netfilter: nf_tables: add compatibility layer for x_tables

This patch adds the x_tables compatibility layer. This allows you
to use existing x_tables matches and targets from nf_tables.

This compatibility later allows us to use existing matches/targets
for features that are still missing in nf_tables. We can progressively
replace them with native nf_tables extensions. It also provides the
userspace compatibility software that allows you to express the
rule-set using the iptables syntax but using the nf_tables kernel
components.

In order to get this compatibility layer working, I've done the
following things:

* add NFNL_SUBSYS_NFT_COMPAT: this new nfnetlink subsystem is used
to query the x_tables match/target revision, so we don't need to
use the native x_table getsockopt interface.

* emulate xt structures: this required extending the struct nft_pktinfo
to include the fragment offset, which is already obtained from
ip[6]_tables and that is used by some matches/targets.

* add support for default policy to base chains, required to emulate
  x_tables.

* add NFTA_CHAIN_USE attribute to obtain the number of references to
  chains, required by x_tables emulation.

* add chain packet/byte counters using per-cpu.

* support 32-64 bits compat.

For historical reasons, this patch includes the following patches
that were posted in the netfilter-devel mailing list.

From Pablo Neira Ayuso:
* nf_tables: add default policy to base chains
* netfilter: nf_tables: add NFTA_CHAIN_USE attribute
* nf_tables: nft_compat: private data of target and matches in contiguous area
* nf_tables: validate hooks for compat match/target
* nf_tables: nft_compat: release cached matches/targets
* nf_tables: x_tables support as a compile time option
* nf_tables: fix alias for xtables over nftables module
* nf_tables: add packet and byte counters per chain
* nf_tables: fix per-chain counter stats if no counters are passed
* nf_tables: don't bump chain stats
* nf_tables: add protocol and flags for xtables over nf_tables
* nf_tables: add ip[6]t_entry emulation
* nf_tables: move specific layer 3 compat code to nf_tables_ipv[4|6]
* nf_tables: support 32bits-64bits x_tables compat
* nf_tables: fix compilation if CONFIG_COMPAT is disabled

From Patrick McHardy:
* nf_tables: move policy to struct nft_base_chain
* nf_tables: send notifications for base chain policy changes

From Alexander Primak:
* nf_tables: remove the duplicate NF_INET_LOCAL_OUT

From Nicolas Dichtel:
* nf_tables: fix compilation when nf-netlink is a module

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

3 files changed, 90 insertions, 7 deletions

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 8403f7f52e81..a68f45f0fe2e 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -3,6 +3,7 @@
 
 #include <linux/list.h>
 #include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netlink.h>
 
@@ -15,8 +16,23 @@ struct nft_pktinfo {
         u8                              hooknum;
         u8                              nhoff;
         u8                              thoff;
+        /* for x_tables compatibility */
+        struct xt_action_param          xt;
 };
 
+static inline void nft_set_pktinfo(struct nft_pktinfo *pkt,
+                                   const struct nf_hook_ops *ops,
+                                   struct sk_buff *skb,
+                                   const struct net_device *in,
+                                   const struct net_device *out)
+{
+        pkt->skb = skb;
+        pkt->in = pkt->xt.in = in;
+        pkt->out = pkt->xt.out = out;
+        pkt->hooknum = pkt->xt.hooknum = ops->hooknum;
+        pkt->xt.family = ops->pf;
+}
+
 struct nft_data {
         union {
                 u32                             data[4];
@@ -57,6 +73,7 @@ static inline void nft_data_debug(const struct nft_data *data)
  *      @afi: address family info
  *      @table: the table the chain is contained in
  *      @chain: the chain the rule is contained in
+ *      @nla: netlink attributes
  */
 struct nft_ctx {
         const struct sk_buff            *skb;
@@ -64,6 +81,7 @@ struct nft_ctx {
         const struct nft_af_info        *afi;
         const struct nft_table          *table;
         const struct nft_chain          *chain;
+        const struct nlattr * const     *nla;
 };
 
