nft_compat.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
  4 *
  5 * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
  6 */
  7
  8#include <linux/kernel.h>
  9#include <linux/init.h>
 10#include <linux/module.h>
 11#include <linux/netlink.h>
 12#include <linux/netfilter.h>
 13#include <linux/netfilter/nfnetlink.h>
 14#include <linux/netfilter/nf_tables.h>
 15#include <linux/netfilter/nf_tables_compat.h>
 16#include <linux/netfilter/x_tables.h>
 17#include <linux/netfilter_ipv4/ip_tables.h>
 18#include <linux/netfilter_ipv6/ip6_tables.h>
 19#include <linux/netfilter_bridge/ebtables.h>
 20#include <linux/netfilter_arp/arp_tables.h>
 21#include <net/netfilter/nf_tables.h>
 22#include <net/netfilter/nf_log.h>
 23
 24/* Used for matches where *info is larger than X byte */
 25#define NFT_MATCH_LARGE_THRESH	192
 26
 27struct nft_xt_match_priv {
 28	void *info;
 29};
 30
 31static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx,
 32						const char *tablename)
 33{
 34	enum nft_chain_types type = NFT_CHAIN_T_DEFAULT;
 35	const struct nft_chain *chain = ctx->chain;
 36	const struct nft_base_chain *basechain;
 37
 38	if (!tablename ||
 39	    !nft_is_base_chain(chain))
 40		return 0;
 41
 42	basechain = nft_base_chain(chain);
 43	if (strcmp(tablename, "nat") == 0) {
 44		if (ctx->family != NFPROTO_BRIDGE)
 45			type = NFT_CHAIN_T_NAT;
 46		if (basechain->type->type != type)
 47			return -EINVAL;
 48	}
 49
 50	return 0;
 51}
 52
 53union nft_entry {
 54	struct ipt_entry e4;
 55	struct ip6t_entry e6;
 56	struct ebt_entry ebt;
 57	struct arpt_entry arp;
 58};
 59
 60static inline void
 61nft_compat_set_par(struct xt_action_param *par,
 62		   const struct nft_pktinfo *pkt,
 63		   const void *xt, const void *xt_info)
 64{
 65	par->state	= pkt->state;
 66	par->thoff	= nft_thoff(pkt);
 67	par->fragoff	= pkt->fragoff;
 68	par->target	= xt;
 69	par->targinfo	= xt_info;
 70	par->hotdrop	= false;
 71}
 72
 73static void nft_target_eval_xt(const struct nft_expr *expr,
 74			       struct nft_regs *regs,
 75			       const struct nft_pktinfo *pkt)
 76{
 77	void *info = nft_expr_priv(expr);
 78	struct xt_target *target = expr->ops->data;
 79	struct sk_buff *skb = pkt->skb;
 80	struct xt_action_param xt;
 81	int ret;
 82
 83	nft_compat_set_par(&xt, pkt, target, info);
 84
 85	ret = target->target(skb, &xt);
 86
 87	if (xt.hotdrop)
 88		ret = NF_DROP;
 89
 90	switch (ret) {
 91	case XT_CONTINUE:
 92		regs->verdict.code = NFT_CONTINUE;
 93		break;
 94	default:
 95		regs->verdict.code = ret;
 96		break;
 97	}
 98}
 99
100static void nft_target_eval_bridge(const struct nft_expr *expr,
101				   struct nft_regs *regs,
102				   const struct nft_pktinfo *pkt)
103{
104	void *info = nft_expr_priv(expr);
105	struct xt_target *target = expr->ops->data;
106	struct sk_buff *skb = pkt->skb;
107	struct xt_action_param xt;
108	int ret;
109
110	nft_compat_set_par(&xt, pkt, target, info);
111
112	ret = target->target(skb, &xt);
113
114	if (xt.hotdrop)
115		ret = NF_DROP;
116
117	switch (ret) {
118	case EBT_ACCEPT:
119		regs->verdict.code = NF_ACCEPT;
120		break;
121	case EBT_DROP:
122		regs->verdict.code = NF_DROP;
123		break;
124	case EBT_CONTINUE:
125		regs->verdict.code = NFT_CONTINUE;
