projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Android: Add empty Android.mk file
[GitHub/LineageOS/android_kernel_motorola_exynos9610.git] / net / netfilter / nft_ct.c
CommitLineData
96518518 1/*
ef1f7df9 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
25443261 3 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
96518518
PM		 4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
10 */
11
12#include <linux/kernel.h>
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nf_tables.h>
18#include <net/netfilter/nf_tables.h>
19#include <net/netfilter/nf_conntrack.h>
48f66c90 20#include <net/netfilter/nf_conntrack_acct.h>
96518518
PM		 21#include <net/netfilter/nf_conntrack_tuple.h>
22#include <net/netfilter/nf_conntrack_helper.h>
c4ede3d3 23#include <net/netfilter/nf_conntrack_ecache.h>
d2bf2f34 24#include <net/netfilter/nf_conntrack_labels.h>
96518518
PM		 25
26struct nft_ct {
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
d46f2cd2 29 union {
c4ede3d3
KE		 30 enum nft_registers dreg:8;
31 enum nft_registers sreg:8;
32 };
96518518
PM		 33};
34
1a64edf5
FW		 35struct nft_ct_helper_obj {
36 struct nf_conntrack_helper *helper4;
37 struct nf_conntrack_helper *helper6;
38 u8 l4proto;
39};
40
edee4f1e
FW		 41#ifdef CONFIG_NF_CONNTRACK_ZONES
42static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
43static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
44#endif
45
48f66c90
FW		 46static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
47 enum nft_ct_keys k,
48 enum ip_conntrack_dir d)
49{
50 if (d < IP_CT_DIR_MAX)
51 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
52 atomic64_read(&c[d].packets);
53
54 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
55 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
56}
57
c4ede3d3 58static void nft_ct_get_eval(const struct nft_expr *expr,
a55e22e9 59 struct nft_regs *regs,
c4ede3d3 60 const struct nft_pktinfo *pkt)
96518518
PM		 61{
62 const struct nft_ct *priv = nft_expr_priv(expr);
49499c3e 63 u32 *dest = &regs->data[priv->dreg];
96518518
PM		 64 enum ip_conntrack_info ctinfo;
65 const struct nf_conn *ct;
66 const struct nf_conn_help *help;
67 const struct nf_conntrack_tuple *tuple;
68 const struct nf_conntrack_helper *helper;
96518518
PM		 69 unsigned int state;
70
71 ct = nf_ct_get(pkt->skb, &ctinfo);
72
73 switch (priv->key) {
74 case NFT_CT_STATE:
cc41c84b
FW		 75 if (ct)
76 state = NF_CT_STATE_BIT(ctinfo);
77 else if (ctinfo == IP_CT_UNTRACKED)
96518518
PM		 78 state = NF_CT_STATE_UNTRACKED_BIT;
79 else
cc41c84b 80 state = NF_CT_STATE_INVALID_BIT;
fad136ea 81 *dest = state;
96518518 82 return;
c1f86676
DM		 83 default:
84 break;
96518518
PM		 85 }
86
87 if (ct == NULL)
88 goto err;
89
90 switch (priv->key) {
91 case NFT_CT_DIRECTION:
10596608 92 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
96518518
PM		 93 return;
94 case NFT_CT_STATUS:
fad136ea 95 *dest = ct->status;
96518518
PM		 96 return;
97#ifdef CONFIG_NF_CONNTRACK_MARK
98 case NFT_CT_MARK:
fad136ea 99 *dest = ct->mark;
96518518
PM		 100 return;
101#endif
102#ifdef CONFIG_NF_CONNTRACK_SECMARK
103 case NFT_CT_SECMARK:
fad136ea 104 *dest = ct->secmark;
96518518
PM		 105 return;
106#endif
107 case NFT_CT_EXPIRATION:
c8607e02 108 *dest = jiffies_to_msecs(nf_ct_expires(ct));
96518518
PM		 109 return;
110 case NFT_CT_HELPER:
111 if (ct->master == NULL)
112 goto err;
113 help = nfct_help(ct->master);
114 if (help == NULL)
115 goto err;
