netfilter: nf_tables: add userdata support for nft_object

Enables storing userdata for nft_object. Initially this will store an
optional comment but can be extended in the future as needed.

Adds new attribute NFTA_OBJ_USERDATA to nft_object.

Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 97a7e147a59a90733c670f25f262edb8d4101d60..99c1b3188b1e8786f220a816ccf90ba98f499828 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1123,6 +1123,8 @@ struct nft_object {
        u32                             genmask:2,
                                        use:30;
        u64                             handle;
+       u16                             udlen;
+       u8                              *udata;
        /* runtime data below here */
        const struct nft_object_ops     *ops ____cacheline_aligned;
        unsigned char                   data[]

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 543dc697b79608a5802e96d666e75a6380149359..2a6e09dea1a04dac864402069d9643d4186dd72a 100644 (file)
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1559,6 +1559,7 @@ enum nft_ct_expectation_attributes {
  * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
  * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
  * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
+ * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
  */
 enum nft_object_attributes {
        NFTA_OBJ_UNSPEC,
@@ -1569,6 +1570,7 @@ enum nft_object_attributes {
        NFTA_OBJ_USE,
        NFTA_OBJ_HANDLE,
        NFTA_OBJ_PAD,
+       NFTA_OBJ_USERDATA,
        __NFTA_OBJ_MAX
 };
 #define NFTA_OBJ_MAX           (__NFTA_OBJ_MAX - 1)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6ccce2a2e715da3a4f3b2a63266d58900100d03d..e9b4848e9dd01311ac0334ce7c84adaa4b6bd6f7 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5755,6 +5755,8 @@ static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
        [NFTA_OBJ_TYPE]         = { .type = NLA_U32 },
        [NFTA_OBJ_DATA]         = { .type = NLA_NESTED },
        [NFTA_OBJ_HANDLE]       = { .type = NLA_U64},
+       [NFTA_OBJ_USERDATA]     = { .type = NLA_BINARY,
+                                   .len = NFT_USERDATA_MAXLEN },
 };
 
 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
@@ -5902,6 +5904,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
        struct nft_object *obj;
        struct nft_ctx ctx;
        u32 objtype;
+       u16 udlen;
        int err;
 
        if (!nla[NFTA_OBJ_TYPE] ||
@@ -5946,7 +5949,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
        obj = nft_obj_init(&ctx, type, nla[NFTA_OBJ_DATA]);
        if (IS_ERR(obj)) {
                err = PTR_ERR(obj);
-               goto err1;
+               goto err_init;
        }
        obj->key.table = table;
        obj->handle = nf_tables_alloc_handle(table);
@@ -5954,32 +5957,44 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
        obj->key.name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
        if (!obj->key.name) {
                err = -ENOMEM;
-               goto err2;
+               goto err_strdup;
+       }
+
+       if (nla[NFTA_OBJ_USERDATA]) {
+               udlen = nla_len(nla[NFTA_OBJ_USERDATA]);
+               obj->udata = kzalloc(udlen, GFP_KERNEL);
+               if (obj->udata == NULL)
+                       goto err_userdata;
+
+               nla_memcpy(obj->udata, nla[NFTA_OBJ_USERDATA], udlen);
+               obj->udlen = udlen;
        }
 
        err = nft_trans_obj_add(&ctx, NFT_MSG_NEWOBJ, obj);
        if (err < 0)
-               goto err3;
+               goto err_trans;
 
        err = rhltable_insert(&nft_objname_ht, &obj->rhlhead,
                              nft_objname_ht_params);
        if (err < 0)
-               goto err4;
+               goto err_obj_ht;
 
        list_add_tail_rcu(&obj->list, &table->objects);
        table->use++;
        return 0;
-err4:
+err_obj_ht:
        /* queued in transaction log */
        INIT_LIST_HEAD(&obj->list);
        return err;
-err3:
+err_trans:
        kfree(obj->key.name);
-err2:
+err_userdata:
+       kfree(obj->udata);
+err_strdup:
        if (obj->ops->destroy)
                obj->ops->destroy(&ctx, obj);
        kfree(obj);
-err1:
+err_init:
        module_put(type->owner);
        return err;
 }
@@ -6011,6 +6026,10 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
                         NFTA_OBJ_PAD))
                goto nla_put_failure;
 
+       if (obj->udata &&
+           nla_put(skb, NFTA_OBJ_USERDATA, obj->udlen, obj->udata))
+               goto nla_put_failure;
+
        nlmsg_end(skb, nlh);
        return 0;