Loading...
1/*
2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
10 */
11
12#include <linux/kernel.h>
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nf_tables.h>
18#include <net/netfilter/nf_tables.h>
19#include <net/netfilter/nf_conntrack.h>
20#include <net/netfilter/nf_conntrack_acct.h>
21#include <net/netfilter/nf_conntrack_tuple.h>
22#include <net/netfilter/nf_conntrack_helper.h>
23#include <net/netfilter/nf_conntrack_ecache.h>
24#include <net/netfilter/nf_conntrack_labels.h>
25
26struct nft_ct {
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
29 union {
30 enum nft_registers dreg:8;
31 enum nft_registers sreg:8;
32 };
33};
34
35static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
36 enum nft_ct_keys k,
37 enum ip_conntrack_dir d)
38{
39 if (d < IP_CT_DIR_MAX)
40 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
41 atomic64_read(&c[d].packets);
42
43 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
44 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
45}
46
47static void nft_ct_get_eval(const struct nft_expr *expr,
48 struct nft_regs *regs,
49 const struct nft_pktinfo *pkt)
50{
51 const struct nft_ct *priv = nft_expr_priv(expr);
52 u32 *dest = ®s->data[priv->dreg];
53 enum ip_conntrack_info ctinfo;
54 const struct nf_conn *ct;
55 const struct nf_conn_help *help;
56 const struct nf_conntrack_tuple *tuple;
57 const struct nf_conntrack_helper *helper;
58 unsigned int state;
59
60 ct = nf_ct_get(pkt->skb, &ctinfo);
61
62 switch (priv->key) {
63 case NFT_CT_STATE:
64 if (ct == NULL)
65 state = NF_CT_STATE_INVALID_BIT;
66 else if (nf_ct_is_untracked(ct))
67 state = NF_CT_STATE_UNTRACKED_BIT;
68 else
69 state = NF_CT_STATE_BIT(ctinfo);
70 *dest = state;
71 return;
72 default:
73 break;
74 }
75
76 if (ct == NULL)
77 goto err;
78
79 switch (priv->key) {
80 case NFT_CT_DIRECTION:
81 *dest = CTINFO2DIR(ctinfo);
82 return;
83 case NFT_CT_STATUS:
84 *dest = ct->status;
85 return;
86#ifdef CONFIG_NF_CONNTRACK_MARK
87 case NFT_CT_MARK:
88 *dest = ct->mark;
89 return;
90#endif
91#ifdef CONFIG_NF_CONNTRACK_SECMARK
92 case NFT_CT_SECMARK:
93 *dest = ct->secmark;
94 return;
95#endif
96 case NFT_CT_EXPIRATION:
97 *dest = jiffies_to_msecs(nf_ct_expires(ct));
98 return;
99 case NFT_CT_HELPER:
100 if (ct->master == NULL)
101 goto err;
102 help = nfct_help(ct->master);
103 if (help == NULL)
104 goto err;
105 helper = rcu_dereference(help->helper);
106 if (helper == NULL)
107 goto err;
108 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
109 return;
110#ifdef CONFIG_NF_CONNTRACK_LABELS
111 case NFT_CT_LABELS: {
112 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
113
114 if (labels)
115 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
116 else
117 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
118 return;
119 }
120#endif
121 case NFT_CT_BYTES: /* fallthrough */
122 case NFT_CT_PKTS: {
123 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
124 u64 count = 0;
125
126 if (acct)
127 count = nft_ct_get_eval_counter(acct->counter,
128 priv->key, priv->dir);
129 memcpy(dest, &count, sizeof(count));
130 return;
131 }
132 case NFT_CT_L3PROTOCOL:
133 *dest = nf_ct_l3num(ct);
134 return;
135 case NFT_CT_PROTOCOL:
136 *dest = nf_ct_protonum(ct);
137 return;
138 default:
139 break;
140 }
141
142 tuple = &ct->tuplehash[priv->dir].tuple;
143 switch (priv->key) {
144 case NFT_CT_SRC:
145 memcpy(dest, tuple->src.u3.all,
146 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
147 return;
148 case NFT_CT_DST:
149 memcpy(dest, tuple->dst.u3.all,
150 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
151 return;
152 case NFT_CT_PROTO_SRC:
153 *dest = (__force __u16)tuple->src.u.all;
154 return;
155 case NFT_CT_PROTO_DST:
156 *dest = (__force __u16)tuple->dst.u.all;
157 return;
158 default:
159 break;
160 }
161 return;
162err:
163 regs->verdict.code = NFT_BREAK;
164}
165
166static void nft_ct_set_eval(const struct nft_expr *expr,
167 struct nft_regs *regs,
168 const struct nft_pktinfo *pkt)
169{
170 const struct nft_ct *priv = nft_expr_priv(expr);
171 struct sk_buff *skb = pkt->skb;
172#ifdef CONFIG_NF_CONNTRACK_MARK
173 u32 value = regs->data[priv->sreg];
174#endif
175 enum ip_conntrack_info ctinfo;
176 struct nf_conn *ct;
177
178 ct = nf_ct_get(skb, &ctinfo);
179 if (ct == NULL)
180 return;
181
182 switch (priv->key) {
183#ifdef CONFIG_NF_CONNTRACK_MARK
184 case NFT_CT_MARK:
185 if (ct->mark != value) {
186 ct->mark = value;
187 nf_conntrack_event_cache(IPCT_MARK, ct);
188 }
189 break;
190#endif
191#ifdef CONFIG_NF_CONNTRACK_LABELS
192 case NFT_CT_LABELS:
193 nf_connlabels_replace(ct,
194 ®s->data[priv->sreg],
195 ®s->data[priv->sreg],
196 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
197 break;
198#endif
199 default:
200 break;
201 }
202}
203
204static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
205 [NFTA_CT_DREG] = { .type = NLA_U32 },
206 [NFTA_CT_KEY] = { .type = NLA_U32 },
207 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
208 [NFTA_CT_SREG] = { .type = NLA_U32 },
209};
210
211static int nft_ct_netns_get(struct net *net, uint8_t family)
212{
213 int err;
214
215 if (family == NFPROTO_INET) {
216 err = nf_ct_netns_get(net, NFPROTO_IPV4);
217 if (err < 0)
218 goto err1;
219 err = nf_ct_netns_get(net, NFPROTO_IPV6);
220 if (err < 0)
221 goto err2;
222 } else {
223 err = nf_ct_netns_get(net, family);
224 if (err < 0)
225 goto err1;
226 }
227 return 0;
228
229err2:
230 nf_ct_netns_put(net, NFPROTO_IPV4);
231err1:
232 return err;
233}
234
235static void nft_ct_netns_put(struct net *net, uint8_t family)
236{
237 if (family == NFPROTO_INET) {
238 nf_ct_netns_put(net, NFPROTO_IPV4);
239 nf_ct_netns_put(net, NFPROTO_IPV6);
240 } else
241 nf_ct_netns_put(net, family);
242}
243
244static int nft_ct_get_init(const struct nft_ctx *ctx,
245 const struct nft_expr *expr,
246 const struct nlattr * const tb[])
247{
248 struct nft_ct *priv = nft_expr_priv(expr);
249 unsigned int len;
250 int err;
251
252 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
253 switch (priv->key) {
254 case NFT_CT_DIRECTION:
255 if (tb[NFTA_CT_DIRECTION] != NULL)
256 return -EINVAL;
257 len = sizeof(u8);
258 break;
259 case NFT_CT_STATE:
260 case NFT_CT_STATUS:
261#ifdef CONFIG_NF_CONNTRACK_MARK
262 case NFT_CT_MARK:
263#endif
264#ifdef CONFIG_NF_CONNTRACK_SECMARK
265 case NFT_CT_SECMARK:
266#endif
267 case NFT_CT_EXPIRATION:
268 if (tb[NFTA_CT_DIRECTION] != NULL)
269 return -EINVAL;
270 len = sizeof(u32);
271 break;
272#ifdef CONFIG_NF_CONNTRACK_LABELS
273 case NFT_CT_LABELS:
274 if (tb[NFTA_CT_DIRECTION] != NULL)
275 return -EINVAL;
276 len = NF_CT_LABELS_MAX_SIZE;
277 break;
278#endif
279 case NFT_CT_HELPER:
280 if (tb[NFTA_CT_DIRECTION] != NULL)
281 return -EINVAL;
282 len = NF_CT_HELPER_NAME_LEN;
283 break;
284
285 case NFT_CT_L3PROTOCOL:
286 case NFT_CT_PROTOCOL:
287 /* For compatibility, do not report error if NFTA_CT_DIRECTION
288 * attribute is specified.
289 */
290 len = sizeof(u8);
291 break;
292 case NFT_CT_SRC:
293 case NFT_CT_DST:
294 if (tb[NFTA_CT_DIRECTION] == NULL)
295 return -EINVAL;
296
297 switch (ctx->afi->family) {
298 case NFPROTO_IPV4:
299 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
300 src.u3.ip);
301 break;
302 case NFPROTO_IPV6:
303 case NFPROTO_INET:
304 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
305 src.u3.ip6);
306 break;
307 default:
308 return -EAFNOSUPPORT;
309 }
310 break;
311 case NFT_CT_PROTO_SRC:
312 case NFT_CT_PROTO_DST:
313 if (tb[NFTA_CT_DIRECTION] == NULL)
314 return -EINVAL;
315 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
316 break;
317 case NFT_CT_BYTES:
318 case NFT_CT_PKTS:
319 /* no direction? return sum of original + reply */
320 if (tb[NFTA_CT_DIRECTION] == NULL)
321 priv->dir = IP_CT_DIR_MAX;
322 len = sizeof(u64);
323 break;
324 default:
325 return -EOPNOTSUPP;
326 }
327
328 if (tb[NFTA_CT_DIRECTION] != NULL) {
329 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
330 switch (priv->dir) {
331 case IP_CT_DIR_ORIGINAL:
332 case IP_CT_DIR_REPLY:
333 break;
334 default:
335 return -EINVAL;
336 }
337 }
338
339 priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
340 err = nft_validate_register_store(ctx, priv->dreg, NULL,
341 NFT_DATA_VALUE, len);
342 if (err < 0)
343 return err;
344
345 err = nft_ct_netns_get(ctx->net, ctx->afi->family);
346 if (err < 0)
347 return err;
348
349 if (priv->key == NFT_CT_BYTES || priv->key == NFT_CT_PKTS)
350 nf_ct_set_acct(ctx->net, true);
351
352 return 0;
353}
354
355static int nft_ct_set_init(const struct nft_ctx *ctx,
356 const struct nft_expr *expr,
357 const struct nlattr * const tb[])
358{
359 struct nft_ct *priv = nft_expr_priv(expr);
360 bool label_got = false;
361 unsigned int len;
362 int err;
363
364 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
365 switch (priv->key) {
366#ifdef CONFIG_NF_CONNTRACK_MARK
367 case NFT_CT_MARK:
368 if (tb[NFTA_CT_DIRECTION])
369 return -EINVAL;
370 len = FIELD_SIZEOF(struct nf_conn, mark);
371 break;
372#endif
373#ifdef CONFIG_NF_CONNTRACK_LABELS
374 case NFT_CT_LABELS:
375 if (tb[NFTA_CT_DIRECTION])
376 return -EINVAL;
377 len = NF_CT_LABELS_MAX_SIZE;
378 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
379 if (err)
380 return err;
381 label_got = true;
382 break;
383#endif
384 default:
385 return -EOPNOTSUPP;
386 }
387
388 priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
389 err = nft_validate_register_load(priv->sreg, len);
390 if (err < 0)
391 goto err1;
392
393 err = nft_ct_netns_get(ctx->net, ctx->afi->family);
394 if (err < 0)
395 goto err1;
396
397 return 0;
398
399err1:
400 if (label_got)
401 nf_connlabels_put(ctx->net);
402 return err;
403}
404
405static void nft_ct_get_destroy(const struct nft_ctx *ctx,
406 const struct nft_expr *expr)
407{
408 nf_ct_netns_put(ctx->net, ctx->afi->family);
409}
410
411static void nft_ct_set_destroy(const struct nft_ctx *ctx,
412 const struct nft_expr *expr)
413{
414 struct nft_ct *priv = nft_expr_priv(expr);
415
416 switch (priv->key) {
417#ifdef CONFIG_NF_CONNTRACK_LABELS
418 case NFT_CT_LABELS:
419 nf_connlabels_put(ctx->net);
420 break;
421#endif
422 default:
423 break;
424 }
425
426 nft_ct_netns_put(ctx->net, ctx->afi->family);
427}
428
429static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
430{
431 const struct nft_ct *priv = nft_expr_priv(expr);
432
433 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
434 goto nla_put_failure;
435 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
436 goto nla_put_failure;
437
438 switch (priv->key) {
439 case NFT_CT_SRC:
440 case NFT_CT_DST:
441 case NFT_CT_PROTO_SRC:
442 case NFT_CT_PROTO_DST:
443 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
444 goto nla_put_failure;
445 break;
446 case NFT_CT_BYTES:
447 case NFT_CT_PKTS:
448 if (priv->dir < IP_CT_DIR_MAX &&
449 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
450 goto nla_put_failure;
451 break;
452 default:
453 break;
454 }
455
456 return 0;
457
458nla_put_failure:
459 return -1;
460}
461
462static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
463{
464 const struct nft_ct *priv = nft_expr_priv(expr);
465
466 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
467 goto nla_put_failure;
468 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
469 goto nla_put_failure;
470 return 0;
471
472nla_put_failure:
473 return -1;
474}
475
476static struct nft_expr_type nft_ct_type;
477static const struct nft_expr_ops nft_ct_get_ops = {
478 .type = &nft_ct_type,
479 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
480 .eval = nft_ct_get_eval,
481 .init = nft_ct_get_init,
482 .destroy = nft_ct_get_destroy,
483 .dump = nft_ct_get_dump,
484};
485
486static const struct nft_expr_ops nft_ct_set_ops = {
487 .type = &nft_ct_type,
488 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
489 .eval = nft_ct_set_eval,
490 .init = nft_ct_set_init,
491 .destroy = nft_ct_set_destroy,
492 .dump = nft_ct_set_dump,
493};
494
495static const struct nft_expr_ops *
496nft_ct_select_ops(const struct nft_ctx *ctx,
497 const struct nlattr * const tb[])
498{
499 if (tb[NFTA_CT_KEY] == NULL)
500 return ERR_PTR(-EINVAL);
501
502 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
503 return ERR_PTR(-EINVAL);
504
505 if (tb[NFTA_CT_DREG])
506 return &nft_ct_get_ops;
507
508 if (tb[NFTA_CT_SREG])
509 return &nft_ct_set_ops;
510
511 return ERR_PTR(-EINVAL);
512}
513
514static struct nft_expr_type nft_ct_type __read_mostly = {
515 .name = "ct",
516 .select_ops = &nft_ct_select_ops,
517 .policy = nft_ct_policy,
518 .maxattr = NFTA_CT_MAX,
519 .owner = THIS_MODULE,
520};
521
522static void nft_notrack_eval(const struct nft_expr *expr,
523 struct nft_regs *regs,
524 const struct nft_pktinfo *pkt)
525{
526 struct sk_buff *skb = pkt->skb;
527 enum ip_conntrack_info ctinfo;
528 struct nf_conn *ct;
529
530 ct = nf_ct_get(pkt->skb, &ctinfo);
531 /* Previously seen (loopback or untracked)? Ignore. */
532 if (ct)
533 return;
534
535 ct = nf_ct_untracked_get();
536 atomic_inc(&ct->ct_general.use);
537 skb->nfct = &ct->ct_general;
538 skb->nfctinfo = IP_CT_NEW;
539}
540
541static struct nft_expr_type nft_notrack_type;
542static const struct nft_expr_ops nft_notrack_ops = {
543 .type = &nft_notrack_type,
544 .size = NFT_EXPR_SIZE(0),
545 .eval = nft_notrack_eval,
546};
547
548static struct nft_expr_type nft_notrack_type __read_mostly = {
549 .name = "notrack",
550 .ops = &nft_notrack_ops,
551 .owner = THIS_MODULE,
552};
553
554static int __init nft_ct_module_init(void)
555{
556 int err;
557
558 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
559
560 err = nft_register_expr(&nft_ct_type);
561 if (err < 0)
562 return err;
563
564 err = nft_register_expr(&nft_notrack_type);
565 if (err < 0)
566 goto err1;
567
568 return 0;
569err1:
570 nft_unregister_expr(&nft_ct_type);
571 return err;
572}
573
574static void __exit nft_ct_module_exit(void)
575{
576 nft_unregister_expr(&nft_notrack_type);
577 nft_unregister_expr(&nft_ct_type);
578}
579
580module_init(nft_ct_module_init);
581module_exit(nft_ct_module_exit);
582
583MODULE_LICENSE("GPL");
584MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
585MODULE_ALIAS_NFT_EXPR("ct");
586MODULE_ALIAS_NFT_EXPR("notrack");
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 *
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
7 */
8
9#include <linux/kernel.h>
10#include <linux/init.h>
11#include <linux/module.h>
12#include <linux/netlink.h>
13#include <linux/netfilter.h>
14#include <linux/netfilter/nf_tables.h>
15#include <net/netfilter/nf_tables.h>
16#include <net/netfilter/nf_conntrack.h>
17#include <net/netfilter/nf_conntrack_acct.h>
18#include <net/netfilter/nf_conntrack_tuple.h>
19#include <net/netfilter/nf_conntrack_helper.h>
20#include <net/netfilter/nf_conntrack_ecache.h>
21#include <net/netfilter/nf_conntrack_labels.h>
22#include <net/netfilter/nf_conntrack_timeout.h>
23#include <net/netfilter/nf_conntrack_l4proto.h>
24#include <net/netfilter/nf_conntrack_expect.h>
25
26struct nft_ct {
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
29 u8 len;
30 union {
31 u8 dreg;
32 u8 sreg;
33 };
34};
35
36struct nft_ct_helper_obj {
37 struct nf_conntrack_helper *helper4;
38 struct nf_conntrack_helper *helper6;
39 u8 l4proto;
40};
41
42#ifdef CONFIG_NF_CONNTRACK_ZONES
43static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
44static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
45static DEFINE_MUTEX(nft_ct_pcpu_mutex);
46#endif
47
48static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
49 enum nft_ct_keys k,
50 enum ip_conntrack_dir d)
51{
52 if (d < IP_CT_DIR_MAX)
53 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
54 atomic64_read(&c[d].packets);
55
56 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
57 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
58}
59
60static void nft_ct_get_eval(const struct nft_expr *expr,
61 struct nft_regs *regs,
62 const struct nft_pktinfo *pkt)
63{
64 const struct nft_ct *priv = nft_expr_priv(expr);
65 u32 *dest = ®s->data[priv->dreg];
66 enum ip_conntrack_info ctinfo;
67 const struct nf_conn *ct;
68 const struct nf_conn_help *help;
69 const struct nf_conntrack_tuple *tuple;
70 const struct nf_conntrack_helper *helper;
71 unsigned int state;
72
73 ct = nf_ct_get(pkt->skb, &ctinfo);
74
75 switch (priv->key) {
76 case NFT_CT_STATE:
77 if (ct)
78 state = NF_CT_STATE_BIT(ctinfo);
79 else if (ctinfo == IP_CT_UNTRACKED)
80 state = NF_CT_STATE_UNTRACKED_BIT;
81 else
82 state = NF_CT_STATE_INVALID_BIT;
83 *dest = state;
84 return;
85 default:
86 break;
87 }
88
89 if (ct == NULL)
90 goto err;
91
92 switch (priv->key) {
93 case NFT_CT_DIRECTION:
94 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
95 return;
96 case NFT_CT_STATUS:
97 *dest = ct->status;
98 return;
99#ifdef CONFIG_NF_CONNTRACK_MARK
100 case NFT_CT_MARK:
101 *dest = READ_ONCE(ct->mark);
102 return;
103#endif
104#ifdef CONFIG_NF_CONNTRACK_SECMARK
105 case NFT_CT_SECMARK:
106 *dest = ct->secmark;
107 return;
108#endif
109 case NFT_CT_EXPIRATION:
110 *dest = jiffies_to_msecs(nf_ct_expires(ct));
111 return;
112 case NFT_CT_HELPER:
113 if (ct->master == NULL)
114 goto err;
115 help = nfct_help(ct->master);
116 if (help == NULL)
117 goto err;
118 helper = rcu_dereference(help->helper);
119 if (helper == NULL)
120 goto err;
121 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
122 return;
123#ifdef CONFIG_NF_CONNTRACK_LABELS
124 case NFT_CT_LABELS: {
125 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
126
127 if (labels)
128 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
129 else
130 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
131 return;
132 }
133#endif
134 case NFT_CT_BYTES:
135 case NFT_CT_PKTS: {
136 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
137 u64 count = 0;
138
139 if (acct)
140 count = nft_ct_get_eval_counter(acct->counter,
141 priv->key, priv->dir);
142 memcpy(dest, &count, sizeof(count));
143 return;
144 }
145 case NFT_CT_AVGPKT: {
146 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
147 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
148
149 if (acct) {
150 pcnt = nft_ct_get_eval_counter(acct->counter,
151 NFT_CT_PKTS, priv->dir);
152 bcnt = nft_ct_get_eval_counter(acct->counter,
153 NFT_CT_BYTES, priv->dir);
154 if (pcnt != 0)
155 avgcnt = div64_u64(bcnt, pcnt);
156 }
157
158 memcpy(dest, &avgcnt, sizeof(avgcnt));
159 return;
160 }
161 case NFT_CT_L3PROTOCOL:
162 nft_reg_store8(dest, nf_ct_l3num(ct));
163 return;
164 case NFT_CT_PROTOCOL:
165 nft_reg_store8(dest, nf_ct_protonum(ct));
166 return;
167#ifdef CONFIG_NF_CONNTRACK_ZONES
168 case NFT_CT_ZONE: {
169 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
170 u16 zoneid;
171
172 if (priv->dir < IP_CT_DIR_MAX)
173 zoneid = nf_ct_zone_id(zone, priv->dir);
174 else
175 zoneid = zone->id;
176
177 nft_reg_store16(dest, zoneid);
178 return;
179 }
180#endif
181 case NFT_CT_ID:
182 *dest = nf_ct_get_id(ct);
183 return;
184 default:
185 break;
186 }
187
188 tuple = &ct->tuplehash[priv->dir].tuple;
189 switch (priv->key) {
190 case NFT_CT_SRC:
191 memcpy(dest, tuple->src.u3.all,
192 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
193 return;
194 case NFT_CT_DST:
195 memcpy(dest, tuple->dst.u3.all,
196 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
197 return;
198 case NFT_CT_PROTO_SRC:
199 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
200 return;
201 case NFT_CT_PROTO_DST:
202 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
203 return;
204 case NFT_CT_SRC_IP:
205 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
206 goto err;
207 *dest = (__force __u32)tuple->src.u3.ip;
208 return;
209 case NFT_CT_DST_IP:
210 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
211 goto err;
212 *dest = (__force __u32)tuple->dst.u3.ip;
213 return;
214 case NFT_CT_SRC_IP6:
215 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
216 goto err;
217 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
218 return;
219 case NFT_CT_DST_IP6:
220 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
221 goto err;
222 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
223 return;
224 default:
225 break;
226 }
227 return;
228err:
229 regs->verdict.code = NFT_BREAK;
230}
231
232#ifdef CONFIG_NF_CONNTRACK_ZONES
233static void nft_ct_set_zone_eval(const struct nft_expr *expr,
234 struct nft_regs *regs,
235 const struct nft_pktinfo *pkt)
236{
237 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
238 const struct nft_ct *priv = nft_expr_priv(expr);
239 struct sk_buff *skb = pkt->skb;
240 enum ip_conntrack_info ctinfo;
241 u16 value = nft_reg_load16(®s->data[priv->sreg]);
242 struct nf_conn *ct;
243
244 ct = nf_ct_get(skb, &ctinfo);
245 if (ct) /* already tracked */
246 return;
247
248 zone.id = value;
249
250 switch (priv->dir) {
251 case IP_CT_DIR_ORIGINAL:
252 zone.dir = NF_CT_ZONE_DIR_ORIG;
253 break;
254 case IP_CT_DIR_REPLY:
255 zone.dir = NF_CT_ZONE_DIR_REPL;
256 break;
257 default:
258 break;
259 }
260
261 ct = this_cpu_read(nft_ct_pcpu_template);
262
263 if (likely(refcount_read(&ct->ct_general.use) == 1)) {
264 refcount_inc(&ct->ct_general.use);
265 nf_ct_zone_add(ct, &zone);
266 } else {
267 /* previous skb got queued to userspace, allocate temporary
268 * one until percpu template can be reused.
269 */
270 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
271 if (!ct) {
272 regs->verdict.code = NF_DROP;
273 return;
274 }
275 }
276
277 nf_ct_set(skb, ct, IP_CT_NEW);
278}
279#endif
280
281static void nft_ct_set_eval(const struct nft_expr *expr,
282 struct nft_regs *regs,
283 const struct nft_pktinfo *pkt)
284{
285 const struct nft_ct *priv = nft_expr_priv(expr);
286 struct sk_buff *skb = pkt->skb;
287#if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
288 u32 value = regs->data[priv->sreg];
289#endif
290 enum ip_conntrack_info ctinfo;
291 struct nf_conn *ct;
292
293 ct = nf_ct_get(skb, &ctinfo);
294 if (ct == NULL || nf_ct_is_template(ct))
295 return;
296
297 switch (priv->key) {
298#ifdef CONFIG_NF_CONNTRACK_MARK
299 case NFT_CT_MARK:
300 if (READ_ONCE(ct->mark) != value) {
301 WRITE_ONCE(ct->mark, value);
302 nf_conntrack_event_cache(IPCT_MARK, ct);
303 }
304 break;
305#endif
306#ifdef CONFIG_NF_CONNTRACK_SECMARK
307 case NFT_CT_SECMARK:
308 if (ct->secmark != value) {
309 ct->secmark = value;
310 nf_conntrack_event_cache(IPCT_SECMARK, ct);
311 }
312 break;
313#endif
314#ifdef CONFIG_NF_CONNTRACK_LABELS
315 case NFT_CT_LABELS:
316 nf_connlabels_replace(ct,
317 ®s->data[priv->sreg],
318 ®s->data[priv->sreg],
319 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
320 break;
321#endif
322#ifdef CONFIG_NF_CONNTRACK_EVENTS
323 case NFT_CT_EVENTMASK: {
324 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
325 u32 ctmask = regs->data[priv->sreg];
326
327 if (e) {
328 if (e->ctmask != ctmask)
329 e->ctmask = ctmask;
330 break;
331 }
332
333 if (ctmask && !nf_ct_is_confirmed(ct))
334 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
335 break;
336 }
337#endif
338 default:
339 break;
340 }
341}
342
343static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
344 [NFTA_CT_DREG] = { .type = NLA_U32 },
345 [NFTA_CT_KEY] = { .type = NLA_U32 },
346 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
347 [NFTA_CT_SREG] = { .type = NLA_U32 },
348};
349
350#ifdef CONFIG_NF_CONNTRACK_ZONES
351static void nft_ct_tmpl_put_pcpu(void)
352{
353 struct nf_conn *ct;
354 int cpu;
355
356 for_each_possible_cpu(cpu) {
357 ct = per_cpu(nft_ct_pcpu_template, cpu);
358 if (!ct)
359 break;
360 nf_ct_put(ct);
361 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
362 }
363}
364
365static bool nft_ct_tmpl_alloc_pcpu(void)
366{
367 struct nf_conntrack_zone zone = { .id = 0 };
368 struct nf_conn *tmp;
369 int cpu;
370
371 if (nft_ct_pcpu_template_refcnt)
372 return true;
373
374 for_each_possible_cpu(cpu) {
375 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
376 if (!tmp) {
377 nft_ct_tmpl_put_pcpu();
378 return false;
379 }
380
381 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
382 }
383
384 return true;
385}
386#endif
387
388static int nft_ct_get_init(const struct nft_ctx *ctx,
389 const struct nft_expr *expr,
390 const struct nlattr * const tb[])
391{
392 struct nft_ct *priv = nft_expr_priv(expr);
393 unsigned int len;
394 int err;
395
396 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
397 priv->dir = IP_CT_DIR_MAX;
398 switch (priv->key) {
399 case NFT_CT_DIRECTION:
400 if (tb[NFTA_CT_DIRECTION] != NULL)
401 return -EINVAL;
402 len = sizeof(u8);
403 break;
404 case NFT_CT_STATE:
405 case NFT_CT_STATUS:
406#ifdef CONFIG_NF_CONNTRACK_MARK
407 case NFT_CT_MARK:
408#endif
409#ifdef CONFIG_NF_CONNTRACK_SECMARK
410 case NFT_CT_SECMARK:
411#endif
412 case NFT_CT_EXPIRATION:
413 if (tb[NFTA_CT_DIRECTION] != NULL)
414 return -EINVAL;
415 len = sizeof(u32);
416 break;
417#ifdef CONFIG_NF_CONNTRACK_LABELS
418 case NFT_CT_LABELS:
419 if (tb[NFTA_CT_DIRECTION] != NULL)
420 return -EINVAL;
421 len = NF_CT_LABELS_MAX_SIZE;
422 break;
423#endif
424 case NFT_CT_HELPER:
425 if (tb[NFTA_CT_DIRECTION] != NULL)
426 return -EINVAL;
427 len = NF_CT_HELPER_NAME_LEN;
428 break;
429
430 case NFT_CT_L3PROTOCOL:
431 case NFT_CT_PROTOCOL:
432 /* For compatibility, do not report error if NFTA_CT_DIRECTION
433 * attribute is specified.
434 */
435 len = sizeof(u8);
436 break;
437 case NFT_CT_SRC:
438 case NFT_CT_DST:
439 if (tb[NFTA_CT_DIRECTION] == NULL)
440 return -EINVAL;
441
442 switch (ctx->family) {
443 case NFPROTO_IPV4:
444 len = sizeof_field(struct nf_conntrack_tuple,
445 src.u3.ip);
446 break;
447 case NFPROTO_IPV6:
448 case NFPROTO_INET:
449 len = sizeof_field(struct nf_conntrack_tuple,
450 src.u3.ip6);
451 break;
452 default:
453 return -EAFNOSUPPORT;
454 }
455 break;
456 case NFT_CT_SRC_IP:
457 case NFT_CT_DST_IP:
458 if (tb[NFTA_CT_DIRECTION] == NULL)
459 return -EINVAL;
460
461 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
462 break;
463 case NFT_CT_SRC_IP6:
464 case NFT_CT_DST_IP6:
465 if (tb[NFTA_CT_DIRECTION] == NULL)
466 return -EINVAL;
467
468 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
469 break;
470 case NFT_CT_PROTO_SRC:
471 case NFT_CT_PROTO_DST:
472 if (tb[NFTA_CT_DIRECTION] == NULL)
473 return -EINVAL;
474 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
475 break;
476 case NFT_CT_BYTES:
477 case NFT_CT_PKTS:
478 case NFT_CT_AVGPKT:
479 len = sizeof(u64);
480 break;
481#ifdef CONFIG_NF_CONNTRACK_ZONES
482 case NFT_CT_ZONE:
483 len = sizeof(u16);
484 break;
485#endif
486 case NFT_CT_ID:
487 len = sizeof(u32);
488 break;
489 default:
490 return -EOPNOTSUPP;
491 }
492
493 if (tb[NFTA_CT_DIRECTION] != NULL) {
494 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
495 switch (priv->dir) {
496 case IP_CT_DIR_ORIGINAL:
497 case IP_CT_DIR_REPLY:
498 break;
499 default:
500 return -EINVAL;
501 }
502 }
503
504 priv->len = len;
505 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
506 NFT_DATA_VALUE, len);
507 if (err < 0)
508 return err;
509
510 err = nf_ct_netns_get(ctx->net, ctx->family);
511 if (err < 0)
512 return err;
513
514 if (priv->key == NFT_CT_BYTES ||
515 priv->key == NFT_CT_PKTS ||
516 priv->key == NFT_CT_AVGPKT)
517 nf_ct_set_acct(ctx->net, true);
518
519 return 0;
520}
521
522static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
523{
524 switch (priv->key) {
525#ifdef CONFIG_NF_CONNTRACK_LABELS
526 case NFT_CT_LABELS:
527 nf_connlabels_put(ctx->net);
528 break;
529#endif
530#ifdef CONFIG_NF_CONNTRACK_ZONES
531 case NFT_CT_ZONE:
532 mutex_lock(&nft_ct_pcpu_mutex);
533 if (--nft_ct_pcpu_template_refcnt == 0)
534 nft_ct_tmpl_put_pcpu();
535 mutex_unlock(&nft_ct_pcpu_mutex);
536 break;
537#endif
538 default:
539 break;
540 }
541}
542
543static int nft_ct_set_init(const struct nft_ctx *ctx,
544 const struct nft_expr *expr,
545 const struct nlattr * const tb[])
546{
547 struct nft_ct *priv = nft_expr_priv(expr);
548 unsigned int len;
549 int err;
550
551 priv->dir = IP_CT_DIR_MAX;
552 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
553 switch (priv->key) {
554#ifdef CONFIG_NF_CONNTRACK_MARK
555 case NFT_CT_MARK:
556 if (tb[NFTA_CT_DIRECTION])
557 return -EINVAL;
558 len = sizeof_field(struct nf_conn, mark);
559 break;
560#endif
561#ifdef CONFIG_NF_CONNTRACK_LABELS
562 case NFT_CT_LABELS:
563 if (tb[NFTA_CT_DIRECTION])
564 return -EINVAL;
565 len = NF_CT_LABELS_MAX_SIZE;
566 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
567 if (err)
568 return err;
569 break;
570#endif
571#ifdef CONFIG_NF_CONNTRACK_ZONES
572 case NFT_CT_ZONE:
573 mutex_lock(&nft_ct_pcpu_mutex);
574 if (!nft_ct_tmpl_alloc_pcpu()) {
575 mutex_unlock(&nft_ct_pcpu_mutex);
576 return -ENOMEM;
577 }
578 nft_ct_pcpu_template_refcnt++;
579 mutex_unlock(&nft_ct_pcpu_mutex);
580 len = sizeof(u16);
581 break;
582#endif
583#ifdef CONFIG_NF_CONNTRACK_EVENTS
584 case NFT_CT_EVENTMASK:
585 if (tb[NFTA_CT_DIRECTION])
586 return -EINVAL;
587 len = sizeof(u32);
588 break;
589#endif
590#ifdef CONFIG_NF_CONNTRACK_SECMARK
591 case NFT_CT_SECMARK:
592 if (tb[NFTA_CT_DIRECTION])
593 return -EINVAL;
594 len = sizeof(u32);
595 break;
596#endif
597 default:
598 return -EOPNOTSUPP;
599 }
600
601 if (tb[NFTA_CT_DIRECTION]) {
602 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
603 switch (priv->dir) {
604 case IP_CT_DIR_ORIGINAL:
605 case IP_CT_DIR_REPLY:
606 break;
607 default:
608 err = -EINVAL;
609 goto err1;
610 }
611 }
612
613 priv->len = len;
614 err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
615 if (err < 0)
616 goto err1;
617
618 err = nf_ct_netns_get(ctx->net, ctx->family);
619 if (err < 0)
620 goto err1;
621
622 return 0;
623
624err1:
625 __nft_ct_set_destroy(ctx, priv);
626 return err;
627}
628
629static void nft_ct_get_destroy(const struct nft_ctx *ctx,
630 const struct nft_expr *expr)
631{
632 nf_ct_netns_put(ctx->net, ctx->family);
633}
634
635static void nft_ct_set_destroy(const struct nft_ctx *ctx,
636 const struct nft_expr *expr)
637{
638 struct nft_ct *priv = nft_expr_priv(expr);
639
640 __nft_ct_set_destroy(ctx, priv);
641 nf_ct_netns_put(ctx->net, ctx->family);
642}
643
644static int nft_ct_get_dump(struct sk_buff *skb,
645 const struct nft_expr *expr, bool reset)
646{
647 const struct nft_ct *priv = nft_expr_priv(expr);
648
649 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
650 goto nla_put_failure;
651 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
652 goto nla_put_failure;
653
654 switch (priv->key) {
655 case NFT_CT_SRC:
656 case NFT_CT_DST:
657 case NFT_CT_SRC_IP:
658 case NFT_CT_DST_IP:
659 case NFT_CT_SRC_IP6:
660 case NFT_CT_DST_IP6:
661 case NFT_CT_PROTO_SRC:
662 case NFT_CT_PROTO_DST:
663 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
664 goto nla_put_failure;
665 break;
666 case NFT_CT_BYTES:
667 case NFT_CT_PKTS:
668 case NFT_CT_AVGPKT:
669 case NFT_CT_ZONE:
670 if (priv->dir < IP_CT_DIR_MAX &&
671 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
672 goto nla_put_failure;
673 break;
674 default:
675 break;
676 }
677
678 return 0;
679
680nla_put_failure:
681 return -1;
682}
683
684static bool nft_ct_get_reduce(struct nft_regs_track *track,
