net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/netlink.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_conntrack.h>
  20 #include <net/netfilter/nf_conntrack_acct.h>
  21 #include <net/netfilter/nf_conntrack_tuple.h>
  22 #include <net/netfilter/nf_conntrack_helper.h>
  23 #include <net/netfilter/nf_conntrack_ecache.h>
  24 #include <net/netfilter/nf_conntrack_labels.h>
  25 #include <net/netfilter/nf_conntrack_timeout.h>
  26 #include <net/netfilter/nf_conntrack_l4proto.h>
  27
  28 struct nft_ct {
  29         enum nft_ct_keys        key:8;
  30         enum ip_conntrack_dir   dir:8;
  31         union {
  32                 enum nft_registers      dreg:8;
  33                 enum nft_registers      sreg:8;
  34         };
  35 };
  36
  37 struct nft_ct_helper_obj  {
  38         struct nf_conntrack_helper *helper4;
  39         struct nf_conntrack_helper *helper6;
  40         u8 l4proto;
  41 };
  42
  43 #ifdef CONFIG_NF_CONNTRACK_ZONES
  44 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  45 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  46 #endif
  47
  48 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  49                                    enum nft_ct_keys k,
  50                                    enum ip_conntrack_dir d)
  51 {
  52         if (d < IP_CT_DIR_MAX)
  53                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  54                                            atomic64_read(&c[d].packets);
  55
  56         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  57                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  58 }
  59
  60 static void nft_ct_get_eval(const struct nft_expr *expr,
  61                             struct nft_regs *regs,
  62                             const struct nft_pktinfo *pkt)
  63 {
  64         const struct nft_ct *priv = nft_expr_priv(expr);
  65         u32 *dest = &regs->data[priv->dreg];
  66         enum ip_conntrack_info ctinfo;
  67         const struct nf_conn *ct;
  68         const struct nf_conn_help *help;
  69         const struct nf_conntrack_tuple *tuple;
  70         const struct nf_conntrack_helper *helper;
  71         unsigned int state;
  72
  73         ct = nf_ct_get(pkt->skb, &ctinfo);
  74
  75         switch (priv->key) {
  76         case NFT_CT_STATE:
  77                 if (ct)
  78                         state = NF_CT_STATE_BIT(ctinfo);
  79                 else if (ctinfo == IP_CT_UNTRACKED)
  80                         state = NF_CT_STATE_UNTRACKED_BIT;
  81                 else
  82                         state = NF_CT_STATE_INVALID_BIT;
  83                 *dest = state;
  84                 return;
  85         default:
  86                 break;
  87         }
  88
  89         if (ct == NULL)
  90                 goto err;
  91
  92         switch (priv->key) {
  93         case NFT_CT_DIRECTION:
  94                 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
  95                 return;
  96         case NFT_CT_STATUS:
  97                 *dest = ct->status;
  98                 return;
  99 #ifdef CONFIG_NF_CONNTRACK_MARK
 100         case NFT_CT_MARK:
 101                 *dest = ct->mark;
 102                 return;
 103 #endif
 104 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 105         case NFT_CT_SECMARK:
 106                 *dest = ct->secmark;
 107                 return;
 108 #endif
 109         case NFT_CT_EXPIRATION:
 110                 *dest = jiffies_to_msecs(nf_ct_expires(ct));
 111                 return;
 112         case NFT_CT_HELPER:
 113                 if (ct->master == NULL)
 114                         goto err;
 115                 help = nfct_help(ct->master);
 116                 if (help == NULL)
 117                         goto err;
 118                 helper = rcu_dereference(help->helper);
 119                 if (helper == NULL)
 120                         goto err;
 121                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 122                 return;
 123 #ifdef CONFIG_NF_CONNTRACK_LABELS
 124         case NFT_CT_LABELS: {
 125                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 126
 127                 if (labels)
 128                         memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 129                 else
 130                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 131                 return;
 132         }
 133 #endif
 134         case NFT_CT_BYTES: /* fallthrough */
 135         case NFT_CT_PKTS: {
 136                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 137                 u64 count = 0;
 138
 139                 if (acct)
 140                         count = nft_ct_get_eval_counter(acct->counter,
 141                                                         priv->key, priv->dir);
 142                 memcpy(dest, &count, sizeof(count));
 143                 return;
 144         }
 145         case NFT_CT_AVGPKT: {
 146                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 147                 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 148