116 helper = rcu_dereference(help->helper);
117 if (helper == NULL)
118 goto err;
fad136ea 119 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
96518518 120 return;
d2bf2f34
FW		 121#ifdef CONFIG_NF_CONNTRACK_LABELS
122 case NFT_CT_LABELS: {
123 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
d2bf2f34 124
23014011
FW		 125 if (labels)
126 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
127 else
fad136ea 128 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
d2bf2f34
FW		 129 return;
130 }
efaea94a 131#endif
48f66c90
FW		 132 case NFT_CT_BYTES: /* fallthrough */
133 case NFT_CT_PKTS: {
134 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
135 u64 count = 0;
136
137 if (acct)
138 count = nft_ct_get_eval_counter(acct->counter,
139 priv->key, priv->dir);
140 memcpy(dest, &count, sizeof(count));
141 return;
142 }
949a3584
LZ		 143 case NFT_CT_AVGPKT: {
144 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
145 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
146
147 if (acct) {
148 pcnt = nft_ct_get_eval_counter(acct->counter,
149 NFT_CT_PKTS, priv->dir);
150 bcnt = nft_ct_get_eval_counter(acct->counter,
151 NFT_CT_BYTES, priv->dir);
152 if (pcnt != 0)
153 avgcnt = div64_u64(bcnt, pcnt);
154 }
155
156 memcpy(dest, &avgcnt, sizeof(avgcnt));
157 return;
158 }
d767ff2c 159 case NFT_CT_L3PROTOCOL:
10596608 160 nft_reg_store8(dest, nf_ct_l3num(ct));
d767ff2c
LZ		 161 return;
162 case NFT_CT_PROTOCOL:
10596608 163 nft_reg_store8(dest, nf_ct_protonum(ct));
d767ff2c 164 return;
ab23821f
FW		 165#ifdef CONFIG_NF_CONNTRACK_ZONES
166 case NFT_CT_ZONE: {
167 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
10596608 168 u16 zoneid;
ab23821f
FW		 169
170 if (priv->dir < IP_CT_DIR_MAX)
10596608 171 zoneid = nf_ct_zone_id(zone, priv->dir);
ab23821f 172 else
10596608 173 zoneid = zone->id;
ab23821f 174
10596608 175 nft_reg_store16(dest, zoneid);
ab23821f
FW		 176 return;
177 }
178#endif
c1f86676
DM		 179 default:
180 break;
96518518
PM		 181 }
182
183 tuple = &ct->tuplehash[priv->dir].tuple;
184 switch (priv->key) {
96518518 185 case NFT_CT_SRC:
fad136ea 186 memcpy(dest, tuple->src.u3.all,
96518518
PM		 187 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
188 return;
189 case NFT_CT_DST:
fad136ea 190 memcpy(dest, tuple->dst.u3.all,
96518518
PM		 191 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
192 return;
96518518 193 case NFT_CT_PROTO_SRC:
10596608 194 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
96518518
PM		 195 return;
196 case NFT_CT_PROTO_DST:
10596608 197 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
96518518 198 return;
c1f86676
DM		 199 default:
200 break;
96518518
PM		 201 }
202 return;
203err:
a55e22e9 204 regs->verdict.code = NFT_BREAK;
96518518
PM		 205}
206
edee4f1e
FW		 207#ifdef CONFIG_NF_CONNTRACK_ZONES
208static void nft_ct_set_zone_eval(const struct nft_expr *expr,
209 struct nft_regs *regs,
210 const struct nft_pktinfo *pkt)
211{
212 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
213 const struct nft_ct *priv = nft_expr_priv(expr);
214 struct sk_buff *skb = pkt->skb;
215 enum ip_conntrack_info ctinfo;
10596608 216 u16 value = nft_reg_load16(&regs->data[priv->sreg]);
edee4f1e
FW		 217 struct nf_conn *ct;
218
219 ct = nf_ct_get(skb, &ctinfo);
220 if (ct) /* already tracked */
221 return;
222
223 zone.id = value;
224
225 switch (priv->dir) {
226 case IP_CT_DIR_ORIGINAL:
227 zone.dir = NF_CT_ZONE_DIR_ORIG;
228 break;