685 const struct nft_expr *expr)
686{
687 const struct nft_ct *priv = nft_expr_priv(expr);
688 const struct nft_ct *ct;
689
690 if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
691 nft_reg_track_update(track, expr, priv->dreg, priv->len);
692 return false;
693 }
694
695 ct = nft_expr_priv(track->regs[priv->dreg].selector);
696 if (priv->key != ct->key) {
697 nft_reg_track_update(track, expr, priv->dreg, priv->len);
698 return false;
699 }
700
701 if (!track->regs[priv->dreg].bitwise)
702 return true;
703
704 return nft_expr_reduce_bitwise(track, expr);
705}
706
707static int nft_ct_set_dump(struct sk_buff *skb,
708 const struct nft_expr *expr, bool reset)
709{
710 const struct nft_ct *priv = nft_expr_priv(expr);
711
712 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
713 goto nla_put_failure;
714 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
715 goto nla_put_failure;
716
717 switch (priv->key) {
718 case NFT_CT_ZONE:
719 if (priv->dir < IP_CT_DIR_MAX &&
720 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
721 goto nla_put_failure;
722 break;
723 default:
724 break;
725 }
726
727 return 0;
728
729nla_put_failure:
730 return -1;
731}
732
733static struct nft_expr_type nft_ct_type;
734static const struct nft_expr_ops nft_ct_get_ops = {
735 .type = &nft_ct_type,
736 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
737 .eval = nft_ct_get_eval,
738 .init = nft_ct_get_init,
739 .destroy = nft_ct_get_destroy,
740 .dump = nft_ct_get_dump,
741 .reduce = nft_ct_get_reduce,
742};
743
744static bool nft_ct_set_reduce(struct nft_regs_track *track,
745 const struct nft_expr *expr)
746{
747 int i;
748
749 for (i = 0; i < NFT_REG32_NUM; i++) {
750 if (!track->regs[i].selector)
751 continue;
752
753 if (track->regs[i].selector->ops != &nft_ct_get_ops)
754 continue;
755
756 __nft_reg_track_cancel(track, i);
757 }
758
759 return false;
760}
761
762static const struct nft_expr_ops nft_ct_set_ops = {
763 .type = &nft_ct_type,
764 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
765 .eval = nft_ct_set_eval,
766 .init = nft_ct_set_init,
767 .destroy = nft_ct_set_destroy,
768 .dump = nft_ct_set_dump,
769 .reduce = nft_ct_set_reduce,
770};
771
772#ifdef CONFIG_NF_CONNTRACK_ZONES
773static const struct nft_expr_ops nft_ct_set_zone_ops = {
774 .type = &nft_ct_type,
775 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
776 .eval = nft_ct_set_zone_eval,
777 .init = nft_ct_set_init,
778 .destroy = nft_ct_set_destroy,
779 .dump = nft_ct_set_dump,
780 .reduce = nft_ct_set_reduce,
781};
782#endif
783
784static const struct nft_expr_ops *
785nft_ct_select_ops(const struct nft_ctx *ctx,
786 const struct nlattr * const tb[])
787{
788 if (tb[NFTA_CT_KEY] == NULL)
789 return ERR_PTR(-EINVAL);
790
791 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
792 return ERR_PTR(-EINVAL);
793
794 if (tb[NFTA_CT_DREG])
795 return &nft_ct_get_ops;
796
797 if (tb[NFTA_CT_SREG]) {
798#ifdef CONFIG_NF_CONNTRACK_ZONES
799 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
800 return &nft_ct_set_zone_ops;
801#endif
802 return &nft_ct_set_ops;
803 }
804
805 return ERR_PTR(-EINVAL);
806}
807
808static struct nft_expr_type nft_ct_type __read_mostly = {
809 .name = "ct",
810 .select_ops = nft_ct_select_ops,
811 .policy = nft_ct_policy,
812 .maxattr = NFTA_CT_MAX,
813 .owner = THIS_MODULE,
814};
815
816static void nft_notrack_eval(const struct nft_expr *expr,
817 struct nft_regs *regs,
818 const struct nft_pktinfo *pkt)
819{
820 struct sk_buff *skb = pkt->skb;
821 enum ip_conntrack_info ctinfo;
822 struct nf_conn *ct;
823
824 ct = nf_ct_get(pkt->skb, &ctinfo);
825 /* Previously seen (loopback or untracked)? Ignore. */
826 if (ct || ctinfo == IP_CT_UNTRACKED)
827 return;
828
829 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
830}
831
832static struct nft_expr_type nft_notrack_type;
833static const struct nft_expr_ops nft_notrack_ops = {
834 .type = &nft_notrack_type,
835 .size = NFT_EXPR_SIZE(0),
836 .eval = nft_notrack_eval,
837 .reduce = NFT_REDUCE_READONLY,
838};
839
840static struct nft_expr_type nft_notrack_type __read_mostly = {
841 .name = "notrack",
842 .ops = &nft_notrack_ops,
843 .owner = THIS_MODULE,
844};
845
846#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
847static int
848nft_ct_timeout_parse_policy(void *timeouts,
849 const struct nf_conntrack_l4proto *l4proto,
850 struct net *net, const struct nlattr *attr)
851{
852 struct nlattr **tb;
853 int ret = 0;
854
855 tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
856 GFP_KERNEL);
857
858 if (!tb)
859 return -ENOMEM;
860
861 ret = nla_parse_nested_deprecated(tb,
862 l4proto->ctnl_timeout.nlattr_max,
863 attr,
864 l4proto->ctnl_timeout.nla_policy,
865 NULL);
866 if (ret < 0)
867 goto err;
868
869 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
870
871err:
872 kfree(tb);
873 return ret;
874}
875
876struct nft_ct_timeout_obj {
877 struct nf_ct_timeout *timeout;
878 u8 l4proto;
879};
880
881static void nft_ct_timeout_obj_eval(struct nft_object *obj,
882 struct nft_regs *regs,
883 const struct nft_pktinfo *pkt)
884{
885 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
886 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
887 struct nf_conn_timeout *timeout;
888 const unsigned int *values;
889
890 if (priv->l4proto != pkt->tprot)
891 return;
892
893 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
894 return;
895
896 timeout = nf_ct_timeout_find(ct);
897 if (!timeout) {
898 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
899 if (!timeout) {
900 regs->verdict.code = NF_DROP;
901 return;
902 }
903 }
904
905 rcu_assign_pointer(timeout->timeout, priv->timeout);
906
907 /* adjust the timeout as per 'new' state. ct is unconfirmed,
908 * so the current timestamp must not be added.