 149                 if (acct) {
 150                         pcnt = nft_ct_get_eval_counter(acct->counter,
 151                                                        NFT_CT_PKTS, priv->dir);
 152                         bcnt = nft_ct_get_eval_counter(acct->counter,
 153                                                        NFT_CT_BYTES, priv->dir);
 154                         if (pcnt != 0)
 155                                 avgcnt = div64_u64(bcnt, pcnt);
 156                 }
 157
 158                 memcpy(dest, &avgcnt, sizeof(avgcnt));
 159                 return;
 160         }
 161         case NFT_CT_L3PROTOCOL:
 162                 nft_reg_store8(dest, nf_ct_l3num(ct));
 163                 return;
 164         case NFT_CT_PROTOCOL:
 165                 nft_reg_store8(dest, nf_ct_protonum(ct));
 166                 return;
 167 #ifdef CONFIG_NF_CONNTRACK_ZONES
 168         case NFT_CT_ZONE: {
 169                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 170                 u16 zoneid;
 171
 172                 if (priv->dir < IP_CT_DIR_MAX)
 173                         zoneid = nf_ct_zone_id(zone, priv->dir);
 174                 else
 175                         zoneid = zone->id;
 176
 177                 nft_reg_store16(dest, zoneid);
 178                 return;
 179         }
 180 #endif
 181         default:
 182                 break;
 183         }
 184
 185         tuple = &ct->tuplehash[priv->dir].tuple;
 186         switch (priv->key) {
 187         case NFT_CT_SRC:
 188                 memcpy(dest, tuple->src.u3.all,
 189                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 190                 return;
 191         case NFT_CT_DST:
 192                 memcpy(dest, tuple->dst.u3.all,
 193                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 194                 return;
 195         case NFT_CT_PROTO_SRC:
 196                 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
 197                 return;
 198         case NFT_CT_PROTO_DST:
 199                 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
 200                 return;
 201         case NFT_CT_SRC_IP:
 202                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 203                         goto err;
 204                 *dest = tuple->src.u3.ip;
 205                 return;
 206         case NFT_CT_DST_IP:
 207                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 208                         goto err;
 209                 *dest = tuple->dst.u3.ip;
 210                 return;
 211         case NFT_CT_SRC_IP6:
 212                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 213                         goto err;
 214                 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
 215                 return;
 216         case NFT_CT_DST_IP6:
 217                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 218                         goto err;
 219                 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
 220                 return;
 221         default:
 222                 break;
 223         }
 224         return;
 225 err:
 226         regs->verdict.code = NFT_BREAK;
 227 }
 228
 229 #ifdef CONFIG_NF_CONNTRACK_ZONES
 230 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 231                                  struct nft_regs *regs,
 232                                  const struct nft_pktinfo *pkt)
 233 {
 234         struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 235         const struct nft_ct *priv = nft_expr_priv(expr);
 236         struct sk_buff *skb = pkt->skb;
 237         enum ip_conntrack_info ctinfo;
 238         u16 value = nft_reg_load16(&regs->data[priv->sreg]);
 239         struct nf_conn *ct;
 240
 241         ct = nf_ct_get(skb, &ctinfo);
 242         if (ct) /* already tracked */
 243                 return;
 244
 245         zone.id = value;
 246
 247         switch (priv->dir) {
 248         case IP_CT_DIR_ORIGINAL:
 249                 zone.dir = NF_CT_ZONE_DIR_ORIG;
 250                 break;
 251         case IP_CT_DIR_REPLY:
 252                 zone.dir = NF_CT_ZONE_DIR_REPL;
 253                 break;
 254         default:
 255                 break;
 256         }
 257
 258         ct = this_cpu_read(nft_ct_pcpu_template);
 259
 260         if (likely(atomic_read(&ct->ct_general.use) == 1)) {
 261                 nf_ct_zone_add(ct, &zone);
 262         } else {
 263                 /* previous skb got queued to userspace */
 264                 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 265                 if (!ct) {
 266                         regs->verdict.code = NF_DROP;
 267                         return;
 268                 }
 269         }
 270
 271         atomic_inc(&ct->ct_general.use);
 272         nf_ct_set(skb, ct, IP_CT_NEW);
 273 }
 274 #endif
 275
 276 static void nft_ct_set_eval(const struct nft_expr *expr,
 277                             struct nft_regs *regs,
 278                             const struct nft_pktinfo *pkt)
 279 {
 280         const struct nft_ct *priv = nft_expr_priv(expr);
 281         struct sk_buff *skb = pkt->skb;
 282 #ifdef CONFIG_NF_CONNTRACK_MARK
 283         u32 value = regs->data[priv->sreg];
 284 #endif
 285         enum ip_conntrack_info ctinfo;
 286         struct nf_conn *ct;
 287
 288         ct = nf_ct_get(skb, &ctinfo);
 289         if (ct == NULL || nf_ct_is_template(ct))
 290                 return;
 291
 292         switch (priv->key) {
 293 #ifdef CONFIG_NF_CONNTRACK_MARK
 294         case NFT_CT_MARK:
 295                 if (ct->mark != value) {
 296                         ct->mark = value;
 297                         nf_conntrack_event_cache(IPCT_MARK, ct);
 298                 }
 299                 break;
 300 #endif
 301 #ifdef CONFIG_NF_CONNTRACK_LABELS
 302         case NFT_CT_LABELS:
 303                 nf_connlabels_replace(ct,
 304                                       &regs->data[priv->sreg],
 305                                       &regs->data[priv->sreg],
 306                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 307                 break;
 308 #endif
 309 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 310         case NFT_CT_EVENTMASK: {
 311                 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
 312                 u32 ctmask = regs->data[priv->sreg];
 313
 314                 if (e) {
 315                         if (e->ctmask != ctmask)
 316                                 e->ctmask = ctmask;
 317                         break;
 318                 }
 319
 320                 if (ctmask && !nf_ct_is_confirmed(ct))
 321                         nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
 322                 break;
 323         }
 324 #endif
 325         default:
 326                 break;
 327         }
 328 }
 329
 330 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 331         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 332         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 333         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 334         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 335 };
 336
 337 #ifdef CONFIG_NF_CONNTRACK_ZONES
 338 static void nft_ct_tmpl_put_pcpu(void)
 339 {
 340         struct nf_conn *ct;
 341         int cpu;
 342
 343         for_each_possible_cpu(cpu) {
 344                 ct = per_cpu(nft_ct_pcpu_template, cpu);
 345                 if (!ct)
 346                         break;
 347                 nf_ct_put(ct);
 348                 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 349         }
 350 }
 351
 352 static bool nft_ct_tmpl_alloc_pcpu(void)
 353 {
 354         struct nf_conntrack_zone zone = { .id = 0 };
 355         struct nf_conn *tmp;
 356         int cpu;
 357
 358         if (nft_ct_pcpu_template_refcnt)
 359                 return true;
 360
 361         for_each_possible_cpu(cpu) {
 362                 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 363                 if (!tmp) {
 364                         nft_ct_tmpl_put_pcpu();
 365                         return false;
 366                 }
 367
 368                 atomic_set(&tmp->ct_general.use, 1);
 369                 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 370         }
 371
 372         return true;
 373 }
 374 #endif
 375
 376 static int nft_ct_get_init(const struct nft_ctx *ctx,
 377                            const struct nft_expr *expr,
 378                            const struct nlattr * const tb[])
 379 {
 380         struct nft_ct *priv = nft_expr_priv(expr);
 381         unsigned int len;
 382         int err;
 383
 384         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 385         priv->dir = IP_CT_DIR_MAX;
 386         switch (priv->key) {
 387         case NFT_CT_DIRECTION:
 388                 if (tb[NFTA_CT_DIRECTION] != NULL)
 389                         return -EINVAL;
 390                 len = sizeof(u8);
 391                 break;
 392         case NFT_CT_STATE:
 393         case NFT_CT_STATUS:
 394 #ifdef CONFIG_NF_CONNTRACK_MARK
 395         case NFT_CT_MARK:
 396 #endif
 397 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 398         case NFT_CT_SECMARK:
 399 #endif
 400         case NFT_CT_EXPIRATION:
 401                 if (tb[NFTA_CT_DIRECTION] != NULL)
 402                         return -EINVAL;
 403                 len = sizeof(u32);
 404                 break;
 405 #ifdef CONFIG_NF_CONNTRACK_LABELS
 406         case NFT_CT_LABELS:
 407                 if (tb[NFTA_CT_DIRECTION] != NULL)
 408                         return -EINVAL;
 409                 len = NF_CT_LABELS_MAX_SIZE;
 410                 break;
 411 #endif
 412         case NFT_CT_HELPER:
 413                 if (tb[NFTA_CT_DIRECTION] != NULL)
 414                         return -EINVAL;
 415                 len = NF_CT_HELPER_NAME_LEN;
 416                 break;
 417
 418         case NFT_CT_L3PROTOCOL:
 419         case NFT_CT_PROTOCOL:
 420                 /* For compatibility, do not report error if NFTA_CT_DIRECTION
 421                  * attribute is specified.
