net/netfilter/nft_ct.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   4  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   5  *
   6  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   7  */
   8
   9 #include <linux/kernel.h>
  10 #include <linux/init.h>
  11 #include <linux/module.h>
  12 #include <linux/netlink.h>
  13 #include <linux/netfilter.h>
  14 #include <linux/netfilter/nf_tables.h>
  15 #include <net/netfilter/nf_tables.h>
  16 #include <net/netfilter/nf_conntrack.h>
  17 #include <net/netfilter/nf_conntrack_acct.h>
  18 #include <net/netfilter/nf_conntrack_tuple.h>
  19 #include <net/netfilter/nf_conntrack_helper.h>
  20 #include <net/netfilter/nf_conntrack_ecache.h>
  21 #include <net/netfilter/nf_conntrack_labels.h>
  22 #include <net/netfilter/nf_conntrack_timeout.h>
  23 #include <net/netfilter/nf_conntrack_l4proto.h>
  24 #include <net/netfilter/nf_conntrack_expect.h>
  25
  26 struct nft_ct {
  27         enum nft_ct_keys        key:8;
  28         enum ip_conntrack_dir   dir:8;
  29         union {
  30                 u8              dreg;
  31                 u8              sreg;
  32         };
  33 };
  34
  35 struct nft_ct_helper_obj  {
  36         struct nf_conntrack_helper *helper4;
  37         struct nf_conntrack_helper *helper6;
  38         u8 l4proto;
  39 };
  40
  41 #ifdef CONFIG_NF_CONNTRACK_ZONES
  42 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  43 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  44 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
  45 #endif
  46
  47 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  48                                    enum nft_ct_keys k,
  49                                    enum ip_conntrack_dir d)
  50 {
  51         if (d < IP_CT_DIR_MAX)
  52                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  53                                            atomic64_read(&c[d].packets);
  54
  55         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  56                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  57 }
  58
  59 static void nft_ct_get_eval(const struct nft_expr *expr,
  60                             struct nft_regs *regs,
  61                             const struct nft_pktinfo *pkt)
  62 {
  63         const struct nft_ct *priv = nft_expr_priv(expr);
  64         u32 *dest = &regs->data[priv->dreg];
  65         enum ip_conntrack_info ctinfo;
  66         const struct nf_conn *ct;
  67         const struct nf_conn_help *help;
  68         const struct nf_conntrack_tuple *tuple;
  69         const struct nf_conntrack_helper *helper;
  70         unsigned int state;
  71
  72         ct = nf_ct_get(pkt->skb, &ctinfo);
  73
  74         switch (priv->key) {
  75         case NFT_CT_STATE:
  76                 if (ct)
  77                         state = NF_CT_STATE_BIT(ctinfo);
  78                 else if (ctinfo == IP_CT_UNTRACKED)
  79                         state = NF_CT_STATE_UNTRACKED_BIT;
  80                 else
  81                         state = NF_CT_STATE_INVALID_BIT;
  82                 *dest = state;
  83                 return;
  84         default:
  85                 break;
  86         }
  87
  88         if (ct == NULL)
  89                 goto err;
  90
  91         switch (priv->key) {
  92         case NFT_CT_DIRECTION:
  93                 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
  94                 return;
  95         case NFT_CT_STATUS:
  96                 *dest = ct->status;
  97                 return;
  98 #ifdef CONFIG_NF_CONNTRACK_MARK
  99         case NFT_CT_MARK:
 100                 *dest = ct->mark;
 101                 return;
 102 #endif
 103 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 104         case NFT_CT_SECMARK:
 105                 *dest = ct->secmark;
 106                 return;
 107 #endif
 108         case NFT_CT_EXPIRATION:
 109                 *dest = jiffies_to_msecs(nf_ct_expires(ct));
 110                 return;
 111         case NFT_CT_HELPER:
 112                 if (ct->master == NULL)
 113                         goto err;
 114                 help = nfct_help(ct->master);
 115                 if (help == NULL)
 116                         goto err;
 117                 helper = rcu_dereference(help->helper);
 118                 if (helper == NULL)
 119                         goto err;
 120                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 121                 return;
 122 #ifdef CONFIG_NF_CONNTRACK_LABELS
 123         case NFT_CT_LABELS: {
 124                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 125
 126                 if (labels)
 127                         memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 128                 else
 129                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 130                 return;
 131         }
 132 #endif
 133         case NFT_CT_BYTES:
 134         case NFT_CT_PKTS: {
 135                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 136                 u64 count = 0;
 137
 138                 if (acct)
 139                         count = nft_ct_get_eval_counter(acct->counter,
 140                                                         priv->key, priv->dir);
 141                 memcpy(dest, &count, sizeof(count));
 142                 return;
 143         }
 144         case NFT_CT_AVGPKT: {
