xref: /linux/net/netfilter/nft_ct.c (revision 44f57d78) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5  *
6  * Development of this code funded by Astaro AG (http://www.astaro.com/)
7  */
8 
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 
25 struct nft_ct {
26 	enum nft_ct_keys	key:8;
27 	enum ip_conntrack_dir	dir:8;
28 	union {
29 		enum nft_registers	dreg:8;
30 		enum nft_registers	sreg:8;
31 	};
32 };
33 
34 struct nft_ct_helper_obj  {
35 	struct nf_conntrack_helper *helper4;
36 	struct nf_conntrack_helper *helper6;
37 	u8 l4proto;
38 };
39 
40 #ifdef CONFIG_NF_CONNTRACK_ZONES
41 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
42 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
43 #endif
44 
45 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
46 				   enum nft_ct_keys k,
47 				   enum ip_conntrack_dir d)
48 {
49 	if (d < IP_CT_DIR_MAX)
50 		return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
51 					   atomic64_read(&c[d].packets);
52 
53 	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
54 	       nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
55 }
56 
57 static void nft_ct_get_eval(const struct nft_expr *expr,
58 			    struct nft_regs *regs,
59 			    const struct nft_pktinfo *pkt)
60 {
61 	const struct nft_ct *priv = nft_expr_priv(expr);
62 	u32 *dest = &regs->data[priv->dreg];
63 	enum ip_conntrack_info ctinfo;
64 	const struct nf_conn *ct;
65 	const struct nf_conn_help *help;
66 	const struct nf_conntrack_tuple *tuple;
67 	const struct nf_conntrack_helper *helper;
68 	unsigned int state;
69 
70 	ct = nf_ct_get(pkt->skb, &ctinfo);
71 
72 	switch (priv->key) {
73 	case NFT_CT_STATE:
74 		if (ct)
75 			state = NF_CT_STATE_BIT(ctinfo);
76 		else if (ctinfo == IP_CT_UNTRACKED)
77 			state = NF_CT_STATE_UNTRACKED_BIT;
78 		else
79 			state = NF_CT_STATE_INVALID_BIT;
80 		*dest = state;
81 		return;
82 	default:
83 		break;
84 	}
85 
86 	if (ct == NULL)
87 		goto err;
88 
89 	switch (priv->key) {
90 	case NFT_CT_DIRECTION:
91 		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
92 		return;
93 	case NFT_CT_STATUS:
94 		*dest = ct->status;
95 		return;
96 #ifdef CONFIG_NF_CONNTRACK_MARK
97 	case NFT_CT_MARK:
98 		*dest = ct->mark;
99 		return;
100 #endif
101 #ifdef CONFIG_NF_CONNTRACK_SECMARK
102 	case NFT_CT_SECMARK:
103 		*dest = ct->secmark;
104 		return;
105 #endif
106 	case NFT_CT_EXPIRATION:
107 		*dest = jiffies_to_msecs(nf_ct_expires(ct));
108 		return;
109 	case NFT_CT_HELPER:
110 		if (ct->master == NULL)
111 			goto err;
112 		help = nfct_help(ct->master);
113 		if (help == NULL)
114 			goto err;
115 		helper = rcu_dereference(help->helper);
116 		if (helper == NULL)
117 			goto err;
118 		strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
119 		return;
120 #ifdef CONFIG_NF_CONNTRACK_LABELS
121 	case NFT_CT_LABELS: {
122 		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
123 
124 		if (labels)
125 			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
126 		else
127 			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
128 		return;
129 	}
130 #endif
131 	case NFT_CT_BYTES: /* fallthrough */
132 	case NFT_CT_PKTS: {
133 		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
134 		u64 count = 0;
135 
136 		if (acct)
137 			count = nft_ct_get_eval_counter(acct->counter,
138 							priv->key, priv->dir);
139 		memcpy(dest, &count, sizeof(count));
140 		return;
141 	}
142 	case NFT_CT_AVGPKT: {
143 		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
144 		u64 avgcnt = 0, bcnt = 0, pcnt = 0;
145 
146 		if (acct) {
147 			pcnt = nft_ct_get_eval_counter(acct->counter,
148 						       NFT_CT_PKTS, priv->dir);
149 			bcnt = nft_ct_get_eval_counter(acct->counter,
