1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
30 enum nft_registers dreg:8;
31 enum nft_registers sreg:8;
35 struct nft_ct_helper_obj {
36 struct nf_conntrack_helper *helper4;
37 struct nf_conntrack_helper *helper6;
41 #ifdef CONFIG_NF_CONNTRACK_ZONES
42 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
43 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
46 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
48 enum ip_conntrack_dir d)
50 if (d < IP_CT_DIR_MAX)
51 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
52 atomic64_read(&c[d].packets);
54 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
55 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
58 static void nft_ct_get_eval(const struct nft_expr *expr,
59 struct nft_regs *regs,
60 const struct nft_pktinfo *pkt)
62 const struct nft_ct *priv = nft_expr_priv(expr);
63 u32 *dest = ®s->data[priv->dreg];
64 enum ip_conntrack_info ctinfo;
65 const struct nf_conn *ct;
66 const struct nf_conn_help *help;
67 const struct nf_conntrack_tuple *tuple;
68 const struct nf_conntrack_helper *helper;
71 ct = nf_ct_get(pkt->skb, &ctinfo);
76 state = NF_CT_STATE_BIT(ctinfo);
77 else if (ctinfo == IP_CT_UNTRACKED)
78 state = NF_CT_STATE_UNTRACKED_BIT;
80 state = NF_CT_STATE_INVALID_BIT;
91 case NFT_CT_DIRECTION:
92 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
97 #ifdef CONFIG_NF_CONNTRACK_MARK
102 #ifdef CONFIG_NF_CONNTRACK_SECMARK
107 case NFT_CT_EXPIRATION:
108 *dest = jiffies_to_msecs(nf_ct_expires(ct));
111 if (ct->master == NULL)
113 help = nfct_help(ct->master);
116 helper = rcu_dereference(help->helper);
119 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
121 #ifdef CONFIG_NF_CONNTRACK_LABELS
122 case NFT_CT_LABELS: {
123 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
126 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
128 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
132 case NFT_CT_BYTES: /* fallthrough */
134 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
138 count = nft_ct_get_eval_counter(acct->counter,
139 priv->key, priv->dir);
140 memcpy(dest, &count, sizeof(count));
143 case NFT_CT_AVGPKT: {
144 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
145 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
148 pcnt = nft_ct_get_eval_counter(acct->counter,
149 NFT_CT_PKTS, priv->dir);
150 bcnt = nft_ct_get_eval_counter(acct->counter,
151 NFT_CT_BYTES, priv->dir);
153 avgcnt = div64_u64(bcnt, pcnt);
156 memcpy(dest, &avgcnt, sizeof(avgcnt));
159 case NFT_CT_L3PROTOCOL:
160 nft_reg_store8(dest, nf_ct_l3num(ct));
162 case NFT_CT_PROTOCOL:
163 nft_reg_store8(dest, nf_ct_protonum(ct));
165 #ifdef CONFIG_NF_CONNTRACK_ZONES
167 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
170 if (priv->dir < IP_CT_DIR_MAX)
171 zoneid = nf_ct_zone_id(zone, priv->dir);
175 nft_reg_store16(dest, zoneid);
180 if (!nf_ct_is_confirmed(ct))
182 *dest = nf_ct_get_id(ct);
188 tuple = &ct->tuplehash[priv->dir].tuple;
191 memcpy(dest, tuple->src.u3.all,
192 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
195 memcpy(dest, tuple->dst.u3.all,
196 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
198 case NFT_CT_PROTO_SRC:
199 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
201 case NFT_CT_PROTO_DST:
202 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
205 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
207 *dest = tuple->src.u3.ip;
210 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
212 *dest = tuple->dst.u3.ip;
215 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
217 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
220 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
222 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