229 case IP_CT_DIR_REPLY:
230 zone.dir = NF_CT_ZONE_DIR_REPL;
231 break;
232 default:
233 break;
234 }
235
236 ct = this_cpu_read(nft_ct_pcpu_template);
237
238 if (likely(atomic_read(&ct->ct_general.use) == 1)) {
239 nf_ct_zone_add(ct, &zone);
240 } else {
241 /* previous skb got queued to userspace */
242 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
243 if (!ct) {
244 regs->verdict.code = NF_DROP;
245 return;
246 }
247 }
248
249 atomic_inc(&ct->ct_general.use);
250 nf_ct_set(skb, ct, IP_CT_NEW);
251}
252#endif
253
c4ede3d3 254static void nft_ct_set_eval(const struct nft_expr *expr,
a55e22e9 255 struct nft_regs *regs,
c4ede3d3
KE		 256 const struct nft_pktinfo *pkt)
257{
258 const struct nft_ct *priv = nft_expr_priv(expr);
259 struct sk_buff *skb = pkt->skb;
847c8e29 260#ifdef CONFIG_NF_CONNTRACK_MARK
49499c3e 261 u32 value = regs->data[priv->sreg];
847c8e29 262#endif
c4ede3d3
KE		 263 enum ip_conntrack_info ctinfo;
264 struct nf_conn *ct;
265
266 ct = nf_ct_get(skb, &ctinfo);
694a0055 267 if (ct == NULL || nf_ct_is_template(ct))
c4ede3d3
KE		 268 return;
269
270 switch (priv->key) {
271#ifdef CONFIG_NF_CONNTRACK_MARK
272 case NFT_CT_MARK:
273 if (ct->mark != value) {
274 ct->mark = value;
275 nf_conntrack_event_cache(IPCT_MARK, ct);
276 }
277 break;
1ad8f48d
FW		 278#endif
279#ifdef CONFIG_NF_CONNTRACK_LABELS
280 case NFT_CT_LABELS:
281 nf_connlabels_replace(ct,
282 &regs->data[priv->sreg],
283 &regs->data[priv->sreg],
284 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
285 break;
694a0055
FW		 286#endif
287#ifdef CONFIG_NF_CONNTRACK_EVENTS
288 case NFT_CT_EVENTMASK: {
289 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
290 u32 ctmask = regs->data[priv->sreg];
291
292 if (e) {
293 if (e->ctmask != ctmask)
294 e->ctmask = ctmask;
295 break;
296 }
297
298 if (ctmask && !nf_ct_is_confirmed(ct))
299 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
300 break;
301 }
c4ede3d3 302#endif
c1f86676
DM		 303 default:
304 break;
c4ede3d3
KE		 305 }
306}
307
96518518
PM		 308static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
309 [NFTA_CT_DREG] = { .type = NLA_U32 },
310 [NFTA_CT_KEY] = { .type = NLA_U32 },
311 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
c4ede3d3 312 [NFTA_CT_SREG] = { .type = NLA_U32 },
96518518
PM		 313};
314
ecb2421b 315static int nft_ct_netns_get(struct net *net, uint8_t family)
9638f33e
PM		 316{
317 int err;
318
319 if (family == NFPROTO_INET) {
ecb2421b 320 err = nf_ct_netns_get(net, NFPROTO_IPV4);
9638f33e
PM		 321 if (err < 0)
322 goto err1;
ecb2421b 323 err = nf_ct_netns_get(net, NFPROTO_IPV6);
9638f33e
PM		 324 if (err < 0)
325 goto err2;
326 } else {
ecb2421b 327 err = nf_ct_netns_get(net, family);
9638f33e
PM		 328 if (err < 0)
329 goto err1;
330 }
331 return 0;
332
333err2:
ecb2421b 334 nf_ct_netns_put(net, NFPROTO_IPV4);
9638f33e
PM		 335err1:
336 return err;
337}
338
ecb2421b 339static void nft_ct_netns_put(struct net *net, uint8_t family)
9638f33e
PM		 340{
341 if (family == NFPROTO_INET) {
ecb2421b
FW		 342 nf_ct_netns_put(net, NFPROTO_IPV4);
343 nf_ct_netns_put(net, NFPROTO_IPV6);
9638f33e 344 } else
ecb2421b 345 nf_ct_netns_put(net, family);
9638f33e
PM		 346}
347
edee4f1e
FW		 348#ifdef CONFIG_NF_CONNTRACK_ZONES
349static void nft_ct_tmpl_put_pcpu(void)
350{
351 struct nf_conn *ct;
352 int cpu;
353
354 for_each_possible_cpu(cpu) {
355 ct = per_cpu(nft_ct_pcpu_template, cpu);
356 if (!ct)
357 break;
358 nf_ct_put(ct);