126		break;
127	case EBT_RETURN:
128		regs->verdict.code = NFT_RETURN;
129		break;
130	default:
131		regs->verdict.code = ret;
132		break;
133	}
134}
135
136static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = {
137	[NFTA_TARGET_NAME]	= { .type = NLA_NUL_STRING,
138				    .len = XT_EXTENSION_MAXNAMELEN, },
139	[NFTA_TARGET_REV]	= NLA_POLICY_MAX(NLA_BE32, 255),
140	[NFTA_TARGET_INFO]	= { .type = NLA_BINARY },
141};
142
143static void
144nft_target_set_tgchk_param(struct xt_tgchk_param *par,
145			   const struct nft_ctx *ctx,
146			   struct xt_target *target, void *info,
147			   union nft_entry *entry, u16 proto, bool inv)
148{
149	par->net	= ctx->net;
150	par->table	= ctx->table->name;
151	switch (ctx->family) {
152	case AF_INET:
153		entry->e4.ip.proto = proto;
154		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
155		break;
156	case AF_INET6:
157		if (proto)
158			entry->e6.ipv6.flags |= IP6T_F_PROTO;
159
160		entry->e6.ipv6.proto = proto;
161		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
162		break;
163	case NFPROTO_BRIDGE:
164		entry->ebt.ethproto = (__force __be16)proto;
165		entry->ebt.invflags = inv ? EBT_IPROTO : 0;
166		break;
167	case NFPROTO_ARP:
168		break;
169	}
170	par->entryinfo	= entry;
171	par->target	= target;
172	par->targinfo	= info;
173	if (nft_is_base_chain(ctx->chain)) {
174		const struct nft_base_chain *basechain =
175						nft_base_chain(ctx->chain);
176		const struct nf_hook_ops *ops = &basechain->ops;
177
178		par->hook_mask = 1 << ops->hooknum;
179	} else {
180		par->hook_mask = 0;
181	}
182	par->family	= ctx->family;
183	par->nft_compat = true;
184}
185
186static void target_compat_from_user(struct xt_target *t, void *in, void *out)
187{
188	int pad;
189
190	memcpy(out, in, t->targetsize);
191	pad = XT_ALIGN(t->targetsize) - t->targetsize;
192	if (pad > 0)
193		memset(out + t->targetsize, 0, pad);
194}
195
196static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = {
197	[NFTA_RULE_COMPAT_PROTO]	= { .type = NLA_U32 },
198	[NFTA_RULE_COMPAT_FLAGS]	= { .type = NLA_U32 },
199};
200
201static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
202{
203	struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
204	u32 l4proto;
205	u32 flags;
206	int err;
207
208	err = nla_parse_nested_deprecated(tb, NFTA_RULE_COMPAT_MAX, attr,
209					  nft_rule_compat_policy, NULL);
210	if (err < 0)
211		return err;
212
213	if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS])
214		return -EINVAL;
215
216	flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS]));
217	if (flags & NFT_RULE_COMPAT_F_UNUSED ||
218	    flags & ~NFT_RULE_COMPAT_F_MASK)
219		return -EINVAL;
220	if (flags & NFT_RULE_COMPAT_F_INV)
221		*inv = true;
222
223	l4proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
224	if (l4proto > U16_MAX)
225		return -EINVAL;
226
227	*proto = l4proto;
228
229	return 0;
230}
231
232static void nft_compat_wait_for_destructors(struct net *net)
233{
234	/* xtables matches or targets can have side effects, e.g.
235	 * creation/destruction of /proc files.
236	 * The xt ->destroy functions are run asynchronously from
237	 * work queue.  If we have pending invocations we thus
238	 * need to wait for those to finish.
