Commit b131c964 authored by Jose M. Guisado Gomez's avatar Jose M. Guisado Gomez Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add userdata support for nft_object 



Enables storing userdata for nft_object. Initially this will store an
optional comment but can be extended in the future as needed.

Adds new attribute NFTA_OBJ_USERDATA to nft_object.

Signed-off-by: default avatarJose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0c5edd77

include/net/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -1123,6 +1123,8 @@ struct nft_object { 
	u32				genmask:2,

					use:30;

	u64				handle;

	u16				udlen;

	u8				*udata;

	/* runtime data below here */

	const struct nft_object_ops	*ops ____cacheline_aligned;

	unsigned char			data[]

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -1559,6 +1559,7 @@ enum nft_ct_expectation_attributes { 
 * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)

 * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)

 * @NFTA_OBJ_HANDLE: object handle (NLA_U64)

 * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)

 */

enum nft_object_attributes {

	NFTA_OBJ_UNSPEC,
@@ -1569,6 +1570,7 @@ enum nft_object_attributes { 
	NFTA_OBJ_USE,

	NFTA_OBJ_HANDLE,

	NFTA_OBJ_PAD,

	NFTA_OBJ_USERDATA,

	__NFTA_OBJ_MAX

};

#define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)

net/netfilter/nf_tables_api.c

+27 −8
Original line number Diff line number Diff line
@@ -5755,6 +5755,8 @@ static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { 
	[NFTA_OBJ_TYPE]		= { .type = NLA_U32 },

	[NFTA_OBJ_DATA]		= { .type = NLA_NESTED },

	[NFTA_OBJ_HANDLE]	= { .type = NLA_U64},

	[NFTA_OBJ_USERDATA]	= { .type = NLA_BINARY,

				    .len = NFT_USERDATA_MAXLEN },

};



static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
@@ -5902,6 +5904,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, 
	struct nft_object *obj;

	struct nft_ctx ctx;

	u32 objtype;

	u16 udlen;

	int err;



	if (!nla[NFTA_OBJ_TYPE] ||
@@ -5946,7 +5949,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, 
	obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);

	if (IS_ERR(obj)) {

		err = PTR_ERR(obj);

		goto err1;

		goto err_init;

	}

	obj->key.table = table;

	obj->handle = nf_tables_alloc_handle(table);
@@ -5954,32 +5957,44 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, 
	obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);

	if (!obj->key.name) {

		err = -ENOMEM;

		goto err2;

		goto err_strdup;

	}



	if (nla[NFTA_OBJ_USERDATA]) {

		udlen = nla_len(nla[NFTA_OBJ_USERDATA]);

		obj->udata = kzalloc(udlen, GFP_KERNEL);

		if (obj->udata == NULL)

			goto err_userdata;



		nla_memcpy(obj->udata, nla[NFTA_OBJ_USERDATA], udlen);

		obj->udlen = udlen;

	}



	err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);

	if (err < 0)

		goto err3;

		goto err_trans;



	err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,

			      nft_objname_ht_params);

	if (err < 0)

		goto err4;

		goto err_obj_ht;



	list_add_tail_rcu(&obj->list, &table->objects);

	table->use++;

	return 0;

err4:

err_obj_ht:

	/* queued in transaction log */

	INIT_LIST_HEAD(&obj->list);

	return err;

err3:

err_trans:

	kfree(obj->key.name);

err2:

err_userdata:

	kfree(obj->udata);

err_strdup:

	if (obj->ops->destroy)

		obj->ops->destroy(&ctx, obj);

	kfree(obj);

err1:

err_init:

	module_put(type->owner);

	return err;

}
@@ -6011,6 +6026,10 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, 
			 NFTA_OBJ_PAD))

		goto nla_put_failure;



	if (obj->udata &&

	    nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata))

		goto nla_put_failure;



	nlmsg_end(skb, nlh);

	return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE