Commit 7a81575b authored by Jose M. Guisado Gomez's avatar Jose M. Guisado Gomez Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add userdata attributes to nft_table 



Enables storing userdata for nft_table. Field udata points to user data
and udlen store its length.

Adds new attribute flag NFTA_TABLE_USERDATA

Signed-off-by: default avatarJose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent c5a8a849

include/net/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -1080,6 +1080,8 @@ struct nft_table { 
					flags:8,

					genmask:2;

	char				*name;

	u16				udlen;

	u8				*udata;

};



void nft_register_chain_type(const struct nft_chain_type *);

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -172,6 +172,7 @@ enum nft_table_flags { 
 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)

 * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)

 * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)

 * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)

 */

enum nft_table_attributes {

	NFTA_TABLE_UNSPEC,
@@ -180,6 +181,7 @@ enum nft_table_attributes { 
	NFTA_TABLE_USE,

	NFTA_TABLE_HANDLE,

	NFTA_TABLE_PAD,

	NFTA_TABLE_USERDATA,

	__NFTA_TABLE_MAX

};

#define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)

net/netfilter/nf_tables_api.c

+21 −1
Original line number Diff line number Diff line
@@ -650,6 +650,8 @@ static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { 
				    .len = NFT_TABLE_MAXNAMELEN - 1 },

	[NFTA_TABLE_FLAGS]	= { .type = NLA_U32 },

	[NFTA_TABLE_HANDLE]	= { .type = NLA_U64 },

	[NFTA_TABLE_USERDATA]	= { .type = NLA_BINARY,

				    .len = NFT_USERDATA_MAXLEN }

};



static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
@@ -676,6 +678,11 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, 
			 NFTA_TABLE_PAD))

		goto nla_put_failure;



	if (table->udata) {

		if (nla_put(skb, NFTA_TABLE_USERDATA, table->udlen, table->udata))

			goto nla_put_failure;

	}



	nlmsg_end(skb, nlh);

	return 0;
@@ -977,8 +984,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, 
	int family = nfmsg->nfgen_family;

	const struct nlattr *attr;

	struct nft_table *table;

	u32 flags = 0;

	struct nft_ctx ctx;

	u32 flags = 0;

	u16 udlen = 0;

	int err;



	lockdep_assert_held(&net->nft.commit_mutex);
@@ -1014,6 +1022,16 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, 
	if (table->name == NULL)

		goto err_strdup;



	if (nla[NFTA_TABLE_USERDATA]) {

		udlen = nla_len(nla[NFTA_TABLE_USERDATA]);

		table->udata = kzalloc(udlen, GFP_KERNEL);

		if (table->udata == NULL)

			goto err_table_udata;



		nla_memcpy(table->udata, nla[NFTA_TABLE_USERDATA], udlen);

		table->udlen = udlen;

	}



	err = rhltable_init(&table->chains_ht, &nft_chain_ht_params);

	if (err)

		goto err_chain_ht;
@@ -1036,6 +1054,8 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, 
err_trans:

	rhltable_destroy(&table->chains_ht);

err_chain_ht:

	kfree(table->udata);

err_table_udata:

	kfree(table->name);

err_strdup:

	kfree(table);