 422                  */
 423                 len = sizeof(u8);
 424                 break;
 425         case NFT_CT_SRC:
 426         case NFT_CT_DST:
 427                 if (tb[NFTA_CT_DIRECTION] == NULL)
 428                         return -EINVAL;
 429
 430                 switch (ctx->family) {
 431                 case NFPROTO_IPV4:
 432                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 433                                            src.u3.ip);
 434                         break;
 435                 case NFPROTO_IPV6:
 436                 case NFPROTO_INET:
 437                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 438                                            src.u3.ip6);
 439                         break;
 440                 default:
 441                         return -EAFNOSUPPORT;
 442                 }
 443                 break;
 444         case NFT_CT_SRC_IP:
 445         case NFT_CT_DST_IP:
 446                 if (tb[NFTA_CT_DIRECTION] == NULL)
 447                         return -EINVAL;
 448
 449                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip);
 450                 break;
 451         case NFT_CT_SRC_IP6:
 452         case NFT_CT_DST_IP6:
 453                 if (tb[NFTA_CT_DIRECTION] == NULL)
 454                         return -EINVAL;
 455
 456                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip6);
 457                 break;
 458         case NFT_CT_PROTO_SRC:
 459         case NFT_CT_PROTO_DST:
 460                 if (tb[NFTA_CT_DIRECTION] == NULL)
 461                         return -EINVAL;
 462                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
 463                 break;
 464         case NFT_CT_BYTES:
 465         case NFT_CT_PKTS:
 466         case NFT_CT_AVGPKT:
 467                 len = sizeof(u64);
 468                 break;
 469 #ifdef CONFIG_NF_CONNTRACK_ZONES
 470         case NFT_CT_ZONE:
 471                 len = sizeof(u16);
 472                 break;
 473 #endif
 474         default:
 475                 return -EOPNOTSUPP;
 476         }
 477
 478         if (tb[NFTA_CT_DIRECTION] != NULL) {
 479                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 480                 switch (priv->dir) {
 481                 case IP_CT_DIR_ORIGINAL:
 482                 case IP_CT_DIR_REPLY:
 483                         break;
 484                 default:
 485                         return -EINVAL;
 486                 }
 487         }
 488
 489         priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
 490         err = nft_validate_register_store(ctx, priv->dreg, NULL,
 491                                           NFT_DATA_VALUE, len);
 492         if (err < 0)
 493                 return err;
 494
 495         err = nf_ct_netns_get(ctx->net, ctx->family);
 496         if (err < 0)
 497                 return err;
 498
 499         if (priv->key == NFT_CT_BYTES ||
 500             priv->key == NFT_CT_PKTS  ||
 501             priv->key == NFT_CT_AVGPKT)
 502                 nf_ct_set_acct(ctx->net, true);
 503
 504         return 0;
 505 }
 506
 507 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 508 {
 509         switch (priv->key) {
 510 #ifdef CONFIG_NF_CONNTRACK_LABELS
 511         case NFT_CT_LABELS:
 512                 nf_connlabels_put(ctx->net);
 513                 break;
 514 #endif
 515 #ifdef CONFIG_NF_CONNTRACK_ZONES
 516         case NFT_CT_ZONE:
 517                 if (--nft_ct_pcpu_template_refcnt == 0)
 518                         nft_ct_tmpl_put_pcpu();
 519 #endif
 520         default:
 521                 break;
 522         }
 523 }
 524
 525 static int nft_ct_set_init(const struct nft_ctx *ctx,
 526                            const struct nft_expr *expr,
 527                            const struct nlattr * const tb[])
 528 {
 529         struct nft_ct *priv = nft_expr_priv(expr);
 530         unsigned int len;
 531         int err;
 532
 533         priv->dir = IP_CT_DIR_MAX;
 534         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 535         switch (priv->key) {
 536 #ifdef CONFIG_NF_CONNTRACK_MARK
 537         case NFT_CT_MARK:
 538                 if (tb[NFTA_CT_DIRECTION])
 539                         return -EINVAL;
 540                 len = FIELD_SIZEOF(struct nf_conn, mark);
 541                 break;
 542 #endif
 543 #ifdef CONFIG_NF_CONNTRACK_LABELS
 544         case NFT_CT_LABELS:
 545                 if (tb[NFTA_CT_DIRECTION])
 546                         return -EINVAL;
 547                 len = NF_CT_LABELS_MAX_SIZE;
 548                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 549                 if (err)
 550                         return err;
 551                 break;
 552 #endif
 553 #ifdef CONFIG_NF_CONNTRACK_ZONES
 554         case NFT_CT_ZONE:
 555                 if (!nft_ct_tmpl_alloc_pcpu())
 556                         return -ENOMEM;
 557                 nft_ct_pcpu_template_refcnt++;
 558                 len = sizeof(u16);
 559                 break;
 560 #endif
 561 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 562         case NFT_CT_EVENTMASK:
 563                 if (tb[NFTA_CT_DIRECTION])
 564                         return -EINVAL;
 565                 len = sizeof(u32);
 566                 break;
 567 #endif
 568         default:
 569                 return -EOPNOTSUPP;
 570         }
 571
 572         if (tb[NFTA_CT_DIRECTION]) {
 573                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 574                 switch (priv->dir) {
