Linux Audio

Check our new training course

Loading...
v5.14.15
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   5 *
   6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
   7 */
   8
   9#include <linux/kernel.h>
  10#include <linux/init.h>
  11#include <linux/module.h>
  12#include <linux/netlink.h>
  13#include <linux/netfilter.h>
  14#include <linux/netfilter/nf_tables.h>
  15#include <net/netfilter/nf_tables.h>
  16#include <net/netfilter/nf_conntrack.h>
  17#include <net/netfilter/nf_conntrack_acct.h>
  18#include <net/netfilter/nf_conntrack_tuple.h>
  19#include <net/netfilter/nf_conntrack_helper.h>
  20#include <net/netfilter/nf_conntrack_ecache.h>
  21#include <net/netfilter/nf_conntrack_labels.h>
  22#include <net/netfilter/nf_conntrack_timeout.h>
  23#include <net/netfilter/nf_conntrack_l4proto.h>
  24#include <net/netfilter/nf_conntrack_expect.h>
  25
  26struct nft_ct {
  27	enum nft_ct_keys	key:8;
  28	enum ip_conntrack_dir	dir:8;
  29	union {
  30		u8		dreg;
  31		u8		sreg;
  32	};
  33};
  34
  35struct nft_ct_helper_obj  {
  36	struct nf_conntrack_helper *helper4;
  37	struct nf_conntrack_helper *helper6;
  38	u8 l4proto;
  39};
  40
  41#ifdef CONFIG_NF_CONNTRACK_ZONES
  42static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  43static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  44static DEFINE_MUTEX(nft_ct_pcpu_mutex);
  45#endif
  46
  47static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  48				   enum nft_ct_keys k,
  49				   enum ip_conntrack_dir d)
  50{
  51	if (d < IP_CT_DIR_MAX)
  52		return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  53					   atomic64_read(&c[d].packets);
  54
  55	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  56	       nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  57}
  58
  59static void nft_ct_get_eval(const struct nft_expr *expr,
  60			    struct nft_regs *regs,
  61			    const struct nft_pktinfo *pkt)
  62{
  63	const struct nft_ct *priv = nft_expr_priv(expr);
  64	u32 *dest = &regs->data[priv->dreg];
  65	enum ip_conntrack_info ctinfo;
  66	const struct nf_conn *ct;
  67	const struct nf_conn_help *help;
  68	const struct nf_conntrack_tuple *tuple;
  69	const struct nf_conntrack_helper *helper;
  70	unsigned int state;
  71
  72	ct = nf_ct_get(pkt->skb, &ctinfo);
  73
  74	switch (priv->key) {
  75	case NFT_CT_STATE:
  76		if (ct)
  77			state = NF_CT_STATE_BIT(ctinfo);
  78		else if (ctinfo == IP_CT_UNTRACKED)
  79			state = NF_CT_STATE_UNTRACKED_BIT;
  80		else
  81			state = NF_CT_STATE_INVALID_BIT;
  82		*dest = state;
  83		return;
  84	default:
  85		break;
  86	}
  87
  88	if (ct == NULL)
  89		goto err;
  90
  91	switch (priv->key) {
  92	case NFT_CT_DIRECTION:
  93		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
  94		return;
  95	case NFT_CT_STATUS:
  96		*dest = ct->status;
  97		return;
  98#ifdef CONFIG_NF_CONNTRACK_MARK
  99	case NFT_CT_MARK:
 100		*dest = ct->mark;
 101		return;
 102#endif
 103#ifdef CONFIG_NF_CONNTRACK_SECMARK
 104	case NFT_CT_SECMARK:
 105		*dest = ct->secmark;
 106		return;
 107#endif
 108	case NFT_CT_EXPIRATION:
 109		*dest = jiffies_to_msecs(nf_ct_expires(ct));
 110		return;
 111	case NFT_CT_HELPER:
 112		if (ct->master == NULL)
 113			goto err;
 114		help = nfct_help(ct->master);
 115		if (help == NULL)
 116			goto err;
 117		helper = rcu_dereference(help->helper);
 118		if (helper == NULL)
 119			goto err;
 120		strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 121		return;
 122#ifdef CONFIG_NF_CONNTRACK_LABELS
 123	case NFT_CT_LABELS: {
 124		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 125
 126		if (labels)
 127			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 128		else
 129			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 130		return;
 131	}
 132#endif
 133	case NFT_CT_BYTES:
 134	case NFT_CT_PKTS: {
 135		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 136		u64 count = 0;
 137
 138		if (acct)
 139			count = nft_ct_get_eval_counter(acct->counter,
 140							priv->key, priv->dir);
 141		memcpy(dest, &count, sizeof(count));
 142		return;
 143	}
 144	case NFT_CT_AVGPKT: {
 145		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 146		u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 147
 148		if (acct) {
 149			pcnt = nft_ct_get_eval_counter(acct->counter,
 150						       NFT_CT_PKTS, priv->dir);
 151			bcnt = nft_ct_get_eval_counter(acct->counter,
 152						       NFT_CT_BYTES, priv->dir);
 153			if (pcnt != 0)
 154				avgcnt = div64_u64(bcnt, pcnt);
 155		}
 156
 157		memcpy(dest, &avgcnt, sizeof(avgcnt));
 158		return;
 159	}
 160	case NFT_CT_L3PROTOCOL:
 161		nft_reg_store8(dest, nf_ct_l3num(ct));
 162		return;
 163	case NFT_CT_PROTOCOL:
 164		nft_reg_store8(dest, nf_ct_protonum(ct));
 165		return;
 166#ifdef CONFIG_NF_CONNTRACK_ZONES
 167	case NFT_CT_ZONE: {
 168		const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 169		u16 zoneid;
 170
 171		if (priv->dir < IP_CT_DIR_MAX)
 172			zoneid = nf_ct_zone_id(zone, priv->dir);
 173		else
 174			zoneid = zone->id;
 175
 176		nft_reg_store16(dest, zoneid);
 177		return;
 178	}
 179#endif
 180	case NFT_CT_ID:
 181		*dest = nf_ct_get_id(ct);
 182		return;
 183	default:
 184		break;
 185	}
 186
 187	tuple = &ct->tuplehash[priv->dir].tuple;
 188	switch (priv->key) {
 189	case NFT_CT_SRC:
 190		memcpy(dest, tuple->src.u3.all,
 191		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 192		return;
 193	case NFT_CT_DST:
 194		memcpy(dest, tuple->dst.u3.all,
 195		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 196		return;
 197	case NFT_CT_PROTO_SRC:
 198		nft_reg_store16(dest, (__force u16)tuple->src.u.all);
 199		return;
 200	case NFT_CT_PROTO_DST:
 201		nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
 202		return;
 203	case NFT_CT_SRC_IP:
 204		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 205			goto err;
 206		*dest = tuple->src.u3.ip;
 207		return;
 208	case NFT_CT_DST_IP:
 209		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 210			goto err;
 211		*dest = tuple->dst.u3.ip;
 212		return;
 213	case NFT_CT_SRC_IP6:
 214		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 215			goto err;
 216		memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
 217		return;
 218	case NFT_CT_DST_IP6:
 219		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 220			goto err;
 221		memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
 222		return;
 223	default:
 224		break;
 225	}
 226	return;
 227err:
 228	regs->verdict.code = NFT_BREAK;
 229}
 230
 231#ifdef CONFIG_NF_CONNTRACK_ZONES
 232static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 233				 struct nft_regs *regs,
 234				 const struct nft_pktinfo *pkt)
 235{
 236	struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 237	const struct nft_ct *priv = nft_expr_priv(expr);
 238	struct sk_buff *skb = pkt->skb;
 239	enum ip_conntrack_info ctinfo;
 240	u16 value = nft_reg_load16(&regs->data[priv->sreg]);
 241	struct nf_conn *ct;
 242
 243	ct = nf_ct_get(skb, &ctinfo);
 244	if (ct) /* already tracked */
 245		return;
 246
 247	zone.id = value;
 248
 249	switch (priv->dir) {
 250	case IP_CT_DIR_ORIGINAL:
 251		zone.dir = NF_CT_ZONE_DIR_ORIG;
 252		break;
 253	case IP_CT_DIR_REPLY:
 254		zone.dir = NF_CT_ZONE_DIR_REPL;
 255		break;
 256	default:
 257		break;
 258	}
 259
 260	ct = this_cpu_read(nft_ct_pcpu_template);
 261
 262	if (likely(atomic_read(&ct->ct_general.use) == 1)) {
 
 263		nf_ct_zone_add(ct, &zone);
 264	} else {
 265		/* previous skb got queued to userspace */
 
 
 266		ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 267		if (!ct) {
 268			regs->verdict.code = NF_DROP;
 269			return;
 270		}
 
 271	}
 272
 273	atomic_inc(&ct->ct_general.use);
 274	nf_ct_set(skb, ct, IP_CT_NEW);
 275}
 276#endif
 277
 278static void nft_ct_set_eval(const struct nft_expr *expr,
 279			    struct nft_regs *regs,
 280			    const struct nft_pktinfo *pkt)
 281{
 282	const struct nft_ct *priv = nft_expr_priv(expr);
 283	struct sk_buff *skb = pkt->skb;
 284#if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
 285	u32 value = regs->data[priv->sreg];
 286#endif
 287	enum ip_conntrack_info ctinfo;
 288	struct nf_conn *ct;
 289
 290	ct = nf_ct_get(skb, &ctinfo);
 291	if (ct == NULL || nf_ct_is_template(ct))
 292		return;
 293
 294	switch (priv->key) {
 295#ifdef CONFIG_NF_CONNTRACK_MARK
 296	case NFT_CT_MARK:
 297		if (ct->mark != value) {
 298			ct->mark = value;
 299			nf_conntrack_event_cache(IPCT_MARK, ct);
 300		}
 301		break;
 302#endif
 303#ifdef CONFIG_NF_CONNTRACK_SECMARK
 304	case NFT_CT_SECMARK:
 305		if (ct->secmark != value) {
 306			ct->secmark = value;
 307			nf_conntrack_event_cache(IPCT_SECMARK, ct);
 308		}
 309		break;
 310#endif
 311#ifdef CONFIG_NF_CONNTRACK_LABELS
 312	case NFT_CT_LABELS:
 313		nf_connlabels_replace(ct,
 314				      &regs->data[priv->sreg],
 315				      &regs->data[priv->sreg],
 316				      NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 317		break;
 318#endif
 319#ifdef CONFIG_NF_CONNTRACK_EVENTS
 320	case NFT_CT_EVENTMASK: {
 321		struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
 322		u32 ctmask = regs->data[priv->sreg];
 323
 324		if (e) {
 325			if (e->ctmask != ctmask)
 326				e->ctmask = ctmask;
 327			break;
 328		}
 329
 330		if (ctmask && !nf_ct_is_confirmed(ct))
 331			nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
 332		break;
 333	}
 334#endif
 335	default:
 336		break;
 337	}
 338}
 339
 340static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 341	[NFTA_CT_DREG]		= { .type = NLA_U32 },
 342	[NFTA_CT_KEY]		= { .type = NLA_U32 },
 343	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
 344	[NFTA_CT_SREG]		= { .type = NLA_U32 },
 345};
 346
 347#ifdef CONFIG_NF_CONNTRACK_ZONES
 348static void nft_ct_tmpl_put_pcpu(void)
 349{
 350	struct nf_conn *ct;
 351	int cpu;
 352
 353	for_each_possible_cpu(cpu) {
 354		ct = per_cpu(nft_ct_pcpu_template, cpu);
 355		if (!ct)
 356			break;
 357		nf_ct_put(ct);
 358		per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 359	}
 360}
 361
 362static bool nft_ct_tmpl_alloc_pcpu(void)
 363{
 364	struct nf_conntrack_zone zone = { .id = 0 };
 365	struct nf_conn *tmp;
 366	int cpu;
 367
 368	if (nft_ct_pcpu_template_refcnt)
 369		return true;
 370
 371	for_each_possible_cpu(cpu) {
 372		tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 373		if (!tmp) {
 374			nft_ct_tmpl_put_pcpu();
 375			return false;
 376		}
 377
 378		atomic_set(&tmp->ct_general.use, 1);
 379		per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 380	}
 381
 382	return true;
 383}
 384#endif
 385
 386static int nft_ct_get_init(const struct nft_ctx *ctx,
 387			   const struct nft_expr *expr,
 388			   const struct nlattr * const tb[])
 389{
 390	struct nft_ct *priv = nft_expr_priv(expr);
 391	unsigned int len;
 392	int err;
 393
 394	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 395	priv->dir = IP_CT_DIR_MAX;
 396	switch (priv->key) {
 397	case NFT_CT_DIRECTION:
 398		if (tb[NFTA_CT_DIRECTION] != NULL)
 399			return -EINVAL;
 400		len = sizeof(u8);
 401		break;
 402	case NFT_CT_STATE:
 403	case NFT_CT_STATUS:
 404#ifdef CONFIG_NF_CONNTRACK_MARK
 405	case NFT_CT_MARK:
 406#endif
 407#ifdef CONFIG_NF_CONNTRACK_SECMARK
 408	case NFT_CT_SECMARK:
 409#endif
 410	case NFT_CT_EXPIRATION:
 411		if (tb[NFTA_CT_DIRECTION] != NULL)
 412			return -EINVAL;
 413		len = sizeof(u32);
 414		break;
 415#ifdef CONFIG_NF_CONNTRACK_LABELS
 416	case NFT_CT_LABELS:
 417		if (tb[NFTA_CT_DIRECTION] != NULL)
 418			return -EINVAL;
 419		len = NF_CT_LABELS_MAX_SIZE;
 420		break;
 421#endif
 422	case NFT_CT_HELPER:
 423		if (tb[NFTA_CT_DIRECTION] != NULL)
 424			return -EINVAL;
 425		len = NF_CT_HELPER_NAME_LEN;
 426		break;
 427
 428	case NFT_CT_L3PROTOCOL:
 429	case NFT_CT_PROTOCOL:
 430		/* For compatibility, do not report error if NFTA_CT_DIRECTION
 431		 * attribute is specified.
 432		 */
 433		len = sizeof(u8);
 434		break;
 435	case NFT_CT_SRC:
 436	case NFT_CT_DST:
 437		if (tb[NFTA_CT_DIRECTION] == NULL)
 438			return -EINVAL;
 439
 440		switch (ctx->family) {
 441		case NFPROTO_IPV4:
 442			len = sizeof_field(struct nf_conntrack_tuple,
 443					   src.u3.ip);
 444			break;
 445		case NFPROTO_IPV6:
 446		case NFPROTO_INET:
 447			len = sizeof_field(struct nf_conntrack_tuple,
 448					   src.u3.ip6);
 449			break;
 450		default:
 451			return -EAFNOSUPPORT;
 452		}
 453		break;
 454	case NFT_CT_SRC_IP:
 455	case NFT_CT_DST_IP:
 456		if (tb[NFTA_CT_DIRECTION] == NULL)
 457			return -EINVAL;
 458
 459		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
 460		break;
 461	case NFT_CT_SRC_IP6:
 462	case NFT_CT_DST_IP6:
 463		if (tb[NFTA_CT_DIRECTION] == NULL)
 464			return -EINVAL;
 465
 466		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
 467		break;
 468	case NFT_CT_PROTO_SRC:
 469	case NFT_CT_PROTO_DST:
 470		if (tb[NFTA_CT_DIRECTION] == NULL)
 471			return -EINVAL;
 472		len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
 473		break;
 474	case NFT_CT_BYTES:
 475	case NFT_CT_PKTS:
 476	case NFT_CT_AVGPKT:
 477		len = sizeof(u64);
 478		break;
 479#ifdef CONFIG_NF_CONNTRACK_ZONES
 480	case NFT_CT_ZONE:
 481		len = sizeof(u16);
 482		break;
 483#endif
 484	case NFT_CT_ID:
 
 
 
 485		len = sizeof(u32);
 486		break;
 487	default:
 488		return -EOPNOTSUPP;
 489	}
 490
 491	if (tb[NFTA_CT_DIRECTION] != NULL) {
 492		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 493		switch (priv->dir) {
 494		case IP_CT_DIR_ORIGINAL:
 495		case IP_CT_DIR_REPLY:
 496			break;
 497		default:
 498			return -EINVAL;
 499		}
 500	}
 501
 
 502	err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
 503				       NFT_DATA_VALUE, len);
 504	if (err < 0)
 505		return err;
 506
 507	err = nf_ct_netns_get(ctx->net, ctx->family);
 508	if (err < 0)
 509		return err;
 510
 511	if (priv->key == NFT_CT_BYTES ||
 512	    priv->key == NFT_CT_PKTS  ||
 513	    priv->key == NFT_CT_AVGPKT)
 514		nf_ct_set_acct(ctx->net, true);
 515
 516	return 0;
 517}
 518
 519static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 520{
 521	switch (priv->key) {
 522#ifdef CONFIG_NF_CONNTRACK_LABELS
 523	case NFT_CT_LABELS:
 524		nf_connlabels_put(ctx->net);
 525		break;
 526#endif
 527#ifdef CONFIG_NF_CONNTRACK_ZONES
 528	case NFT_CT_ZONE:
 529		mutex_lock(&nft_ct_pcpu_mutex);
 530		if (--nft_ct_pcpu_template_refcnt == 0)
 531			nft_ct_tmpl_put_pcpu();
 532		mutex_unlock(&nft_ct_pcpu_mutex);
 533		break;
 534#endif
 535	default:
 536		break;
 537	}
 538}
 539
 540static int nft_ct_set_init(const struct nft_ctx *ctx,
 541			   const struct nft_expr *expr,
 542			   const struct nlattr * const tb[])
 543{
 544	struct nft_ct *priv = nft_expr_priv(expr);
 545	unsigned int len;
 546	int err;
 547
 548	priv->dir = IP_CT_DIR_MAX;
 549	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 550	switch (priv->key) {
 551#ifdef CONFIG_NF_CONNTRACK_MARK
 552	case NFT_CT_MARK:
 553		if (tb[NFTA_CT_DIRECTION])
 554			return -EINVAL;
 555		len = sizeof_field(struct nf_conn, mark);
 556		break;
 557#endif
 558#ifdef CONFIG_NF_CONNTRACK_LABELS
 559	case NFT_CT_LABELS:
 560		if (tb[NFTA_CT_DIRECTION])
 561			return -EINVAL;
 562		len = NF_CT_LABELS_MAX_SIZE;
 563		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 564		if (err)
 565			return err;
 566		break;
 567#endif
 568#ifdef CONFIG_NF_CONNTRACK_ZONES
 569	case NFT_CT_ZONE:
 570		mutex_lock(&nft_ct_pcpu_mutex);
 571		if (!nft_ct_tmpl_alloc_pcpu()) {
 572			mutex_unlock(&nft_ct_pcpu_mutex);
 573			return -ENOMEM;
 574		}
 575		nft_ct_pcpu_template_refcnt++;
 576		mutex_unlock(&nft_ct_pcpu_mutex);
 577		len = sizeof(u16);
 578		break;
 579#endif
 580#ifdef CONFIG_NF_CONNTRACK_EVENTS
 581	case NFT_CT_EVENTMASK:
 582		if (tb[NFTA_CT_DIRECTION])
 583			return -EINVAL;
 584		len = sizeof(u32);
 585		break;
 586#endif
 587#ifdef CONFIG_NF_CONNTRACK_SECMARK
 588	case NFT_CT_SECMARK:
 589		if (tb[NFTA_CT_DIRECTION])
 590			return -EINVAL;
 591		len = sizeof(u32);
 592		break;
 593#endif
 594	default:
 595		return -EOPNOTSUPP;
 596	}
 597
 598	if (tb[NFTA_CT_DIRECTION]) {
 599		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 600		switch (priv->dir) {
 601		case IP_CT_DIR_ORIGINAL:
 602		case IP_CT_DIR_REPLY:
 603			break;
 604		default:
 605			err = -EINVAL;
 606			goto err1;
 607		}
 608	}
 609
 
 610	err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
 611	if (err < 0)
 612		goto err1;
 613
 614	err = nf_ct_netns_get(ctx->net, ctx->family);
 615	if (err < 0)
 616		goto err1;
 617
 618	return 0;
 619
 620err1:
 621	__nft_ct_set_destroy(ctx, priv);
 622	return err;
 623}
 624
 625static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 626			       const struct nft_expr *expr)
 627{
 628	nf_ct_netns_put(ctx->net, ctx->family);
 629}
 630
 631static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 632			       const struct nft_expr *expr)
 633{
 634	struct nft_ct *priv = nft_expr_priv(expr);
 635
 636	__nft_ct_set_destroy(ctx, priv);
 637	nf_ct_netns_put(ctx->net, ctx->family);
 638}
 639
 640static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 
 641{
 642	const struct nft_ct *priv = nft_expr_priv(expr);
 643
 644	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 645		goto nla_put_failure;
 646	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 647		goto nla_put_failure;
 648
 649	switch (priv->key) {
 650	case NFT_CT_SRC:
 651	case NFT_CT_DST:
 652	case NFT_CT_SRC_IP:
 653	case NFT_CT_DST_IP:
 654	case NFT_CT_SRC_IP6:
 655	case NFT_CT_DST_IP6:
 656	case NFT_CT_PROTO_SRC:
 657	case NFT_CT_PROTO_DST:
 658		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 659			goto nla_put_failure;
 660		break;
 661	case NFT_CT_BYTES:
 662	case NFT_CT_PKTS:
 663	case NFT_CT_AVGPKT:
 664	case NFT_CT_ZONE:
 665		if (priv->dir < IP_CT_DIR_MAX &&
 666		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 667			goto nla_put_failure;
 668		break;
 669	default:
 670		break;
 671	}
 672
 673	return 0;
 674
 675nla_put_failure:
 676	return -1;
 677}
 678
 679static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 680{
 681	const struct nft_ct *priv = nft_expr_priv(expr);
 682
 683	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 684		goto nla_put_failure;
 685	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 686		goto nla_put_failure;
 687
 688	switch (priv->key) {
 689	case NFT_CT_ZONE:
 690		if (priv->dir < IP_CT_DIR_MAX &&
 691		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 692			goto nla_put_failure;
 693		break;
 694	default:
 695		break;
 696	}
 697
 698	return 0;
 699
 700nla_put_failure:
 701	return -1;
 702}
 703
 704static struct nft_expr_type nft_ct_type;
 705static const struct nft_expr_ops nft_ct_get_ops = {
 706	.type		= &nft_ct_type,
 707	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 708	.eval		= nft_ct_get_eval,
 709	.init		= nft_ct_get_init,
 710	.destroy	= nft_ct_get_destroy,
 711	.dump		= nft_ct_get_dump,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 712};
 