359 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
360 }
361}
362
363static bool nft_ct_tmpl_alloc_pcpu(void)
364{
365 struct nf_conntrack_zone zone = { .id = 0 };
366 struct nf_conn *tmp;
367 int cpu;
368
369 if (nft_ct_pcpu_template_refcnt)
370 return true;
371
372 for_each_possible_cpu(cpu) {
373 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
374 if (!tmp) {
375 nft_ct_tmpl_put_pcpu();
376 return false;
377 }
378
379 atomic_set(&tmp->ct_general.use, 1);
380 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
381 }
382
383 return true;
384}
385#endif
386
fe92ca45
PM		 387static int nft_ct_get_init(const struct nft_ctx *ctx,
388 const struct nft_expr *expr,
389 const struct nlattr * const tb[])
96518518
PM		 390{
391 struct nft_ct *priv = nft_expr_priv(expr);
45d9bcda 392 unsigned int len;
fe92ca45 393 int err;
96518518 394
fe92ca45 395 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
ab23821f 396 priv->dir = IP_CT_DIR_MAX;
96518518 397 switch (priv->key) {
96518518 398 case NFT_CT_DIRECTION:
45d9bcda
PM		 399 if (tb[NFTA_CT_DIRECTION] != NULL)
400 return -EINVAL;
401 len = sizeof(u8);
402 break;
403 case NFT_CT_STATE:
96518518
PM		 404 case NFT_CT_STATUS:
405#ifdef CONFIG_NF_CONNTRACK_MARK
406 case NFT_CT_MARK:
407#endif
408#ifdef CONFIG_NF_CONNTRACK_SECMARK
409 case NFT_CT_SECMARK:
d2bf2f34 410#endif
45d9bcda
PM		 411 case NFT_CT_EXPIRATION:
412 if (tb[NFTA_CT_DIRECTION] != NULL)
413 return -EINVAL;
414 len = sizeof(u32);
415 break;
d2bf2f34
FW		 416#ifdef CONFIG_NF_CONNTRACK_LABELS
417 case NFT_CT_LABELS:
45d9bcda
PM		 418 if (tb[NFTA_CT_DIRECTION] != NULL)
419 return -EINVAL;
420 len = NF_CT_LABELS_MAX_SIZE;
421 break;
96518518 422#endif
96518518
PM		 423 case NFT_CT_HELPER:
424 if (tb[NFTA_CT_DIRECTION] != NULL)
425 return -EINVAL;
45d9bcda 426 len = NF_CT_HELPER_NAME_LEN;
96518518 427 break;
45d9bcda 428
51292c07 429 case NFT_CT_L3PROTOCOL:
96518518 430 case NFT_CT_PROTOCOL:
d767ff2c
LZ		 431 /* For compatibility, do not report error if NFTA_CT_DIRECTION
432 * attribute is specified.
433 */
45d9bcda
PM		 434 len = sizeof(u8);
435 break;
96518518
PM		 436 case NFT_CT_SRC:
437 case NFT_CT_DST:
45d9bcda
PM		 438 if (tb[NFTA_CT_DIRECTION] == NULL)
439 return -EINVAL;
440
441 switch (ctx->afi->family) {
442 case NFPROTO_IPV4:
443 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
444 src.u3.ip);
445 break;
446 case NFPROTO_IPV6:
447 case NFPROTO_INET:
448 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
449 src.u3.ip6);
450 break;
451 default:
452 return -EAFNOSUPPORT;
453 }
454 break;
96518518
PM		 455 case NFT_CT_PROTO_SRC:
456 case NFT_CT_PROTO_DST:
457 if (tb[NFTA_CT_DIRECTION] == NULL)
458 return -EINVAL;
45d9bcda 459 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
96518518 460 break;
48f66c90
FW		 461 case NFT_CT_BYTES:
462 case NFT_CT_PKTS:
949a3584 463 case NFT_CT_AVGPKT:
48f66c90
FW		 464 len = sizeof(u64);
465 break;
ab23821f
FW		 466#ifdef CONFIG_NF_CONNTRACK_ZONES
467 case NFT_CT_ZONE:
468 len = sizeof(u16);
469 break;
470#endif
96518518
PM		 471 default:
472 return -EOPNOTSUPP;
473 }
474
fe92ca45
PM		 475 if (tb[NFTA_CT_DIRECTION] != NULL) {
476 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
477 switch (priv->dir) {
478 case IP_CT_DIR_ORIGINAL:
479 case IP_CT_DIR_REPLY:
480 break;
481 default:
482 return -EINVAL;
483 }
484 }
485
b1c96ed3 486 priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
1ec10212
