net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/netlink.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_conntrack.h>
  20 #include <net/netfilter/nf_conntrack_acct.h>
  21 #include <net/netfilter/nf_conntrack_tuple.h>
  22 #include <net/netfilter/nf_conntrack_helper.h>
  23 #include <net/netfilter/nf_conntrack_ecache.h>
  24 #include <net/netfilter/nf_conntrack_labels.h>
  25 #include <net/netfilter/nf_conntrack_timeout.h>
  26 #include <net/netfilter/nf_conntrack_l4proto.h>
  27
  28 struct nft_ct {
  29         enum nft_ct_keys        key:8;
  30         enum ip_conntrack_dir   dir:8;
  31         union {
  32                 u8              dreg;
  33                 u8              sreg;
  34         };
  35 };
  36
  37 struct nft_ct_helper_obj  {
  38         struct nf_conntrack_helper *helper4;
  39         struct nf_conntrack_helper *helper6;
  40         u8 l4proto;
  41 };
  42
  43 #ifdef CONFIG_NF_CONNTRACK_ZONES
  44 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  45 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  46 #endif
  47
  48 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  49                                    enum nft_ct_keys k,
  50                                    enum ip_conntrack_dir d)
  51 {
  52         if (d < IP_CT_DIR_MAX)
  53                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  54                                            atomic64_read(&c[d].packets);
  55
  56         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  57                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  58 }
  59
  60 static void nft_ct_get_eval(const struct nft_expr *expr,
  61                             struct nft_regs *regs,
  62                             const struct nft_pktinfo *pkt)
  63 {
  64         const struct nft_ct *priv = nft_expr_priv(expr);
  65         u32 *dest = &regs->data[priv->dreg];
  66         enum ip_conntrack_info ctinfo;
  67         const struct nf_conn *ct;
  68         const struct nf_conn_help *help;
  69         const struct nf_conntrack_tuple *tuple;
  70         const struct nf_conntrack_helper *helper;
  71         unsigned int state;
  72
  73         ct = nf_ct_get(pkt->skb, &ctinfo);
  74
  75         switch (priv->key) {
  76         case NFT_CT_STATE:
  77                 if (ct)
  78                         state = NF_CT_STATE_BIT(ctinfo);
  79                 else if (ctinfo == IP_CT_UNTRACKED)
  80                         state = NF_CT_STATE_UNTRACKED_BIT;
  81                 else
  82                         state = NF_CT_STATE_INVALID_BIT;
  83                 *dest = state;
  84                 return;
  85         default:
  86                 break;
  87         }
  88
  89         if (ct == NULL)
  90                 goto err;
  91
  92         switch (priv->key) {
  93         case NFT_CT_DIRECTION:
  94                 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
  95                 return;
  96         case NFT_CT_STATUS:
  97                 *dest = ct->status;
  98                 return;
  99 #ifdef CONFIG_NF_CONNTRACK_MARK
 100         case NFT_CT_MARK:
 101                 *dest = ct->mark;
 102                 return;
 103 #endif
 104 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 105         case NFT_CT_SECMARK:
 106                 *dest = ct->secmark;
 107                 return;
 108 #endif
 109         case NFT_CT_EXPIRATION:
 110                 *dest = jiffies_to_msecs(nf_ct_expires(ct));
 111                 return;
 112         case NFT_CT_HELPER:
 113                 if (ct->master == NULL)
 114                         goto err;
 115                 help = nfct_help(ct->master);
 116                 if (help == NULL)
 117                         goto err;
 118                 helper = rcu_dereference(help->helper);
 119                 if (helper == NULL)
 120                         goto err;
 121                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 122                 return;
 123 #ifdef CONFIG_NF_CONNTRACK_LABELS
 124         case NFT_CT_LABELS: {
 125                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 126
 127                 if (labels)
 128                         memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 129                 else
 130                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 131                 return;
 132         }
 133 #endif
 134         case NFT_CT_BYTES: /* fallthrough */
 135         case NFT_CT_PKTS: {
 136                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 137                 u64 count = 0;
 138
 139                 if (acct)
 140                         count = nft_ct_get_eval_counter(acct->counter,
 141                                                         priv->key, priv->dir);
 142                 memcpy(dest, &count, sizeof(count));
 143                 return;
 144         }
 145         case NFT_CT_AVGPKT: {
 146                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 147                 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 148