150 						       NFT_CT_BYTES, priv->dir);
151 			if (pcnt != 0)
152 				avgcnt = div64_u64(bcnt, pcnt);
153 		}
154 
155 		memcpy(dest, &avgcnt, sizeof(avgcnt));
156 		return;
157 	}
158 	case NFT_CT_L3PROTOCOL:
159 		nft_reg_store8(dest, nf_ct_l3num(ct));
160 		return;
161 	case NFT_CT_PROTOCOL:
162 		nft_reg_store8(dest, nf_ct_protonum(ct));
163 		return;
164 #ifdef CONFIG_NF_CONNTRACK_ZONES
165 	case NFT_CT_ZONE: {
166 		const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
167 		u16 zoneid;
168 
169 		if (priv->dir < IP_CT_DIR_MAX)
170 			zoneid = nf_ct_zone_id(zone, priv->dir);
171 		else
172 			zoneid = zone->id;
173 
174 		nft_reg_store16(dest, zoneid);
175 		return;
176 	}
177 #endif
178 	case NFT_CT_ID:
179 		if (!nf_ct_is_confirmed(ct))
180 			goto err;
181 		*dest = nf_ct_get_id(ct);
182 		return;
183 	default:
184 		break;
185 	}
186 
187 	tuple = &ct->tuplehash[priv->dir].tuple;
188 	switch (priv->key) {
189 	case NFT_CT_SRC:
190 		memcpy(dest, tuple->src.u3.all,
191 		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
192 		return;
193 	case NFT_CT_DST:
194 		memcpy(dest, tuple->dst.u3.all,
195 		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
196 		return;
197 	case NFT_CT_PROTO_SRC:
198 		nft_reg_store16(dest, (__force u16)tuple->src.u.all);
199 		return;
200 	case NFT_CT_PROTO_DST:
201 		nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
202 		return;
203 	case NFT_CT_SRC_IP:
204 		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
205 			goto err;
206 		*dest = tuple->src.u3.ip;
207 		return;
208 	case NFT_CT_DST_IP:
209 		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
210 			goto err;
211 		*dest = tuple->dst.u3.ip;
212 		return;
213 	case NFT_CT_SRC_IP6:
214 		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
215 			goto err;
216 		memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
217 		return;
218 	case NFT_CT_DST_IP6:
219 		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
220 			goto err;
221 		memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
222 		return;
223 	default:
224 		break;
225 	}
226 	return;
227 err:
228 	regs->verdict.code = NFT_BREAK;
229 }
230 
231 #ifdef CONFIG_NF_CONNTRACK_ZONES
232 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
233 				 struct nft_regs *regs,
234 				 const struct nft_pktinfo *pkt)
235 {
236 	struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
237 	const struct nft_ct *priv = nft_expr_priv(expr);
238 	struct sk_buff *skb = pkt->skb;
239 	enum ip_conntrack_info ctinfo;
240 	u16 value = nft_reg_load16(&regs->data[priv->sreg]);
241 	struct nf_conn *ct;
242 
243 	ct = nf_ct_get(skb, &ctinfo);
244 	if (ct) /* already tracked */
245 		return;
246 
247 	zone.id = value;
248 
249 	switch (priv->dir) {
250 	case IP_CT_DIR_ORIGINAL:
251 		zone.dir = NF_CT_ZONE_DIR_ORIG;
252 		break;
253 	case IP_CT_DIR_REPLY:
254 		zone.dir = NF_CT_ZONE_DIR_REPL;
255 		break;
256 	default:
257 		break;
258 	}
259 
260 	ct = this_cpu_read(nft_ct_pcpu_template);
261 
262 	if (likely(atomic_read(&ct->ct_general.use) == 1)) {
263 		nf_ct_zone_add(ct, &zone);
264 	} else {
265 		/* previous skb got queued to userspace */
266 		ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
267 		if (!ct) {
268 			regs->verdict.code = NF_DROP;
269 			return;
270 		}
271 	}
272 
273 	atomic_inc(&ct->ct_general.use);
274 	nf_ct_set(skb, ct, IP_CT_NEW);
275 }
276 #endif
277 
278 static void nft_ct_set_eval(const struct nft_expr *expr,
279 			    struct nft_regs *regs,
280 			    const struct nft_pktinfo *pkt)
281 {
282 	const struct nft_ct *priv = nft_expr_priv(expr);
283 	struct sk_buff *skb = pkt->skb;
284 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
285 	u32 value = regs->data[priv->sreg];