229 regs->verdict.code = NFT_BREAK;
232 #ifdef CONFIG_NF_CONNTRACK_ZONES
233 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
234 struct nft_regs *regs,
235 const struct nft_pktinfo *pkt)
237 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
238 const struct nft_ct *priv = nft_expr_priv(expr);
239 struct sk_buff *skb = pkt->skb;
240 enum ip_conntrack_info ctinfo;
241 u16 value = nft_reg_load16(®s->data[priv->sreg]);
244 ct = nf_ct_get(skb, &ctinfo);
245 if (ct) /* already tracked */
251 case IP_CT_DIR_ORIGINAL:
252 zone.dir = NF_CT_ZONE_DIR_ORIG;
254 case IP_CT_DIR_REPLY:
255 zone.dir = NF_CT_ZONE_DIR_REPL;
261 ct = this_cpu_read(nft_ct_pcpu_template);
263 if (likely(atomic_read(&ct->ct_general.use) == 1)) {
264 nf_ct_zone_add(ct, &zone);
266 /* previous skb got queued to userspace */
267 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
269 regs->verdict.code = NF_DROP;
274 atomic_inc(&ct->ct_general.use);
275 nf_ct_set(skb, ct, IP_CT_NEW);
279 static void nft_ct_set_eval(const struct nft_expr *expr,
280 struct nft_regs *regs,
281 const struct nft_pktinfo *pkt)
283 const struct nft_ct *priv = nft_expr_priv(expr);
284 struct sk_buff *skb = pkt->skb;
285 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
286 u32 value = regs->data[priv->sreg];
288 enum ip_conntrack_info ctinfo;
291 ct = nf_ct_get(skb, &ctinfo);
292 if (ct == NULL || nf_ct_is_template(ct))
296 #ifdef CONFIG_NF_CONNTRACK_MARK
298 if (ct->mark != value) {
300 nf_conntrack_event_cache(IPCT_MARK, ct);
304 #ifdef CONFIG_NF_CONNTRACK_SECMARK
306 if (ct->secmark != value) {
308 nf_conntrack_event_cache(IPCT_SECMARK, ct);
312 #ifdef CONFIG_NF_CONNTRACK_LABELS
314 nf_connlabels_replace(ct,
315 ®s->data[priv->sreg],
316 ®s->data[priv->sreg],
317 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
320 #ifdef CONFIG_NF_CONNTRACK_EVENTS
321 case NFT_CT_EVENTMASK: {
322 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
323 u32 ctmask = regs->data[priv->sreg];
326 if (e->ctmask != ctmask)
331 if (ctmask && !nf_ct_is_confirmed(ct))
332 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
341 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
342 [NFTA_CT_DREG] = { .type = NLA_U32 },
343 [NFTA_CT_KEY] = { .type = NLA_U32 },
344 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
345 [NFTA_CT_SREG] = { .type = NLA_U32 },
348 #ifdef CONFIG_NF_CONNTRACK_ZONES
349 static void nft_ct_tmpl_put_pcpu(void)
354 for_each_possible_cpu(cpu) {
355 ct = per_cpu(nft_ct_pcpu_template, cpu);
359 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
363 static bool nft_ct_tmpl_alloc_pcpu(void)
365 struct nf_conntrack_zone zone = { .id = 0 };
369 if (nft_ct_pcpu_template_refcnt)
372 for_each_possible_cpu(cpu) {
373 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
375 nft_ct_tmpl_put_pcpu();
379 atomic_set(&tmp->ct_general.use, 1);
380 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
387 static int nft_ct_get_init(const struct nft_ctx *ctx,
388 const struct nft_expr *expr,
389 const struct nlattr * const tb[])
391 struct nft_ct *priv = nft_expr_priv(expr);
395 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
396 priv->dir = IP_CT_DIR_MAX;
398 case NFT_CT_DIRECTION:
399 if (tb[NFTA_CT_DIRECTION] != NULL)
405 #ifdef CONFIG_NF_CONNTRACK_MARK
408 #ifdef CONFIG_NF_CONNTRACK_SECMARK
411 case NFT_CT_EXPIRATION:
412 if (tb[NFTA_CT_DIRECTION] != NULL)
416 #ifdef CONFIG_NF_CONNTRACK_LABELS
418 if (tb[NFTA_CT_DIRECTION] != NULL)
420 len = NF_CT_LABELS_MAX_SIZE;
424 if (tb[NFTA_CT_DIRECTION] != NULL)
426 len = NF_CT_HELPER_NAME_LEN;
429 case NFT_CT_L3PROTOCOL:
430 case NFT_CT_PROTOCOL:
431 /* For compatibility, do not report error if NFTA_CT_DIRECTION
432 * attribute is specified.