 149                 if (acct) {
 150                         pcnt = nft_ct_get_eval_counter(acct->counter,
 151                                                        NFT_CT_PKTS, priv->dir);
 152                         bcnt = nft_ct_get_eval_counter(acct->counter,
 153                                                        NFT_CT_BYTES, priv->dir);
 154                         if (pcnt != 0)
 155                                 avgcnt = div64_u64(bcnt, pcnt);
 156                 }
 157
 158                 memcpy(dest, &avgcnt, sizeof(avgcnt));
 159                 return;
 160         }
 161         case NFT_CT_L3PROTOCOL:
 162                 nft_reg_store8(dest, nf_ct_l3num(ct));
 163                 return;
 164         case NFT_CT_PROTOCOL:
 165                 nft_reg_store8(dest, nf_ct_protonum(ct));
 166                 return;
 167 #ifdef CONFIG_NF_CONNTRACK_ZONES
 168         case NFT_CT_ZONE: {
 169                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 170                 u16 zoneid;
 171
 172                 if (priv->dir < IP_CT_DIR_MAX)
 173                         zoneid = nf_ct_zone_id(zone, priv->dir);
 174                 else
 175                         zoneid = zone->id;
 176
 177                 nft_reg_store16(dest, zoneid);
 178                 return;
 179         }
 180 #endif
 181         default:
 182                 break;
 183         }
 184
 185         tuple = &ct->tuplehash[priv->dir].tuple;
 186         switch (priv->key) {
 187         case NFT_CT_SRC:
 188                 memcpy(dest, tuple->src.u3.all,
 189                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 190                 return;
 191         case NFT_CT_DST:
 192                 memcpy(dest, tuple->dst.u3.all,
 193                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 194                 return;
 195         case NFT_CT_PROTO_SRC:
 196                 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
 197                 return;
 198         case NFT_CT_PROTO_DST:
 199                 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
 200                 return;
 201         case NFT_CT_SRC_IP:
 202                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 203                         goto err;
 204                 *dest = tuple->src.u3.ip;
 205                 return;
 206         case NFT_CT_DST_IP:
 207                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 208                         goto err;
 209                 *dest = tuple->dst.u3.ip;
 210                 return;
 211         case NFT_CT_SRC_IP6:
 212                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 213                         goto err;
 214                 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
 215                 return;
 216         case NFT_CT_DST_IP6:
 217                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 218                         goto err;
 219                 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
 220                 return;
 221         default:
 222                 break;
 223         }
 224         return;
 225 err:
 226         regs->verdict.code = NFT_BREAK;
 227 }
 228
 229 #ifdef CONFIG_NF_CONNTRACK_ZONES
 230 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 231                                  struct nft_regs *regs,
 232                                  const struct nft_pktinfo *pkt)
 233 {
 234         struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 235         const struct nft_ct *priv = nft_expr_priv(expr);
 236         struct sk_buff *skb = pkt->skb;
 237         enum ip_conntrack_info ctinfo;
 238         u16 value = nft_reg_load16(&regs->data[priv->sreg]);
 239         struct nf_conn *ct;
 240
 241         ct = nf_ct_get(skb, &ctinfo);
 242         if (ct) /* already tracked */
 243                 return;
 244
 245         zone.id = value;
 246
 247         switch (priv->dir) {
 248         case IP_CT_DIR_ORIGINAL:
 249                 zone.dir = NF_CT_ZONE_DIR_ORIG;
 250                 break;
 251         case IP_CT_DIR_REPLY:
 252                 zone.dir = NF_CT_ZONE_DIR_REPL;
 253                 break;
 254         default:
 255                 break;
 256         }
 257
 258         ct = this_cpu_read(nft_ct_pcpu_template);
 259
 260         if (likely(atomic_read(&ct->ct_general.use) == 1)) {
 261                 nf_ct_zone_add(ct, &zone);
 262         } else {
 263                 /* previous skb got queued to userspace */
 264                 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 265                 if (!ct) {
 266                         regs->verdict.code = NF_DROP;
 267                         return;
 268                 }
 269         }
 270
 271         atomic_inc(&ct->ct_general.use);
 272         nf_ct_set(skb, ct, IP_CT_NEW);
 273 }
 274 #endif
 275
 276 static void nft_ct_set_eval(const struct nft_expr *expr,
 277                             struct nft_regs *regs,
 278                             const struct nft_pktinfo *pkt)
 279 {