 713
 714static const struct nft_expr_ops nft_ct_set_ops = {
 715	.type		= &nft_ct_type,
 716	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 717	.eval		= nft_ct_set_eval,
 718	.init		= nft_ct_set_init,
 719	.destroy	= nft_ct_set_destroy,
 720	.dump		= nft_ct_set_dump,
 
 721};
 722
 723#ifdef CONFIG_NF_CONNTRACK_ZONES
 724static const struct nft_expr_ops nft_ct_set_zone_ops = {
 725	.type		= &nft_ct_type,
 726	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 727	.eval		= nft_ct_set_zone_eval,
 728	.init		= nft_ct_set_init,
 729	.destroy	= nft_ct_set_destroy,
 730	.dump		= nft_ct_set_dump,
 
 731};
 732#endif
 733
 734static const struct nft_expr_ops *
 735nft_ct_select_ops(const struct nft_ctx *ctx,
 736		    const struct nlattr * const tb[])
 737{
 738	if (tb[NFTA_CT_KEY] == NULL)
 739		return ERR_PTR(-EINVAL);
 740
 741	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 742		return ERR_PTR(-EINVAL);
 743
 744	if (tb[NFTA_CT_DREG])
 
 
 
 
 
 
 
 
 
 
 
 
 745		return &nft_ct_get_ops;
 
 746
 747	if (tb[NFTA_CT_SREG]) {
 748#ifdef CONFIG_NF_CONNTRACK_ZONES
 749		if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 750			return &nft_ct_set_zone_ops;
 751#endif
 752		return &nft_ct_set_ops;
 753	}
 754
 755	return ERR_PTR(-EINVAL);
 756}
 757
 758static struct nft_expr_type nft_ct_type __read_mostly = {
 759	.name		= "ct",
 760	.select_ops	= nft_ct_select_ops,
 761	.policy		= nft_ct_policy,
 762	.maxattr	= NFTA_CT_MAX,
 763	.owner		= THIS_MODULE,
 764};
 765
 766static void nft_notrack_eval(const struct nft_expr *expr,
 767			     struct nft_regs *regs,
 768			     const struct nft_pktinfo *pkt)
 769{
 770	struct sk_buff *skb = pkt->skb;
 771	enum ip_conntrack_info ctinfo;
 772	struct nf_conn *ct;
 773
 774	ct = nf_ct_get(pkt->skb, &ctinfo);
 775	/* Previously seen (loopback or untracked)?  Ignore. */
 776	if (ct || ctinfo == IP_CT_UNTRACKED)
 777		return;
 778
 779	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 780}
 781
 782static struct nft_expr_type nft_notrack_type;
 783static const struct nft_expr_ops nft_notrack_ops = {
 784	.type		= &nft_notrack_type,
 785	.size		= NFT_EXPR_SIZE(0),
 786	.eval		= nft_notrack_eval,
 
 787};
 788
 789static struct nft_expr_type nft_notrack_type __read_mostly = {
 790	.name		= "notrack",
 791	.ops		= &nft_notrack_ops,
 792	.owner		= THIS_MODULE,
 793};
 794
 795#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 796static int
 797nft_ct_timeout_parse_policy(void *timeouts,
 798			    const struct nf_conntrack_l4proto *l4proto,
 799			    struct net *net, const struct nlattr *attr)
 800{
 801	struct nlattr **tb;
 802	int ret = 0;
 803
 804	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
 805		     GFP_KERNEL);
 806
 807	if (!tb)
 808		return -ENOMEM;
 809
 810	ret = nla_parse_nested_deprecated(tb,
 811					  l4proto->ctnl_timeout.nlattr_max,
 812					  attr,
 813					  l4proto->ctnl_timeout.nla_policy,
 814					  NULL);
 815	if (ret < 0)
 816		goto err;
 817
 818	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 819
 820err:
 821	kfree(tb);
 822	return ret;
 823}
 824
 825struct nft_ct_timeout_obj {
 826	struct nf_ct_timeout    *timeout;
 827	u8			l4proto;
 828};
 829
 830static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 831				    struct nft_regs *regs,
 832				    const struct nft_pktinfo *pkt)
 833{
 834	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 835	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
 836	struct nf_conn_timeout *timeout;
 837	const unsigned int *values;
 838
 839	if (priv->l4proto != pkt->tprot)
 840		return;
 841
 842	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
 843		return;
 844
 845	timeout = nf_ct_timeout_find(ct);
 846	if (!timeout) {
 847		timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
 848		if (!timeout) {
 849			regs->verdict.code = NF_DROP;
 850			return;
 851		}
 852	}
 853
 854	rcu_assign_pointer(timeout->timeout, priv->timeout);
 855
 856	/* adjust the timeout as per 'new' state. ct is unconfirmed,
 857	 * so the current timestamp must not be added.
 858	 */
 859	values = nf_ct_timeout_data(timeout);
 860	if (values)
 861		nf_ct_refresh(ct, pkt->skb, values[0]);
 862}
 863
 864static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 865				   const struct nlattr * const tb[],
 866				   struct nft_object *obj)
 867{
 868	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 869	const struct nf_conntrack_l4proto *l4proto;
 870	struct nf_ct_timeout *timeout;
 871	int l3num = ctx->family;
 872	__u8 l4num;
 873	int ret;
 874
 875	if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
 876	    !tb[NFTA_CT_TIMEOUT_DATA])
 877		return -EINVAL;
 878
 879	if (tb[NFTA_CT_TIMEOUT_L3PROTO])
 880		l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
 881
 882	l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
 883	priv->l4proto = l4num;
 884
 885	l4proto = nf_ct_l4proto_find(l4num);
 886
 887	if (l4proto->l4proto != l4num) {
 888		ret = -EOPNOTSUPP;
 889		goto err_proto_put;
 890	}
 891
 892	timeout = kzalloc(sizeof(struct nf_ct_timeout) +
 893			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
 894	if (timeout == NULL) {
 895		ret = -ENOMEM;
 896		goto err_proto_put;
 897	}
 898
 899	ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
 900					  tb[NFTA_CT_TIMEOUT_DATA]);
 901	if (ret < 0)
 902		goto err_free_timeout;
 903
 904	timeout->l3num = l3num;
 905	timeout->l4proto = l4proto;
 906
 907	ret = nf_ct_netns_get(ctx->net, ctx->family);
 908	if (ret < 0)
 909		goto err_free_timeout;
 910
 911	priv->timeout = timeout;
 912	return 0;
 913
 914err_free_timeout:
 915	kfree(timeout);
 916err_proto_put:
 917	return ret;
 918}
 919
 920static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
 921				       struct nft_object *obj)
 922{
 923	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 924	struct nf_ct_timeout *timeout = priv->timeout;
 925
 926	nf_ct_untimeout(ctx->net, timeout);
 927	nf_ct_netns_put(ctx->net, ctx->family);
 928	kfree(priv->timeout);
 929}
 930
 931static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
 932				   struct nft_object *obj, bool reset)
 933{
 934	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 935	const struct nf_ct_timeout *timeout = priv->timeout;
 936	struct nlattr *nest_params;
 937	int ret;
 938
 939	if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
 940	    nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
 941		return -1;
 942
 943	nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
 944	if (!nest_params)
 945		return -1;
 946
 947	ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
 948	if (ret < 0)
 949		return -1;
 950	nla_nest_end(skb, nest_params);
 951	return 0;
 952}
 953
 954static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
 955	[NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
 956	[NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
 957	[NFTA_CT_TIMEOUT_DATA]	  = {.type = NLA_NESTED },
 958};
 959
 960static struct nft_object_type nft_ct_timeout_obj_type;
 961
 962static const struct nft_object_ops nft_ct_timeout_obj_ops = {
 963	.type		= &nft_ct_timeout_obj_type,
 964	.size		= sizeof(struct nft_ct_timeout_obj),
 965	.eval		= nft_ct_timeout_obj_eval,
 966	.init		= nft_ct_timeout_obj_init,
 967	.destroy	= nft_ct_timeout_obj_destroy,
 968	.dump		= nft_ct_timeout_obj_dump,
 969};
 970
 971static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
 972	.type		= NFT_OBJECT_CT_TIMEOUT,
 973	.ops		= &nft_ct_timeout_obj_ops,
 974	.maxattr	= NFTA_CT_TIMEOUT_MAX,
 975	.policy		= nft_ct_timeout_policy,
 976	.owner		= THIS_MODULE,
 977};
 978#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 979
 980static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
 981				  const struct nlattr * const tb[],
 982				  struct nft_object *obj)
 983{
 984	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 985	struct nf_conntrack_helper *help4, *help6;
 986	char name[NF_CT_HELPER_NAME_LEN];
 987	int family = ctx->family;
 988	int err;
 989
 990	if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
 991		return -EINVAL;
 992
 993	priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
 994	if (!priv->l4proto)
 995		return -ENOENT;
 996
 997	nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
 998
 999	if (tb[NFTA_CT_HELPER_L3PROTO])
1000		family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1001
1002	help4 = NULL;
1003	help6 = NULL;
1004
1005	switch (family) {
1006	case NFPROTO_IPV4:
1007		if (ctx->family == NFPROTO_IPV6)
1008			return -EINVAL;
1009
1010		help4 = nf_conntrack_helper_try_module_get(name, family,
1011							   priv->l4proto);
1012		break;
1013	case NFPROTO_IPV6:
1014		if (ctx->family == NFPROTO_IPV4)
1015			return -EINVAL;
1016
1017		help6 = nf_conntrack_helper_try_module_get(name, family,
1018							   priv->l4proto);
1019		break;
1020	case NFPROTO_NETDEV:
1021	case NFPROTO_BRIDGE:
1022	case NFPROTO_INET:
1023		help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1024							   priv->l4proto);
1025		help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1026							   priv->l4proto);
1027		break;
1028	default:
1029		return -EAFNOSUPPORT;
1030	}
1031
1032	/* && is intentional; only error if INET found neither ipv4 or ipv6 */
1033	if (!help4 && !help6)
1034		return -ENOENT;
1035
1036	priv->helper4 = help4;
1037	priv->helper6 = help6;
1038
1039	err = nf_ct_netns_get(ctx->net, ctx->family);
1040	if (err < 0)
1041		goto err_put_helper;
1042
1043	return 0;
1044
1045err_put_helper:
1046	if (priv->helper4)
1047		nf_conntrack_helper_put(priv->helper4);
1048	if (priv->helper6)
1049		nf_conntrack_helper_put(priv->helper6);
1050	return err;
1051}
1052
1053static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1054				      struct nft_object *obj)
1055{
1056	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1057
1058	if (priv->helper4)
1059		nf_conntrack_helper_put(priv->helper4);
1060	if (priv->helper6)
1061		nf_conntrack_helper_put(priv->helper6);
1062
1063	nf_ct_netns_put(ctx->net, ctx->family);
1064}
1065
1066static void nft_ct_helper_obj_eval(struct nft_object *obj,
1067				   struct nft_regs *regs,
1068				   const struct nft_pktinfo *pkt)
1069{
1070	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1071	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1072	struct nf_conntrack_helper *to_assign = NULL;
1073	struct nf_conn_help *help;
1074
1075	if (!ct ||
1076	    nf_ct_is_confirmed(ct) ||
1077	    nf_ct_is_template(ct) ||
1078	    priv->l4proto != nf_ct_protonum(ct))
1079		return;
1080
1081	switch (nf_ct_l3num(ct)) {
1082	case NFPROTO_IPV4:
1083		to_assign = priv->helper4;
1084		break;
1085	case NFPROTO_IPV6:
1086		to_assign = priv->helper6;
1087		break;
1088	default:
1089		WARN_ON_ONCE(1);
1090		return;
1091	}
1092
1093	if (!to_assign)
1094		return;
1095
1096	if (test_bit(IPS_HELPER_BIT, &ct->status))
1097		return;
1098
1099	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1100	if (help) {
1101		rcu_assign_pointer(help->helper, to_assign);
1102		set_bit(IPS_HELPER_BIT, &ct->status);
1103	}
1104}
1105
1106static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1107				  struct nft_object *obj, bool reset)
1108{
1109	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1110	const struct nf_conntrack_helper *helper;
1111	u16 family;
1112
1113	if (priv->helper4 && priv->helper6) {
1114		family = NFPROTO_INET;
1115		helper = priv->helper4;
1116	} else if (priv->helper6) {
1117		family = NFPROTO_IPV6;
1118		helper = priv->helper6;
1119	} else {
1120		family = NFPROTO_IPV4;
1121		helper = priv->helper4;
1122	}
1123
1124	if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1125		return -1;
1126
1127	if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1128		return -1;
1129
1130	if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1131		return -1;
1132
1133	return 0;
1134}
1135
1136static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1137	[NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1138				  .len = NF_CT_HELPER_NAME_LEN - 1 },
1139	[NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1140	[NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1141};
1142
1143static struct nft_object_type nft_ct_helper_obj_type;
1144static const struct nft_object_ops nft_ct_helper_obj_ops = {
1145	.type		= &nft_ct_helper_obj_type,
1146	.size		= sizeof(struct nft_ct_helper_obj),
1147	.eval		= nft_ct_helper_obj_eval,
1148	.init		= nft_ct_helper_obj_init,
1149	.destroy	= nft_ct_helper_obj_destroy,
1150	.dump		= nft_ct_helper_obj_dump,
1151};
1152
1153static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1154	.type		= NFT_OBJECT_CT_HELPER,
1155	.ops		= &nft_ct_helper_obj_ops,
1156	.maxattr	= NFTA_CT_HELPER_MAX,
1157	.policy		= nft_ct_helper_policy,
1158	.owner		= THIS_MODULE,
1159};
1160
1161struct nft_ct_expect_obj {
1162	u16		l3num;
1163	__be16		dport;
1164	u8		l4proto;
1165	u8		size;
1166	u32		timeout;
1167};
1168
1169static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1170				  const struct nlattr * const tb[],
1171				  struct nft_object *obj)
1172{
1173	struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1174
1175	if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1176	    !tb[NFTA_CT_EXPECT_DPORT] ||
1177	    !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1178	    !tb[NFTA_CT_EXPECT_SIZE])
1179		return -EINVAL;
1180
1181	priv->l3num = ctx->family;
1182	if (tb[NFTA_CT_EXPECT_L3PROTO])
1183		priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1184
 