438 if (tb[NFTA_CT_DIRECTION] == NULL)
441 switch (ctx->family) {
443 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
448 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
452 return -EAFNOSUPPORT;
457 if (tb[NFTA_CT_DIRECTION] == NULL)
460 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip);
464 if (tb[NFTA_CT_DIRECTION] == NULL)
467 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip6);
469 case NFT_CT_PROTO_SRC:
470 case NFT_CT_PROTO_DST:
471 if (tb[NFTA_CT_DIRECTION] == NULL)
473 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
480 #ifdef CONFIG_NF_CONNTRACK_ZONES
492 if (tb[NFTA_CT_DIRECTION] != NULL) {
493 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
495 case IP_CT_DIR_ORIGINAL:
496 case IP_CT_DIR_REPLY:
503 priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
504 err = nft_validate_register_store(ctx, priv->dreg, NULL,
505 NFT_DATA_VALUE, len);
509 err = nf_ct_netns_get(ctx->net, ctx->family);
513 if (priv->key == NFT_CT_BYTES ||
514 priv->key == NFT_CT_PKTS ||
515 priv->key == NFT_CT_AVGPKT)
516 nf_ct_set_acct(ctx->net, true);
521 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
524 #ifdef CONFIG_NF_CONNTRACK_LABELS
526 nf_connlabels_put(ctx->net);
529 #ifdef CONFIG_NF_CONNTRACK_ZONES
531 if (--nft_ct_pcpu_template_refcnt == 0)
532 nft_ct_tmpl_put_pcpu();
539 static int nft_ct_set_init(const struct nft_ctx *ctx,
540 const struct nft_expr *expr,
541 const struct nlattr * const tb[])
543 struct nft_ct *priv = nft_expr_priv(expr);
547 priv->dir = IP_CT_DIR_MAX;
548 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
550 #ifdef CONFIG_NF_CONNTRACK_MARK
552 if (tb[NFTA_CT_DIRECTION])
554 len = FIELD_SIZEOF(struct nf_conn, mark);
557 #ifdef CONFIG_NF_CONNTRACK_LABELS
559 if (tb[NFTA_CT_DIRECTION])
561 len = NF_CT_LABELS_MAX_SIZE;
562 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
567 #ifdef CONFIG_NF_CONNTRACK_ZONES
569 if (!nft_ct_tmpl_alloc_pcpu())
571 nft_ct_pcpu_template_refcnt++;
575 #ifdef CONFIG_NF_CONNTRACK_EVENTS
576 case NFT_CT_EVENTMASK:
577 if (tb[NFTA_CT_DIRECTION])
582 #ifdef CONFIG_NF_CONNTRACK_SECMARK
584 if (tb[NFTA_CT_DIRECTION])
593 if (tb[NFTA_CT_DIRECTION]) {
594 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
596 case IP_CT_DIR_ORIGINAL:
597 case IP_CT_DIR_REPLY:
605 priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
606 err = nft_validate_register_load(priv->sreg, len);
610 err = nf_ct_netns_get(ctx->net, ctx->family);
617 __nft_ct_set_destroy(ctx, priv);
621 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
622 const struct nft_expr *expr)
624 nf_ct_netns_put(ctx->net, ctx->family);
627 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
628 const struct nft_expr *expr)
630 struct nft_ct *priv = nft_expr_priv(expr);
632 __nft_ct_set_destroy(ctx, priv);
633 nf_ct_netns_put(ctx->net, ctx->family);
636 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
638 const struct nft_ct *priv = nft_expr_priv(expr);
640 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
641 goto nla_put_failure;
642 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
643 goto nla_put_failure;
652 case NFT_CT_PROTO_SRC:
653 case NFT_CT_PROTO_DST:
654 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
655 goto nla_put_failure;
661 if (priv->dir < IP_CT_DIR_MAX &&
662 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
663 goto nla_put_failure;
675 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
677 const struct nft_ct *priv = nft_expr_priv(expr);
679 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
680 goto nla_put_failure;
681 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
682 goto nla_put_failure;
