netfilter: nf_tables: add netlink set API

This patch adds the new netlink API for maintaining nf_tables sets
independently of the ruleset. The API supports the following operations:

- creation of sets
- deletion of sets
- querying of specific sets
- dumping of all sets

- addition of set elements
- removal of set elements
- dumping of all set elements

Sets are identified by name, each table defines an individual namespace.
The name of a set may be allocated automatically, this is mostly useful
in combination with the NFT_SET_ANONYMOUS flag, which destroys a set
automatically once the last reference has been released.

Sets can be marked constant, meaning they're not allowed to change while
linked to a rule. This allows to perform lockless operation for set
types that would otherwise require locking.

Additionally, if the implementation supports it, sets can (as before) be
used as maps, associating a data value with each key (or range), by
specifying the NFT_SET_MAP flag and can be used for interval queries by
specifying the NFT_SET_INTERVAL flag.

Set elements are added and removed incrementally. All element operations
support batching, reducing netlink message and set lookup overhead.

The old "set" and "hash" expressions are replaced by a generic "lookup"
expression, which binds to the specified set. Userspace is not aware
of the actual set implementation used by the kernel anymore, all
configuration options are generic.

Currently the implementation selection logic is largely missing and the
kernel will simply use the first registered implementation supporting the
requested operation. Eventually, the plan is to have userspace supply a
description of the data characteristics and select the implementation
based on expected performance and memory use.

This patch includes the new 'lookup' expression to look up for element
matching in the set.

This patch includes kernel-doc descriptions for this set API and it
also includes the following fixes.

From Patrick McHardy:
* netfilter: nf_tables: fix set element data type in dumps
* netfilter: nf_tables: fix indentation of struct nft_set_elem comments
* netfilter: nf_tables: fix oops in nft_validate_data_load()
* netfilter: nf_tables: fix oops while listing sets of built-in tables
* netfilter: nf_tables: destroy anonymous sets immediately if binding fails
* netfilter: nf_tables: propagate context to set iter callback
* netfilter: nf_tables: add loop detection

From Pablo Neira Ayuso:
* netfilter: nf_tables: allow to dump all existing sets
* netfilter: nf_tables: fix wrong type for flags variable in newelem

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2 files changed, 281 insertions, 59 deletions

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index d26dfa345f49..677dd79380ed 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -6,6 +6,8 @@
 #include <linux/netfilter/nf_tables.h>
 #include <net/netlink.h>
 
+#define NFT_JUMP_STACK_SIZE     16
+
 struct nft_pktinfo {
         struct sk_buff                  *skb;
         const struct net_device         *in;
@@ -48,23 +50,22 @@ static inline void nft_data_debug(const struct nft_data *data)
 }
 
 /**
- *      struct nft_ctx - nf_tables rule context
+ *      struct nft_ctx - nf_tables rule/set context
  *
+ *      @skb: netlink skb
+ *      @nlh: netlink message header
  *      @afi: address family info
  *      @table: the table the chain is contained in
  *      @chain: the chain the rule is contained in
  */
 struct nft_ctx {
+        const struct sk_buff            *skb;
+        const struct nlmsghdr           *nlh;
         const struct nft_af_info        *afi;
         const struct nft_table          *table;
         const struct nft_chain          *chain;
 };
 
-enum nft_data_types {
-        NFT_DATA_VALUE,
-        NFT_DATA_VERDICT,
-};
-
 struct nft_data_desc {
         enum nft_data_types             type;
         unsigned int                    len;
@@ -83,6 +84,11 @@ static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg)
         return reg == NFT_REG_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
 }
 
+static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
+{
+        return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1;
+}
+
 extern int nft_validate_input_register(enum nft_registers reg);
 extern int nft_validate_output_register(enum nft_registers reg);
 extern int nft_validate_data_load(const struct nft_ctx *ctx,
@@ -91,6 +97,132 @@ extern int nft_validate_data_load(const struct nft_ctx *ctx,
                                   enum nft_data_types type);
 