286 #endif
287 	enum ip_conntrack_info ctinfo;
288 	struct nf_conn *ct;
289 
290 	ct = nf_ct_get(skb, &ctinfo);
291 	if (ct == NULL || nf_ct_is_template(ct))
292 		return;
293 
294 	switch (priv->key) {
295 #ifdef CONFIG_NF_CONNTRACK_MARK
296 	case NFT_CT_MARK:
297 		if (ct->mark != value) {
298 			ct->mark = value;
299 			nf_conntrack_event_cache(IPCT_MARK, ct);
300 		}
301 		break;
302 #endif
303 #ifdef CONFIG_NF_CONNTRACK_SECMARK
304 	case NFT_CT_SECMARK:
305 		if (ct->secmark != value) {
306 			ct->secmark = value;
307 			nf_conntrack_event_cache(IPCT_SECMARK, ct);
308 		}
309 		break;
310 #endif
311 #ifdef CONFIG_NF_CONNTRACK_LABELS
312 	case NFT_CT_LABELS:
313 		nf_connlabels_replace(ct,
314 				      &regs->data[priv->sreg],
315 				      &regs->data[priv->sreg],
316 				      NF_CT_LABELS_MAX_SIZE / sizeof(u32));
317 		break;
318 #endif
319 #ifdef CONFIG_NF_CONNTRACK_EVENTS
320 	case NFT_CT_EVENTMASK: {
321 		struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
322 		u32 ctmask = regs->data[priv->sreg];
323 
324 		if (e) {
325 			if (e->ctmask != ctmask)
326 				e->ctmask = ctmask;
327 			break;
328 		}
329 
330 		if (ctmask && !nf_ct_is_confirmed(ct))
331 			nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
332 		break;
333 	}
334 #endif
335 	default:
336 		break;
337 	}
338 }
339 
340 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
341 	[NFTA_CT_DREG]		= { .type = NLA_U32 },
342 	[NFTA_CT_KEY]		= { .type = NLA_U32 },
343 	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
344 	[NFTA_CT_SREG]		= { .type = NLA_U32 },
345 };
346 
347 #ifdef CONFIG_NF_CONNTRACK_ZONES
348 static void nft_ct_tmpl_put_pcpu(void)
349 {
350 	struct nf_conn *ct;
351 	int cpu;
352 
353 	for_each_possible_cpu(cpu) {
354 		ct = per_cpu(nft_ct_pcpu_template, cpu);
355 		if (!ct)
356 			break;
357 		nf_ct_put(ct);
358 		per_cpu(nft_ct_pcpu_template, cpu) = NULL;
359 	}
360 }
361 
362 static bool nft_ct_tmpl_alloc_pcpu(void)
363 {
364 	struct nf_conntrack_zone zone = { .id = 0 };
365 	struct nf_conn *tmp;
366 	int cpu;
367 
368 	if (nft_ct_pcpu_template_refcnt)
369 		return true;
370 
371 	for_each_possible_cpu(cpu) {
372 		tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
373 		if (!tmp) {
374 			nft_ct_tmpl_put_pcpu();
375 			return false;
376 		}
377 
378 		atomic_set(&tmp->ct_general.use, 1);
379 		per_cpu(nft_ct_pcpu_template, cpu) = tmp;
380 	}
381 
382 	return true;
383 }
384 #endif
385 
386 static int nft_ct_get_init(const struct nft_ctx *ctx,
387 			   const struct nft_expr *expr,
388 			   const struct nlattr * const tb[])
389 {
390 	struct nft_ct *priv = nft_expr_priv(expr);
391 	unsigned int len;
392 	int err;
393 
394 	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
395 	priv->dir = IP_CT_DIR_MAX;
396 	switch (priv->key) {
397 	case NFT_CT_DIRECTION:
398 		if (tb[NFTA_CT_DIRECTION] != NULL)
399 			return -EINVAL;
400 		len = sizeof(u8);
401 		break;
402 	case NFT_CT_STATE:
403 	case NFT_CT_STATUS:
404 #ifdef CONFIG_NF_CONNTRACK_MARK
405 	case NFT_CT_MARK:
406 #endif
407 #ifdef CONFIG_NF_CONNTRACK_SECMARK
408 	case NFT_CT_SECMARK:
409 #endif
410 	case NFT_CT_EXPIRATION:
411 		if (tb[NFTA_CT_DIRECTION] != NULL)
412 			return -EINVAL;
413 		len = sizeof(u32);
414 		break;
415 #ifdef CONFIG_NF_CONNTRACK_LABELS
416 	case NFT_CT_LABELS:
417 		if (tb[NFTA_CT_DIRECTION] != NULL)
418 			return -EINVAL;
419 		len = NF_CT_LABELS_MAX_SIZE;
420 		break;
421 #endif
422 	case NFT_CT_HELPER:
423 		if (tb[NFTA_CT_DIRECTION] != NULL)
424 			return -EINVAL;
425 		len = NF_CT_HELPER_NAME_LEN;
426 		break;
427 
428 	case NFT_CT_L3PROTOCOL:
429 	case NFT_CT_PROTOCOL:
430 		/* For compatibility, do not report error if NFTA_CT_DIRECTION
431 		 * attribute is specified.