686 if (priv->dir < IP_CT_DIR_MAX &&
687 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
688 goto nla_put_failure;
700 static struct nft_expr_type nft_ct_type;
701 static const struct nft_expr_ops nft_ct_get_ops = {
702 .type = &nft_ct_type,
703 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
704 .eval = nft_ct_get_eval,
705 .init = nft_ct_get_init,
706 .destroy = nft_ct_get_destroy,
707 .dump = nft_ct_get_dump,
710 static const struct nft_expr_ops nft_ct_set_ops = {
711 .type = &nft_ct_type,
712 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
713 .eval = nft_ct_set_eval,
714 .init = nft_ct_set_init,
715 .destroy = nft_ct_set_destroy,
716 .dump = nft_ct_set_dump,
719 #ifdef CONFIG_NF_CONNTRACK_ZONES
720 static const struct nft_expr_ops nft_ct_set_zone_ops = {
721 .type = &nft_ct_type,
722 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
723 .eval = nft_ct_set_zone_eval,
724 .init = nft_ct_set_init,
725 .destroy = nft_ct_set_destroy,
726 .dump = nft_ct_set_dump,
730 static const struct nft_expr_ops *
731 nft_ct_select_ops(const struct nft_ctx *ctx,
732 const struct nlattr * const tb[])
734 if (tb[NFTA_CT_KEY] == NULL)
735 return ERR_PTR(-EINVAL);
737 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
738 return ERR_PTR(-EINVAL);
740 if (tb[NFTA_CT_DREG])
741 return &nft_ct_get_ops;
743 if (tb[NFTA_CT_SREG]) {
744 #ifdef CONFIG_NF_CONNTRACK_ZONES
745 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
746 return &nft_ct_set_zone_ops;
748 return &nft_ct_set_ops;
751 return ERR_PTR(-EINVAL);
754 static struct nft_expr_type nft_ct_type __read_mostly = {
756 .select_ops = nft_ct_select_ops,
757 .policy = nft_ct_policy,
758 .maxattr = NFTA_CT_MAX,
759 .owner = THIS_MODULE,
762 static void nft_notrack_eval(const struct nft_expr *expr,
763 struct nft_regs *regs,
764 const struct nft_pktinfo *pkt)
766 struct sk_buff *skb = pkt->skb;
767 enum ip_conntrack_info ctinfo;
770 ct = nf_ct_get(pkt->skb, &ctinfo);
771 /* Previously seen (loopback or untracked)? Ignore. */
772 if (ct || ctinfo == IP_CT_UNTRACKED)
775 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
778 static struct nft_expr_type nft_notrack_type;
779 static const struct nft_expr_ops nft_notrack_ops = {
780 .type = &nft_notrack_type,
781 .size = NFT_EXPR_SIZE(0),
782 .eval = nft_notrack_eval,
785 static struct nft_expr_type nft_notrack_type __read_mostly = {
787 .ops = &nft_notrack_ops,
788 .owner = THIS_MODULE,
791 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
793 nft_ct_timeout_parse_policy(void *timeouts,
794 const struct nf_conntrack_l4proto *l4proto,
795 struct net *net, const struct nlattr *attr)
800 tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
806 ret = nla_parse_nested_deprecated(tb,
807 l4proto->ctnl_timeout.nlattr_max,
809 l4proto->ctnl_timeout.nla_policy,
814 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
821 struct nft_ct_timeout_obj {
822 struct nf_ct_timeout *timeout;
826 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
827 struct nft_regs *regs,
828 const struct nft_pktinfo *pkt)
830 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
831 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
832 struct nf_conn_timeout *timeout;
833 const unsigned int *values;
835 if (priv->l4proto != pkt->tprot)
838 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
841 timeout = nf_ct_timeout_find(ct);
843 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
845 regs->verdict.code = NF_DROP;
850 rcu_assign_pointer(timeout->timeout, priv->timeout);
852 /* adjust the timeout as per 'new' state. ct is unconfirmed,
853 * so the current timestamp must not be added.