PM		 487 err = nft_validate_register_store(ctx, priv->dreg, NULL,
488 NFT_DATA_VALUE, len);
fe92ca45
PM		 489 if (err < 0)
490 return err;
491
ecb2421b 492 err = nft_ct_netns_get(ctx->net, ctx->afi->family);
fe92ca45
PM		 493 if (err < 0)
494 return err;
495
949a3584
LZ		 496 if (priv->key == NFT_CT_BYTES ||
497 priv->key == NFT_CT_PKTS ||
498 priv->key == NFT_CT_AVGPKT)
3f8b61b7
LZ		 499 nf_ct_set_acct(ctx->net, true);
500
c4ede3d3
KE		 501 return 0;
502}
503
5c178d81
FW		 504static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
505{
506 switch (priv->key) {
507#ifdef CONFIG_NF_CONNTRACK_LABELS
508 case NFT_CT_LABELS:
509 nf_connlabels_put(ctx->net);
510 break;
edee4f1e
FW		 511#endif
512#ifdef CONFIG_NF_CONNTRACK_ZONES
513 case NFT_CT_ZONE:
514 if (--nft_ct_pcpu_template_refcnt == 0)
515 nft_ct_tmpl_put_pcpu();
5c178d81
FW		 516#endif
517 default:
518 break;
519 }
520}
521
fe92ca45
PM		 522static int nft_ct_set_init(const struct nft_ctx *ctx,
523 const struct nft_expr *expr,
524 const struct nlattr * const tb[])
c4ede3d3 525{
fe92ca45 526 struct nft_ct *priv = nft_expr_priv(expr);
d07db988 527 unsigned int len;
fe92ca45
PM		 528 int err;
529
edee4f1e 530 priv->dir = IP_CT_DIR_MAX;
fe92ca45
PM		 531 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
532 switch (priv->key) {
e88e514e 533#ifdef CONFIG_NF_CONNTRACK_MARK
c4ede3d3 534 case NFT_CT_MARK:
7bfdde70
LZ		 535 if (tb[NFTA_CT_DIRECTION])
536 return -EINVAL;
d07db988 537 len = FIELD_SIZEOF(struct nf_conn, mark);
c4ede3d3 538 break;
1ad8f48d
FW		 539#endif
540#ifdef CONFIG_NF_CONNTRACK_LABELS
541 case NFT_CT_LABELS:
542 if (tb[NFTA_CT_DIRECTION])
543 return -EINVAL;
544 len = NF_CT_LABELS_MAX_SIZE;
545 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
546 if (err)
547 return err;
548 break;
edee4f1e
FW		 549#endif
550#ifdef CONFIG_NF_CONNTRACK_ZONES
551 case NFT_CT_ZONE:
552 if (!nft_ct_tmpl_alloc_pcpu())
553 return -ENOMEM;
554 nft_ct_pcpu_template_refcnt++;
427345d6 555 len = sizeof(u16);
edee4f1e 556 break;
694a0055
FW		 557#endif
558#ifdef CONFIG_NF_CONNTRACK_EVENTS
559 case NFT_CT_EVENTMASK:
560 if (tb[NFTA_CT_DIRECTION])
561 return -EINVAL;
562 len = sizeof(u32);
563 break;
e88e514e 564#endif
c4ede3d3
KE		 565 default:
566 return -EOPNOTSUPP;
567 }
568
edee4f1e
FW		 569 if (tb[NFTA_CT_DIRECTION]) {
570 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
571 switch (priv->dir) {
572 case IP_CT_DIR_ORIGINAL:
573 case IP_CT_DIR_REPLY:
574 break;
575 default:
4494dbc6
LZ		 576 err = -EINVAL;
577 goto err1;
edee4f1e
FW		 578 }
579 }
580
b1c96ed3 581 priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
d07db988 582 err = nft_validate_register_load(priv->sreg, len);
fe92ca45 583 if (err < 0)
590025a2 584 goto err1;
c4ede3d3 585
ecb2421b 586 err = nft_ct_netns_get(ctx->net, ctx->afi->family);
96518518 587 if (err < 0)
590025a2 588 goto err1;
96518518 589
96518518 590 return 0;
590025a2
LZ		 591
592err1:
5c178d81 593 __nft_ct_set_destroy(ctx, priv);
590025a2
LZ		 594 return err;
595}
596
597static void nft_ct_get_destroy(const struct nft_ctx *ctx,
598 const struct nft_expr *expr)
599{
ecb2421b 600 nf_ct_netns_put(ctx->net, ctx->afi->family);
96518518
PM		 601}
602
590025a2
LZ		 603static void nft_ct_set_destroy(const struct nft_ctx *ctx,
604 const struct nft_expr *expr)
96518518 605{
1ad8f48d
FW		 606 struct nft_ct *priv = nft_expr_priv(expr);
607
5c178d81 608 __nft_ct_set_destroy(ctx, priv);
ecb2421b 609 nft_ct_netns_put(ctx->net, ctx->afi->family);