 /**
+ *      struct nft_set_elem - generic representation of set elements
+ *
+ *      @cookie: implementation specific element cookie
+ *      @key: element key
+ *      @data: element data (maps only)
+ *      @flags: element flags (end of interval)
+ *
+ *      The cookie can be used to store a handle to the element for subsequent
+ *      removal.
+ */
+struct nft_set_elem {
+        void                    *cookie;
+        struct nft_data         key;
+        struct nft_data         data;
+        u32                     flags;
+};
+
+struct nft_set;
+struct nft_set_iter {
+        unsigned int    count;
+        unsigned int    skip;
+        int             err;
+        int             (*fn)(const struct nft_ctx *ctx,
+                              const struct nft_set *set,
+                              const struct nft_set_iter *iter,
+                              const struct nft_set_elem *elem);
+};
+
+/**
+ *      struct nft_set_ops - nf_tables set operations
+ *
+ *      @lookup: look up an element within the set
+ *      @insert: insert new element into set
+ *      @remove: remove element from set
+ *      @walk: iterate over all set elemeennts
+ *      @privsize: function to return size of set private data
+ *      @init: initialize private data of new set instance
+ *      @destroy: destroy private data of set instance
+ *      @list: nf_tables_set_ops list node
+ *      @owner: module reference
+ *      @features: features supported by the implementation
+ */
+struct nft_set_ops {
+        bool                            (*lookup)(const struct nft_set *set,
+                                                  const struct nft_data *key,
+                                                  struct nft_data *data);
+        int                             (*get)(const struct nft_set *set,
+                                               struct nft_set_elem *elem);
+        int                             (*insert)(const struct nft_set *set,
+                                                  const struct nft_set_elem *elem);
+        void                            (*remove)(const struct nft_set *set,
+                                                  const struct nft_set_elem *elem);
+        void                            (*walk)(const struct nft_ctx *ctx,
+                                                const struct nft_set *set,
+                                                struct nft_set_iter *iter);
+
+        unsigned int                    (*privsize)(const struct nlattr * const nla[]);
+        int                             (*init)(const struct nft_set *set,
+                                                const struct nlattr * const nla[]);
+        void                            (*destroy)(const struct nft_set *set);
+
+        struct list_head                list;
+        struct module                   *owner;
+        u32                             features;
+};
+
+extern int nft_register_set(struct nft_set_ops *ops);
+extern void nft_unregister_set(struct nft_set_ops *ops);
+
+/**
+ *      struct nft_set - nf_tables set instance
+ *
+ *      @list: table set list node
+ *      @bindings: list of set bindings
+ *      @name: name of the set
+ *      @ktype: key type (numeric type defined by userspace, not used in the kernel)
+ *      @dtype: data type (verdict or numeric type defined by userspace)
+ *      @ops: set ops
+ *      @flags: set flags
+ *      @klen: key length
+ *      @dlen: data length
+ *      @data: private set data
+ */
+struct nft_set {
+        struct list_head                list;
+        struct list_head                bindings;
+        char                            name[IFNAMSIZ];
+        u32                             ktype;
+        u32                             dtype;
+        /* runtime data below here */
+        const struct nft_set_ops        *ops ____cacheline_aligned;
+        u16                             flags;
+        u8                              klen;
+        u8                              dlen;
+        unsigned char                   data[]
+                __attribute__((aligned(__alignof__(u64))));
+};
+
+static inline void *nft_set_priv(const struct nft_set *set)
+{
+        return (void *)set->data;
+}
+
+extern struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
+                                            const struct nlattr *nla);
+
+/**
+ *      struct nft_set_binding - nf_tables set binding
+ *
+ *      @list: set bindings list node
+ *      @chain: chain containing the rule bound to the set
+ *
+ *      A set binding contains all information necessary for validation
+ *      of new elements added to a bound set.
+ */
+struct nft_set_binding {
+        struct list_head                list;
+        const struct nft_chain          *chain;
+};
+
+extern int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
+                              struct nft_set_binding *binding);
+extern void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
+                                 struct nft_set_binding *binding);
+
+/**
  *      struct nft_expr_ops - nf_tables expression operations
  *
  *      @eval: Expression evaluation function
@@ -115,7 +247,7 @@ struct nft_expr_ops {
         void                            (*destroy)(const struct nft_expr *expr);
         int                             (*dump)(struct sk_buff *skb,
                                                 const struct nft_expr *expr);
-
+        const struct nft_data *         (*get_verdict)(const struct nft_expr *expr);
         struct list_head                list;
         const char                      *name;
         struct module                   *owner;
@@ -298,4 +430,7 @@ extern void nft_unregister_expr(struct nft_expr_ops *);
 #define MODULE_ALIAS_NFT_EXPR(name) \
         MODULE_ALIAS("nft-expr-" name)
 