 
 
 
 
 
 
 
 
 
 
 
1185	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
 
 
 
 
 
 
 
 
 
 
 
1186	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1187	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1188	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1189
1190	return nf_ct_netns_get(ctx->net, ctx->family);
1191}
1192
1193static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1194				       struct nft_object *obj)
1195{
1196	nf_ct_netns_put(ctx->net, ctx->family);
1197}
1198
1199static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1200				  struct nft_object *obj, bool reset)
1201{
1202	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1203
1204	if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1205	    nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1206	    nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1207	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1208	    nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1209		return -1;
1210
1211	return 0;
1212}
1213
1214static void nft_ct_expect_obj_eval(struct nft_object *obj,
1215				   struct nft_regs *regs,
1216				   const struct nft_pktinfo *pkt)
1217{
1218	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1219	struct nf_conntrack_expect *exp;
1220	enum ip_conntrack_info ctinfo;
1221	struct nf_conn_help *help;
1222	enum ip_conntrack_dir dir;
1223	u16 l3num = priv->l3num;
1224	struct nf_conn *ct;
1225
1226	ct = nf_ct_get(pkt->skb, &ctinfo);
1227	if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1228		regs->verdict.code = NFT_BREAK;
1229		return;
1230	}
1231	dir = CTINFO2DIR(ctinfo);
1232
1233	help = nfct_help(ct);
1234	if (!help)
1235		help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1236	if (!help) {
1237		regs->verdict.code = NF_DROP;
1238		return;
1239	}
1240
1241	if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1242		regs->verdict.code = NFT_BREAK;
1243		return;
1244	}
1245	if (l3num == NFPROTO_INET)
1246		l3num = nf_ct_l3num(ct);
1247
1248	exp = nf_ct_expect_alloc(ct);
1249	if (exp == NULL) {
1250		regs->verdict.code = NF_DROP;
1251		return;
1252	}
1253	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1254		          &ct->tuplehash[!dir].tuple.src.u3,
1255		          &ct->tuplehash[!dir].tuple.dst.u3,
1256		          priv->l4proto, NULL, &priv->dport);
1257	exp->timeout.expires = jiffies + priv->timeout * HZ;
1258
1259	if (nf_ct_expect_related(exp, 0) != 0)
1260		regs->verdict.code = NF_DROP;
1261}
1262
1263static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1264	[NFTA_CT_EXPECT_L3PROTO]	= { .type = NLA_U16 },
1265	[NFTA_CT_EXPECT_L4PROTO]	= { .type = NLA_U8 },
1266	[NFTA_CT_EXPECT_DPORT]		= { .type = NLA_U16 },
1267	[NFTA_CT_EXPECT_TIMEOUT]	= { .type = NLA_U32 },
1268	[NFTA_CT_EXPECT_SIZE]		= { .type = NLA_U8 },
1269};
1270
1271static struct nft_object_type nft_ct_expect_obj_type;
1272
1273static const struct nft_object_ops nft_ct_expect_obj_ops = {
1274	.type		= &nft_ct_expect_obj_type,
1275	.size		= sizeof(struct nft_ct_expect_obj),
1276	.eval		= nft_ct_expect_obj_eval,
1277	.init		= nft_ct_expect_obj_init,
1278	.destroy	= nft_ct_expect_obj_destroy,
1279	.dump		= nft_ct_expect_obj_dump,
1280};
1281
1282static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1283	.type		= NFT_OBJECT_CT_EXPECT,
1284	.ops		= &nft_ct_expect_obj_ops,
1285	.maxattr	= NFTA_CT_EXPECT_MAX,
1286	.policy		= nft_ct_expect_policy,
1287	.owner		= THIS_MODULE,
1288};
1289
1290static int __init nft_ct_module_init(void)
1291{
1292	int err;
1293
1294	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1295
1296	err = nft_register_expr(&nft_ct_type);
1297	if (err < 0)
1298		return err;
1299
1300	err = nft_register_expr(&nft_notrack_type);
1301	if (err < 0)
1302		goto err1;
1303
1304	err = nft_register_obj(&nft_ct_helper_obj_type);
1305	if (err < 0)
1306		goto err2;
1307
1308	err = nft_register_obj(&nft_ct_expect_obj_type);
1309	if (err < 0)
1310		goto err3;
1311#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1312	err = nft_register_obj(&nft_ct_timeout_obj_type);
1313	if (err < 0)
1314		goto err4;
1315#endif
1316	return 0;
1317
1318#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1319err4:
1320	nft_unregister_obj(&nft_ct_expect_obj_type);
1321#endif
1322err3:
1323	nft_unregister_obj(&nft_ct_helper_obj_type);
1324err2:
1325	nft_unregister_expr(&nft_notrack_type);
1326err1:
1327	nft_unregister_expr(&nft_ct_type);
1328	return err;
1329}
1330
1331static void __exit nft_ct_module_exit(void)
1332{
1333#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1334	nft_unregister_obj(&nft_ct_timeout_obj_type);
1335#endif
1336	nft_unregister_obj(&nft_ct_expect_obj_type);
1337	nft_unregister_obj(&nft_ct_helper_obj_type);
1338	nft_unregister_expr(&nft_notrack_type);
1339	nft_unregister_expr(&nft_ct_type);
1340}
1341
1342module_init(nft_ct_module_init);
1343module_exit(nft_ct_module_exit);
1344
1345MODULE_LICENSE("GPL");
1346MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1347MODULE_ALIAS_NFT_EXPR("ct");
1348MODULE_ALIAS_NFT_EXPR("notrack");
1349MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1350MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1351MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1352MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");
v6.8
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   5 *
   6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
   7 */
   8
   9#include <linux/kernel.h>
  10#include <linux/init.h>
  11#include <linux/module.h>
  12#include <linux/netlink.h>
  13#include <linux/netfilter.h>
  14#include <linux/netfilter/nf_tables.h>
  15#include <net/netfilter/nf_tables_core.h>
  16#include <net/netfilter/nf_conntrack.h>
  17#include <net/netfilter/nf_conntrack_acct.h>
  18#include <net/netfilter/nf_conntrack_tuple.h>
  19#include <net/netfilter/nf_conntrack_helper.h>
  20#include <net/netfilter/nf_conntrack_ecache.h>
  21#include <net/netfilter/nf_conntrack_labels.h>
  22#include <net/netfilter/nf_conntrack_timeout.h>
  23#include <net/netfilter/nf_conntrack_l4proto.h>
  24#include <net/netfilter/nf_conntrack_expect.h>
  25
 
 
 
 
 
 
 
 
 