96518518
PM		 610}
611
c4ede3d3 612static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
96518518
PM		 613{
614 const struct nft_ct *priv = nft_expr_priv(expr);
615
b1c96ed3 616 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
96518518
PM		 617 goto nla_put_failure;
618 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
619 goto nla_put_failure;
2a53bfb3
AB		 620
621 switch (priv->key) {
2a53bfb3
AB		 622 case NFT_CT_SRC:
623 case NFT_CT_DST:
624 case NFT_CT_PROTO_SRC:
625 case NFT_CT_PROTO_DST:
626 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
627 goto nla_put_failure;
48f66c90
FW		 628 break;
629 case NFT_CT_BYTES:
630 case NFT_CT_PKTS:
949a3584 631 case NFT_CT_AVGPKT:
ab23821f 632 case NFT_CT_ZONE:
48f66c90
FW		 633 if (priv->dir < IP_CT_DIR_MAX &&
634 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
635 goto nla_put_failure;
636 break;
2a53bfb3
AB		 637 default:
638 break;
639 }
640
96518518
PM		 641 return 0;
642
643nla_put_failure:
644 return -1;
645}
646
c4ede3d3
KE		 647static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
648{
649 const struct nft_ct *priv = nft_expr_priv(expr);
650
b1c96ed3 651 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
c4ede3d3
KE		 652 goto nla_put_failure;
653 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
654 goto nla_put_failure;
edee4f1e
FW		 655
656 switch (priv->key) {
657 case NFT_CT_ZONE:
658 if (priv->dir < IP_CT_DIR_MAX &&
659 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
660 goto nla_put_failure;
661 break;
662 default:
663 break;
664 }
665
c4ede3d3
KE		 666 return 0;
667
668nla_put_failure:
669 return -1;
670}
671
ef1f7df9 672static struct nft_expr_type nft_ct_type;
c4ede3d3 673static const struct nft_expr_ops nft_ct_get_ops = {
ef1f7df9 674 .type = &nft_ct_type,
96518518 675 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
c4ede3d3 676 .eval = nft_ct_get_eval,
fe92ca45 677 .init = nft_ct_get_init,
590025a2 678 .destroy = nft_ct_get_destroy,
c4ede3d3 679 .dump = nft_ct_get_dump,
ef1f7df9
PM		 680};
681
c4ede3d3
KE		 682static const struct nft_expr_ops nft_ct_set_ops = {
683 .type = &nft_ct_type,
684 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
685 .eval = nft_ct_set_eval,
fe92ca45 686 .init = nft_ct_set_init,
590025a2 687 .destroy = nft_ct_set_destroy,
c4ede3d3
KE		 688 .dump = nft_ct_set_dump,
689};
690
edee4f1e
FW		 691#ifdef CONFIG_NF_CONNTRACK_ZONES
692static const struct nft_expr_ops nft_ct_set_zone_ops = {
693 .type = &nft_ct_type,
694 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
695 .eval = nft_ct_set_zone_eval,
696 .init = nft_ct_set_init,
697 .destroy = nft_ct_set_destroy,
698 .dump = nft_ct_set_dump,
699};
700#endif
701
c4ede3d3
KE		 702static const struct nft_expr_ops *
703nft_ct_select_ops(const struct nft_ctx *ctx,
704 const struct nlattr * const tb[])
705{
706 if (tb[NFTA_CT_KEY] == NULL)
707 return ERR_PTR(-EINVAL);
708
709 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
710 return ERR_PTR(-EINVAL);
711
712 if (tb[NFTA_CT_DREG])
713 return &nft_ct_get_ops;
714
edee4f1e
FW		 715 if (tb[NFTA_CT_SREG]) {
716#ifdef CONFIG_NF_CONNTRACK_ZONES
717 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
718 return &nft_ct_set_zone_ops;
719#endif
c4ede3d3 720 return &nft_ct_set_ops;
edee4f1e 721 }
c4ede3d3
KE		 722
723 return ERR_PTR(-EINVAL);
724}
725
ef1f7df9
PM		 726static struct nft_expr_type nft_ct_type __read_mostly = {
727 .name = "ct",