432 		 */
433 		len = sizeof(u8);
434 		break;
435 	case NFT_CT_SRC:
436 	case NFT_CT_DST:
437 		if (tb[NFTA_CT_DIRECTION] == NULL)
438 			return -EINVAL;
439 
440 		switch (ctx->family) {
441 		case NFPROTO_IPV4:
442 			len = FIELD_SIZEOF(struct nf_conntrack_tuple,
443 					   src.u3.ip);
444 			break;
445 		case NFPROTO_IPV6:
446 		case NFPROTO_INET:
447 			len = FIELD_SIZEOF(struct nf_conntrack_tuple,
448 					   src.u3.ip6);
449 			break;
450 		default:
451 			return -EAFNOSUPPORT;
452 		}
453 		break;
454 	case NFT_CT_SRC_IP:
455 	case NFT_CT_DST_IP:
456 		if (tb[NFTA_CT_DIRECTION] == NULL)
457 			return -EINVAL;
458 
459 		len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip);
460 		break;
461 	case NFT_CT_SRC_IP6:
462 	case NFT_CT_DST_IP6:
463 		if (tb[NFTA_CT_DIRECTION] == NULL)
464 			return -EINVAL;
465 
466 		len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip6);
467 		break;
468 	case NFT_CT_PROTO_SRC:
469 	case NFT_CT_PROTO_DST:
470 		if (tb[NFTA_CT_DIRECTION] == NULL)
471 			return -EINVAL;
472 		len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
473 		break;
474 	case NFT_CT_BYTES:
475 	case NFT_CT_PKTS:
476 	case NFT_CT_AVGPKT:
477 		len = sizeof(u64);
478 		break;
479 #ifdef CONFIG_NF_CONNTRACK_ZONES
480 	case NFT_CT_ZONE:
481 		len = sizeof(u16);
482 		break;
483 #endif
484 	case NFT_CT_ID:
485 		len = sizeof(u32);
486 		break;
487 	default:
488 		return -EOPNOTSUPP;
489 	}
490 
491 	if (tb[NFTA_CT_DIRECTION] != NULL) {
492 		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
493 		switch (priv->dir) {
494 		case IP_CT_DIR_ORIGINAL:
495 		case IP_CT_DIR_REPLY:
496 			break;
497 		default:
498 			return -EINVAL;
499 		}
500 	}
501 
502 	priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
503 	err = nft_validate_register_store(ctx, priv->dreg, NULL,
504 					  NFT_DATA_VALUE, len);
505 	if (err < 0)
506 		return err;
507 
508 	err = nf_ct_netns_get(ctx->net, ctx->family);
509 	if (err < 0)
510 		return err;
511 
512 	if (priv->key == NFT_CT_BYTES ||
513 	    priv->key == NFT_CT_PKTS  ||
514 	    priv->key == NFT_CT_AVGPKT)
515 		nf_ct_set_acct(ctx->net, true);
516 
517 	return 0;
518 }
519 
520 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
521 {
522 	switch (priv->key) {
523 #ifdef CONFIG_NF_CONNTRACK_LABELS
524 	case NFT_CT_LABELS:
525 		nf_connlabels_put(ctx->net);
526 		break;
527 #endif
528 #ifdef CONFIG_NF_CONNTRACK_ZONES
529 	case NFT_CT_ZONE:
530 		if (--nft_ct_pcpu_template_refcnt == 0)
531 			nft_ct_tmpl_put_pcpu();
532 #endif
533 	default:
534 		break;
535 	}
536 }
537 
538 static int nft_ct_set_init(const struct nft_ctx *ctx,
539 			   const struct nft_expr *expr,
540 			   const struct nlattr * const tb[])
541 {
542 	struct nft_ct *priv = nft_expr_priv(expr);
543 	unsigned int len;
544 	int err;
545 
546 	priv->dir = IP_CT_DIR_MAX;
547 	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
548 	switch (priv->key) {
549 #ifdef CONFIG_NF_CONNTRACK_MARK
550 	case NFT_CT_MARK:
551 		if (tb[NFTA_CT_DIRECTION])
552 			return -EINVAL;
553 		len = FIELD_SIZEOF(struct nf_conn, mark);
554 		break;
555 #endif
556 #ifdef CONFIG_NF_CONNTRACK_LABELS
557 	case NFT_CT_LABELS:
558 		if (tb[NFTA_CT_DIRECTION])
559 			return -EINVAL;
560 		len = NF_CT_LABELS_MAX_SIZE;
561 		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
562 		if (err)
563 			return err;
564 		break;
565 #endif
566 #ifdef CONFIG_NF_CONNTRACK_ZONES
567 	case NFT_CT_ZONE:
568 		if (!nft_ct_tmpl_alloc_pcpu())
569 			return -ENOMEM;
570 		nft_ct_pcpu_template_refcnt++;
571 		len = sizeof(u16);
572 		break;
573 #endif
574 #ifdef CONFIG_NF_CONNTRACK_EVENTS
575 	case NFT_CT_EVENTMASK:
576 		if (tb[NFTA_CT_DIRECTION])
577 			return -EINVAL;
578 		len = sizeof(u32);
579 		break;
580 #endif
581 #ifdef CONFIG_NF_CONNTRACK_SECMARK
582 	case NFT_CT_SECMARK:
583 		if (tb[NFTA_CT_DIRECTION])
584 			return -EINVAL;
585 		len = sizeof(u32);
586 		break;
587 #endif
588 	default:
589 		return -EOPNOTSUPP;
590 	}
591 
592 	if (tb[NFTA_CT_DIRECTION]) {
593 		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
594 		switch (priv->dir) {
595 		case IP_CT_DIR_ORIGINAL:
596 		case IP_CT_DIR_REPLY:
597 			break;
598 		default:
599 			err = -EINVAL;
600 			goto err1;
601 		}
602 	}
603 
604 	priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
605 	err = nft_validate_register_load(priv->sreg, len);
606 	if (err < 0)
607 		goto err1;
608 
609 	err = nf_ct_netns_get(ctx->net, ctx->family);
610 	if (err < 0)
611 		goto err1;
612 
613 	return 0;
614 
615 err1:
616 	__nft_ct_set_destroy(ctx, priv);
617 	return err;
618 }
619 
620 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
621 			       const struct nft_expr *expr)
622 {
623 	nf_ct_netns_put(ctx->net, ctx->family);
624 }
625 
626 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
627 			       const struct nft_expr *expr)
628 {
629 	struct nft_ct *priv = nft_expr_priv(expr);
630 
631 	__nft_ct_set_destroy(ctx, priv);
632 	nf_ct_netns_put(ctx->net, ctx->family);
633 }
634 
635 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
636 {
637 	const struct nft_ct *priv = nft_expr_priv(expr);
638 
639 	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
640 		goto nla_put_failure;
641 	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
642 		goto nla_put_failure;
643 
644 	switch (priv->key) {
645 	case NFT_CT_SRC:
646 	case NFT_CT_DST:
647 	case NFT_CT_SRC_IP:
648 	case NFT_CT_DST_IP:
649 	case NFT_CT_SRC_IP6:
650 	case NFT_CT_DST_IP6:
651 	case NFT_CT_PROTO_SRC:
652 	case NFT_CT_PROTO_DST:
653 		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
654 			goto nla_put_failure;
655 		break;
656 	case NFT_CT_BYTES:
657 	case NFT_CT_PKTS:
658 	case NFT_CT_AVGPKT:
659 	case NFT_CT_ZONE:
660 		if (priv->dir < IP_CT_DIR_MAX &&
661 		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
662 			goto nla_put_failure;
663 		break;
664 	default:
665 		break;
666 	}
667 
668 	return 0;
669 
670 nla_put_failure:
671 	return -1;
672 }
673 
674 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
675 {
676 	const struct nft_ct *priv = nft_expr_priv(expr);
677 
678 	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
679 		goto nla_put_failure;
680 	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
681 		goto nla_put_failure;
682 
683 	switch (priv->key) {
684 	case NFT_CT_ZONE:
685 		if (priv->dir < IP_CT_DIR_MAX &&
686 		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
687 			goto nla_put_failure;
688 		break;
689 	default:
690 		break;
691 	}
692 
693 	return 0;
694 
695 nla_put_failure:
696 	return -1;
697 }
698 
699 static struct nft_expr_type nft_ct_type;
700 static const struct nft_expr_ops nft_ct_get_ops = {
701 	.type		= &nft_ct_type,
702 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
703 	.eval		= nft_ct_get_eval,
704 	.init		= nft_ct_get_init,
705 	.destroy	= nft_ct_get_destroy,
706 	.dump		= nft_ct_get_dump,
707 };
708 
709 static const struct nft_expr_ops nft_ct_set_ops = {
710 	.type		= &nft_ct_type,
711 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
712 	.eval		= nft_ct_set_eval,
713 	.init		= nft_ct_set_init,
714 	.destroy	= nft_ct_set_destroy,
715 	.dump		= nft_ct_set_dump,
716 };
717 
718 #ifdef CONFIG_NF_CONNTRACK_ZONES
719 static const struct nft_expr_ops nft_ct_set_zone_ops = {