239	 */
240	nf_tables_trans_destroy_flush_work(net);
241}
242
243static int
244nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
245		const struct nlattr * const tb[])
246{
247	void *info = nft_expr_priv(expr);
248	struct xt_target *target = expr->ops->data;
249	struct xt_tgchk_param par;
250	size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
251	u16 proto = 0;
252	bool inv = false;
253	union nft_entry e = {};
254	int ret;
255
256	target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
257
258	if (ctx->nla[NFTA_RULE_COMPAT]) {
259		ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
260		if (ret < 0)
261			return ret;
262	}
263
264	nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
265
266	nft_compat_wait_for_destructors(ctx->net);
267
268	ret = xt_check_target(&par, size, proto, inv);
269	if (ret < 0) {
270		if (ret == -ENOENT) {
271			const char *modname = NULL;
272
273			if (strcmp(target->name, "LOG") == 0)
274				modname = "nf_log_syslog";
275			else if (strcmp(target->name, "NFLOG") == 0)
276				modname = "nfnetlink_log";
277
278			if (modname &&
279			    nft_request_module(ctx->net, "%s", modname) == -EAGAIN)
280				return -EAGAIN;
281		}
282
283		return ret;
284	}
285
286	/* The standard target cannot be used */
287	if (!target->target)
288		return -EINVAL;
289
290	return 0;
291}
292
293static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr)
294{
295	module_put(me);
296	kfree(expr->ops);
297}
298
299static void
300nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
301{
302	struct xt_target *target = expr->ops->data;
303	void *info = nft_expr_priv(expr);
304	struct module *me = target->me;
305	struct xt_tgdtor_param par;
306
307	par.net = ctx->net;
308	par.target = target;
309	par.targinfo = info;
310	par.family = ctx->family;
311	if (par.target->destroy != NULL)
312		par.target->destroy(&par);
313
314	__nft_mt_tg_destroy(me, expr);
315}
316
317static int nft_extension_dump_info(struct sk_buff *skb, int attr,
318				   const void *info,
319				   unsigned int size, unsigned int user_size)
320{
321	unsigned int info_size, aligned_size = XT_ALIGN(size);
322	struct nlattr *nla;
323
324	nla = nla_reserve(skb, attr, aligned_size);
325	if (!nla)
326		return -1;
327
328	info_size = user_size ? : size;
329	memcpy(nla_data(nla), info, info_size);
330	memset(nla_data(nla) + info_size, 0, aligned_size - info_size);
331
332	return 0;
333}
334
335static int nft_target_dump(struct sk_buff *skb,
336			   const struct nft_expr *expr, bool reset)
337{
338	const struct xt_target *target = expr->ops->data;
339	void *info = nft_expr_priv(expr);
340
341	if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) ||
342	    nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) ||
343	    nft_extension_dump_info(skb, NFTA_TARGET_INFO, info,
344				    target->targetsize, target->usersize))
345		goto nla_put_failure;
346
347	return 0;
348
349nla_put_failure:
350	return -1;
351}
352
353static int nft_target_validate(const struct nft_ctx *ctx,
354			       const struct nft_expr *expr)
355{
356	struct xt_target *target = expr->ops->data;
357	unsigned int hook_mask = 0;
358	int ret;
359
360	if (ctx->family != NFPROTO_IPV4 &&
361	    ctx->family != NFPROTO_IPV6 &&
362	    ctx->family != NFPROTO_INET &&
363	    ctx->family != NFPROTO_BRIDGE &&
364	    ctx->family != NFPROTO_ARP)
365		return -EOPNOTSUPP;
366
367	ret = nft_chain_validate_hooks(ctx->chain,
368				       (1 << NF_INET_PRE_ROUTING) |
369				       (1 << NF_INET_LOCAL_IN) |
370				       (1 << NF_INET_FORWARD) |
371				       (1 << NF_INET_LOCAL_OUT) |
372				       (1 << NF_INET_POST_ROUTING));
373	if (ret)
374		return ret;
375
376	if (nft_is_base_chain(ctx->chain)) {
377		const struct nft_base_chain *basechain =
378						nft_base_chain(ctx->chain);
379		const struct nf_hook_ops *ops = &basechain->ops;
380
381		hook_mask = 1 << ops->hooknum;
382		if (target->hooks && !(hook_mask & target->hooks))
383			return -EINVAL;
384
385		ret = nft_compat_chain_validate_dependency(ctx, target->table);
386		if (ret < 0)
387			return ret;
388	}
389	return 0;
390}
391
392static void __nft_match_eval(const struct nft_expr *expr,
393			     struct nft_regs *regs,
394			     const struct nft_pktinfo *pkt,