  26struct nft_ct_helper_obj  {
  27	struct nf_conntrack_helper *helper4;
  28	struct nf_conntrack_helper *helper6;
  29	u8 l4proto;
  30};
  31
  32#ifdef CONFIG_NF_CONNTRACK_ZONES
  33static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  34static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  35static DEFINE_MUTEX(nft_ct_pcpu_mutex);
  36#endif
  37
  38static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  39				   enum nft_ct_keys k,
  40				   enum ip_conntrack_dir d)
  41{
  42	if (d < IP_CT_DIR_MAX)
  43		return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  44					   atomic64_read(&c[d].packets);
  45
  46	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  47	       nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  48}
  49
  50static void nft_ct_get_eval(const struct nft_expr *expr,
  51			    struct nft_regs *regs,
  52			    const struct nft_pktinfo *pkt)
  53{
  54	const struct nft_ct *priv = nft_expr_priv(expr);
  55	u32 *dest = &regs->data[priv->dreg];
  56	enum ip_conntrack_info ctinfo;
  57	const struct nf_conn *ct;
  58	const struct nf_conn_help *help;
  59	const struct nf_conntrack_tuple *tuple;
  60	const struct nf_conntrack_helper *helper;
  61	unsigned int state;
  62
  63	ct = nf_ct_get(pkt->skb, &ctinfo);
  64
  65	switch (priv->key) {
  66	case NFT_CT_STATE:
  67		if (ct)
  68			state = NF_CT_STATE_BIT(ctinfo);
  69		else if (ctinfo == IP_CT_UNTRACKED)
  70			state = NF_CT_STATE_UNTRACKED_BIT;
  71		else
  72			state = NF_CT_STATE_INVALID_BIT;
  73		*dest = state;
  74		return;
  75	default:
  76		break;
  77	}
  78
  79	if (ct == NULL)
  80		goto err;
  81
  82	switch (priv->key) {
  83	case NFT_CT_DIRECTION:
  84		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
  85		return;
  86	case NFT_CT_STATUS:
  87		*dest = ct->status;
  88		return;
  89#ifdef CONFIG_NF_CONNTRACK_MARK
  90	case NFT_CT_MARK:
  91		*dest = READ_ONCE(ct->mark);
  92		return;
  93#endif
  94#ifdef CONFIG_NF_CONNTRACK_SECMARK
  95	case NFT_CT_SECMARK:
  96		*dest = ct->secmark;
  97		return;
  98#endif
  99	case NFT_CT_EXPIRATION:
 100		*dest = jiffies_to_msecs(nf_ct_expires(ct));
 101		return;
 102	case NFT_CT_HELPER:
 103		if (ct->master == NULL)
 104			goto err;
 105		help = nfct_help(ct->master);
 106		if (help == NULL)
 107			goto err;
 108		helper = rcu_dereference(help->helper);
 109		if (helper == NULL)
 110			goto err;
 111		strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 112		return;
 113#ifdef CONFIG_NF_CONNTRACK_LABELS
 114	case NFT_CT_LABELS: {
 115		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 116
 117		if (labels)
 118			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 119		else
 120			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 121		return;
 122	}
 123#endif
 124	case NFT_CT_BYTES:
 125	case NFT_CT_PKTS: {
 126		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 127		u64 count = 0;
 128
 129		if (acct)
 130			count = nft_ct_get_eval_counter(acct->counter,
 131							priv->key, priv->dir);
 132		memcpy(dest, &count, sizeof(count));
 133		return;
 134	}
 135	case NFT_CT_AVGPKT: {
 136		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 137		u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 138
 139		if (acct) {
 140			pcnt = nft_ct_get_eval_counter(acct->counter,
 141						       NFT_CT_PKTS, priv->dir);
 142			bcnt = nft_ct_get_eval_counter(acct->counter,
 143						       NFT_CT_BYTES, priv->dir);
 144			if (pcnt != 0)
 145				avgcnt = div64_u64(bcnt, pcnt);
 146		}
 147
 148		memcpy(dest, &avgcnt, sizeof(avgcnt));
 149		return;
 150	}
 151	case NFT_CT_L3PROTOCOL:
 152		nft_reg_store8(dest, nf_ct_l3num(ct));
 153		return;
 154	case NFT_CT_PROTOCOL:
 155		nft_reg_store8(dest, nf_ct_protonum(ct));
 156		return;
 157#ifdef CONFIG_NF_CONNTRACK_ZONES
 158	case NFT_CT_ZONE: {
 159		const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 160		u16 zoneid;
 161
 162		if (priv->dir < IP_CT_DIR_MAX)
 163			zoneid = nf_ct_zone_id(zone, priv->dir);
 164		else
 165			zoneid = zone->id;
 166
 167		nft_reg_store16(dest, zoneid);
 168		return;
 169	}
 170#endif
 171	case NFT_CT_ID:
 172		*dest = nf_ct_get_id(ct);
 173		return;
 174	default:
 175		break;
 176	}
 177
 178	tuple = &ct->tuplehash[priv->dir].tuple;
 179	switch (priv->key) {
 180	case NFT_CT_SRC:
 181		memcpy(dest, tuple->src.u3.all,
 182		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 183		return;
 184	case NFT_CT_DST:
 185		memcpy(dest, tuple->dst.u3.all,
 186		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 187		return;
 188	case NFT_CT_PROTO_SRC:
 189		nft_reg_store16(dest, (__force u16)tuple->src.u.all);
 190		return;
 191	case NFT_CT_PROTO_DST:
 192		nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
 193		return;
 194	case NFT_CT_SRC_IP:
 195		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 196			goto err;
 197		*dest = (__force __u32)tuple->src.u3.ip;
 198		return;
 199	case NFT_CT_DST_IP:
 200		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 201			goto err;
 202		*dest = (__force __u32)tuple->dst.u3.ip;
 203		return;
 204	case NFT_CT_SRC_IP6:
 205		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 206			goto err;
 207		memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
 208		return;
 209	case NFT_CT_DST_IP6:
 210		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 211			goto err;
 212		memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
 213		return;
 214	default:
 215		break;
 216	}
 217	return;
 218err:
 219	regs->verdict.code = NFT_BREAK;
 220}
 221
 222#ifdef CONFIG_NF_CONNTRACK_ZONES
 223static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 224				 struct nft_regs *regs,
 225				 const struct nft_pktinfo *pkt)
 226{
 227	struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 228	const struct nft_ct *priv = nft_expr_priv(expr);
 229	struct sk_buff *skb = pkt->skb;
 230	enum ip_conntrack_info ctinfo;
 231	u16 value = nft_reg_load16(&regs->data[priv->sreg]);
 232	struct nf_conn *ct;
 233
 234	ct = nf_ct_get(skb, &ctinfo);
 235	if (ct) /* already tracked */
 236		return;
 237
 238	zone.id = value;
 239
 240	switch (priv->dir) {
 241	case IP_CT_DIR_ORIGINAL:
 242		zone.dir = NF_CT_ZONE_DIR_ORIG;
 243		break;
 244	case IP_CT_DIR_REPLY:
 245		zone.dir = NF_CT_ZONE_DIR_REPL;
 246		break;
 247	default:
 248		break;
 249	}
 250
 251	ct = this_cpu_read(nft_ct_pcpu_template);
 252
 253	if (likely(refcount_read(&ct->ct_general.use) == 1)) {
 254		refcount_inc(&ct->ct_general.use);
 255		nf_ct_zone_add(ct, &zone);
 256	} else {
 257		/* previous skb got queued to userspace, allocate temporary
 258		 * one until percpu template can be reused.
 259		 */
 260		ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 261		if (!ct) {
 262			regs->verdict.code = NF_DROP;
 263			return;
 264		}
 265		__set_bit(IPS_CONFIRMED_BIT, &ct->status);
 266	}
 267
 