720 	.type		= &nft_ct_type,
721 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
722 	.eval		= nft_ct_set_zone_eval,
723 	.init		= nft_ct_set_init,
724 	.destroy	= nft_ct_set_destroy,
725 	.dump		= nft_ct_set_dump,
726 };
727 #endif
728 
729 static const struct nft_expr_ops *
730 nft_ct_select_ops(const struct nft_ctx *ctx,
731 		    const struct nlattr * const tb[])
732 {
733 	if (tb[NFTA_CT_KEY] == NULL)
734 		return ERR_PTR(-EINVAL);
735 
736 	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
737 		return ERR_PTR(-EINVAL);
738 
739 	if (tb[NFTA_CT_DREG])
740 		return &nft_ct_get_ops;
741 
742 	if (tb[NFTA_CT_SREG]) {
743 #ifdef CONFIG_NF_CONNTRACK_ZONES
744 		if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
745 			return &nft_ct_set_zone_ops;
746 #endif
747 		return &nft_ct_set_ops;
748 	}
749 
750 	return ERR_PTR(-EINVAL);
751 }
752 
753 static struct nft_expr_type nft_ct_type __read_mostly = {
754 	.name		= "ct",
755 	.select_ops	= nft_ct_select_ops,
756 	.policy		= nft_ct_policy,
757 	.maxattr	= NFTA_CT_MAX,
758 	.owner		= THIS_MODULE,
759 };
760 
761 static void nft_notrack_eval(const struct nft_expr *expr,
762 			     struct nft_regs *regs,
763 			     const struct nft_pktinfo *pkt)
764 {
765 	struct sk_buff *skb = pkt->skb;
766 	enum ip_conntrack_info ctinfo;
767 	struct nf_conn *ct;
768 
769 	ct = nf_ct_get(pkt->skb, &ctinfo);
770 	/* Previously seen (loopback or untracked)?  Ignore. */
771 	if (ct || ctinfo == IP_CT_UNTRACKED)
772 		return;
773 
774 	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
775 }
776 
777 static struct nft_expr_type nft_notrack_type;
778 static const struct nft_expr_ops nft_notrack_ops = {
779 	.type		= &nft_notrack_type,
780 	.size		= NFT_EXPR_SIZE(0),
781 	.eval		= nft_notrack_eval,
782 };
783 
784 static struct nft_expr_type nft_notrack_type __read_mostly = {
785 	.name		= "notrack",
786 	.ops		= &nft_notrack_ops,
787 	.owner		= THIS_MODULE,
788 };
789 
790 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
791 static int
792 nft_ct_timeout_parse_policy(void *timeouts,
793 			    const struct nf_conntrack_l4proto *l4proto,
794 			    struct net *net, const struct nlattr *attr)
795 {
796 	struct nlattr **tb;
797 	int ret = 0;
798 
799 	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
800 		     GFP_KERNEL);
801 
802 	if (!tb)
803 		return -ENOMEM;
804 
805 	ret = nla_parse_nested_deprecated(tb,
806 					  l4proto->ctnl_timeout.nlattr_max,
807 					  attr,
808 					  l4proto->ctnl_timeout.nla_policy,
809 					  NULL);
810 	if (ret < 0)
811 		goto err;
812 
813 	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
814 
815 err:
816 	kfree(tb);
817 	return ret;
818 }
819 
820 struct nft_ct_timeout_obj {
821 	struct nf_ct_timeout    *timeout;
822 	u8			l4proto;
823 };
824 
825 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
826 				    struct nft_regs *regs,
827 				    const struct nft_pktinfo *pkt)
828 {
829 	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
830 	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
831 	struct nf_conn_timeout *timeout;
832 	const unsigned int *values;
833 
834 	if (priv->l4proto != pkt->tprot)
835 		return;
836 
837 	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
838 		return;
839 
840 	timeout = nf_ct_timeout_find(ct);
841 	if (!timeout) {
842 		timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
843 		if (!timeout) {
844 			regs->verdict.code = NF_DROP;
845 			return;
846 		}
847 	}
848 
849 	rcu_assign_pointer(timeout->timeout, priv->timeout);
850 
851 	/* adjust the timeout as per 'new' state. ct is unconfirmed,
852 	 * so the current timestamp must not be added.