 280         const struct nft_ct *priv = nft_expr_priv(expr);
 281         struct sk_buff *skb = pkt->skb;
 282 #ifdef CONFIG_NF_CONNTRACK_MARK
 283         u32 value = regs->data[priv->sreg];
 284 #endif
 285         enum ip_conntrack_info ctinfo;
 286         struct nf_conn *ct;
 287
 288         ct = nf_ct_get(skb, &ctinfo);
 289         if (ct == NULL || nf_ct_is_template(ct))
 290                 return;
 291
 292         switch (priv->key) {
 293 #ifdef CONFIG_NF_CONNTRACK_MARK
 294         case NFT_CT_MARK:
 295                 if (ct->mark != value) {
 296                         ct->mark = value;
 297                         nf_conntrack_event_cache(IPCT_MARK, ct);
 298                 }
 299                 break;
 300 #endif
 301 #ifdef CONFIG_NF_CONNTRACK_LABELS
 302         case NFT_CT_LABELS:
 303                 nf_connlabels_replace(ct,
 304                                       &regs->data[priv->sreg],
 305                                       &regs->data[priv->sreg],
 306                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 307                 break;
 308 #endif
 309 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 310         case NFT_CT_EVENTMASK: {
 311                 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
 312                 u32 ctmask = regs->data[priv->sreg];
 313
 314                 if (e) {
 315                         if (e->ctmask != ctmask)
 316                                 e->ctmask = ctmask;
 317                         break;
 318                 }
 319
 320                 if (ctmask && !nf_ct_is_confirmed(ct))
 321                         nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
 322                 break;
 323         }
 324 #endif
 325         default:
 326                 break;
 327         }
 328 }
 329
 330 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 331         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 332         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 333         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 334         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 335 };
 336
 337 #ifdef CONFIG_NF_CONNTRACK_ZONES
 338 static void nft_ct_tmpl_put_pcpu(void)
 339 {
 340         struct nf_conn *ct;
 341         int cpu;
 342
 343         for_each_possible_cpu(cpu) {
 344                 ct = per_cpu(nft_ct_pcpu_template, cpu);
 345                 if (!ct)
 346                         break;
 347                 nf_ct_put(ct);
 348                 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 349         }
 350 }
 351
 352 static bool nft_ct_tmpl_alloc_pcpu(void)
 353 {
 354         struct nf_conntrack_zone zone = { .id = 0 };
 355         struct nf_conn *tmp;
 356         int cpu;
 357
 358         if (nft_ct_pcpu_template_refcnt)
 359                 return true;
 360
 361         for_each_possible_cpu(cpu) {
 362                 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 363                 if (!tmp) {
 364                         nft_ct_tmpl_put_pcpu();
 365                         return false;
 366                 }
 367
 368                 atomic_set(&tmp->ct_general.use, 1);
 369                 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 370         }
 371
 372         return true;
 373 }
 374 #endif
 375
 376 static int nft_ct_get_init(const struct nft_ctx *ctx,
 377                            const struct nft_expr *expr,
 378                            const struct nlattr * const tb[])
 379 {
 380         struct nft_ct *priv = nft_expr_priv(expr);
 381         unsigned int len;
 382         int err;
 383
 384         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 385         priv->dir = IP_CT_DIR_MAX;
 386         switch (priv->key) {
 387         case NFT_CT_DIRECTION:
 388                 if (tb[NFTA_CT_DIRECTION] != NULL)
 389                         return -EINVAL;
 390                 len = sizeof(u8);
 391                 break;
 392         case NFT_CT_STATE:
 393         case NFT_CT_STATUS:
 394 #ifdef CONFIG_NF_CONNTRACK_MARK
 395         case NFT_CT_MARK:
 396 #endif
 397 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 398         case NFT_CT_SECMARK:
 399 #endif
 400         case NFT_CT_EXPIRATION:
 401                 if (tb[NFTA_CT_DIRECTION] != NULL)
 402                         return -EINVAL;
 403                 len = sizeof(u32);
 404                 break;
 405 #ifdef CONFIG_NF_CONNTRACK_LABELS
 406         case NFT_CT_LABELS:
 407                 if (tb[NFTA_CT_DIRECTION] != NULL)
 408                         return -EINVAL;
 409                 len = NF_CT_LABELS_MAX_SIZE;
 410                 break;
 411 #endif
 412         case NFT_CT_HELPER:
 413                 if (tb[NFTA_CT_DIRECTION] != NULL)
 414                         return -EINVAL;
 415                 len = NF_CT_HELPER_NAME_LEN;
 416                 break;
 417
 418         case NFT_CT_L3PROTOCOL:
 419         case NFT_CT_PROTOCOL:
 420                 /* For compatibility, do not report error if NFTA_CT_DIRECTION
 421                  * attribute is specified.