 struct nft_data_desc {
@@ -235,7 +253,8 @@ extern void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
  *      @maxattr: highest netlink attribute number
  */
 struct nft_expr_type {
-        const struct nft_expr_ops       *(*select_ops)(const struct nlattr * const tb[]);
+        const struct nft_expr_ops       *(*select_ops)(const struct nft_ctx *,
+                                                       const struct nlattr * const tb[]);
         const struct nft_expr_ops       *ops;
         struct list_head                list;
         const char                      *name;
@@ -253,6 +272,8 @@ struct nft_expr_type {
  *      @destroy: destruction function
  *      @dump: function to dump parameters
  *      @type: expression type
+ *      @validate: validate expression, called during loop detection
+ *      @data: extra data to attach to this expression operation
  */
 struct nft_expr;
 struct nft_expr_ops {
@@ -267,8 +288,11 @@ struct nft_expr_ops {
         void                            (*destroy)(const struct nft_expr *expr);
         int                             (*dump)(struct sk_buff *skb,
                                                 const struct nft_expr *expr);
-        const struct nft_data *         (*get_verdict)(const struct nft_expr *expr);
+        int                             (*validate)(const struct nft_ctx *ctx,
+                                                    const struct nft_expr *expr,
+                                                    const struct nft_data **data);
         const struct nft_expr_type      *type;
+        void                            *data;
 };
 
 #define NFT_EXPR_MAXATTR                16
@@ -368,16 +392,25 @@ enum nft_chain_type {
         NFT_CHAIN_T_MAX
 };
 
+struct nft_stats {
+        u64 bytes;
+        u64 pkts;
+};
+
 /**
  *      struct nft_base_chain - nf_tables base chain
  *
  *      @ops: netfilter hook ops
  *      @type: chain type
+ *      @policy: default policy
+ *      @stats: per-cpu chain stats
  *      @chain: the chain
  */
 struct nft_base_chain {
         struct nf_hook_ops              ops;
         enum nft_chain_type             type;
+        u8                              policy;
+        struct nft_stats __percpu       *stats;
         struct nft_chain                chain;
 };
 
@@ -386,11 +419,8 @@ static inline struct nft_base_chain *nft_base_chain(const struct nft_chain *chai
         return container_of(chain, struct nft_base_chain, chain);
 }
 
-extern unsigned int nft_do_chain(const struct nf_hook_ops *ops,
-                                 struct sk_buff *skb,
-                                 const struct net_device *in,
-                                 const struct net_device *out,
-                                 int (*okfn)(struct sk_buff *));
+extern unsigned int nft_do_chain_pktinfo(struct nft_pktinfo *pkt,
+                                         const struct nf_hook_ops *ops);
 
 /**
  *      struct nft_table - nf_tables table
diff --git a/include/net/netfilter/nf_tables_ipv4.h b/include/net/netfilter/nf_tables_ipv4.h
new file mode 100644
index 000000000000..1be1c2c197ee
--- /dev/null
+++ b/include/net/netfilter/nf_tables_ipv4.h
@@ -0,0 +1,23 @@
+#ifndef _NF_TABLES_IPV4_H_
+#define _NF_TABLES_IPV4_H_
+
+#include <net/netfilter/nf_tables.h>
+#include <net/ip.h>
+
+static inline void
+nft_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
+                     const struct nf_hook_ops *ops,
+                     struct sk_buff *skb,
+                     const struct net_device *in,
+                     const struct net_device *out)
+{
+        struct iphdr *ip;
+
+        nft_set_pktinfo(pkt, ops, skb, in, out);
+
+        pkt->xt.thoff = ip_hdrlen(pkt->skb);
+        ip = ip_hdr(pkt->skb);
+        pkt->xt.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
+}
+
+#endif
diff --git a/include/net/netfilter/nf_tables_ipv6.h b/include/net/netfilter/nf_tables_ipv6.h
new file mode 100644
index 000000000000..4a9b88a65963
--- /dev/null
+++ b/include/net/netfilter/nf_tables_ipv6.h
@@ -0,0 +1,30 @@
+#ifndef _NF_TABLES_IPV6_H_
+#define _NF_TABLES_IPV6_H_
+
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <net/ipv6.h>
+
+static inline int
+nft_set_pktinfo_ipv6(struct nft_pktinfo *pkt,
+                     const struct nf_hook_ops *ops,
+                     struct sk_buff *skb,
+                     const struct net_device *in,
+                     const struct net_device *out)
+{
+        int protohdr, thoff = 0;
+        unsigned short frag_off;
+
+        nft_set_pktinfo(pkt, ops, skb, in, out);
+
+        protohdr = ipv6_find_hdr(pkt->skb, &thoff, -1, &frag_off, NULL);
+        /* If malformed, drop it */
+        if (protohdr < 0)
+                return -1;
+
+        pkt->xt.thoff = thoff;
+        pkt->xt.fragoff = frag_off;
+
+        return 0;
+}
+
+#endif