395			     void *info)
396{
397	struct xt_match *match = expr->ops->data;
398	struct sk_buff *skb = pkt->skb;
399	struct xt_action_param xt;
400	bool ret;
401
402	nft_compat_set_par(&xt, pkt, match, info);
403
404	ret = match->match(skb, &xt);
405
406	if (xt.hotdrop) {
407		regs->verdict.code = NF_DROP;
408		return;
409	}
410
411	switch (ret ? 1 : 0) {
412	case 1:
413		regs->verdict.code = NFT_CONTINUE;
414		break;
415	case 0:
416		regs->verdict.code = NFT_BREAK;
417		break;
418	}
419}
420
421static void nft_match_large_eval(const struct nft_expr *expr,
422				 struct nft_regs *regs,
423				 const struct nft_pktinfo *pkt)
424{
425	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
426
427	__nft_match_eval(expr, regs, pkt, priv->info);
428}
429
430static void nft_match_eval(const struct nft_expr *expr,
431			   struct nft_regs *regs,
432			   const struct nft_pktinfo *pkt)
433{
434	__nft_match_eval(expr, regs, pkt, nft_expr_priv(expr));
435}
436
437static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
438	[NFTA_MATCH_NAME]	= { .type = NLA_NUL_STRING,
439				    .len = XT_EXTENSION_MAXNAMELEN },
440	[NFTA_MATCH_REV]	= NLA_POLICY_MAX(NLA_BE32, 255),
441	[NFTA_MATCH_INFO]	= { .type = NLA_BINARY },
442};
443
444/* struct xt_mtchk_param and xt_tgchk_param look very similar */
445static void
446nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
447			  struct xt_match *match, void *info,
448			  union nft_entry *entry, u16 proto, bool inv)
449{
450	par->net	= ctx->net;
451	par->table	= ctx->table->name;
452	switch (ctx->family) {
453	case AF_INET:
454		entry->e4.ip.proto = proto;
455		entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
456		break;
457	case AF_INET6:
458		if (proto)
459			entry->e6.ipv6.flags |= IP6T_F_PROTO;
460
461		entry->e6.ipv6.proto = proto;
462		entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
463		break;
464	case NFPROTO_BRIDGE:
465		entry->ebt.ethproto = (__force __be16)proto;
466		entry->ebt.invflags = inv ? EBT_IPROTO : 0;
467		break;
468	case NFPROTO_ARP:
469		break;
470	}
471	par->entryinfo	= entry;
472	par->match	= match;
473	par->matchinfo	= info;
474	if (nft_is_base_chain(ctx->chain)) {
475		const struct nft_base_chain *basechain =
476						nft_base_chain(ctx->chain);
477		const struct nf_hook_ops *ops = &basechain->ops;
478
479		par->hook_mask = 1 << ops->hooknum;
480	} else {
481		par->hook_mask = 0;
482	}
483	par->family	= ctx->family;
484	par->nft_compat = true;
485}
486
487static void match_compat_from_user(struct xt_match *m, void *in, void *out)
488{
489	int pad;
490
491	memcpy(out, in, m->matchsize);
492	pad = XT_ALIGN(m->matchsize) - m->matchsize;
493	if (pad > 0)
494		memset(out + m->matchsize, 0, pad);
495}
496
497static int
498__nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
499		 const struct nlattr * const tb[],
500		 void *info)
501{
502	struct xt_match *match = expr->ops->data;
503	struct xt_mtchk_param par;
504	size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
505	u16 proto = 0;
506	bool inv = false;
507	union nft_entry e = {};
508	int ret;
509
510	match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
511
512	if (ctx->nla[NFTA_RULE_COMPAT]) {
513		ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
514		if (ret < 0)
515			return ret;
516	}
517
518	nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
519
520	nft_compat_wait_for_destructors(ctx->net);
521
522	return xt_check_match(&par, size, proto, inv);
523}
524
525static int
526nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
527	       const struct nlattr * const tb[])
528{
529	return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr));
530}
531
532static int
533nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
534		     const struct nlattr * const tb[])
535{
536	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
537	struct xt_match *m = expr->ops->data;
538	int ret;
539
540	priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL_ACCOUNT);
541	if (!priv->info)
542		return -ENOMEM;
543
544	ret = __nft_match_init(ctx, expr, tb, priv->info);
545	if (ret)
546		kfree(priv->info);
547	return ret;
548}
549
550static void
551__nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr,
552		    void *info)