 145                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 146                 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 147
 148                 if (acct) {
 149                         pcnt = nft_ct_get_eval_counter(acct->counter,
 150                                                        NFT_CT_PKTS, priv->dir);
 151                         bcnt = nft_ct_get_eval_counter(acct->counter,
 152                                                        NFT_CT_BYTES, priv->dir);
 153                         if (pcnt != 0)
 154                                 avgcnt = div64_u64(bcnt, pcnt);
 155                 }
 156
 157                 memcpy(dest, &avgcnt, sizeof(avgcnt));
 158                 return;
 159         }
 160         case NFT_CT_L3PROTOCOL:
 161                 nft_reg_store8(dest, nf_ct_l3num(ct));
 162                 return;
 163         case NFT_CT_PROTOCOL:
 164                 nft_reg_store8(dest, nf_ct_protonum(ct));
 165                 return;
 166 #ifdef CONFIG_NF_CONNTRACK_ZONES
 167         case NFT_CT_ZONE: {
 168                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 169                 u16 zoneid;
 170
 171                 if (priv->dir < IP_CT_DIR_MAX)
 172                         zoneid = nf_ct_zone_id(zone, priv->dir);
 173                 else
 174                         zoneid = zone->id;
 175
 176                 nft_reg_store16(dest, zoneid);
 177                 return;
 178         }
 179 #endif
 180         case NFT_CT_ID:
 181                 *dest = nf_ct_get_id(ct);
 182                 return;
 183         default:
 184                 break;
 185         }
 186
 187         tuple = &ct->tuplehash[priv->dir].tuple;
 188         switch (priv->key) {
 189         case NFT_CT_SRC:
 190                 memcpy(dest, tuple->src.u3.all,
 191                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 192                 return;
 193         case NFT_CT_DST:
 194                 memcpy(dest, tuple->dst.u3.all,
 195                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 196                 return;
 197         case NFT_CT_PROTO_SRC:
 198                 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
 199                 return;
 200         case NFT_CT_PROTO_DST:
 201                 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
 202                 return;
 203         case NFT_CT_SRC_IP:
 204                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 205                         goto err;
 206                 *dest = tuple->src.u3.ip;
 207                 return;
 208         case NFT_CT_DST_IP:
 209                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 210                         goto err;
 211                 *dest = tuple->dst.u3.ip;
 212                 return;
 213         case NFT_CT_SRC_IP6:
 214                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 215                         goto err;
 216                 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
 217                 return;
 218         case NFT_CT_DST_IP6:
 219                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 220                         goto err;
 221                 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
 222                 return;
 223         default:
 224                 break;
 225         }
 226         return;
 227 err:
 228         regs->verdict.code = NFT_BREAK;
 229 }
 230
 231 #ifdef CONFIG_NF_CONNTRACK_ZONES
 232 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 233                                  struct nft_regs *regs,
 234                                  const struct nft_pktinfo *pkt)
 235 {
 236         struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 237         const struct nft_ct *priv = nft_expr_priv(expr);
 238         struct sk_buff *skb = pkt->skb;
 239         enum ip_conntrack_info ctinfo;
 240         u16 value = nft_reg_load16(&regs->data[priv->sreg]);
 241         struct nf_conn *ct;
 242
 243         ct = nf_ct_get(skb, &ctinfo);
 244         if (ct) /* already tracked */
 245                 return;
 246
 247         zone.id = value;
 248
 249         switch (priv->dir) {
 250         case IP_CT_DIR_ORIGINAL:
 251                 zone.dir = NF_CT_ZONE_DIR_ORIG;
 252                 break;
 253         case IP_CT_DIR_REPLY:
 254                 zone.dir = NF_CT_ZONE_DIR_REPL;
 255                 break;
 256         default:
 257                 break;
 258         }
 259
 260         ct = this_cpu_read(nft_ct_pcpu_template);
 261
 262         if (likely(refcount_read(&ct->ct_general.use) == 1)) {
 263                 nf_ct_zone_add(ct, &zone);
 264         } else {
 265                 /* previous skb got queued to userspace */
 266                 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 267                 if (!ct) {
 268                         regs->verdict.code = NF_DROP;
 269                         return;
 270                 }
 271         }
 272
 273         nf_ct_set(skb, ct, IP_CT_NEW);
 274 }
 275 #endif
 276
 277 static void nft_ct_set_eval(const struct nft_expr *expr,
 278                             struct nft_regs *regs,
 279                             const struct nft_pktinfo *pkt)
 280 {
 281         const struct nft_ct *priv = nft_expr_priv(expr);
 282         struct sk_buff *skb = pkt->skb;
 283 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
 284         u32 value = regs->data[priv->sreg];
 285 #endif