 575                 case IP_CT_DIR_ORIGINAL:
 576                 case IP_CT_DIR_REPLY:
 577                         break;
 578                 default:
 579                         err = -EINVAL;
 580                         goto err1;
 581                 }
 582         }
 583
 584         priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
 585         err = nft_validate_register_load(priv->sreg, len);
 586         if (err < 0)
 587                 goto err1;
 588
 589         err = nf_ct_netns_get(ctx->net, ctx->family);
 590         if (err < 0)
 591                 goto err1;
 592
 593         return 0;
 594
 595 err1:
 596         __nft_ct_set_destroy(ctx, priv);
 597         return err;
 598 }
 599
 600 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 601                                const struct nft_expr *expr)
 602 {
 603         nf_ct_netns_put(ctx->net, ctx->family);
 604 }
 605
 606 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 607                                const struct nft_expr *expr)
 608 {
 609         struct nft_ct *priv = nft_expr_priv(expr);
 610
 611         __nft_ct_set_destroy(ctx, priv);
 612         nf_ct_netns_put(ctx->net, ctx->family);
 613 }
 614
 615 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 616 {
 617         const struct nft_ct *priv = nft_expr_priv(expr);
 618
 619         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 620                 goto nla_put_failure;
 621         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 622                 goto nla_put_failure;
 623
 624         switch (priv->key) {
 625         case NFT_CT_SRC:
 626         case NFT_CT_DST:
 627         case NFT_CT_SRC_IP:
 628         case NFT_CT_DST_IP:
 629         case NFT_CT_SRC_IP6:
 630         case NFT_CT_DST_IP6:
 631         case NFT_CT_PROTO_SRC:
 632         case NFT_CT_PROTO_DST:
 633                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 634                         goto nla_put_failure;
 635                 break;
 636         case NFT_CT_BYTES:
 637         case NFT_CT_PKTS:
 638         case NFT_CT_AVGPKT:
 639         case NFT_CT_ZONE:
 640                 if (priv->dir < IP_CT_DIR_MAX &&
 641                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 642                         goto nla_put_failure;
 643                 break;
 644         default:
 645                 break;
 646         }
 647
 648         return 0;
 649
 650 nla_put_failure:
 651         return -1;
 652 }
 653
 654 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 655 {
 656         const struct nft_ct *priv = nft_expr_priv(expr);
 657
 658         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 659                 goto nla_put_failure;
 660         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 661                 goto nla_put_failure;
 662
 663         switch (priv->key) {
 664         case NFT_CT_ZONE:
 665                 if (priv->dir < IP_CT_DIR_MAX &&
 666                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 667                         goto nla_put_failure;
 668                 break;
 669         default:
 670                 break;
 671         }
 672
 673         return 0;
 674
 675 nla_put_failure:
 676         return -1;
 677 }
 678
 679 static struct nft_expr_type nft_ct_type;
 680 static const struct nft_expr_ops nft_ct_get_ops = {
 681         .type           = &nft_ct_type,
 682         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 683         .eval           = nft_ct_get_eval,
 684         .init           = nft_ct_get_init,
 685         .destroy        = nft_ct_get_destroy,
 686         .dump           = nft_ct_get_dump,
 687 };
 688
 689 static const struct nft_expr_ops nft_ct_set_ops = {
 690         .type           = &nft_ct_type,
 691         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 692         .eval           = nft_ct_set_eval,
 693         .init           = nft_ct_set_init,
 694         .destroy        = nft_ct_set_destroy,
 695         .dump           = nft_ct_set_dump,
 696 };
 697
 698 #ifdef CONFIG_NF_CONNTRACK_ZONES
 699 static const struct nft_expr_ops nft_ct_set_zone_ops = {
 700         .type           = &nft_ct_type,
 701         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 702         .eval           = nft_ct_set_zone_eval,
 703         .init           = nft_ct_set_init,
 704         .destroy        = nft_ct_set_destroy,
 705         .dump           = nft_ct_set_dump,
 706 };
 707 #endif
 708
 709 static const struct nft_expr_ops *
 710 nft_ct_select_ops(const struct nft_ctx *ctx,
 711                     const struct nlattr * const tb[])
 712 {
 713         if (tb[NFTA_CT_KEY] == NULL)
 714                 return ERR_PTR(-EINVAL);
 715
 716         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 717                 return ERR_PTR(-EINVAL);
 718
 719         if (tb[NFTA_CT_DREG])
 720                 return &nft_ct_get_ops;
 721
 722         if (tb[NFTA_CT_SREG]) {
 723 #ifdef CONFIG_NF_CONNTRACK_ZONES
 724                 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 725                         return &nft_ct_set_zone_ops;
 726 #endif
 727                 return &nft_ct_set_ops;
 728         }
 729
 730         return ERR_PTR(-EINVAL);
 731 }
 732
 733 static struct nft_expr_type nft_ct_type __read_mostly = {
 734         .name           = "ct",
 735         .select_ops     = nft_ct_select_ops,
 736         .policy         = nft_ct_policy,