 422                  */
 423                 len = sizeof(u8);
 424                 break;
 425         case NFT_CT_SRC:
 426         case NFT_CT_DST:
 427                 if (tb[NFTA_CT_DIRECTION] == NULL)
 428                         return -EINVAL;
 429
 430                 switch (ctx->family) {
 431                 case NFPROTO_IPV4:
 432                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 433                                            src.u3.ip);
 434                         break;
 435                 case NFPROTO_IPV6:
 436                 case NFPROTO_INET:
 437                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 438                                            src.u3.ip6);
 439                         break;
 440                 default:
 441                         return -EAFNOSUPPORT;
 442                 }
 443                 break;
 444         case NFT_CT_SRC_IP:
 445         case NFT_CT_DST_IP:
 446                 if (tb[NFTA_CT_DIRECTION] == NULL)
 447                         return -EINVAL;
 448
 449                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip);
 450                 break;
 451         case NFT_CT_SRC_IP6:
 452         case NFT_CT_DST_IP6:
 453                 if (tb[NFTA_CT_DIRECTION] == NULL)
 454                         return -EINVAL;
 455
 456                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip6);
 457                 break;
 458         case NFT_CT_PROTO_SRC:
 459         case NFT_CT_PROTO_DST:
 460                 if (tb[NFTA_CT_DIRECTION] == NULL)
 461                         return -EINVAL;
 462                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
 463                 break;
 464         case NFT_CT_BYTES:
 465         case NFT_CT_PKTS:
 466         case NFT_CT_AVGPKT:
 467                 len = sizeof(u64);
 468                 break;
 469 #ifdef CONFIG_NF_CONNTRACK_ZONES
 470         case NFT_CT_ZONE:
 471                 len = sizeof(u16);
 472                 break;
 473 #endif
 474         default:
 475                 return -EOPNOTSUPP;
 476         }
 477
 478         if (tb[NFTA_CT_DIRECTION] != NULL) {
 479                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 480                 switch (priv->dir) {
 481                 case IP_CT_DIR_ORIGINAL:
 482                 case IP_CT_DIR_REPLY:
 483                         break;
 484                 default:
 485                         return -EINVAL;
 486                 }
 487         }
 488
 489         err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
 490                                        NFT_DATA_VALUE, len);
 491         if (err < 0)
 492                 return err;
 493
 494         err = nf_ct_netns_get(ctx->net, ctx->family);
 495         if (err < 0)
 496                 return err;
 497
 498         if (priv->key == NFT_CT_BYTES ||
 499             priv->key == NFT_CT_PKTS  ||
 500             priv->key == NFT_CT_AVGPKT)
 501                 nf_ct_set_acct(ctx->net, true);
 502
 503         return 0;
 504 }
 505
 506 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 507 {
 508         switch (priv->key) {
 509 #ifdef CONFIG_NF_CONNTRACK_LABELS
 510         case NFT_CT_LABELS:
 511                 nf_connlabels_put(ctx->net);
 512                 break;
 513 #endif
 514 #ifdef CONFIG_NF_CONNTRACK_ZONES
 515         case NFT_CT_ZONE:
 516                 if (--nft_ct_pcpu_template_refcnt == 0)
 517                         nft_ct_tmpl_put_pcpu();
 518 #endif
 519         default:
 520                 break;
 521         }
 522 }
 523
 524 static int nft_ct_set_init(const struct nft_ctx *ctx,
 525                            const struct nft_expr *expr,
 526                            const struct nlattr * const tb[])
 527 {
 528         struct nft_ct *priv = nft_expr_priv(expr);
 529         unsigned int len;
 530         int err;
 531
 532         priv->dir = IP_CT_DIR_MAX;
 533         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 534         switch (priv->key) {
 535 #ifdef CONFIG_NF_CONNTRACK_MARK
 536         case NFT_CT_MARK:
 537                 if (tb[NFTA_CT_DIRECTION])
 538                         return -EINVAL;
 539                 len = FIELD_SIZEOF(struct nf_conn, mark);
 540                 break;
 541 #endif
 542 #ifdef CONFIG_NF_CONNTRACK_LABELS
 543         case NFT_CT_LABELS:
 544                 if (tb[NFTA_CT_DIRECTION])
 545                         return -EINVAL;
 546                 len = NF_CT_LABELS_MAX_SIZE;
 547                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 548                 if (err)
 549                         return err;
 550                 break;
 551 #endif
 552 #ifdef CONFIG_NF_CONNTRACK_ZONES
 553         case NFT_CT_ZONE:
 554                 if (!nft_ct_tmpl_alloc_pcpu())
 555                         return -ENOMEM;
 556                 nft_ct_pcpu_template_refcnt++;
 557                 len = sizeof(u16);
 558                 break;
 559 #endif
 560 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 561         case NFT_CT_EVENTMASK:
 562                 if (tb[NFTA_CT_DIRECTION])
 563                         return -EINVAL;
 564                 len = sizeof(u32);
 565                 break;
 566 #endif
 567         default:
 568                 return -EOPNOTSUPP;
 569         }
 570
 571         if (tb[NFTA_CT_DIRECTION]) {
 572                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 573                 switch (priv->dir) {