+#define MODULE_ALIAS_NFT_SET() \
+        MODULE_ALIAS("nft-set")
+
 #endif /* _NET_NF_TABLES_H */
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index ec6d84a8ed1e..9e924014efe3 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -44,6 +44,12 @@ enum nft_verdicts {
  * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
  * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
  * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
+ * @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
+ * @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
+ * @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
+ * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
+ * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
+ * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
  */
 enum nf_tables_msg_types {
         NFT_MSG_NEWTABLE,
@@ -55,9 +61,20 @@ enum nf_tables_msg_types {
         NFT_MSG_NEWRULE,
         NFT_MSG_GETRULE,
         NFT_MSG_DELRULE,
+        NFT_MSG_NEWSET,
+        NFT_MSG_GETSET,
+        NFT_MSG_DELSET,
+        NFT_MSG_NEWSETELEM,
+        NFT_MSG_GETSETELEM,
+        NFT_MSG_DELSETELEM,
         NFT_MSG_MAX,
 };
 
+/**
+ * enum nft_list_attributes - nf_tables generic list netlink attributes
+ *
+ * @NFTA_LIST_ELEM: list element (NLA_NESTED)
+ */
 enum nft_list_attributes {
         NFTA_LIST_UNPEC,
         NFTA_LIST_ELEM,
@@ -127,6 +144,113 @@ enum nft_rule_attributes {
 };
 #define NFTA_RULE_MAX           (__NFTA_RULE_MAX - 1)
 
+/**
+ * enum nft_set_flags - nf_tables set flags
+ *
+ * @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
+ * @NFT_SET_CONSTANT: set contents may not change while bound
+ * @NFT_SET_INTERVAL: set contains intervals
+ * @NFT_SET_MAP: set is used as a dictionary
+ */
+enum nft_set_flags {
+        NFT_SET_ANONYMOUS               = 0x1,
+        NFT_SET_CONSTANT                = 0x2,
+        NFT_SET_INTERVAL                = 0x4,
+        NFT_SET_MAP                     = 0x8,
+};
+
+/**
+ * enum nft_set_attributes - nf_tables set netlink attributes
+ *
+ * @NFTA_SET_TABLE: table name (NLA_STRING)
+ * @NFTA_SET_NAME: set name (NLA_STRING)
+ * @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
+ * @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
+ * @NFTA_SET_KEY_LEN: key data length (NLA_U32)
+ * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
+ * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
+ */
+enum nft_set_attributes {
+        NFTA_SET_UNSPEC,
+        NFTA_SET_TABLE,
+        NFTA_SET_NAME,
+        NFTA_SET_FLAGS,
+        NFTA_SET_KEY_TYPE,
+        NFTA_SET_KEY_LEN,
+        NFTA_SET_DATA_TYPE,
+        NFTA_SET_DATA_LEN,
+        __NFTA_SET_MAX
+};
+#define NFTA_SET_MAX            (__NFTA_SET_MAX - 1)
+
+/**
+ * enum nft_set_elem_flags - nf_tables set element flags
+ *
+ * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
+ */
+enum nft_set_elem_flags {
+        NFT_SET_ELEM_INTERVAL_END       = 0x1,
+};
+
+/**
+ * enum nft_set_elem_attributes - nf_tables set element netlink attributes
+ *
+ * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
+ * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
+ * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
+ */
+enum nft_set_elem_attributes {
+        NFTA_SET_ELEM_UNSPEC,
+        NFTA_SET_ELEM_KEY,
+        NFTA_SET_ELEM_DATA,
+        NFTA_SET_ELEM_FLAGS,
+        __NFTA_SET_ELEM_MAX
+};
+#define NFTA_SET_ELEM_MAX       (__NFTA_SET_ELEM_MAX - 1)
+
+/**
+ * enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
+ *
+ * @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
+ * @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
+ * @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
+ */
+enum nft_set_elem_list_attributes {
+        NFTA_SET_ELEM_LIST_UNSPEC,
+        NFTA_SET_ELEM_LIST_TABLE,
+        NFTA_SET_ELEM_LIST_SET,
+        NFTA_SET_ELEM_LIST_ELEMENTS,
+        __NFTA_SET_ELEM_LIST_MAX
+};
+#define NFTA_SET_ELEM_LIST_MAX  (__NFTA_SET_ELEM_LIST_MAX - 1)
+
+/**
+ * enum nft_data_types - nf_tables data types
+ *
+ * @NFT_DATA_VALUE: generic data
+ * @NFT_DATA_VERDICT: netfilter verdict
+ *
+ * The type of data is usually determined by the kernel directly and is not
+ * explicitly specified by userspace. The only difference are sets, where
+ * userspace specifies the key and mapping data types.
+ *
+ * The values 0xffffff00-0xffffffff are reserved for internally used types.
+ * The remaining range can be freely used by userspace to encode types, all
+ * values are equivalent to NFT_DATA_VALUE.
+ */
+enum nft_data_types {
+        NFT_DATA_VALUE,
+        NFT_DATA_VERDICT        = 0xffffff00U,
+};
+
+#define NFT_DATA_RESERVED_MASK  0xffffff00U
+
+/**
+ * enum nft_data_attributes - nf_tables data netlink attributes
+ *
+ * @NFTA_DATA_VALUE: generic data (NLA_BINARY)
+ * @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
+ */
 enum nft_data_attributes {
         NFTA_DATA_UNSPEC,
         NFTA_DATA_VALUE,
@@ -275,58 +399,21 @@ enum nft_cmp_attributes {
 };
 #define NFTA_CMP_MAX            (__NFTA_CMP_MAX - 1)
 