d4ef3835 728 .select_ops = nft_ct_select_ops,
96518518
PM		 729 .policy = nft_ct_policy,
730 .maxattr = NFTA_CT_MAX,
ef1f7df9 731 .owner = THIS_MODULE,
96518518
PM		 732};
733
25443261
PNA		 734static void nft_notrack_eval(const struct nft_expr *expr,
735 struct nft_regs *regs,
736 const struct nft_pktinfo *pkt)
737{
738 struct sk_buff *skb = pkt->skb;
739 enum ip_conntrack_info ctinfo;
740 struct nf_conn *ct;
741
742 ct = nf_ct_get(pkt->skb, &ctinfo);
743 /* Previously seen (loopback or untracked)? Ignore. */
cc41c84b 744 if (ct || ctinfo == IP_CT_UNTRACKED)
25443261
PNA		 745 return;
746
cc41c84b 747 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
25443261
PNA		 748}
749
750static struct nft_expr_type nft_notrack_type;
751static const struct nft_expr_ops nft_notrack_ops = {
752 .type = &nft_notrack_type,
753 .size = NFT_EXPR_SIZE(0),
754 .eval = nft_notrack_eval,
755};
756
757static struct nft_expr_type nft_notrack_type __read_mostly = {
758 .name = "notrack",
759 .ops = &nft_notrack_ops,
760 .owner = THIS_MODULE,
761};
762
1a64edf5
FW		 763static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
764 const struct nlattr * const tb[],
765 struct nft_object *obj)
766{
767 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
768 struct nf_conntrack_helper *help4, *help6;
769 char name[NF_CT_HELPER_NAME_LEN];
770 int family = ctx->afi->family;
771
772 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
773 return -EINVAL;
774
775 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
776 if (!priv->l4proto)
777 return -ENOENT;
778
779 nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
780
781 if (tb[NFTA_CT_HELPER_L3PROTO])
782 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
783
784 help4 = NULL;
785 help6 = NULL;
786
787 switch (family) {
788 case NFPROTO_IPV4:
789 if (ctx->afi->family == NFPROTO_IPV6)
790 return -EINVAL;
791
792 help4 = nf_conntrack_helper_try_module_get(name, family,
793 priv->l4proto);
794 break;
795 case NFPROTO_IPV6:
796 if (ctx->afi->family == NFPROTO_IPV4)
797 return -EINVAL;
798
799 help6 = nf_conntrack_helper_try_module_get(name, family,
800 priv->l4proto);
801 break;
802 case NFPROTO_NETDEV: /* fallthrough */
803 case NFPROTO_BRIDGE: /* same */
804 case NFPROTO_INET:
805 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
806 priv->l4proto);
807 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
808 priv->l4proto);
809 break;
810 default:
811 return -EAFNOSUPPORT;
812 }
813
814 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
815 if (!help4 && !help6)
816 return -ENOENT;
817
818 priv->helper4 = help4;
819 priv->helper6 = help6;
820
821 return 0;
822}
823
824static void nft_ct_helper_obj_destroy(struct nft_object *obj)
825{
826 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
827
828 if (priv->helper4)
d91fc59c 829 nf_conntrack_helper_put(priv->helper4);
1a64edf5 830 if (priv->helper6)
d91fc59c 831 nf_conntrack_helper_put(priv->helper6);
1a64edf5
FW		 832}
833
834static void nft_ct_helper_obj_eval(struct nft_object *obj,
835 struct nft_regs *regs,
836 const struct nft_pktinfo *pkt)
837{
838 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
839 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
840 struct nf_conntrack_helper *to_assign = NULL;
841 struct nf_conn_help *help;
842
843 if (!ct ||
844 nf_ct_is_confirmed(ct) ||
845 nf_ct_is_template(ct) ||
846 priv->l4proto != nf_ct_protonum(ct))
847 return;
848