 737         .maxattr        = NFTA_CT_MAX,
 738         .owner          = THIS_MODULE,
 739 };
 740
 741 static void nft_notrack_eval(const struct nft_expr *expr,
 742                              struct nft_regs *regs,
 743                              const struct nft_pktinfo *pkt)
 744 {
 745         struct sk_buff *skb = pkt->skb;
 746         enum ip_conntrack_info ctinfo;
 747         struct nf_conn *ct;
 748
 749         ct = nf_ct_get(pkt->skb, &ctinfo);
 750         /* Previously seen (loopback or untracked)?  Ignore. */
 751         if (ct || ctinfo == IP_CT_UNTRACKED)
 752                 return;
 753
 754         nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 755 }
 756
 757 static struct nft_expr_type nft_notrack_type;
 758 static const struct nft_expr_ops nft_notrack_ops = {
 759         .type           = &nft_notrack_type,
 760         .size           = NFT_EXPR_SIZE(0),
 761         .eval           = nft_notrack_eval,
 762 };
 763
 764 static struct nft_expr_type nft_notrack_type __read_mostly = {
 765         .name           = "notrack",
 766         .ops            = &nft_notrack_ops,
 767         .owner          = THIS_MODULE,
 768 };
 769
 770 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 771 static int
 772 nft_ct_timeout_parse_policy(void *timeouts,
 773                             const struct nf_conntrack_l4proto *l4proto,
 774                             struct net *net, const struct nlattr *attr)
 775 {
 776         struct nlattr **tb;
 777         int ret = 0;
 778
 779         if (!l4proto->ctnl_timeout.nlattr_to_obj)
 780                 return 0;
 781
 782         tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
 783                      GFP_KERNEL);
 784
 785         if (!tb)
 786                 return -ENOMEM;
 787
 788         ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
 789                                attr, l4proto->ctnl_timeout.nla_policy,
 790                                NULL);
 791         if (ret < 0)
 792                 goto err;
 793
 794         ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 795
 796 err:
 797         kfree(tb);
 798         return ret;
 799 }
 800
 801 struct nft_ct_timeout_obj {
 802         struct nf_ct_timeout    *timeout;
 803         u8                      l4proto;
 804 };
 805
 806 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 807                                     struct nft_regs *regs,
 808                                     const struct nft_pktinfo *pkt)
 809 {
 810         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 811         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
 812         struct nf_conn_timeout *timeout;
 813         const unsigned int *values;
 814
 815         if (priv->l4proto != pkt->tprot)
 816                 return;
 817
 818         if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
 819                 return;
 820
 821         timeout = nf_ct_timeout_find(ct);
 822         if (!timeout) {
 823                 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
 824                 if (!timeout) {
 825                         regs->verdict.code = NF_DROP;
 826                         return;
 827                 }
 828         }
 829
 830         rcu_assign_pointer(timeout->timeout, priv->timeout);
 831
 832         /* adjust the timeout as per 'new' state. ct is unconfirmed,
 833          * so the current timestamp must not be added.
 834          */
 835         values = nf_ct_timeout_data(timeout);
 836         if (values)
 837                 nf_ct_refresh(ct, pkt->skb, values[0]);
 838 }
 839
 840 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 841                                    const struct nlattr * const tb[],
 842                                    struct nft_object *obj)
 843 {
 844         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 845         const struct nf_conntrack_l4proto *l4proto;
 846         struct nf_ct_timeout *timeout;
 847         int l3num = ctx->family;
 848         __u8 l4num;
 849         int ret;
 850
 851         if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
 852             !tb[NFTA_CT_TIMEOUT_DATA])
 853                 return -EINVAL;
 854
 855         if (tb[NFTA_CT_TIMEOUT_L3PROTO])
 856                 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
 857
 858         l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
 859         priv->l4proto = l4num;
 860
 861         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
 862
 863         if (l4proto->l4proto != l4num) {
 864                 ret = -EOPNOTSUPP;
 865                 goto err_proto_put;
 866         }
 867
 868         timeout = kzalloc(sizeof(struct nf_ct_timeout) +
 869                           l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
 870         if (timeout == NULL) {
 871                 ret = -ENOMEM;
 872                 goto err_proto_put;
 873         }
 874
 875         ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
 876                                           tb[NFTA_CT_TIMEOUT_DATA]);
 877         if (ret < 0)
 878                 goto err_free_timeout;
 879
 880         timeout->l3num = l3num;
 881         timeout->l4proto = l4proto;
 882
 883         ret = nf_ct_netns_get(ctx->net, ctx->family);
 884         if (ret < 0)
 885                 goto err_free_timeout;
 886
 887         priv->timeout = timeout;
 888         return 0;
 889
 890 err_free_timeout:
 891         kfree(timeout);
 892 err_proto_put:
 893         nf_ct_l4proto_put(l4proto);