853 	 */
854 	values = nf_ct_timeout_data(timeout);
855 	if (values)
856 		nf_ct_refresh(ct, pkt->skb, values[0]);
857 }
858 
859 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
860 				   const struct nlattr * const tb[],
861 				   struct nft_object *obj)
862 {
863 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
864 	const struct nf_conntrack_l4proto *l4proto;
865 	struct nf_ct_timeout *timeout;
866 	int l3num = ctx->family;
867 	__u8 l4num;
868 	int ret;
869 
870 	if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
871 	    !tb[NFTA_CT_TIMEOUT_DATA])
872 		return -EINVAL;
873 
874 	if (tb[NFTA_CT_TIMEOUT_L3PROTO])
875 		l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
876 
877 	l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
878 	priv->l4proto = l4num;
879 
880 	l4proto = nf_ct_l4proto_find(l4num);
881 
882 	if (l4proto->l4proto != l4num) {
883 		ret = -EOPNOTSUPP;
884 		goto err_proto_put;
885 	}
886 
887 	timeout = kzalloc(sizeof(struct nf_ct_timeout) +
888 			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
889 	if (timeout == NULL) {
890 		ret = -ENOMEM;
891 		goto err_proto_put;
892 	}
893 
894 	ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
895 					  tb[NFTA_CT_TIMEOUT_DATA]);
896 	if (ret < 0)
897 		goto err_free_timeout;
898 
899 	timeout->l3num = l3num;
900 	timeout->l4proto = l4proto;
901 
902 	ret = nf_ct_netns_get(ctx->net, ctx->family);
903 	if (ret < 0)
904 		goto err_free_timeout;
905 
906 	priv->timeout = timeout;
907 	return 0;
908 
909 err_free_timeout:
910 	kfree(timeout);
911 err_proto_put:
912 	return ret;
913 }
914 
915 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
916 				       struct nft_object *obj)
917 {
918 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
919 	struct nf_ct_timeout *timeout = priv->timeout;
920 
921 	nf_ct_untimeout(ctx->net, timeout);
922 	nf_ct_netns_put(ctx->net, ctx->family);
923 	kfree(priv->timeout);
924 }
925 
926 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
927 				   struct nft_object *obj, bool reset)
928 {
929 	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
930 	const struct nf_ct_timeout *timeout = priv->timeout;
931 	struct nlattr *nest_params;
932 	int ret;
933 
934 	if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
935 	    nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
936 		return -1;
937 
938 	nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
939 	if (!nest_params)
940 		return -1;
941 
942 	ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
943 	if (ret < 0)
944 		return -1;
945 	nla_nest_end(skb, nest_params);
946 	return 0;
947 }
948 
949 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
950 	[NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
951 	[NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
952 	[NFTA_CT_TIMEOUT_DATA]	  = {.type = NLA_NESTED },
953 };
954 
955 static struct nft_object_type nft_ct_timeout_obj_type;
956 
957 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
958 	.type		= &nft_ct_timeout_obj_type,
959 	.size		= sizeof(struct nft_ct_timeout_obj),
960 	.eval		= nft_ct_timeout_obj_eval,
961 	.init		= nft_ct_timeout_obj_init,
962 	.destroy	= nft_ct_timeout_obj_destroy,
963 	.dump		= nft_ct_timeout_obj_dump,
964 };
965 
966 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
967 	.type		= NFT_OBJECT_CT_TIMEOUT,
968 	.ops		= &nft_ct_timeout_obj_ops,
969 	.maxattr	= NFTA_CT_TIMEOUT_MAX,
970 	.policy		= nft_ct_timeout_policy,
971 	.owner		= THIS_MODULE,
972 };
973 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
974 
975 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
976 				  const struct nlattr * const tb[],
977 				  struct nft_object *obj)
978 {
979 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
980 	struct nf_conntrack_helper *help4, *help6;
981 	char name[NF_CT_HELPER_NAME_LEN];
982 	int family = ctx->family;
983 	int err;
984 
985 	if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
986 		return -EINVAL;
987 
988 	priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
989 	if (!priv->l4proto)
990 		return -ENOENT;
991 
992 	nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
993 
994 	if (tb[NFTA_CT_HELPER_L3PROTO])
995 		family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
996 
997 	help4 = NULL;
998 	help6 = NULL;
999 
1000 	switch (family) {
1001 	case NFPROTO_IPV4:
1002 		if (ctx->family == NFPROTO_IPV6)
1003 			return -EINVAL;
1004 
1005 		help4 = nf_conntrack_helper_try_module_get(name, family,
1006 							   priv->l4proto);
1007 		break;
1008 	case NFPROTO_IPV6:
1009 		if (ctx->family == NFPROTO_IPV4)
1010 			return -EINVAL;
1011 
1012 		help6 = nf_conntrack_helper_try_module_get(name, family,
1013 							   priv->l4proto);
1014 		break;
1015 	case NFPROTO_NETDEV: /* fallthrough */
1016 	case NFPROTO_BRIDGE: /* same */
1017 	case NFPROTO_INET:
1018 		help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1019 							   priv->l4proto);
1020 		help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1021 							   priv->l4proto);
1022 		break;
1023 	default:
1024 		return -EAFNOSUPPORT;
1025 	}
1026 
1027 	/* && is intentional; only error if INET found neither ipv4 or ipv6 */