553{
554	struct xt_match *match = expr->ops->data;
555	struct module *me = match->me;
556	struct xt_mtdtor_param par;
557
558	par.net = ctx->net;
559	par.match = match;
560	par.matchinfo = info;
561	par.family = ctx->family;
562	if (par.match->destroy != NULL)
563		par.match->destroy(&par);
564
565	__nft_mt_tg_destroy(me, expr);
566}
567
568static void
569nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
570{
571	__nft_match_destroy(ctx, expr, nft_expr_priv(expr));
572}
573
574static void
575nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
576{
577	struct nft_xt_match_priv *priv = nft_expr_priv(expr);
578
579	__nft_match_destroy(ctx, expr, priv->info);
580	kfree(priv->info);
581}
582
583static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr,
584			    void *info)
585{
586	struct xt_match *match = expr->ops->data;
587
588	if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) ||
589	    nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) ||
590	    nft_extension_dump_info(skb, NFTA_MATCH_INFO, info,
591				    match->matchsize, match->usersize))
592		goto nla_put_failure;
593
594	return 0;
595
596nla_put_failure:
597	return -1;
598}
599
600static int nft_match_dump(struct sk_buff *skb,
601			  const struct nft_expr *expr, bool reset)
602{
603	return __nft_match_dump(skb, expr, nft_expr_priv(expr));
604}
605
606static int nft_match_large_dump(struct sk_buff *skb,
607				const struct nft_expr *e, bool reset)
608{
609	struct nft_xt_match_priv *priv = nft_expr_priv(e);
610
611	return __nft_match_dump(skb, e, priv->info);
612}
613
614static int nft_match_validate(const struct nft_ctx *ctx,
615			      const struct nft_expr *expr)
616{
617	struct xt_match *match = expr->ops->data;
618	unsigned int hook_mask = 0;
619	int ret;
620
621	if (ctx->family != NFPROTO_IPV4 &&
622	    ctx->family != NFPROTO_IPV6 &&
623	    ctx->family != NFPROTO_INET &&
624	    ctx->family != NFPROTO_BRIDGE &&
625	    ctx->family != NFPROTO_ARP)
626		return -EOPNOTSUPP;
627
628	ret = nft_chain_validate_hooks(ctx->chain,
629				       (1 << NF_INET_PRE_ROUTING) |
630				       (1 << NF_INET_LOCAL_IN) |
631				       (1 << NF_INET_FORWARD) |
632				       (1 << NF_INET_LOCAL_OUT) |
633				       (1 << NF_INET_POST_ROUTING));
634	if (ret)
635		return ret;
636
637	if (nft_is_base_chain(ctx->chain)) {
638		const struct nft_base_chain *basechain =
639						nft_base_chain(ctx->chain);
640		const struct nf_hook_ops *ops = &basechain->ops;
641
642		hook_mask = 1 << ops->hooknum;
643		if (match->hooks && !(hook_mask & match->hooks))
644			return -EINVAL;
645
646		ret = nft_compat_chain_validate_dependency(ctx, match->table);
647		if (ret < 0)
648			return ret;
649	}
650	return 0;
651}
652
653static int
654nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
655		      int event, u16 family, const char *name,
656		      int rev, int target)
657{
658	struct nlmsghdr *nlh;
659	unsigned int flags = portid ? NLM_F_MULTI : 0;
660
661	event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event);
662	nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
663			   NFNETLINK_V0, 0);
664	if (!nlh)
665		goto nlmsg_failure;
666
667	if (nla_put_string(skb, NFTA_COMPAT_NAME, name) ||
668	    nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) ||
669	    nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target)))
670		goto nla_put_failure;
671
672	nlmsg_end(skb, nlh);
673	return skb->len;
674
675nlmsg_failure:
676nla_put_failure:
677	nlmsg_cancel(skb, nlh);
678	return -1;
679}
680
681static int nfnl_compat_get_rcu(struct sk_buff *skb,
682			       const struct nfnl_info *info,
683			       const struct nlattr * const tb[])
684{
685	u8 family = info->nfmsg->nfgen_family;
686	const char *name, *fmt;
687	struct sk_buff *skb2;
688	int ret = 0, target;
689	u32 rev;
690
691	if (tb[NFTA_COMPAT_NAME] == NULL ||
692	    tb[NFTA_COMPAT_REV] == NULL ||
693	    tb[NFTA_COMPAT_TYPE] == NULL)
694		return -EINVAL;
695
696	name = nla_data(tb[NFTA_COMPAT_NAME]);
697	rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV]));
698	/* x_tables api checks for 'target == 1' to mean target,
699	 * everything else means 'match'.
700	 * In x_tables world, the number is set by kernel, not
701	 * userspace.