 894         return ret;
 895 }
 896
 897 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
 898                                        struct nft_object *obj)
 899 {
 900         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 901         struct nf_ct_timeout *timeout = priv->timeout;
 902
 903         nf_ct_untimeout(ctx->net, timeout);
 904         nf_ct_l4proto_put(timeout->l4proto);
 905         nf_ct_netns_put(ctx->net, ctx->family);
 906         kfree(priv->timeout);
 907 }
 908
 909 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
 910                                    struct nft_object *obj, bool reset)
 911 {
 912         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 913         const struct nf_ct_timeout *timeout = priv->timeout;
 914         struct nlattr *nest_params;
 915         int ret;
 916
 917         if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
 918             nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
 919                 return -1;
 920
 921         nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA | NLA_F_NESTED);
 922         if (!nest_params)
 923                 return -1;
 924
 925         ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
 926         if (ret < 0)
 927                 return -1;
 928         nla_nest_end(skb, nest_params);
 929         return 0;
 930 }
 931
 932 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
 933         [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
 934         [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
 935         [NFTA_CT_TIMEOUT_DATA]    = {.type = NLA_NESTED },
 936 };
 937
 938 static struct nft_object_type nft_ct_timeout_obj_type;
 939
 940 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
 941         .type           = &nft_ct_timeout_obj_type,
 942         .size           = sizeof(struct nft_ct_timeout_obj),
 943         .eval           = nft_ct_timeout_obj_eval,
 944         .init           = nft_ct_timeout_obj_init,
 945         .destroy        = nft_ct_timeout_obj_destroy,
 946         .dump           = nft_ct_timeout_obj_dump,
 947 };
 948
 949 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
 950         .type           = NFT_OBJECT_CT_TIMEOUT,
 951         .ops            = &nft_ct_timeout_obj_ops,
 952         .maxattr        = NFTA_CT_TIMEOUT_MAX,
 953         .policy         = nft_ct_timeout_policy,
 954         .owner          = THIS_MODULE,
 955 };
 956 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 957
 958 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
 959                                   const struct nlattr * const tb[],
 960                                   struct nft_object *obj)
 961 {
 962         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 963         struct nf_conntrack_helper *help4, *help6;
 964         char name[NF_CT_HELPER_NAME_LEN];
 965         int family = ctx->family;
 966         int err;
 967
 968         if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
 969                 return -EINVAL;
 970
 971         priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
 972         if (!priv->l4proto)
 973                 return -ENOENT;
 974
 975         nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
 976
 977         if (tb[NFTA_CT_HELPER_L3PROTO])
 978                 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
 979
 980         help4 = NULL;
 981         help6 = NULL;
 982
 983         switch (family) {
 984         case NFPROTO_IPV4:
 985                 if (ctx->family == NFPROTO_IPV6)
 986                         return -EINVAL;
 987
 988                 help4 = nf_conntrack_helper_try_module_get(name, family,
 989                                                            priv->l4proto);
 990                 break;
 991         case NFPROTO_IPV6:
 992                 if (ctx->family == NFPROTO_IPV4)
 993                         return -EINVAL;
 994
 995                 help6 = nf_conntrack_helper_try_module_get(name, family,
 996                                                            priv->l4proto);
 997                 break;
 998         case NFPROTO_NETDEV: /* fallthrough */
 999         case NFPROTO_BRIDGE: /* same */
1000         case NFPROTO_INET:
1001                 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1002                                                            priv->l4proto);
1003                 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1004                                                            priv->l4proto);
1005                 break;
1006         default:
1007                 return -EAFNOSUPPORT;
1008         }
1009
1010         /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1011         if (!help4 && !help6)
1012                 return -ENOENT;
1013
1014         priv->helper4 = help4;
1015         priv->helper6 = help6;
1016
1017         err = nf_ct_netns_get(ctx->net, ctx->family);
1018         if (err < 0)
1019                 goto err_put_helper;
1020
1021         return 0;
1022
1023 err_put_helper:
1024         if (priv->helper4)
1025                 nf_conntrack_helper_put(priv->helper4);
1026         if (priv->helper6)
1027                 nf_conntrack_helper_put(priv->helper6);
1028         return err;
1029 }
1030
1031 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1032                                       struct nft_object *obj)
1033 {
1034         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1035
1036         if (priv->helper4)
