans nft_trans; 1823 struct nft_flowtable *flowtable; 1824 struct list_head hook_list; 1825 u32 flags; 1826 bool update; 1827 }; 1828 1829 #define nft_trans_container_flowtable(t) \ 1830 container_of(t, struct nft_trans_flowtable, nft_trans) 1831 #define nft_trans_flowtable(trans) \ 1832 nft_trans_container_flowtable(trans)->flowtable 1833 #define nft_trans_flowtable_update(trans) \ 1834 nft_trans_container_flowtable(trans)->update 1835 #define nft_trans_flowtable_hooks(trans) \ 1836 nft_trans_container_flowtable(trans)->hook_list 1837 #define nft_trans_flowtable_flags(trans) \ 1838 nft_trans_container_flowtable(trans)->flags 1839 1840 #define NFT_TRANS_GC_BATCHCOUNT 256 1841 1842 struct nft_trans_gc { 1843 struct list_head list; 1844 struct net *net; 1845 struct nft_set *set; 1846 u32 seq; 1847 u16 count; 1848 struct nft_elem_priv *priv[NFT_TRANS_GC_BATCHCOUNT]; 1849 struct rcu_head rcu; 1850 }; 1851 1852 static inline int nft_trans_gc_space(const struct nft_trans_gc *trans) 1853 { 1854 return NFT_TRANS_GC_BATCHCOUNT - trans->count; 1855 } 1856 1857 static inline void nft_ctx_update(struct nft_ctx *ctx, 1858 const struct nft_trans *trans) 1859 { 1860 switch (trans->msg_type) { 1861 case NFT_MSG_NEWRULE: 1862 case NFT_MSG_DELRULE: 1863 case NFT_MSG_DESTROYRULE: 1864 ctx->chain = nft_trans_rule_chain(trans); 1865 break; 1866 case NFT_MSG_NEWCHAIN: 1867 case NFT_MSG_DELCHAIN: 1868 case NFT_MSG_DESTROYCHAIN: 1869 ctx->chain = nft_trans_chain(trans); 1870 break; 1871 default: 1872 ctx->chain = NULL; 1873 break; 1874 } 1875 1876 ctx->net = trans->net; 1877 ctx->table = trans->table; 1878 ctx->family = trans->table->family; 1879 ctx->report = trans->report; 1880 ctx->flags = trans->flags; 1881 ctx->seq = trans->seq; 1882 } 1883 1884 struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set, 1885 unsigned int gc_seq, gfp_t gfp); 1886 void nft_trans_gc_destroy(struct nft_trans_gc *trans); 1887 1888 struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc, 1889 unsigned int gc_seq, gfp_t gfp); 1890 void nft_trans_gc_queue_async_done(struct nft_trans_gc *gc); 1891 1892 struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp); 1893 void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans); 1894 1895 void nft_trans_gc_elem_add(struct nft_trans_gc *gc, void *priv); 1896 1897 struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc, 1898 unsigned int gc_seq); 1899 struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc); 1900 1901 void nft_setelem_data_deactivate(const struct net *net, 1902 const struct nft_set *set, 1903 struct nft_elem_priv *elem_priv); 1904 1905 int __init nft_chain_filter_init(void); 1906 void nft_chain_filter_fini(void); 1907 1908 void __init nft_chain_route_init(void); 1909 void nft_chain_route_fini(void); 1910 1911 void nf_tables_trans_destroy_flush_work(struct net *net); 1912 1913 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result); 1914 __be64 nf_jiffies64_to_msecs(u64 input); 1915 1916 #ifdef CONFIG_MODULES 1917 __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, ...); 1918 #else 1919 static inline int nft_request_module(struct net *net, const char *fmt, ...) { return -ENOENT; } 1920 #endif 1921 1922 struct nftables_pernet { 1923 struct list_head tables; 1924 struct list_head commit_list; 1925 struct list_head destroy_list; 1926 struct list_head commit_set_list; 1927 struct list_head binding_list; 1928 struct list_head module_list; 1929 struct list_head notify_list; 1930 struct mutex commit_mutex; 1931 u64 table_handle; 1932 u64 tstamp; 1933 unsigned int gc_seq; 1934 u8 validate_state; 1935 struct work_struct destroy_work; 1936 }; 1937 1938 extern unsigned int nf_tables_net_id; 1939 1940 static inline struct nftables_pernet *nft_pernet(const struct net *net) 1941 { 1942 return net_generic(net, nf_tables_net_id); 1943 } 1944 1945 static inline u64 nft_net_tstamp(const struct net *net) 1946 { 1947 return nft_pernet(net)->tstamp; 1948 } 1949 1950 #endif /* _NET_NF_TABLES_H */ 1951