855 values = nf_ct_timeout_data(timeout);
857 nf_ct_refresh(ct, pkt->skb, values[0]);
860 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
861 const struct nlattr * const tb[],
862 struct nft_object *obj)
864 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
865 const struct nf_conntrack_l4proto *l4proto;
866 struct nf_ct_timeout *timeout;
867 int l3num = ctx->family;
871 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
872 !tb[NFTA_CT_TIMEOUT_DATA])
875 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
876 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
878 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
879 priv->l4proto = l4num;
881 l4proto = nf_ct_l4proto_find(l4num);
883 if (l4proto->l4proto != l4num) {
888 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
889 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
890 if (timeout == NULL) {
895 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
896 tb[NFTA_CT_TIMEOUT_DATA]);
898 goto err_free_timeout;
900 timeout->l3num = l3num;
901 timeout->l4proto = l4proto;
903 ret = nf_ct_netns_get(ctx->net, ctx->family);
905 goto err_free_timeout;
907 priv->timeout = timeout;
916 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
917 struct nft_object *obj)
919 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
920 struct nf_ct_timeout *timeout = priv->timeout;
922 nf_ct_untimeout(ctx->net, timeout);
923 nf_ct_netns_put(ctx->net, ctx->family);
924 kfree(priv->timeout);
927 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
928 struct nft_object *obj, bool reset)
930 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
931 const struct nf_ct_timeout *timeout = priv->timeout;
932 struct nlattr *nest_params;
935 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
936 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
939 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
943 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
946 nla_nest_end(skb, nest_params);
950 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
951 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
952 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
953 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
956 static struct nft_object_type nft_ct_timeout_obj_type;
958 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
959 .type = &nft_ct_timeout_obj_type,
960 .size = sizeof(struct nft_ct_timeout_obj),
961 .eval = nft_ct_timeout_obj_eval,
962 .init = nft_ct_timeout_obj_init,
963 .destroy = nft_ct_timeout_obj_destroy,
964 .dump = nft_ct_timeout_obj_dump,
967 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
968 .type = NFT_OBJECT_CT_TIMEOUT,
969 .ops = &nft_ct_timeout_obj_ops,
970 .maxattr = NFTA_CT_TIMEOUT_MAX,
971 .policy = nft_ct_timeout_policy,
972 .owner = THIS_MODULE,
974 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
976 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
977 const struct nlattr * const tb[],
978 struct nft_object *obj)
980 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
981 struct nf_conntrack_helper *help4, *help6;
982 char name[NF_CT_HELPER_NAME_LEN];
983 int family = ctx->family;
986 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
989 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
993 nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
995 if (tb[NFTA_CT_HELPER_L3PROTO])
996 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1003 if (ctx->family == NFPROTO_IPV6)
1006 help4 = nf_conntrack_helper_try_module_get(name, family,
1010 if (ctx->family == NFPROTO_IPV4)
1013 help6 = nf_conntrack_helper_try_module_get(name, family,
1016 case NFPROTO_NETDEV: /* fallthrough */
1017 case NFPROTO_BRIDGE: /* same */
1019 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1021 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1025 return -EAFNOSUPPORT;
1028 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1029 if (!help4 && !help6)
1032 priv->helper4 = help4;
1033 priv->helper6 = help6;
1035 err = nf_ct_netns_get(ctx->net, ctx->family);
1037 goto err_put_helper;
1043 nf_conntrack_helper_put(priv->helper4);
1045 nf_conntrack_helper_put(priv->helper6);
1049 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1050 struct nft_object *obj)
1052 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1055 nf_conntrack_helper_put(priv->helper4);
1057 nf_conntrack_helper_put(priv->helper6);
1059 nf_ct_netns_put(ctx->net, ctx->family);
1062 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1063 struct nft_regs *regs,
1064 const struct nft_pktinfo *pkt)
1066 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1067 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1068 struct nf_conntrack_helper *to_assign = NULL;
1069 struct nf_conn_help *help;
1072 nf_ct_is_confirmed(ct) ||
1073 nf_ct_is_template(ct) ||
1074 priv->l4proto != nf_ct_protonum(ct))
1077 switch (nf_ct_l3num(ct)) {
1079 to_assign = priv->helper4;
1082 to_assign = priv->helper6;
1092 if (test_bit(IPS_HELPER_BIT, &ct->status))
1095 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1097 rcu_assign_pointer(help->helper, to_assign);
1098 set_bit(IPS_HELPER_BIT, &ct->status);
1102 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1103 struct nft_object *obj, bool reset)
1105 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1106 const struct nf_conntrack_helper *helper;
1109 if (priv->helper4 && priv->helper6) {
1110 family = NFPROTO_INET;
1111 helper = priv->helper4;
1112 } else if (priv->helper6) {
1113 family = NFPROTO_IPV6;
1114 helper = priv->helper6;
1116 family = NFPROTO_IPV4;
1117 helper = priv->helper4;