909 */
910 values = nf_ct_timeout_data(timeout);
911 if (values)
912 nf_ct_refresh(ct, pkt->skb, values[0]);
913}
914
915static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
916 const struct nlattr * const tb[],
917 struct nft_object *obj)
918{
919 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
920 const struct nf_conntrack_l4proto *l4proto;
921 struct nf_ct_timeout *timeout;
922 int l3num = ctx->family;
923 __u8 l4num;
924 int ret;
925
926 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
927 !tb[NFTA_CT_TIMEOUT_DATA])
928 return -EINVAL;
929
930 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
931 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
932
933 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
934 priv->l4proto = l4num;
935
936 l4proto = nf_ct_l4proto_find(l4num);
937
938 if (l4proto->l4proto != l4num) {
939 ret = -EOPNOTSUPP;
940 goto err_proto_put;
941 }
942
943 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
944 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
945 if (timeout == NULL) {
946 ret = -ENOMEM;
947 goto err_proto_put;
948 }
949
950 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
951 tb[NFTA_CT_TIMEOUT_DATA]);
952 if (ret < 0)
953 goto err_free_timeout;
954
955 timeout->l3num = l3num;
956 timeout->l4proto = l4proto;
957
958 ret = nf_ct_netns_get(ctx->net, ctx->family);
959 if (ret < 0)
960 goto err_free_timeout;
961
962 priv->timeout = timeout;
963 return 0;
964
965err_free_timeout:
966 kfree(timeout);
967err_proto_put:
968 return ret;
969}
970
971static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
972 struct nft_object *obj)
973{
974 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
975 struct nf_ct_timeout *timeout = priv->timeout;
976
977 nf_ct_untimeout(ctx->net, timeout);
978 nf_ct_netns_put(ctx->net, ctx->family);
979 kfree(priv->timeout);
980}
981
982static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
983 struct nft_object *obj, bool reset)
984{
985 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
986 const struct nf_ct_timeout *timeout = priv->timeout;
987 struct nlattr *nest_params;
988 int ret;
989
990 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
991 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
992 return -1;
993
994 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
995 if (!nest_params)
996 return -1;
997
998 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
999 if (ret < 0)
1000 return -1;
1001 nla_nest_end(skb, nest_params);
1002 return 0;
1003}
1004
1005static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1006 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1007 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1008 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
1009};
1010
1011static struct nft_object_type nft_ct_timeout_obj_type;
1012
1013static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1014 .type = &nft_ct_timeout_obj_type,
1015 .size = sizeof(struct nft_ct_timeout_obj),
1016 .eval = nft_ct_timeout_obj_eval,
1017 .init = nft_ct_timeout_obj_init,
1018 .destroy = nft_ct_timeout_obj_destroy,
1019 .dump = nft_ct_timeout_obj_dump,
1020};
1021
1022static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1023 .type = NFT_OBJECT_CT_TIMEOUT,
1024 .ops = &nft_ct_timeout_obj_ops,
1025 .maxattr = NFTA_CT_TIMEOUT_MAX,
1026 .policy = nft_ct_timeout_policy,
1027 .owner = THIS_MODULE,
1028};
1029#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1030
1031static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1032 const struct nlattr * const tb[],
1033 struct nft_object *obj)
1034{
1035 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1036 struct nf_conntrack_helper *help4, *help6;
1037 char name[NF_CT_HELPER_NAME_LEN];
1038 int family = ctx->family;
1039 int err;
1040
1041 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1042 return -EINVAL;
1043
1044 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1045 if (!priv->l4proto)
1046 return -ENOENT;
1047
1048 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1049
1050 if (tb[NFTA_CT_HELPER_L3PROTO])
1051 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1052
1053 help4 = NULL;
1054 help6 = NULL;
1055
1056 switch (family) {
1057 case NFPROTO_IPV4:
1058 if (ctx->family == NFPROTO_IPV6)
1059 return -EINVAL;
1060
1061 help4 = nf_conntrack_helper_try_module_get(name, family,
1062 priv->l4proto);
1063 break;
1064 case NFPROTO_IPV6:
1065 if (ctx->family == NFPROTO_IPV4)
1066 return -EINVAL;
1067
1068 help6 = nf_conntrack_helper_try_module_get(name, family,
1069 priv->l4proto);
1070 break;
1071 case NFPROTO_NETDEV:
1072 case NFPROTO_BRIDGE:
1073 case NFPROTO_INET:
1074 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1075 priv->l4proto);
1076 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1077 priv->l4proto);
1078 break;
1079 default:
1080 return -EAFNOSUPPORT;
1081 }
1082
1083 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1084 if (!help4 && !help6)
1085 return -ENOENT;
1086
1087 priv->helper4 = help4;
1088 priv->helper6 = help6;
1089
1090 err = nf_ct_netns_get(ctx->net, ctx->family);
1091 if (err < 0)
1092 goto err_put_helper;
1093
1094 return 0;
1095
1096err_put_helper:
1097 if (priv->helper4)
1098 nf_conntrack_helper_put(priv->helper4);
1099 if (priv->helper6)
1100 nf_conntrack_helper_put(priv->helper6);
1101 return err;
1102}
1103
1104static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1105 struct nft_object *obj)
1106{
1107 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1108
1109 if (priv->helper4)
1110 nf_conntrack_helper_put(priv->helper4);
1111 if (priv->helper6)
1112 nf_conntrack_helper_put(priv->helper6);
1113
1114 nf_ct_netns_put(ctx->net, ctx->family);
1115}
1116
1117static void nft_ct_helper_obj_eval(struct nft_object *obj,
1118 struct nft_regs *regs,
1119 const struct nft_pktinfo *pkt)
1120{
1121 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1122 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1123 struct nf_conntrack_helper *to_assign = NULL;
1124 struct nf_conn_help *help;
1125
1126 if (!ct ||
1127 nf_ct_is_confirmed(ct) ||
1128 nf_ct_is_template(ct) ||
1129 priv->l4proto != nf_ct_protonum(ct))
1130 return;
1131
1132 switch (nf_ct_l3num(ct)) {
1133 case NFPROTO_IPV4:
1134 to_assign = priv->helper4;
1135 break;
1136 case NFPROTO_IPV6:
1137 to_assign = priv->helper6;
1138 break;
1139 default:
1140 WARN_ON_ONCE(1);
1141 return;
1142 }
1143
1144 if (!to_assign)
1145 return;
1146
1147 if (test_bit(IPS_HELPER_BIT, &ct->status))
1148 return;
1149
1150 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1151 if (help) {
1152 rcu_assign_pointer(help->helper, to_assign);
1153 set_bit(IPS_HELPER_BIT, &ct->status);
1154 }
1155}
1156
1157static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1158 struct nft_object *obj, bool reset)
1159{
1160 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1161 const struct nf_conntrack_helper *helper;
1162 u16 family;
1163
1164 if (priv->helper4 && priv->helper6) {
1165 family = NFPROTO_INET;
1166 helper = priv->helper4;
1167 } else if (priv->helper6) {
1168 family = NFPROTO_IPV6;