-enum nft_set_elem_flags {
-        NFT_SE_INTERVAL_END     = 0x1,
-};
-
-enum nft_set_elem_attributes {
-        NFTA_SE_UNSPEC,
-        NFTA_SE_KEY,
-        NFTA_SE_DATA,
-        NFTA_SE_FLAGS,
-        __NFTA_SE_MAX
-};
-#define NFTA_SE_MAX             (__NFTA_SE_MAX - 1)
-
-enum nft_set_flags {
-        NFT_SET_INTERVAL        = 0x1,
-        NFT_SET_MAP             = 0x2,
-};
-
-enum nft_set_attributes {
-        NFTA_SET_UNSPEC,
-        NFTA_SET_FLAGS,
-        NFTA_SET_SREG,
-        NFTA_SET_DREG,
-        NFTA_SET_KLEN,
-        NFTA_SET_DLEN,
-        NFTA_SET_ELEMENTS,
-        __NFTA_SET_MAX
-};
-#define NFTA_SET_MAX            (__NFTA_SET_MAX - 1)
-
-enum nft_hash_flags {
-        NFT_HASH_MAP            = 0x1,
-};
-
-enum nft_hash_elem_attributes {
-        NFTA_HE_UNSPEC,
-        NFTA_HE_KEY,
-        NFTA_HE_DATA,
-        __NFTA_HE_MAX
-};
-#define NFTA_HE_MAX             (__NFTA_HE_MAX - 1)
-
-enum nft_hash_attributes {
-        NFTA_HASH_UNSPEC,
-        NFTA_HASH_FLAGS,
-        NFTA_HASH_SREG,
-        NFTA_HASH_DREG,
-        NFTA_HASH_KLEN,
-        NFTA_HASH_ELEMENTS,
-        __NFTA_HASH_MAX
-};
-#define NFTA_HASH_MAX           (__NFTA_HASH_MAX - 1)
+/**
+ * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
+ *
+ * @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
+ * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
+ * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
+ */
+enum nft_lookup_attributes {
+        NFTA_LOOKUP_UNSPEC,
+        NFTA_LOOKUP_SET,
+        NFTA_LOOKUP_SREG,
+        NFTA_LOOKUP_DREG,
+        __NFTA_LOOKUP_MAX
+};
+#define NFTA_LOOKUP_MAX         (__NFTA_LOOKUP_MAX - 1)
 
 /**
  * enum nft_payload_bases - nf_tables payload expression offset bases