1028 	if (!help4 && !help6)
1029 		return -ENOENT;
1030 
1031 	priv->helper4 = help4;
1032 	priv->helper6 = help6;
1033 
1034 	err = nf_ct_netns_get(ctx->net, ctx->family);
1035 	if (err < 0)
1036 		goto err_put_helper;
1037 
1038 	return 0;
1039 
1040 err_put_helper:
1041 	if (priv->helper4)
1042 		nf_conntrack_helper_put(priv->helper4);
1043 	if (priv->helper6)
1044 		nf_conntrack_helper_put(priv->helper6);
1045 	return err;
1046 }
1047 
1048 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1049 				      struct nft_object *obj)
1050 {
1051 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1052 
1053 	if (priv->helper4)
1054 		nf_conntrack_helper_put(priv->helper4);
1055 	if (priv->helper6)
1056 		nf_conntrack_helper_put(priv->helper6);
1057 
1058 	nf_ct_netns_put(ctx->net, ctx->family);
1059 }
1060 
1061 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1062 				   struct nft_regs *regs,
1063 				   const struct nft_pktinfo *pkt)
1064 {
1065 	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1066 	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1067 	struct nf_conntrack_helper *to_assign = NULL;
1068 	struct nf_conn_help *help;
1069 
1070 	if (!ct ||
1071 	    nf_ct_is_confirmed(ct) ||
1072 	    nf_ct_is_template(ct) ||
1073 	    priv->l4proto != nf_ct_protonum(ct))
1074 		return;
1075 
1076 	switch (nf_ct_l3num(ct)) {
1077 	case NFPROTO_IPV4:
1078 		to_assign = priv->helper4;
1079 		break;
1080 	case NFPROTO_IPV6:
1081 		to_assign = priv->helper6;
1082 		break;
1083 	default:
1084 		WARN_ON_ONCE(1);
1085 		return;
1086 	}
1087 
1088 	if (!to_assign)
1089 		return;
1090 
1091 	if (test_bit(IPS_HELPER_BIT, &ct->status))
1092 		return;
1093 
1094 	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1095 	if (help) {
1096 		rcu_assign_pointer(help->helper, to_assign);
1097 		set_bit(IPS_HELPER_BIT, &ct->status);
1098 	}
1099 }
1100 
1101 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1102 				  struct nft_object *obj, bool reset)
1103 {
1104 	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1105 	const struct nf_conntrack_helper *helper;
1106 	u16 family;
1107 
1108 	if (priv->helper4 && priv->helper6) {
1109 		family = NFPROTO_INET;
1110 		helper = priv->helper4;
1111 	} else if (priv->helper6) {
1112 		family = NFPROTO_IPV6;
1113 		helper = priv->helper6;
1114 	} else {
1115 		family = NFPROTO_IPV4;
1116 		helper = priv->helper4;
1117 	}
1118 
1119 	if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1120 		return -1;
1121 
1122 	if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1123 		return -1;
1124 
1125 	if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1126 		return -1;
1127 
1128 	return 0;
1129 }
1130 
1131 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1132 	[NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1133 				  .len = NF_CT_HELPER_NAME_LEN - 1 },
1134 	[NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1135 	[NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1136 };
1137 
1138 static struct nft_object_type nft_ct_helper_obj_type;
1139 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1140 	.type		= &nft_ct_helper_obj_type,
1141 	.size		= sizeof(struct nft_ct_helper_obj),
1142 	.eval		= nft_ct_helper_obj_eval,
1143 	.init		= nft_ct_helper_obj_init,
1144 	.destroy	= nft_ct_helper_obj_destroy,
1145 	.dump		= nft_ct_helper_obj_dump,
1146 };
1147 
1148 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1149 	.type		= NFT_OBJECT_CT_HELPER,
1150 	.ops		= &nft_ct_helper_obj_ops,
1151 	.maxattr	= NFTA_CT_HELPER_MAX,
1152 	.policy		= nft_ct_helper_policy,
1153 	.owner		= THIS_MODULE,
1154 };
1155 
1156 static int __init nft_ct_module_init(void)
1157 {
1158 	int err;
1159 
1160 	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1161 
1162 	err = nft_register_expr(&nft_ct_type);
1163 	if (err < 0)
1164 		return err;
1165 
1166 	err = nft_register_expr(&nft_notrack_type);
1167 	if (err < 0)
1168 		goto err1;
1169 
1170 	err = nft_register_obj(&nft_ct_helper_obj_type);
1171 	if (err < 0)
1172 		goto err2;
1173 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1174 	err = nft_register_obj(&nft_ct_timeout_obj_type);
1175 	if (err < 0)
1176 		goto err3;
1177 #endif
1178 	return 0;
1179 
1180 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1181 err3:
1182 	nft_unregister_obj(&nft_ct_helper_obj_type);
1183 #endif
1184 err2:
1185 	nft_unregister_expr(&nft_notrack_type);
1186 err1:
1187 	nft_unregister_expr(&nft_ct_type);
1188 	return err;
1189 }
1190 
1191 static void __exit nft_ct_module_exit(void)
1192 {
1193 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1194 	nft_unregister_obj(&nft_ct_timeout_obj_type);
1195 #endif
1196 	nft_unregister_obj(&nft_ct_helper_obj_type);
1197 	nft_unregister_expr(&nft_notrack_type);
1198 	nft_unregister_expr(&nft_ct_type);
1199 }
1200 
1201 module_init(nft_ct_module_init);
1202 module_exit(nft_ct_module_exit);
1203 
1204 MODULE_LICENSE("GPL");
1205 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1206 MODULE_ALIAS_NFT_EXPR("ct");
1207 MODULE_ALIAS_NFT_EXPR("notrack");
1208 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1209 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1210