 268	nf_ct_set(skb, ct, IP_CT_NEW);
 269}
 270#endif
 271
 272static void nft_ct_set_eval(const struct nft_expr *expr,
 273			    struct nft_regs *regs,
 274			    const struct nft_pktinfo *pkt)
 275{
 276	const struct nft_ct *priv = nft_expr_priv(expr);
 277	struct sk_buff *skb = pkt->skb;
 278#if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
 279	u32 value = regs->data[priv->sreg];
 280#endif
 281	enum ip_conntrack_info ctinfo;
 282	struct nf_conn *ct;
 283
 284	ct = nf_ct_get(skb, &ctinfo);
 285	if (ct == NULL || nf_ct_is_template(ct))
 286		return;
 287
 288	switch (priv->key) {
 289#ifdef CONFIG_NF_CONNTRACK_MARK
 290	case NFT_CT_MARK:
 291		if (READ_ONCE(ct->mark) != value) {
 292			WRITE_ONCE(ct->mark, value);
 293			nf_conntrack_event_cache(IPCT_MARK, ct);
 294		}
 295		break;
 296#endif
 297#ifdef CONFIG_NF_CONNTRACK_SECMARK
 298	case NFT_CT_SECMARK:
 299		if (ct->secmark != value) {
 300			ct->secmark = value;
 301			nf_conntrack_event_cache(IPCT_SECMARK, ct);
 302		}
 303		break;
 304#endif
 305#ifdef CONFIG_NF_CONNTRACK_LABELS
 306	case NFT_CT_LABELS:
 307		nf_connlabels_replace(ct,
 308				      &regs->data[priv->sreg],
 309				      &regs->data[priv->sreg],
 310				      NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 311		break;
 312#endif
 313#ifdef CONFIG_NF_CONNTRACK_EVENTS
 314	case NFT_CT_EVENTMASK: {
 315		struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
 316		u32 ctmask = regs->data[priv->sreg];
 317
 318		if (e) {
 319			if (e->ctmask != ctmask)
 320				e->ctmask = ctmask;
 321			break;
 322		}
 323
 324		if (ctmask && !nf_ct_is_confirmed(ct))
 325			nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
 326		break;
 327	}
 328#endif
 329	default:
 330		break;
 331	}
 332}
 333
 334static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 335	[NFTA_CT_DREG]		= { .type = NLA_U32 },
 336	[NFTA_CT_KEY]		= NLA_POLICY_MAX(NLA_BE32, 255),
 337	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
 338	[NFTA_CT_SREG]		= { .type = NLA_U32 },
 339};
 340
 341#ifdef CONFIG_NF_CONNTRACK_ZONES
 342static void nft_ct_tmpl_put_pcpu(void)
 343{
 344	struct nf_conn *ct;
 345	int cpu;
 346
 347	for_each_possible_cpu(cpu) {
 348		ct = per_cpu(nft_ct_pcpu_template, cpu);
 349		if (!ct)
 350			break;
 351		nf_ct_put(ct);
 352		per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 353	}
 354}
 355
 356static bool nft_ct_tmpl_alloc_pcpu(void)
 357{
 358	struct nf_conntrack_zone zone = { .id = 0 };
 359	struct nf_conn *tmp;
 360	int cpu;
 361
 362	if (nft_ct_pcpu_template_refcnt)
 363		return true;
 364
 365	for_each_possible_cpu(cpu) {
 366		tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 367		if (!tmp) {
 368			nft_ct_tmpl_put_pcpu();
 369			return false;
 370		}
 371
 372		__set_bit(IPS_CONFIRMED_BIT, &tmp->status);
 373		per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 374	}
 375
 376	return true;
 377}
 378#endif
 379
 380static int nft_ct_get_init(const struct nft_ctx *ctx,
 381			   const struct nft_expr *expr,
 382			   const struct nlattr * const tb[])
 383{
 384	struct nft_ct *priv = nft_expr_priv(expr);
 385	unsigned int len;
 386	int err;
 387
 388	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 389	priv->dir = IP_CT_DIR_MAX;
 390	switch (priv->key) {
 391	case NFT_CT_DIRECTION:
 392		if (tb[NFTA_CT_DIRECTION] != NULL)
 393			return -EINVAL;
 394		len = sizeof(u8);
 395		break;
 396	case NFT_CT_STATE:
 397	case NFT_CT_STATUS:
 398#ifdef CONFIG_NF_CONNTRACK_MARK
 399	case NFT_CT_MARK:
 400#endif
 401#ifdef CONFIG_NF_CONNTRACK_SECMARK
 402	case NFT_CT_SECMARK:
 403#endif
 404	case NFT_CT_EXPIRATION:
 405		if (tb[NFTA_CT_DIRECTION] != NULL)
 406			return -EINVAL;
 407		len = sizeof(u32);
 408		break;
 409#ifdef CONFIG_NF_CONNTRACK_LABELS
 410	case NFT_CT_LABELS:
 411		if (tb[NFTA_CT_DIRECTION] != NULL)
 412			return -EINVAL;
 413		len = NF_CT_LABELS_MAX_SIZE;
 414		break;
 415#endif
 416	case NFT_CT_HELPER:
 417		if (tb[NFTA_CT_DIRECTION] != NULL)
 418			return -EINVAL;
 419		len = NF_CT_HELPER_NAME_LEN;
 420		break;
 421
 422	case NFT_CT_L3PROTOCOL:
 423	case NFT_CT_PROTOCOL:
 424		/* For compatibility, do not report error if NFTA_CT_DIRECTION
 425		 * attribute is specified.
 426		 */
 427		len = sizeof(u8);
 428		break;
 429	case NFT_CT_SRC:
 430	case NFT_CT_DST:
 431		if (tb[NFTA_CT_DIRECTION] == NULL)
 432			return -EINVAL;
 433
 434		switch (ctx->family) {
 435		case NFPROTO_IPV4:
 436			len = sizeof_field(struct nf_conntrack_tuple,
 437					   src.u3.ip);
 438			break;
 439		case NFPROTO_IPV6:
 440		case NFPROTO_INET:
 441			len = sizeof_field(struct nf_conntrack_tuple,
 442					   src.u3.ip6);
 443			break;
 444		default:
 445			return -EAFNOSUPPORT;
 446		}
 447		break;
 448	case NFT_CT_SRC_IP:
 449	case NFT_CT_DST_IP:
 450		if (tb[NFTA_CT_DIRECTION] == NULL)
 451			return -EINVAL;
 452
 453		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
 454		break;
 455	case NFT_CT_SRC_IP6:
 456	case NFT_CT_DST_IP6:
 457		if (tb[NFTA_CT_DIRECTION] == NULL)
 458			return -EINVAL;
 459
 460		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
 461		break;
 462	case NFT_CT_PROTO_SRC:
 463	case NFT_CT_PROTO_DST:
 464		if (tb[NFTA_CT_DIRECTION] == NULL)
 465			return -EINVAL;
 466		len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
 467		break;
 468	case NFT_CT_BYTES:
 469	case NFT_CT_PKTS:
 470	case NFT_CT_AVGPKT:
 471		len = sizeof(u64);
 472		break;
 473#ifdef CONFIG_NF_CONNTRACK_ZONES
 474	case NFT_CT_ZONE:
 475		len = sizeof(u16);
 476		break;
 477#endif
 478	case NFT_CT_ID:
 479		if (tb[NFTA_CT_DIRECTION])
 480			return -EINVAL;
 481
 482		len = sizeof(u32);
 483		break;
 484	default:
 485		return -EOPNOTSUPP;
 486	}
 487
 488	if (tb[NFTA_CT_DIRECTION] != NULL) {
 489		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 490		switch (priv->dir) {
 491		case IP_CT_DIR_ORIGINAL:
 492		case IP_CT_DIR_REPLY:
 493			break;
 494		default:
 495			return -EINVAL;
 496		}
 497	}
 498
 499	priv->len = len;
 500	err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
 501				       NFT_DATA_VALUE, len);
 502	if (err < 0)
 503		return err;
 504
 505	err = nf_ct_netns_get(ctx->net, ctx->family);
 506	if (err < 0)
 507		return err;
 508
 509	if (priv->key == NFT_CT_BYTES ||
 510	    priv->key == NFT_CT_PKTS  ||
 511	    priv->key == NFT_CT_AVGPKT)
 512		nf_ct_set_acct(ctx->net, true);
 513
 514	return 0;
 515}
 516
 517static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 518{
 519	switch (priv->key) {
 520#ifdef CONFIG_NF_CONNTRACK_LABELS
 521	case NFT_CT_LABELS:
 522		nf_connlabels_put(ctx->net);
 523		break;
 524#endif
 525#ifdef CONFIG_NF_CONNTRACK_ZONES
 526	case NFT_CT_ZONE:
 527		mutex_lock(&nft_ct_pcpu_mutex);
 528		if (--nft_ct_pcpu_template_refcnt == 0)
 529			nft_ct_tmpl_put_pcpu();
 530		mutex_unlock(&nft_ct_pcpu_mutex);
 531		break;
 532#endif
 533	default:
 534		break;
 535	}
 536}
 537
 538static int nft_ct_set_init(const struct nft_ctx *ctx,
 539			   const struct nft_expr *expr,
 540			   const struct nlattr * const tb[])
 541{
 542	struct nft_ct *priv = nft_expr_priv(expr);
 543	unsigned int len;
 544	int err;
 545
 546	priv->dir = IP_CT_DIR_MAX;
 547	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 548	switch (priv->key) {
 549#ifdef CONFIG_NF_CONNTRACK_MARK
 550	case NFT_CT_MARK:
 551		if (tb[NFTA_CT_DIRECTION])
 552			return -EINVAL;
 553		len = sizeof_field(struct nf_conn, mark);
 554		break;
 555#endif
 556#ifdef CONFIG_NF_CONNTRACK_LABELS
 557	case NFT_CT_LABELS:
 558		if (tb[NFTA_CT_DIRECTION])
 559			return -EINVAL;
 560		len = NF_CT_LABELS_MAX_SIZE;
 561		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 562		if (err)
 563			return err;
 564		break;
 565#endif
 566#ifdef CONFIG_NF_CONNTRACK_ZONES
 567	case NFT_CT_ZONE:
 568		mutex_lock(&nft_ct_pcpu_mutex);
 569		if (!nft_ct_tmpl_alloc_pcpu()) {
 570			mutex_unlock(&nft_ct_pcpu_mutex);
 571			return -ENOMEM;
 572		}
 573		nft_ct_pcpu_template_refcnt++;
 574		mutex_unlock(&nft_ct_pcpu_mutex);
 575		len = sizeof(u16);
 576		break;
 577#endif
 578#ifdef CONFIG_NF_CONNTRACK_EVENTS
 579	case NFT_CT_EVENTMASK:
 580		if (tb[NFTA_CT_DIRECTION])
 581			return -EINVAL;
 582		len = sizeof(u32);
 583		break;
 584#endif
 585#ifdef CONFIG_NF_CONNTRACK_SECMARK
 586	case NFT_CT_SECMARK:
 587		if (tb[NFTA_CT_DIRECTION])
 588			return -EINVAL;
 589		len = sizeof(u32);
 590		break;
 591#endif
 592	default:
 593		return -EOPNOTSUPP;
 594	}
 595
 596	if (tb[NFTA_CT_DIRECTION]) {
 597		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 598		switch (priv->dir) {
 599		case IP_CT_DIR_ORIGINAL:
 600		case IP_CT_DIR_REPLY:
 601			break;
 602		default:
 603			err = -EINVAL;
 604			goto err1;
 605		}
 606	}
 607
 608	priv->len = len;
 609	err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
 610	if (err < 0)
 611		goto err1;
 612
 613	err = nf_ct_netns_get(ctx->net, ctx->family);
 614	if (err < 0)
 615		goto err1;
 616
 617	return 0;
 618
 619err1:
 620	__nft_ct_set_destroy(ctx, priv);
 621	return err;
 622}
 623
 624static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 625			       const struct nft_expr *expr)
 626{
 627	nf_ct_netns_put(ctx->net, ctx->family);
 628}
 629
 630static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 631			       const struct nft_expr *expr)
 632{
 633	struct nft_ct *priv = nft_expr_priv(expr);
 634
 635	__nft_ct_set_destroy(ctx, priv);
 636	nf_ct_netns_put(ctx->net, ctx->family);
 637}
 638
 639static int nft_ct_get_dump(struct sk_buff *skb,
 640			   const struct nft_expr *expr, bool reset)
 641{
 642	const struct nft_ct *priv = nft_expr_priv(expr);
 643
 644	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 645		goto nla_put_failure;
 646	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 647		goto nla_put_failure;
 648
 649	switch (priv->key) {
 650	case NFT_CT_SRC:
 651	case NFT_CT_DST:
 652	case NFT_CT_SRC_IP:
 653	case NFT_CT_DST_IP:
 654	case NFT_CT_SRC_IP6:
 655	case NFT_CT_DST_IP6:
 656	case NFT_CT_PROTO_SRC:
 657	case NFT_CT_PROTO_DST:
 658		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 659			goto nla_put_failure;
 660		break;
 661	case NFT_CT_BYTES:
 662	case NFT_CT_PKTS:
 663	case NFT_CT_AVGPKT:
 664	case NFT_CT_ZONE:
 665		if (priv->dir < IP_CT_DIR_MAX &&
 666		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 667			goto nla_put_failure;
 668		break;
 669	default:
 670		break;
 671	}
 672
 673	return 0;
 674
 675nla_put_failure:
 676	return -1;
 677}
 678
 679static bool nft_ct_get_reduce(struct nft_regs_track *track,
 680			      const struct nft_expr *expr)
 681{
 682	const struct nft_ct *priv = nft_expr_priv(expr);
 683	const struct nft_ct *ct;
 684
 685	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
 686		nft_reg_track_update(track, expr, priv->dreg, priv->len);
 687		return false;
 688	}
 689
 690	ct = nft_expr_priv(track->regs[priv->dreg].selector);