702	 */
703	target = nla_get_be32(tb[NFTA_COMPAT_TYPE]) == htonl(1);
704
705	switch(family) {
706	case AF_INET:
707		fmt = "ipt_%s";
708		break;
709	case AF_INET6:
710		fmt = "ip6t_%s";
711		break;
712	case NFPROTO_BRIDGE:
713		fmt = "ebt_%s";
714		break;
715	case NFPROTO_ARP:
716		fmt = "arpt_%s";
717		break;
718	default:
719		pr_err("nft_compat: unsupported protocol %d\n", family);
720		return -EINVAL;
721	}
722
723	if (!try_module_get(THIS_MODULE))
724		return -EINVAL;
725
726	rcu_read_unlock();
727	try_then_request_module(xt_find_revision(family, name, rev, target, &ret),
728				fmt, name);
729	if (ret < 0)
730		goto out_put;
731
732	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
733	if (skb2 == NULL) {
734		ret = -ENOMEM;
735		goto out_put;
736	}
737
738	/* include the best revision for this extension in the message */
739	if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid,
740				  info->nlh->nlmsg_seq,
741				  NFNL_MSG_TYPE(info->nlh->nlmsg_type),
742				  NFNL_MSG_COMPAT_GET,
743				  family, name, ret, target) <= 0) {
744		kfree_skb(skb2);
745		goto out_put;
746	}
747
748	ret = nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid);
749out_put:
750	rcu_read_lock();
751	module_put(THIS_MODULE);
752
753	return ret;
754}
755
756static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = {
757	[NFTA_COMPAT_NAME]	= { .type = NLA_NUL_STRING,
758				    .len = NFT_COMPAT_NAME_MAX-1 },
759	[NFTA_COMPAT_REV]	= NLA_POLICY_MAX(NLA_BE32, 255),
760	[NFTA_COMPAT_TYPE]	= { .type = NLA_U32 },
761};
762
763static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = {
764	[NFNL_MSG_COMPAT_GET]	= {
765		.call		= nfnl_compat_get_rcu,
766		.type		= NFNL_CB_RCU,
767		.attr_count	= NFTA_COMPAT_MAX,
768		.policy		= nfnl_compat_policy_get
769	},
770};
771
772static const struct nfnetlink_subsystem nfnl_compat_subsys = {
773	.name		= "nft-compat",
774	.subsys_id	= NFNL_SUBSYS_NFT_COMPAT,
775	.cb_count	= NFNL_MSG_COMPAT_MAX,
776	.cb		= nfnl_nft_compat_cb,
777};
778
779static struct nft_expr_type nft_match_type;
780
781static bool nft_match_reduce(struct nft_regs_track *track,
782			     const struct nft_expr *expr)
783{
784	const struct xt_match *match = expr->ops->data;
785
786	return strcmp(match->name, "comment") == 0;
787}
788
789static const struct nft_expr_ops *
790nft_match_select_ops(const struct nft_ctx *ctx,
791		     const struct nlattr * const tb[])
792{
793	struct nft_expr_ops *ops;
794	struct xt_match *match;
795	unsigned int matchsize;
796	char *mt_name;
797	u32 rev, family;
798	int err;
799
800	if (tb[NFTA_MATCH_NAME] == NULL ||
801	    tb[NFTA_MATCH_REV] == NULL ||
802	    tb[NFTA_MATCH_INFO] == NULL)
803		return ERR_PTR(-EINVAL);
804
805	mt_name = nla_data(tb[NFTA_MATCH_NAME]);
806	rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV]));
807	family = ctx->family;
808
809	match = xt_request_find_match(family, mt_name, rev);
810	if (IS_ERR(match))
811		return ERR_PTR(-ENOENT);
812
813	if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) {
814		err = -EINVAL;
815		goto err;
816	}
817
818	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
819	if (!ops) {
820		err = -ENOMEM;
821		goto err;
822	}
823
824	ops->type = &nft_match_type;
825	ops->eval = nft_match_eval;
826	ops->init = nft_match_init;
827	ops->destroy = nft_match_destroy;
828	ops->dump = nft_match_dump;
829	ops->validate = nft_match_validate;
830	ops->data = match;
831	ops->reduce = nft_match_reduce;
832
833	matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
834	if (matchsize > NFT_MATCH_LARGE_THRESH) {
835		matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv));
836
837		ops->eval = nft_match_large_eval;
838		ops->init = nft_match_large_init;
839		ops->destroy = nft_match_large_destroy;
840		ops->dump = nft_match_large_dump;
841	}
842
843	ops->size = matchsize;
844
