Commit 002f2176 authored by Jose M. Guisado Gomez's avatar Jose M. Guisado Gomez Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add userdata attributes to nft_chain 



Enables storing userdata for nft_chain. Field udata points to user data
and udlen stores its length.

Adds new attribute flag NFTA_CHAIN_USERDATA.

Signed-off-by: default avatarJose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 85db827a

include/net/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -945,6 +945,8 @@ struct nft_chain { 
					bound:1,

					genmask:2;

	char				*name;

	u16				udlen;

	u8				*udata;



	/* Only used during control plane commit phase: */

	struct nft_rule			**rules_next;

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -208,6 +208,7 @@ enum nft_chain_flags { 
 * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)

 * @NFTA_CHAIN_FLAGS: chain flags

 * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)

 * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)

 */

enum nft_chain_attributes {

	NFTA_CHAIN_UNSPEC,
@@ -222,6 +223,7 @@ enum nft_chain_attributes { 
	NFTA_CHAIN_PAD,

	NFTA_CHAIN_FLAGS,

	NFTA_CHAIN_ID,

	NFTA_CHAIN_USERDATA,

	__NFTA_CHAIN_MAX

};

#define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)

net/netfilter/nf_tables_api.c

+25 −8
Original line number Diff line number Diff line
@@ -1304,6 +1304,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 
	[NFTA_CHAIN_COUNTERS]	= { .type = NLA_NESTED },

	[NFTA_CHAIN_FLAGS]	= { .type = NLA_U32 },

	[NFTA_CHAIN_ID]		= { .type = NLA_U32 },

	[NFTA_CHAIN_USERDATA]	= { .type = NLA_BINARY,

				    .len = NFT_USERDATA_MAXLEN },

};



static const struct nla_policy nft_hook_policy[NFTA_HOOK_MAX + 1] = {
@@ -1445,6 +1447,10 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, 
	if (nla_put_be32(skb, NFTA_CHAIN_USE, htonl(chain->use)))

		goto nla_put_failure;



	if (chain->udata &&

	    nla_put(skb, NFTA_CHAIN_USERDATA, chain->udlen, chain->udata))

		goto nla_put_failure;



	nlmsg_end(skb, nlh);

	return 0;
@@ -1682,9 +1688,11 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx) 
			free_percpu(rcu_dereference_raw(basechain->stats));

		}

		kfree(chain->name);

		kfree(chain->udata);

		kfree(basechain);

	} else {

		kfree(chain->name);

		kfree(chain->udata);

		kfree(chain);

	}

}
@@ -2038,7 +2046,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
	} else {

		if (!(flags & NFT_CHAIN_BINDING)) {

			err = -EINVAL;

			goto err1;

			goto err_destroy_chain;

		}



		snprintf(name, sizeof(name), "__chain%llu", ++chain_id);
@@ -2047,13 +2055,22 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 


	if (!chain->name) {

		err = -ENOMEM;

		goto err1;

		goto err_destroy_chain;

	}



	if (nla[NFTA_CHAIN_USERDATA]) {

		chain->udata = nla_memdup(nla[NFTA_CHAIN_USERDATA], GFP_KERNEL);

		if (chain->udata == NULL) {

			err = -ENOMEM;

			goto err_destroy_chain;

		}

		chain->udlen = nla_len(nla[NFTA_CHAIN_USERDATA]);

	}



	rules = nf_tables_chain_alloc_rules(chain, 0);

	if (!rules) {

		err = -ENOMEM;

		goto err1;

		goto err_destroy_chain;

	}



	*rules = NULL;
@@ -2062,12 +2079,12 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 


	err = nf_tables_register_hook(net, table, chain);

	if (err < 0)

		goto err1;

		goto err_destroy_chain;



	trans = nft_trans_chain_add(ctx, NFT_MSG_NEWCHAIN);

	if (IS_ERR(trans)) {

		err = PTR_ERR(trans);

		goto err2;

		goto err_unregister_hook;

	}



	nft_trans_chain_policy(trans) = NFT_CHAIN_POLICY_UNSET;
@@ -2077,15 +2094,15 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
	err = nft_chain_add(table, chain);

	if (err < 0) {

		nft_trans_destroy(trans);

		goto err2;

		goto err_unregister_hook;

	}



	table->use++;



	return 0;

err2:

err_unregister_hook:

	nf_tables_unregister_hook(net, table, chain);

err1:

err_destroy_chain:

	nf_tables_chain_destroy(ctx);



	return err;