1037                 nf_conntrack_helper_put(priv->helper4);
1038         if (priv->helper6)
1039                 nf_conntrack_helper_put(priv->helper6);
1040
1041         nf_ct_netns_put(ctx->net, ctx->family);
1042 }
1043
1044 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1045                                    struct nft_regs *regs,
1046                                    const struct nft_pktinfo *pkt)
1047 {
1048         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1049         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1050         struct nf_conntrack_helper *to_assign = NULL;
1051         struct nf_conn_help *help;
1052
1053         if (!ct ||
1054             nf_ct_is_confirmed(ct) ||
1055             nf_ct_is_template(ct) ||
1056             priv->l4proto != nf_ct_protonum(ct))
1057                 return;
1058
1059         switch (nf_ct_l3num(ct)) {
1060         case NFPROTO_IPV4:
1061                 to_assign = priv->helper4;
1062                 break;
1063         case NFPROTO_IPV6:
1064                 to_assign = priv->helper6;
1065                 break;
1066         default:
1067                 WARN_ON_ONCE(1);
1068                 return;
1069         }
1070
1071         if (!to_assign)
1072                 return;
1073
1074         if (test_bit(IPS_HELPER_BIT, &ct->status))
1075                 return;
1076
1077         help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1078         if (help) {
1079                 rcu_assign_pointer(help->helper, to_assign);
1080                 set_bit(IPS_HELPER_BIT, &ct->status);
1081         }
1082 }
1083
1084 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1085                                   struct nft_object *obj, bool reset)
1086 {
1087         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1088         const struct nf_conntrack_helper *helper;
1089         u16 family;
1090
1091         if (priv->helper4 && priv->helper6) {
1092                 family = NFPROTO_INET;
1093                 helper = priv->helper4;
1094         } else if (priv->helper6) {
1095                 family = NFPROTO_IPV6;
1096                 helper = priv->helper6;
1097         } else {
1098                 family = NFPROTO_IPV4;
1099                 helper = priv->helper4;
1100         }
1101
1102         if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1103                 return -1;
1104
1105         if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1106                 return -1;
1107
1108         if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1109                 return -1;
1110
1111         return 0;
1112 }
1113
1114 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1115         [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1116                                   .len = NF_CT_HELPER_NAME_LEN - 1 },
1117         [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1118         [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1119 };
1120
1121 static struct nft_object_type nft_ct_helper_obj_type;
1122 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1123         .type           = &nft_ct_helper_obj_type,
1124         .size           = sizeof(struct nft_ct_helper_obj),
1125         .eval           = nft_ct_helper_obj_eval,
1126         .init           = nft_ct_helper_obj_init,
1127         .destroy        = nft_ct_helper_obj_destroy,
1128         .dump           = nft_ct_helper_obj_dump,
1129 };
1130
1131 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1132         .type           = NFT_OBJECT_CT_HELPER,
1133         .ops            = &nft_ct_helper_obj_ops,
1134         .maxattr        = NFTA_CT_HELPER_MAX,
1135         .policy         = nft_ct_helper_policy,
1136         .owner          = THIS_MODULE,
1137 };
1138
1139 static int __init nft_ct_module_init(void)
1140 {
1141         int err;
1142
1143         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1144
1145         err = nft_register_expr(&nft_ct_type);
1146         if (err < 0)
1147                 return err;
1148
1149         err = nft_register_expr(&nft_notrack_type);
1150         if (err < 0)
1151                 goto err1;
1152
1153         err = nft_register_obj(&nft_ct_helper_obj_type);
1154         if (err < 0)
1155                 goto err2;
1156 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1157         err = nft_register_obj(&nft_ct_timeout_obj_type);
1158         if (err < 0)
1159                 goto err3;
1160 #endif
1161         return 0;
1162
1163 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1164 err3:
1165         nft_unregister_obj(&nft_ct_helper_obj_type);
1166 #endif
1167 err2:
1168         nft_unregister_expr(&nft_notrack_type);
1169 err1:
1170         nft_unregister_expr(&nft_ct_type);
1171         return err;
1172 }
1173
1174 static void __exit nft_ct_module_exit(void)
1175 {
1176 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1177         nft_unregister_obj(&nft_ct_timeout_obj_type);
1178 #endif
1179         nft_unregister_obj(&nft_ct_helper_obj_type);
1180         nft_unregister_expr(&nft_notrack_type);
1181         nft_unregister_expr(&nft_ct_type);
1182 }
1183
1184 module_init(nft_ct_module_init);
1185 module_exit(nft_ct_module_exit);
1186
1187 MODULE_LICENSE("GPL");
1188 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1189 MODULE_ALIAS_NFT_EXPR("ct");
1190 MODULE_ALIAS_NFT_EXPR("notrack");
1191 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1192 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);