 574                 case IP_CT_DIR_ORIGINAL:
 575                 case IP_CT_DIR_REPLY:
 576                         break;
 577                 default:
 578                         err = -EINVAL;
 579                         goto err1;
 580                 }
 581         }
 582
 583         err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
 584         if (err < 0)
 585                 goto err1;
 586
 587         err = nf_ct_netns_get(ctx->net, ctx->family);
 588         if (err < 0)
 589                 goto err1;
 590
 591         return 0;
 592
 593 err1:
 594         __nft_ct_set_destroy(ctx, priv);
 595         return err;
 596 }
 597
 598 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 599                                const struct nft_expr *expr)
 600 {
 601         nf_ct_netns_put(ctx->net, ctx->family);
 602 }
 603
 604 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 605                                const struct nft_expr *expr)
 606 {
 607         struct nft_ct *priv = nft_expr_priv(expr);
 608
 609         __nft_ct_set_destroy(ctx, priv);
 610         nf_ct_netns_put(ctx->net, ctx->family);
 611 }
 612
 613 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 614 {
 615         const struct nft_ct *priv = nft_expr_priv(expr);
 616
 617         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 618                 goto nla_put_failure;
 619         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 620                 goto nla_put_failure;
 621
 622         switch (priv->key) {
 623         case NFT_CT_SRC:
 624         case NFT_CT_DST:
 625         case NFT_CT_SRC_IP:
 626         case NFT_CT_DST_IP:
 627         case NFT_CT_SRC_IP6:
 628         case NFT_CT_DST_IP6:
 629         case NFT_CT_PROTO_SRC:
 630         case NFT_CT_PROTO_DST:
 631                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 632                         goto nla_put_failure;
 633                 break;
 634         case NFT_CT_BYTES:
 635         case NFT_CT_PKTS:
 636         case NFT_CT_AVGPKT:
 637         case NFT_CT_ZONE:
 638                 if (priv->dir < IP_CT_DIR_MAX &&
 639                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 640                         goto nla_put_failure;
 641                 break;
 642         default:
 643                 break;
 644         }
 645
 646         return 0;
 647
 648 nla_put_failure:
 649         return -1;
 650 }
 651
 652 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 653 {
 654         const struct nft_ct *priv = nft_expr_priv(expr);
 655
 656         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 657                 goto nla_put_failure;
 658         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 659                 goto nla_put_failure;
 660
 661         switch (priv->key) {
 662         case NFT_CT_ZONE:
 663                 if (priv->dir < IP_CT_DIR_MAX &&
 664                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 665                         goto nla_put_failure;
 666                 break;
 667         default:
 668                 break;
 669         }
 670
 671         return 0;
 672
 673 nla_put_failure:
 674         return -1;
 675 }
 676
 677 static struct nft_expr_type nft_ct_type;
 678 static const struct nft_expr_ops nft_ct_get_ops = {
 679         .type           = &nft_ct_type,
 680         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 681         .eval           = nft_ct_get_eval,
 682         .init           = nft_ct_get_init,
 683         .destroy        = nft_ct_get_destroy,
 684         .dump           = nft_ct_get_dump,
 685 };
 686
 687 static const struct nft_expr_ops nft_ct_set_ops = {
 688         .type           = &nft_ct_type,
 689         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 690         .eval           = nft_ct_set_eval,
 691         .init           = nft_ct_set_init,
 692         .destroy        = nft_ct_set_destroy,
 693         .dump           = nft_ct_set_dump,
 694 };
 695
 696 #ifdef CONFIG_NF_CONNTRACK_ZONES
 697 static const struct nft_expr_ops nft_ct_set_zone_ops = {
 698         .type           = &nft_ct_type,
 699         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 700         .eval           = nft_ct_set_zone_eval,
 701         .init           = nft_ct_set_init,
 702         .destroy        = nft_ct_set_destroy,
 703         .dump           = nft_ct_set_dump,
 704 };
 705 #endif
 706
 707 static const struct nft_expr_ops *
 708 nft_ct_select_ops(const struct nft_ctx *ctx,
 709                     const struct nlattr * const tb[])
 710 {
 711         if (tb[NFTA_CT_KEY] == NULL)
 712                 return ERR_PTR(-EINVAL);
 713
 714         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 715                 return ERR_PTR(-EINVAL);
 716
 717         if (tb[NFTA_CT_DREG])
 718                 return &nft_ct_get_ops;
 719
 720         if (tb[NFTA_CT_SREG]) {
 721 #ifdef CONFIG_NF_CONNTRACK_ZONES
 722                 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 723                         return &nft_ct_set_zone_ops;
 724 #endif
 725                 return &nft_ct_set_ops;
 726         }
 727
 728         return ERR_PTR(-EINVAL);
 729 }
 730
 731 static struct nft_expr_type nft_ct_type __read_mostly = {
 732         .name           = "ct",
 733         .select_ops     = nft_ct_select_ops,
 734         .policy         = nft_ct_policy,
 735         .maxattr        = NFTA_CT_MAX,
 736         .owner          = THIS_MODULE,
 737 };