 691	if (priv->key != ct->key) {
 692		nft_reg_track_update(track, expr, priv->dreg, priv->len);
 693		return false;
 694	}
 695
 696	if (!track->regs[priv->dreg].bitwise)
 697		return true;
 698
 699	return nft_expr_reduce_bitwise(track, expr);
 700}
 701
 702static int nft_ct_set_dump(struct sk_buff *skb,
 703			   const struct nft_expr *expr, bool reset)
 704{
 705	const struct nft_ct *priv = nft_expr_priv(expr);
 706
 707	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 708		goto nla_put_failure;
 709	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 710		goto nla_put_failure;
 711
 712	switch (priv->key) {
 713	case NFT_CT_ZONE:
 714		if (priv->dir < IP_CT_DIR_MAX &&
 715		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 716			goto nla_put_failure;
 717		break;
 718	default:
 719		break;
 720	}
 721
 722	return 0;
 723
 724nla_put_failure:
 725	return -1;
 726}
 727
 728static struct nft_expr_type nft_ct_type;
 729static const struct nft_expr_ops nft_ct_get_ops = {
 730	.type		= &nft_ct_type,
 731	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 732	.eval		= nft_ct_get_eval,
 733	.init		= nft_ct_get_init,
 734	.destroy	= nft_ct_get_destroy,
 735	.dump		= nft_ct_get_dump,
 736	.reduce		= nft_ct_get_reduce,
 737};
 738
 739static bool nft_ct_set_reduce(struct nft_regs_track *track,
 740			      const struct nft_expr *expr)
 741{
 742	int i;
 743
 744	for (i = 0; i < NFT_REG32_NUM; i++) {
 745		if (!track->regs[i].selector)
 746			continue;
 747
 748		if (track->regs[i].selector->ops != &nft_ct_get_ops)
 749			continue;
 750
 751		__nft_reg_track_cancel(track, i);
 752	}
 753
 754	return false;
 755}
 756
 757#ifdef CONFIG_RETPOLINE
 758static const struct nft_expr_ops nft_ct_get_fast_ops = {
 759	.type		= &nft_ct_type,
 760	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 761	.eval		= nft_ct_get_fast_eval,
 762	.init		= nft_ct_get_init,
 763	.destroy	= nft_ct_get_destroy,
 764	.dump		= nft_ct_get_dump,
 765	.reduce		= nft_ct_set_reduce,
 766};
 767#endif
 768
 769static const struct nft_expr_ops nft_ct_set_ops = {
 770	.type		= &nft_ct_type,
 771	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 772	.eval		= nft_ct_set_eval,
 773	.init		= nft_ct_set_init,
 774	.destroy	= nft_ct_set_destroy,
 775	.dump		= nft_ct_set_dump,
 776	.reduce		= nft_ct_set_reduce,
 777};
 778
 779#ifdef CONFIG_NF_CONNTRACK_ZONES
 780static const struct nft_expr_ops nft_ct_set_zone_ops = {
 781	.type		= &nft_ct_type,
 782	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 783	.eval		= nft_ct_set_zone_eval,
 784	.init		= nft_ct_set_init,
 785	.destroy	= nft_ct_set_destroy,
 786	.dump		= nft_ct_set_dump,
 787	.reduce		= nft_ct_set_reduce,
 788};
 789#endif
 790
 791static const struct nft_expr_ops *
 792nft_ct_select_ops(const struct nft_ctx *ctx,
 793		    const struct nlattr * const tb[])
 794{
 795	if (tb[NFTA_CT_KEY] == NULL)
 796		return ERR_PTR(-EINVAL);
 797
 798	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 799		return ERR_PTR(-EINVAL);
 800
 801	if (tb[NFTA_CT_DREG]) {
 802#ifdef CONFIG_RETPOLINE
 803		u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 804
 805		switch (k) {
 806		case NFT_CT_STATE:
 807		case NFT_CT_DIRECTION:
 808		case NFT_CT_STATUS:
 809		case NFT_CT_MARK:
 810		case NFT_CT_SECMARK:
 811			return &nft_ct_get_fast_ops;
 812		}
 813#endif
 814		return &nft_ct_get_ops;
 815	}
 816
 817	if (tb[NFTA_CT_SREG]) {
 818#ifdef CONFIG_NF_CONNTRACK_ZONES
 819		if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 820			return &nft_ct_set_zone_ops;
 821#endif
 822		return &nft_ct_set_ops;
 823	}
 824
 825	return ERR_PTR(-EINVAL);
 826}
 827
 828static struct nft_expr_type nft_ct_type __read_mostly = {
 829	.name		= "ct",
 830	.select_ops	= nft_ct_select_ops,
 831	.policy		= nft_ct_policy,
 832	.maxattr	= NFTA_CT_MAX,
 833	.owner		= THIS_MODULE,
 834};
 835
 836static void nft_notrack_eval(const struct nft_expr *expr,
 837			     struct nft_regs *regs,
 838			     const struct nft_pktinfo *pkt)
 839{
 840	struct sk_buff *skb = pkt->skb;
 841	enum ip_conntrack_info ctinfo;
 842	struct nf_conn *ct;
 843
 844	ct = nf_ct_get(pkt->skb, &ctinfo);
 845	/* Previously seen (loopback or untracked)?  Ignore. */
 846	if (ct || ctinfo == IP_CT_UNTRACKED)
 847		return;
 848
 849	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 850}
 851
 852static struct nft_expr_type nft_notrack_type;
 853static const struct nft_expr_ops nft_notrack_ops = {
 854	.type		= &nft_notrack_type,
 855	.size		= NFT_EXPR_SIZE(0),
 856	.eval		= nft_notrack_eval,
 857	.reduce		= NFT_REDUCE_READONLY,
 858};
 859
 860static struct nft_expr_type nft_notrack_type __read_mostly = {
 861	.name		= "notrack",
 862	.ops		= &nft_notrack_ops,
 863	.owner		= THIS_MODULE,
 864};
 865
 866#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 867static int
 868nft_ct_timeout_parse_policy(void *timeouts,
 869			    const struct nf_conntrack_l4proto *l4proto,
 870			    struct net *net, const struct nlattr *attr)
 871{
 872	struct nlattr **tb;
 873	int ret = 0;
 874
 875	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
 876		     GFP_KERNEL);
 877
 878	if (!tb)
 879		return -ENOMEM;
 880
 881	ret = nla_parse_nested_deprecated(tb,
 882					  l4proto->ctnl_timeout.nlattr_max,
 883					  attr,
 884					  l4proto->ctnl_timeout.nla_policy,
 885					  NULL);
 886	if (ret < 0)
 887		goto err;
 888
 889	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 890
 891err:
 892	kfree(tb);
 893	return ret;
 894}
 895
 896struct nft_ct_timeout_obj {
 897	struct nf_ct_timeout    *timeout;
 898	u8			l4proto;
 899};
 900
 901static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 902				    struct nft_regs *regs,
 903				    const struct nft_pktinfo *pkt)
 904{
 905	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 906	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
 907	struct nf_conn_timeout *timeout;
 908	const unsigned int *values;
 909
 910	if (priv->l4proto != pkt->tprot)
 911		return;
 912
 913	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
 914		return;
 915
 916	timeout = nf_ct_timeout_find(ct);
 917	if (!timeout) {
 918		timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
 919		if (!timeout) {
 920			regs->verdict.code = NF_DROP;
 921			return;
 922		}
 923	}
 924
 925	rcu_assign_pointer(timeout->timeout, priv->timeout);
 926
 927	/* adjust the timeout as per 'new' state. ct is unconfirmed,
 928	 * so the current timestamp must not be added.
 929	 */
 930	values = nf_ct_timeout_data(timeout);
 931	if (values)
 932		nf_ct_refresh(ct, pkt->skb, values[0]);
 933}
 934
 935static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 936				   const struct nlattr * const tb[],
 937				   struct nft_object *obj)
 938{
 939	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 940	const struct nf_conntrack_l4proto *l4proto;
 941	struct nf_ct_timeout *timeout;
 942	int l3num = ctx->family;
 943	__u8 l4num;
 944	int ret;
 945
 946	if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
 947	    !tb[NFTA_CT_TIMEOUT_DATA])
 948		return -EINVAL;
 949
 950	if (tb[NFTA_CT_TIMEOUT_L3PROTO])
 951		l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
 952
 953	l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
 954	priv->l4proto = l4num;
 955
 956	l4proto = nf_ct_l4proto_find(l4num);
 957
 958	if (l4proto->l4proto != l4num) {
 959		ret = -EOPNOTSUPP;
 960		goto err_proto_put;
 961	}
 962
 963	timeout = kzalloc(sizeof(struct nf_ct_timeout) +
 964			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
 965	if (timeout == NULL) {
 966		ret = -ENOMEM;
 967		goto err_proto_put;
 968	}
 969
 970	ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
 971					  tb[NFTA_CT_TIMEOUT_DATA]);
 972	if (ret < 0)
 973		goto err_free_timeout;
 974
 975	timeout->l3num = l3num;
 976	timeout->l4proto = l4proto;
 977
 978	ret = nf_ct_netns_get(ctx->net, ctx->family);
 979	if (ret < 0)
 980		goto err_free_timeout;
 981
 982	priv->timeout = timeout;
 983	return 0;
 984
 985err_free_timeout:
 986	kfree(timeout);
 987err_proto_put:
 988	return ret;
 989}
 990
 991static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
 992				       struct nft_object *obj)
 993{
 994	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 995	struct nf_ct_timeout *timeout = priv->timeout;
 996
 997	nf_ct_untimeout(ctx->net, timeout);
 998	nf_ct_netns_put(ctx->net, ctx->family);
 999	kfree(priv->timeout);
1000}
1001
1002static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
1003				   struct nft_object *obj, bool reset)
1004{
1005	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
1006	const struct nf_ct_timeout *timeout = priv->timeout;
1007	struct nlattr *nest_params;
1008	int ret;
1009
1010	if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
1011	    nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
1012		return -1;
1013
1014	nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
1015	if (!nest_params)
1016		return -1;
1017
1018	ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
1019	if (ret < 0)
1020		return -1;
1021	nla_nest_end(skb, nest_params);
1022	return 0;
1023}
1024
1025static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1026	[NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1027	[NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1028	[NFTA_CT_TIMEOUT_DATA]	  = {.type = NLA_NESTED },
1029};
1030
1031static struct nft_object_type nft_ct_timeout_obj_type;
1032
1033static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1034	.type		= &nft_ct_timeout_obj_type,
1035	.size		= sizeof(struct nft_ct_timeout_obj),
1036	.eval		= nft_ct_timeout_obj_eval,
1037	.init		= nft_ct_timeout_obj_init,
1038	.destroy	= nft_ct_timeout_obj_destroy,
1039	.dump		= nft_ct_timeout_obj_dump,
1040};
1041
1042static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1043	.type		= NFT_OBJECT_CT_TIMEOUT,
1044	.ops		= &nft_ct_timeout_obj_ops,
1045	.maxattr	= NFTA_CT_TIMEOUT_MAX,
1046	.policy		= nft_ct_timeout_policy,
1047	.owner		= THIS_MODULE,
1048};
1049#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1050
1051static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1052				  const struct nlattr * const tb[],
1053				  struct nft_object *obj)
1054{
1055	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1056	struct nf_conntrack_helper *help4, *help6;
1057	char name[NF_CT_HELPER_NAME_LEN];
1058	int family = ctx->family;
1059	int err;
1060
1061	if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1062		return -EINVAL;
1063
1064	priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1065	if (!priv->l4proto)
1066		return -ENOENT;
1067
1068	nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1069
1070	if (tb[NFTA_CT_HELPER_L3PROTO])
1071		family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1072
1073	help4 = NULL;
1074	help6 = NULL;