1120 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1123 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1126 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1132 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1133 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1134 .len = NF_CT_HELPER_NAME_LEN - 1 },
1135 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1136 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1139 static struct nft_object_type nft_ct_helper_obj_type;
1140 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1141 .type = &nft_ct_helper_obj_type,
1142 .size = sizeof(struct nft_ct_helper_obj),
1143 .eval = nft_ct_helper_obj_eval,
1144 .init = nft_ct_helper_obj_init,
1145 .destroy = nft_ct_helper_obj_destroy,
1146 .dump = nft_ct_helper_obj_dump,
1149 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1150 .type = NFT_OBJECT_CT_HELPER,
1151 .ops = &nft_ct_helper_obj_ops,
1152 .maxattr = NFTA_CT_HELPER_MAX,
1153 .policy = nft_ct_helper_policy,
1154 .owner = THIS_MODULE,
1157 struct nft_ct_expect_obj {
1165 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1166 const struct nlattr * const tb[],
1167 struct nft_object *obj)
1169 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1171 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1172 !tb[NFTA_CT_EXPECT_DPORT] ||
1173 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1174 !tb[NFTA_CT_EXPECT_SIZE])
1177 priv->l3num = ctx->family;
1178 if (tb[NFTA_CT_EXPECT_L3PROTO])
1179 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1181 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1182 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1183 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1184 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1186 return nf_ct_netns_get(ctx->net, ctx->family);
1189 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1190 struct nft_object *obj)
1192 nf_ct_netns_put(ctx->net, ctx->family);
1195 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1196 struct nft_object *obj, bool reset)
1198 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1200 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1201 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1202 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1203 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1204 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1210 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1211 struct nft_regs *regs,
1212 const struct nft_pktinfo *pkt)
1214 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1215 struct nf_conntrack_expect *exp;
1216 enum ip_conntrack_info ctinfo;
1217 struct nf_conn_help *help;
1218 enum ip_conntrack_dir dir;
1219 u16 l3num = priv->l3num;
1222 ct = nf_ct_get(pkt->skb, &ctinfo);
1223 if (!ct || ctinfo == IP_CT_UNTRACKED) {
1224 regs->verdict.code = NFT_BREAK;
1227 dir = CTINFO2DIR(ctinfo);
1229 help = nfct_help(ct);
1231 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1233 regs->verdict.code = NF_DROP;
1237 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1238 regs->verdict.code = NFT_BREAK;
1241 if (l3num == NFPROTO_INET)
1242 l3num = nf_ct_l3num(ct);
1244 exp = nf_ct_expect_alloc(ct);
1246 regs->verdict.code = NF_DROP;
1249 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1250 &ct->tuplehash[!dir].tuple.src.u3,
1251 &ct->tuplehash[!dir].tuple.dst.u3,
1252 priv->l4proto, NULL, &priv->dport);
1253 exp->timeout.expires = jiffies + priv->timeout * HZ;
1255 if (nf_ct_expect_related(exp, 0) != 0)
1256 regs->verdict.code = NF_DROP;
1259 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1260 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1261 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1262 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1263 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1264 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1267 static struct nft_object_type nft_ct_expect_obj_type;
1269 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1270 .type = &nft_ct_expect_obj_type,
1271 .size = sizeof(struct nft_ct_expect_obj),
1272 .eval = nft_ct_expect_obj_eval,
1273 .init = nft_ct_expect_obj_init,
1274 .destroy = nft_ct_expect_obj_destroy,
1275 .dump = nft_ct_expect_obj_dump,
1278 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1279 .type = NFT_OBJECT_CT_EXPECT,
1280 .ops = &nft_ct_expect_obj_ops,
1281 .maxattr = NFTA_CT_EXPECT_MAX,
1282 .policy = nft_ct_expect_policy,
1283 .owner = THIS_MODULE,
1286 static int __init nft_ct_module_init(void)
1290 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1292 err = nft_register_expr(&nft_ct_type);
1296 err = nft_register_expr(&nft_notrack_type);
1300 err = nft_register_obj(&nft_ct_helper_obj_type);
1304 err = nft_register_obj(&nft_ct_expect_obj_type);
1307 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1308 err = nft_register_obj(&nft_ct_timeout_obj_type);
1314 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1316 nft_unregister_obj(&nft_ct_expect_obj_type);
1319 nft_unregister_obj(&nft_ct_helper_obj_type);
1321 nft_unregister_expr(&nft_notrack_type);
1323 nft_unregister_expr(&nft_ct_type);
1327 static void __exit nft_ct_module_exit(void)
1329 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1330 nft_unregister_obj(&nft_ct_timeout_obj_type);
1332 nft_unregister_obj(&nft_ct_expect_obj_type);
1333 nft_unregister_obj(&nft_ct_helper_obj_type);
1334 nft_unregister_expr(&nft_notrack_type);
1335 nft_unregister_expr(&nft_ct_type);
1338 module_init(nft_ct_module_init);
1339 module_exit(nft_ct_module_exit);
1341 MODULE_LICENSE("GPL");
1342 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1343 MODULE_ALIAS_NFT_EXPR("ct");
1344 MODULE_ALIAS_NFT_EXPR("notrack");
1345 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1346 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1347 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);