1169 helper = priv->helper6;
1170 } else {
1171 family = NFPROTO_IPV4;
1172 helper = priv->helper4;
1173 }
1174
1175 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1176 return -1;
1177
1178 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1179 return -1;
1180
1181 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1182 return -1;
1183
1184 return 0;
1185}
1186
1187static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1188 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1189 .len = NF_CT_HELPER_NAME_LEN - 1 },
1190 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1191 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1192};
1193
1194static struct nft_object_type nft_ct_helper_obj_type;
1195static const struct nft_object_ops nft_ct_helper_obj_ops = {
1196 .type = &nft_ct_helper_obj_type,
1197 .size = sizeof(struct nft_ct_helper_obj),
1198 .eval = nft_ct_helper_obj_eval,
1199 .init = nft_ct_helper_obj_init,
1200 .destroy = nft_ct_helper_obj_destroy,
1201 .dump = nft_ct_helper_obj_dump,
1202};
1203
1204static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1205 .type = NFT_OBJECT_CT_HELPER,
1206 .ops = &nft_ct_helper_obj_ops,
1207 .maxattr = NFTA_CT_HELPER_MAX,
1208 .policy = nft_ct_helper_policy,
1209 .owner = THIS_MODULE,
1210};
1211
1212struct nft_ct_expect_obj {
1213 u16 l3num;
1214 __be16 dport;
1215 u8 l4proto;
1216 u8 size;
1217 u32 timeout;
1218};
1219
1220static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1221 const struct nlattr * const tb[],
1222 struct nft_object *obj)
1223{
1224 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1225
1226 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1227 !tb[NFTA_CT_EXPECT_DPORT] ||
1228 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1229 !tb[NFTA_CT_EXPECT_SIZE])
1230 return -EINVAL;
1231
1232 priv->l3num = ctx->family;
1233 if (tb[NFTA_CT_EXPECT_L3PROTO])
1234 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1235
1236 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1237 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1238 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1239 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1240
1241 return nf_ct_netns_get(ctx->net, ctx->family);
1242}
1243
1244static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1245 struct nft_object *obj)
1246{
1247 nf_ct_netns_put(ctx->net, ctx->family);
1248}
1249
1250static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1251 struct nft_object *obj, bool reset)
1252{
1253 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1254
1255 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1256 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1257 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1258 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1259 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1260 return -1;
1261
1262 return 0;
1263}
1264
1265static void nft_ct_expect_obj_eval(struct nft_object *obj,
1266 struct nft_regs *regs,
1267 const struct nft_pktinfo *pkt)
1268{
1269 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1270 struct nf_conntrack_expect *exp;
1271 enum ip_conntrack_info ctinfo;
1272 struct nf_conn_help *help;
1273 enum ip_conntrack_dir dir;
1274 u16 l3num = priv->l3num;
1275 struct nf_conn *ct;
1276
1277 ct = nf_ct_get(pkt->skb, &ctinfo);
1278 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1279 regs->verdict.code = NFT_BREAK;
1280 return;
1281 }
1282 dir = CTINFO2DIR(ctinfo);
1283
1284 help = nfct_help(ct);
1285 if (!help)
1286 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1287 if (!help) {
1288 regs->verdict.code = NF_DROP;
1289 return;
1290 }
1291
1292 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1293 regs->verdict.code = NFT_BREAK;
1294 return;
1295 }
1296 if (l3num == NFPROTO_INET)
1297 l3num = nf_ct_l3num(ct);
1298
1299 exp = nf_ct_expect_alloc(ct);
1300 if (exp == NULL) {
1301 regs->verdict.code = NF_DROP;
1302 return;
1303 }
1304 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1305 &ct->tuplehash[!dir].tuple.src.u3,
1306 &ct->tuplehash[!dir].tuple.dst.u3,
1307 priv->l4proto, NULL, &priv->dport);
1308 exp->timeout.expires = jiffies + priv->timeout * HZ;
1309
1310 if (nf_ct_expect_related(exp, 0) != 0)
1311 regs->verdict.code = NF_DROP;
1312}
1313
1314static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1315 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1316 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1317 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1318 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1319 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1320};
1321
1322static struct nft_object_type nft_ct_expect_obj_type;
1323
1324static const struct nft_object_ops nft_ct_expect_obj_ops = {
1325 .type = &nft_ct_expect_obj_type,
1326 .size = sizeof(struct nft_ct_expect_obj),
1327 .eval = nft_ct_expect_obj_eval,
1328 .init = nft_ct_expect_obj_init,
1329 .destroy = nft_ct_expect_obj_destroy,
1330 .dump = nft_ct_expect_obj_dump,
1331};
1332
1333static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1334 .type = NFT_OBJECT_CT_EXPECT,
1335 .ops = &nft_ct_expect_obj_ops,
1336 .maxattr = NFTA_CT_EXPECT_MAX,
1337 .policy = nft_ct_expect_policy,
1338 .owner = THIS_MODULE,
1339};
1340
1341static int __init nft_ct_module_init(void)
1342{
1343 int err;
1344
1345 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1346
1347 err = nft_register_expr(&nft_ct_type);
1348 if (err < 0)
1349 return err;
1350
1351 err = nft_register_expr(&nft_notrack_type);
1352 if (err < 0)
1353 goto err1;
1354
1355 err = nft_register_obj(&nft_ct_helper_obj_type);
1356 if (err < 0)
1357 goto err2;
1358
1359 err = nft_register_obj(&nft_ct_expect_obj_type);
1360 if (err < 0)
1361 goto err3;
1362#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1363 err = nft_register_obj(&nft_ct_timeout_obj_type);
1364 if (err < 0)
1365 goto err4;
1366#endif
1367 return 0;
1368
1369#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1370err4:
1371 nft_unregister_obj(&nft_ct_expect_obj_type);
1372#endif
1373err3:
1374 nft_unregister_obj(&nft_ct_helper_obj_type);
1375err2:
1376 nft_unregister_expr(&nft_notrack_type);
1377err1:
1378 nft_unregister_expr(&nft_ct_type);
1379 return err;
1380}
1381
1382static void __exit nft_ct_module_exit(void)
1383{
1384#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1385 nft_unregister_obj(&nft_ct_timeout_obj_type);
1386#endif
1387 nft_unregister_obj(&nft_ct_expect_obj_type);
1388 nft_unregister_obj(&nft_ct_helper_obj_type);
1389 nft_unregister_expr(&nft_notrack_type);
1390 nft_unregister_expr(&nft_ct_type);
1391}
1392
1393module_init(nft_ct_module_init);
1394module_exit(nft_ct_module_exit);
1395
1396MODULE_LICENSE("GPL");
1397MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1398MODULE_ALIAS_NFT_EXPR("ct");
1399MODULE_ALIAS_NFT_EXPR("notrack");
1400MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1401MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1402MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1403MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");