 738
 739 static void nft_notrack_eval(const struct nft_expr *expr,
 740                              struct nft_regs *regs,
 741                              const struct nft_pktinfo *pkt)
 742 {
 743         struct sk_buff *skb = pkt->skb;
 744         enum ip_conntrack_info ctinfo;
 745         struct nf_conn *ct;
 746
 747         ct = nf_ct_get(pkt->skb, &ctinfo);
 748         /* Previously seen (loopback or untracked)?  Ignore. */
 749         if (ct || ctinfo == IP_CT_UNTRACKED)
 750                 return;
 751
 752         nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 753 }
 754
 755 static struct nft_expr_type nft_notrack_type;
 756 static const struct nft_expr_ops nft_notrack_ops = {
 757         .type           = &nft_notrack_type,
 758         .size           = NFT_EXPR_SIZE(0),
 759         .eval           = nft_notrack_eval,
 760 };
 761
 762 static struct nft_expr_type nft_notrack_type __read_mostly = {
 763         .name           = "notrack",
 764         .ops            = &nft_notrack_ops,
 765         .owner          = THIS_MODULE,
 766 };
 767
 768 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 769 static int
 770 nft_ct_timeout_parse_policy(void *timeouts,
 771                             const struct nf_conntrack_l4proto *l4proto,
 772                             struct net *net, const struct nlattr *attr)
 773 {
 774         struct nlattr **tb;
 775         int ret = 0;
 776
 777         if (!l4proto->ctnl_timeout.nlattr_to_obj)
 778                 return 0;
 779
 780         tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
 781                      GFP_KERNEL);
 782
 783         if (!tb)
 784                 return -ENOMEM;
 785
 786         ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
 787                                attr, l4proto->ctnl_timeout.nla_policy,
 788                                NULL);
 789         if (ret < 0)
 790                 goto err;
 791
 792         ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 793
 794 err:
 795         kfree(tb);
 796         return ret;
 797 }
 798
 799 struct nft_ct_timeout_obj {
 800         struct nf_ct_timeout    *timeout;
 801         u8                      l4proto;
 802 };
 803
 804 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 805                                     struct nft_regs *regs,
 806                                     const struct nft_pktinfo *pkt)
 807 {
 808         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 809         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
 810         struct nf_conn_timeout *timeout;
 811         const unsigned int *values;
 812
 813         if (priv->l4proto != pkt->tprot)
 814                 return;
 815
 816         if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
 817                 return;
 818
 819         timeout = nf_ct_timeout_find(ct);
 820         if (!timeout) {
 821                 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
 822                 if (!timeout) {
 823                         regs->verdict.code = NF_DROP;
 824                         return;
 825                 }
 826         }
 827
 828         rcu_assign_pointer(timeout->timeout, priv->timeout);
 829
 830         /* adjust the timeout as per 'new' state. ct is unconfirmed,
 831          * so the current timestamp must not be added.
 832          */
 833         values = nf_ct_timeout_data(timeout);
 834         if (values)
 835                 nf_ct_refresh(ct, pkt->skb, values[0]);
 836 }
 837
 838 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 839                                    const struct nlattr * const tb[],
 840                                    struct nft_object *obj)
 841 {
 842         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 843         const struct nf_conntrack_l4proto *l4proto;
 844         struct nf_ct_timeout *timeout;
 845         int l3num = ctx->family;
 846         __u8 l4num;
 847         int ret;
 848
 849         if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
 850             !tb[NFTA_CT_TIMEOUT_DATA])
 851                 return -EINVAL;
 852
 853         if (tb[NFTA_CT_TIMEOUT_L3PROTO])
 854                 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
 855
 856         l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
 857         priv->l4proto = l4num;
 858
 859         l4proto = nf_ct_l4proto_find_get(l3num, l4num);
 860
 861         if (l4proto->l4proto != l4num) {
 862                 ret = -EOPNOTSUPP;
 863                 goto err_proto_put;
 864         }
 865
 866         timeout = kzalloc(sizeof(struct nf_ct_timeout) +
 867                           l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
 868         if (timeout == NULL) {
 869                 ret = -ENOMEM;
 870                 goto err_proto_put;
 871         }
 872
 873         ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
 874                                           tb[NFTA_CT_TIMEOUT_DATA]);
 875         if (ret < 0)
 876                 goto err_free_timeout;
 877
 878         timeout->l3num = l3num;
 879         timeout->l4proto = l4proto;
 880
 881         ret = nf_ct_netns_get(ctx->net, ctx->family);
 882         if (ret < 0)
 883                 goto err_free_timeout;
 884
 885         priv->timeout = timeout;
 886         return 0;
 887
 888 err_free_timeout:
 889         kfree(timeout);
 890 err_proto_put:
 891         nf_ct_l4proto_put(l4proto);
 892         return ret;
 893 }
 894