849 switch (nf_ct_l3num(ct)) {
850 case NFPROTO_IPV4:
851 to_assign = priv->helper4;
852 break;
853 case NFPROTO_IPV6:
854 to_assign = priv->helper6;
855 break;
856 default:
857 WARN_ON_ONCE(1);
858 return;
859 }
860
861 if (!to_assign)
862 return;
863
864 if (test_bit(IPS_HELPER_BIT, &ct->status))
865 return;
866
867 help = nf_ct_helper_ext_add(ct, to_assign, GFP_ATOMIC);
868 if (help) {
869 rcu_assign_pointer(help->helper, to_assign);
870 set_bit(IPS_HELPER_BIT, &ct->status);
871 }
872}
873
874static int nft_ct_helper_obj_dump(struct sk_buff *skb,
875 struct nft_object *obj, bool reset)
876{
877 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
d02ae00a 878 const struct nf_conntrack_helper *helper;
1a64edf5
FW		 879 u16 family;
880
d02ae00a
TY		 881 if (priv->helper4 && priv->helper6) {
882 family = NFPROTO_INET;
883 helper = priv->helper4;
884 } else if (priv->helper6) {
885 family = NFPROTO_IPV6;
886 helper = priv->helper6;
887 } else {
888 family = NFPROTO_IPV4;
889 helper = priv->helper4;
890 }
891
1a64edf5
FW		 892 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
893 return -1;
894
895 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
896 return -1;
897
1a64edf5
FW		 898 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
899 return -1;
900
901 return 0;
902}
903
904static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
905 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
906 .len = NF_CT_HELPER_NAME_LEN - 1 },
907 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
908 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
909};
910
dfc46034
PBG		 911static struct nft_object_type nft_ct_helper_obj_type;
912static const struct nft_object_ops nft_ct_helper_obj_ops = {
913 .type = &nft_ct_helper_obj_type,
1a64edf5 914 .size = sizeof(struct nft_ct_helper_obj),
1a64edf5
FW		 915 .eval = nft_ct_helper_obj_eval,
916 .init = nft_ct_helper_obj_init,
917 .destroy = nft_ct_helper_obj_destroy,
918 .dump = nft_ct_helper_obj_dump,
dfc46034
PBG		 919};
920
921static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
922 .type = NFT_OBJECT_CT_HELPER,
923 .ops = &nft_ct_helper_obj_ops,
924 .maxattr = NFTA_CT_HELPER_MAX,
925 .policy = nft_ct_helper_policy,
1a64edf5
FW		 926 .owner = THIS_MODULE,
927};
928
96518518
PM		 929static int __init nft_ct_module_init(void)
930{
25443261
PNA		 931 int err;
932
adff6c65
FW		 933 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
934
25443261
PNA		 935 err = nft_register_expr(&nft_ct_type);
936 if (err < 0)
937 return err;
938
939 err = nft_register_expr(&nft_notrack_type);
940 if (err < 0)
941 goto err1;
942
dfc46034 943 err = nft_register_obj(&nft_ct_helper_obj_type);
1a64edf5
FW		 944 if (err < 0)
945 goto err2;
946
25443261 947 return 0;
1a64edf5
FW		 948
949err2:
950 nft_unregister_expr(&nft_notrack_type);
25443261
PNA		 951err1:
952 nft_unregister_expr(&nft_ct_type);
953 return err;
96518518
PM		 954}
955
956static void __exit nft_ct_module_exit(void)
957{
dfc46034 958 nft_unregister_obj(&nft_ct_helper_obj_type);
25443261 959 nft_unregister_expr(&nft_notrack_type);
ef1f7df9 960 nft_unregister_expr(&nft_ct_type);
96518518
PM		 961}
962
963module_init(nft_ct_module_init);
964module_exit(nft_ct_module_exit);
965
966MODULE_LICENSE("GPL");
967MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
968MODULE_ALIAS_NFT_EXPR("ct");
25443261 969MODULE_ALIAS_NFT_EXPR("notrack");
1a64edf5 970MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);