845	return ops;
846err:
847	module_put(match->me);
848	return ERR_PTR(err);
849}
850
851static void nft_match_release_ops(const struct nft_expr_ops *ops)
852{
853	struct xt_match *match = ops->data;
854
855	module_put(match->me);
856	kfree(ops);
857}
858
859static struct nft_expr_type nft_match_type __read_mostly = {
860	.name		= "match",
861	.select_ops	= nft_match_select_ops,
862	.release_ops	= nft_match_release_ops,
863	.policy		= nft_match_policy,
864	.maxattr	= NFTA_MATCH_MAX,
865	.owner		= THIS_MODULE,
866};
867
868static struct nft_expr_type nft_target_type;
869
870static const struct nft_expr_ops *
871nft_target_select_ops(const struct nft_ctx *ctx,
872		      const struct nlattr * const tb[])
873{
874	struct nft_expr_ops *ops;
875	struct xt_target *target;
876	char *tg_name;
877	u32 rev, family;
878	int err;
879
880	if (tb[NFTA_TARGET_NAME] == NULL ||
881	    tb[NFTA_TARGET_REV] == NULL ||
882	    tb[NFTA_TARGET_INFO] == NULL)
883		return ERR_PTR(-EINVAL);
884
885	tg_name = nla_data(tb[NFTA_TARGET_NAME]);
886	rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV]));
887	family = ctx->family;
888
889	if (strcmp(tg_name, XT_ERROR_TARGET) == 0 ||
890	    strcmp(tg_name, XT_STANDARD_TARGET) == 0 ||
891	    strcmp(tg_name, "standard") == 0)
892		return ERR_PTR(-EINVAL);
893
894	target = xt_request_find_target(family, tg_name, rev);
895	if (IS_ERR(target))
896		return ERR_PTR(-ENOENT);
897
898	if (!target->target) {
899		err = -EINVAL;
900		goto err;
901	}
902
903	if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) {
904		err = -EINVAL;
905		goto err;
906	}
907
908	ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL_ACCOUNT);
909	if (!ops) {
910		err = -ENOMEM;
911		goto err;
912	}
913
914	ops->type = &nft_target_type;
915	ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize));
916	ops->init = nft_target_init;
917	ops->destroy = nft_target_destroy;
918	ops->dump = nft_target_dump;
919	ops->validate = nft_target_validate;
920	ops->data = target;
921	ops->reduce = NFT_REDUCE_READONLY;
922
923	if (family == NFPROTO_BRIDGE)
924		ops->eval = nft_target_eval_bridge;
925	else
926		ops->eval = nft_target_eval_xt;
927
928	return ops;
929err:
930	module_put(target->me);
931	return ERR_PTR(err);
932}
933
934static void nft_target_release_ops(const struct nft_expr_ops *ops)
935{
936	struct xt_target *target = ops->data;
937
938	module_put(target->me);
939	kfree(ops);
940}
941
942static struct nft_expr_type nft_target_type __read_mostly = {
943	.name		= "target",
944	.select_ops	= nft_target_select_ops,
945	.release_ops	= nft_target_release_ops,
946	.policy		= nft_target_policy,
947	.maxattr	= NFTA_TARGET_MAX,
948	.owner		= THIS_MODULE,
949};
950
951static int __init nft_compat_module_init(void)
952{
953	int ret;
954
955	ret = nft_register_expr(&nft_match_type);
956	if (ret < 0)
957		return ret;
958
959	ret = nft_register_expr(&nft_target_type);
960	if (ret < 0)
961		goto err_match;
962
963	ret = nfnetlink_subsys_register(&nfnl_compat_subsys);
964	if (ret < 0) {
965		pr_err("nft_compat: cannot register with nfnetlink.\n");
966		goto err_target;
967	}
968
969	return ret;
970err_target:
971	nft_unregister_expr(&nft_target_type);
972err_match:
973	nft_unregister_expr(&nft_match_type);
974	return ret;
975}
976
977static void __exit nft_compat_module_exit(void)
978{
979	nfnetlink_subsys_unregister(&nfnl_compat_subsys);
980	nft_unregister_expr(&nft_target_type);
981	nft_unregister_expr(&nft_match_type);
982}
983
984MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT);
985
986module_init(nft_compat_module_init);
987module_exit(nft_compat_module_exit);
988
989MODULE_LICENSE("GPL");
990MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
991MODULE_ALIAS_NFT_EXPR("match");
992MODULE_ALIAS_NFT_EXPR("target");
993MODULE_DESCRIPTION("x_tables over nftables support");