 895 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
 896                                        struct nft_object *obj)
 897 {
 898         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 899         struct nf_ct_timeout *timeout = priv->timeout;
 900
 901         nf_ct_untimeout(ctx->net, timeout);
 902         nf_ct_l4proto_put(timeout->l4proto);
 903         nf_ct_netns_put(ctx->net, ctx->family);
 904         kfree(priv->timeout);
 905 }
 906
 907 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
 908                                    struct nft_object *obj, bool reset)
 909 {
 910         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 911         const struct nf_ct_timeout *timeout = priv->timeout;
 912         struct nlattr *nest_params;
 913         int ret;
 914
 915         if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
 916             nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
 917                 return -1;
 918
 919         nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA | NLA_F_NESTED);
 920         if (!nest_params)
 921                 return -1;
 922
 923         ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
 924         if (ret < 0)
 925                 return -1;
 926         nla_nest_end(skb, nest_params);
 927         return 0;
 928 }
 929
 930 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
 931         [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
 932         [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
 933         [NFTA_CT_TIMEOUT_DATA]    = {.type = NLA_NESTED },
 934 };
 935
 936 static struct nft_object_type nft_ct_timeout_obj_type;
 937
 938 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
 939         .type           = &nft_ct_timeout_obj_type,
 940         .size           = sizeof(struct nft_ct_timeout_obj),
 941         .eval           = nft_ct_timeout_obj_eval,
 942         .init           = nft_ct_timeout_obj_init,
 943         .destroy        = nft_ct_timeout_obj_destroy,
 944         .dump           = nft_ct_timeout_obj_dump,
 945 };
 946
 947 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
 948         .type           = NFT_OBJECT_CT_TIMEOUT,
 949         .ops            = &nft_ct_timeout_obj_ops,
 950         .maxattr        = NFTA_CT_TIMEOUT_MAX,
 951         .policy         = nft_ct_timeout_policy,
 952         .owner          = THIS_MODULE,
 953 };
 954 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 955
 956 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
 957                                   const struct nlattr * const tb[],
 958                                   struct nft_object *obj)
 959 {
 960         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 961         struct nf_conntrack_helper *help4, *help6;
 962         char name[NF_CT_HELPER_NAME_LEN];
 963         int family = ctx->family;
 964         int err;
 965
 966         if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
 967                 return -EINVAL;
 968
 969         priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
 970         if (!priv->l4proto)
 971                 return -ENOENT;
 972
 973         nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
 974
 975         if (tb[NFTA_CT_HELPER_L3PROTO])
 976                 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
 977
 978         help4 = NULL;
 979         help6 = NULL;
 980
 981         switch (family) {
 982         case NFPROTO_IPV4:
 983                 if (ctx->family == NFPROTO_IPV6)
 984                         return -EINVAL;
 985
 986                 help4 = nf_conntrack_helper_try_module_get(name, family,
 987                                                            priv->l4proto);
 988                 break;
 989         case NFPROTO_IPV6:
 990                 if (ctx->family == NFPROTO_IPV4)
 991                         return -EINVAL;
 992
 993                 help6 = nf_conntrack_helper_try_module_get(name, family,
 994                                                            priv->l4proto);
 995                 break;
 996         case NFPROTO_NETDEV: /* fallthrough */
 997         case NFPROTO_BRIDGE: /* same */
 998         case NFPROTO_INET:
 999                 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1000                                                            priv->l4proto);
1001                 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1002                                                            priv->l4proto);
1003                 break;
1004         default:
1005                 return -EAFNOSUPPORT;
1006         }
1007
1008         /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1009         if (!help4 && !help6)
1010                 return -ENOENT;
1011
1012         priv->helper4 = help4;
1013         priv->helper6 = help6;
1014
1015         err = nf_ct_netns_get(ctx->net, ctx->family);
1016         if (err < 0)
1017                 goto err_put_helper;
1018
1019         return 0;
1020
1021 err_put_helper:
1022         if (priv->helper4)
1023                 nf_conntrack_helper_put(priv->helper4);
1024         if (priv->helper6)
1025                 nf_conntrack_helper_put(priv->helper6);
1026         return err;
1027 }
1028
1029 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1030                                       struct nft_object *obj)
1031 {
1032         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1033
1034         if (priv->helper4)