1075
1076	switch (family) {
1077	case NFPROTO_IPV4:
1078		if (ctx->family == NFPROTO_IPV6)
1079			return -EINVAL;
1080
1081		help4 = nf_conntrack_helper_try_module_get(name, family,
1082							   priv->l4proto);
1083		break;
1084	case NFPROTO_IPV6:
1085		if (ctx->family == NFPROTO_IPV4)
1086			return -EINVAL;
1087
1088		help6 = nf_conntrack_helper_try_module_get(name, family,
1089							   priv->l4proto);
1090		break;
1091	case NFPROTO_NETDEV:
1092	case NFPROTO_BRIDGE:
1093	case NFPROTO_INET:
1094		help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1095							   priv->l4proto);
1096		help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1097							   priv->l4proto);
1098		break;
1099	default:
1100		return -EAFNOSUPPORT;
1101	}
1102
1103	/* && is intentional; only error if INET found neither ipv4 or ipv6 */
1104	if (!help4 && !help6)
1105		return -ENOENT;
1106
1107	priv->helper4 = help4;
1108	priv->helper6 = help6;
1109
1110	err = nf_ct_netns_get(ctx->net, ctx->family);
1111	if (err < 0)
1112		goto err_put_helper;
1113
1114	return 0;
1115
1116err_put_helper:
1117	if (priv->helper4)
1118		nf_conntrack_helper_put(priv->helper4);
1119	if (priv->helper6)
1120		nf_conntrack_helper_put(priv->helper6);
1121	return err;
1122}
1123
1124static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1125				      struct nft_object *obj)
1126{
1127	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1128
1129	if (priv->helper4)
1130		nf_conntrack_helper_put(priv->helper4);
1131	if (priv->helper6)
1132		nf_conntrack_helper_put(priv->helper6);
1133
1134	nf_ct_netns_put(ctx->net, ctx->family);
1135}
1136
1137static void nft_ct_helper_obj_eval(struct nft_object *obj,
1138				   struct nft_regs *regs,
1139				   const struct nft_pktinfo *pkt)
1140{
1141	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1142	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1143	struct nf_conntrack_helper *to_assign = NULL;
1144	struct nf_conn_help *help;
1145
1146	if (!ct ||
1147	    nf_ct_is_confirmed(ct) ||
1148	    nf_ct_is_template(ct) ||
1149	    priv->l4proto != nf_ct_protonum(ct))
1150		return;
1151
1152	switch (nf_ct_l3num(ct)) {
1153	case NFPROTO_IPV4:
1154		to_assign = priv->helper4;
1155		break;
1156	case NFPROTO_IPV6:
1157		to_assign = priv->helper6;
1158		break;
1159	default:
1160		WARN_ON_ONCE(1);
1161		return;
1162	}
1163
1164	if (!to_assign)
1165		return;
1166
1167	if (test_bit(IPS_HELPER_BIT, &ct->status))
1168		return;
1169
1170	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1171	if (help) {
1172		rcu_assign_pointer(help->helper, to_assign);
1173		set_bit(IPS_HELPER_BIT, &ct->status);
1174	}
1175}
1176
1177static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1178				  struct nft_object *obj, bool reset)
1179{
1180	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1181	const struct nf_conntrack_helper *helper;
1182	u16 family;
1183
1184	if (priv->helper4 && priv->helper6) {
1185		family = NFPROTO_INET;
1186		helper = priv->helper4;
1187	} else if (priv->helper6) {
1188		family = NFPROTO_IPV6;
1189		helper = priv->helper6;
1190	} else {
1191		family = NFPROTO_IPV4;
1192		helper = priv->helper4;
1193	}
1194
1195	if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1196		return -1;
1197
1198	if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1199		return -1;
1200
1201	if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1202		return -1;
1203
1204	return 0;
1205}
1206
1207static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1208	[NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1209				  .len = NF_CT_HELPER_NAME_LEN - 1 },
1210	[NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1211	[NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1212};
1213
1214static struct nft_object_type nft_ct_helper_obj_type;
1215static const struct nft_object_ops nft_ct_helper_obj_ops = {
1216	.type		= &nft_ct_helper_obj_type,
1217	.size		= sizeof(struct nft_ct_helper_obj),
1218	.eval		= nft_ct_helper_obj_eval,
1219	.init		= nft_ct_helper_obj_init,
1220	.destroy	= nft_ct_helper_obj_destroy,
1221	.dump		= nft_ct_helper_obj_dump,
1222};
1223
1224static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1225	.type		= NFT_OBJECT_CT_HELPER,
1226	.ops		= &nft_ct_helper_obj_ops,
1227	.maxattr	= NFTA_CT_HELPER_MAX,
1228	.policy		= nft_ct_helper_policy,
1229	.owner		= THIS_MODULE,
1230};
1231
1232struct nft_ct_expect_obj {
1233	u16		l3num;
1234	__be16		dport;
1235	u8		l4proto;
1236	u8		size;
1237	u32		timeout;
1238};
1239
1240static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1241				  const struct nlattr * const tb[],
1242				  struct nft_object *obj)
1243{
1244	struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1245
1246	if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1247	    !tb[NFTA_CT_EXPECT_DPORT] ||
1248	    !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1249	    !tb[NFTA_CT_EXPECT_SIZE])
1250		return -EINVAL;
1251
1252	priv->l3num = ctx->family;
1253	if (tb[NFTA_CT_EXPECT_L3PROTO])
1254		priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1255
1256	switch (priv->l3num) {
1257	case NFPROTO_IPV4:
1258	case NFPROTO_IPV6:
1259		if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1260			break;
1261
1262		return -EINVAL;
1263	case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1264	default:
1265		return -EAFNOSUPPORT;
1266	}
1267
1268	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1269	switch (priv->l4proto) {
1270	case IPPROTO_TCP:
1271	case IPPROTO_UDP:
1272	case IPPROTO_UDPLITE:
1273	case IPPROTO_DCCP:
1274	case IPPROTO_SCTP:
1275		break;
1276	default:
1277		return -EOPNOTSUPP;
1278	}
1279
1280	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1281	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1282	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1283
1284	return nf_ct_netns_get(ctx->net, ctx->family);
1285}
1286
1287static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1288				       struct nft_object *obj)
1289{
1290	nf_ct_netns_put(ctx->net, ctx->family);
1291}
1292
1293static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1294				  struct nft_object *obj, bool reset)
1295{
1296	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1297
1298	if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1299	    nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1300	    nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1301	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1302	    nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1303		return -1;
1304
1305	return 0;
1306}
1307
1308static void nft_ct_expect_obj_eval(struct nft_object *obj,
1309				   struct nft_regs *regs,
1310				   const struct nft_pktinfo *pkt)
1311{
1312	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1313	struct nf_conntrack_expect *exp;
1314	enum ip_conntrack_info ctinfo;
1315	struct nf_conn_help *help;
1316	enum ip_conntrack_dir dir;
1317	u16 l3num = priv->l3num;
1318	struct nf_conn *ct;
1319
1320	ct = nf_ct_get(pkt->skb, &ctinfo);
1321	if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1322		regs->verdict.code = NFT_BREAK;
1323		return;
1324	}
1325	dir = CTINFO2DIR(ctinfo);
1326
1327	help = nfct_help(ct);
1328	if (!help)
1329		help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1330	if (!help) {
1331		regs->verdict.code = NF_DROP;
1332		return;
1333	}
1334
1335	if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1336		regs->verdict.code = NFT_BREAK;
1337		return;
1338	}
1339	if (l3num == NFPROTO_INET)
1340		l3num = nf_ct_l3num(ct);
1341
1342	exp = nf_ct_expect_alloc(ct);
1343	if (exp == NULL) {
1344		regs->verdict.code = NF_DROP;
1345		return;
1346	}
1347	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1348		          &ct->tuplehash[!dir].tuple.src.u3,
1349		          &ct->tuplehash[!dir].tuple.dst.u3,
1350		          priv->l4proto, NULL, &priv->dport);
1351	exp->timeout.expires = jiffies + priv->timeout * HZ;
1352
1353	if (nf_ct_expect_related(exp, 0) != 0)
1354		regs->verdict.code = NF_DROP;
1355}
1356
1357static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1358	[NFTA_CT_EXPECT_L3PROTO]	= { .type = NLA_U16 },
1359	[NFTA_CT_EXPECT_L4PROTO]	= { .type = NLA_U8 },
1360	[NFTA_CT_EXPECT_DPORT]		= { .type = NLA_U16 },
1361	[NFTA_CT_EXPECT_TIMEOUT]	= { .type = NLA_U32 },
1362	[NFTA_CT_EXPECT_SIZE]		= { .type = NLA_U8 },
1363};
1364
1365static struct nft_object_type nft_ct_expect_obj_type;
1366
1367static const struct nft_object_ops nft_ct_expect_obj_ops = {
1368	.type		= &nft_ct_expect_obj_type,
1369	.size		= sizeof(struct nft_ct_expect_obj),
1370	.eval		= nft_ct_expect_obj_eval,
1371	.init		= nft_ct_expect_obj_init,
1372	.destroy	= nft_ct_expect_obj_destroy,
1373	.dump		= nft_ct_expect_obj_dump,
1374};
1375
1376static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1377	.type		= NFT_OBJECT_CT_EXPECT,
1378	.ops		= &nft_ct_expect_obj_ops,
1379	.maxattr	= NFTA_CT_EXPECT_MAX,
1380	.policy		= nft_ct_expect_policy,
1381	.owner		= THIS_MODULE,
1382};
1383
1384static int __init nft_ct_module_init(void)
1385{
1386	int err;
1387
1388	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1389
1390	err = nft_register_expr(&nft_ct_type);
1391	if (err < 0)
1392		return err;
1393
1394	err = nft_register_expr(&nft_notrack_type);
1395	if (err < 0)
1396		goto err1;
1397
1398	err = nft_register_obj(&nft_ct_helper_obj_type);
1399	if (err < 0)
1400		goto err2;
1401
1402	err = nft_register_obj(&nft_ct_expect_obj_type);
1403	if (err < 0)
1404		goto err3;
1405#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1406	err = nft_register_obj(&nft_ct_timeout_obj_type);
1407	if (err < 0)
1408		goto err4;
1409#endif
1410	return 0;
1411
1412#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1413err4:
1414	nft_unregister_obj(&nft_ct_expect_obj_type);
1415#endif
1416err3:
1417	nft_unregister_obj(&nft_ct_helper_obj_type);
1418err2:
1419	nft_unregister_expr(&nft_notrack_type);
1420err1:
1421	nft_unregister_expr(&nft_ct_type);
1422	return err;
1423}
1424
1425static void __exit nft_ct_module_exit(void)
1426{
1427#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1428	nft_unregister_obj(&nft_ct_timeout_obj_type);
1429#endif
1430	nft_unregister_obj(&nft_ct_expect_obj_type);
1431	nft_unregister_obj(&nft_ct_helper_obj_type);
1432	nft_unregister_expr(&nft_notrack_type);
1433	nft_unregister_expr(&nft_ct_type);
1434}
1435
1436module_init(nft_ct_module_init);
1437module_exit(nft_ct_module_exit);
1438
1439MODULE_LICENSE("GPL");
1440MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1441MODULE_ALIAS_NFT_EXPR("ct");
1442MODULE_ALIAS_NFT_EXPR("notrack");
1443MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1444MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1445MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1446MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");