1035                 nf_conntrack_helper_put(priv->helper4);
1036         if (priv->helper6)
1037                 nf_conntrack_helper_put(priv->helper6);
1038
1039         nf_ct_netns_put(ctx->net, ctx->family);
1040 }
1041
1042 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1043                                    struct nft_regs *regs,
1044                                    const struct nft_pktinfo *pkt)
1045 {
1046         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1047         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1048         struct nf_conntrack_helper *to_assign = NULL;
1049         struct nf_conn_help *help;
1050
1051         if (!ct ||
1052             nf_ct_is_confirmed(ct) ||
1053             nf_ct_is_template(ct) ||
1054             priv->l4proto != nf_ct_protonum(ct))
1055                 return;
1056
1057         switch (nf_ct_l3num(ct)) {
1058         case NFPROTO_IPV4:
1059                 to_assign = priv->helper4;
1060                 break;
1061         case NFPROTO_IPV6:
1062                 to_assign = priv->helper6;
1063                 break;
1064         default:
1065                 WARN_ON_ONCE(1);
1066                 return;
1067         }
1068
1069         if (!to_assign)
1070                 return;
1071
1072         if (test_bit(IPS_HELPER_BIT, &ct->status))
1073                 return;
1074
1075         help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1076         if (help) {
1077                 rcu_assign_pointer(help->helper, to_assign);
1078                 set_bit(IPS_HELPER_BIT, &ct->status);
1079         }
1080 }
1081
1082 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1083                                   struct nft_object *obj, bool reset)
1084 {
1085         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1086         const struct nf_conntrack_helper *helper;
1087         u16 family;
1088
1089         if (priv->helper4 && priv->helper6) {
1090                 family = NFPROTO_INET;
1091                 helper = priv->helper4;
1092         } else if (priv->helper6) {
1093                 family = NFPROTO_IPV6;
1094                 helper = priv->helper6;
1095         } else {
1096                 family = NFPROTO_IPV4;
1097                 helper = priv->helper4;
1098         }
1099
1100         if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1101                 return -1;
1102
1103         if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1104                 return -1;
1105
1106         if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1107                 return -1;
1108
1109         return 0;
1110 }
1111
1112 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1113         [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1114                                   .len = NF_CT_HELPER_NAME_LEN - 1 },
1115         [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1116         [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1117 };
1118
1119 static struct nft_object_type nft_ct_helper_obj_type;
1120 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1121         .type           = &nft_ct_helper_obj_type,
1122         .size           = sizeof(struct nft_ct_helper_obj),
1123         .eval           = nft_ct_helper_obj_eval,
1124         .init           = nft_ct_helper_obj_init,
1125         .destroy        = nft_ct_helper_obj_destroy,
1126         .dump           = nft_ct_helper_obj_dump,
1127 };
1128
1129 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1130         .type           = NFT_OBJECT_CT_HELPER,
1131         .ops            = &nft_ct_helper_obj_ops,
1132         .maxattr        = NFTA_CT_HELPER_MAX,
1133         .policy         = nft_ct_helper_policy,
1134         .owner          = THIS_MODULE,
1135 };
1136
1137 static int __init nft_ct_module_init(void)
1138 {
1139         int err;
1140
1141         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1142
1143         err = nft_register_expr(&nft_ct_type);
1144         if (err < 0)
1145                 return err;
1146
1147         err = nft_register_expr(&nft_notrack_type);
1148         if (err < 0)
1149                 goto err1;
1150
1151         err = nft_register_obj(&nft_ct_helper_obj_type);
1152         if (err < 0)
1153                 goto err2;
1154 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1155         err = nft_register_obj(&nft_ct_timeout_obj_type);
1156         if (err < 0)
1157                 goto err3;
1158 #endif
1159         return 0;
1160
1161 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1162 err3:
1163         nft_unregister_obj(&nft_ct_helper_obj_type);
1164 #endif
1165 err2:
1166         nft_unregister_expr(&nft_notrack_type);
1167 err1:
1168         nft_unregister_expr(&nft_ct_type);
1169         return err;
1170 }
1171
1172 static void __exit nft_ct_module_exit(void)
1173 {
1174 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1175         nft_unregister_obj(&nft_ct_timeout_obj_type);
1176 #endif
1177         nft_unregister_obj(&nft_ct_helper_obj_type);
1178         nft_unregister_expr(&nft_notrack_type);
1179         nft_unregister_expr(&nft_ct_type);
1180 }
1181
1182 module_init(nft_ct_module_init);
1183 module_exit(nft_ct_module_exit);
1184
1185 MODULE_LICENSE("GPL");
1186 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1187 MODULE_ALIAS_NFT_EXPR("ct");
1188 MODULE_ALIAS_NFT_EXPR("notrack");
1189 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1190 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);