 286         enum ip_conntrack_info ctinfo;
 287         struct nf_conn *ct;
 288
 289         ct = nf_ct_get(skb, &ctinfo);
 290         if (ct == NULL || nf_ct_is_template(ct))
 291                 return;
 292
 293         switch (priv->key) {
 294 #ifdef CONFIG_NF_CONNTRACK_MARK
 295         case NFT_CT_MARK:
 296                 if (ct->mark != value) {
 297                         ct->mark = value;
 298                         nf_conntrack_event_cache(IPCT_MARK, ct);
 299                 }
 300                 break;
 301 #endif
 302 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 303         case NFT_CT_SECMARK:
 304                 if (ct->secmark != value) {
 305                         ct->secmark = value;
 306                         nf_conntrack_event_cache(IPCT_SECMARK, ct);
 307                 }
 308                 break;
 309 #endif
 310 #ifdef CONFIG_NF_CONNTRACK_LABELS
 311         case NFT_CT_LABELS:
 312                 nf_connlabels_replace(ct,
 313                                       &regs->data[priv->sreg],
 314                                       &regs->data[priv->sreg],
 315                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 316                 break;
 317 #endif
 318 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 319         case NFT_CT_EVENTMASK: {
 320                 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
 321                 u32 ctmask = regs->data[priv->sreg];
 322
 323                 if (e) {
 324                         if (e->ctmask != ctmask)
 325                                 e->ctmask = ctmask;
 326                         break;
 327                 }
 328
 329                 if (ctmask && !nf_ct_is_confirmed(ct))
 330                         nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
 331                 break;
 332         }
 333 #endif
 334         default:
 335                 break;
 336         }
 337 }
 338
 339 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 340         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 341         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 342         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 343         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 344 };
 345
 346 #ifdef CONFIG_NF_CONNTRACK_ZONES
 347 static void nft_ct_tmpl_put_pcpu(void)
 348 {
 349         struct nf_conn *ct;
 350         int cpu;
 351
 352         for_each_possible_cpu(cpu) {
 353                 ct = per_cpu(nft_ct_pcpu_template, cpu);
 354                 if (!ct)
 355                         break;
 356                 nf_ct_put(ct);
 357                 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 358         }
 359 }
 360
 361 static bool nft_ct_tmpl_alloc_pcpu(void)
 362 {
 363         struct nf_conntrack_zone zone = { .id = 0 };
 364         struct nf_conn *tmp;
 365         int cpu;
 366
 367         if (nft_ct_pcpu_template_refcnt)
 368                 return true;
 369
 370         for_each_possible_cpu(cpu) {
 371                 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 372                 if (!tmp) {
 373                         nft_ct_tmpl_put_pcpu();
 374                         return false;
 375                 }
 376
 377                 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 378         }
 379
 380         return true;
 381 }
 382 #endif
 383
 384 static int nft_ct_get_init(const struct nft_ctx *ctx,
 385                            const struct nft_expr *expr,
 386                            const struct nlattr * const tb[])
 387 {
 388         struct nft_ct *priv = nft_expr_priv(expr);
 389         unsigned int len;
 390         int err;
 391
 392         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 393         priv->dir = IP_CT_DIR_MAX;
 394         switch (priv->key) {
 395         case NFT_CT_DIRECTION:
 396                 if (tb[NFTA_CT_DIRECTION] != NULL)
 397                         return -EINVAL;
 398                 len = sizeof(u8);
 399                 break;
 400         case NFT_CT_STATE:
 401         case NFT_CT_STATUS:
 402 #ifdef CONFIG_NF_CONNTRACK_MARK
 403         case NFT_CT_MARK:
 404 #endif
 405 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 406         case NFT_CT_SECMARK:
 407 #endif
 408         case NFT_CT_EXPIRATION:
 409                 if (tb[NFTA_CT_DIRECTION] != NULL)
 410                         return -EINVAL;
 411                 len = sizeof(u32);
 412                 break;
 413 #ifdef CONFIG_NF_CONNTRACK_LABELS
 414         case NFT_CT_LABELS:
 415                 if (tb[NFTA_CT_DIRECTION] != NULL)
 416                         return -EINVAL;
 417                 len = NF_CT_LABELS_MAX_SIZE;
 418                 break;
 419 #endif
 420         case NFT_CT_HELPER:
 421                 if (tb[NFTA_CT_DIRECTION] != NULL)
 422                         return -EINVAL;
 423                 len = NF_CT_HELPER_NAME_LEN;
 424                 break;
 425
 426         case NFT_CT_L3PROTOCOL:
 427         case NFT_CT_PROTOCOL:
 428                 /* For compatibility, do not report error if NFTA_CT_DIRECTION
 429                  * attribute is specified.
 430                  */
 431                 len = sizeof(u8);
 432                 break;
 433         case NFT_CT_SRC:
 434         case NFT_CT_DST:
 435                 if (tb[NFTA_CT_DIRECTION] == NULL)
 436                         return -EINVAL;
 437
 438                 switch (ctx->family) {
 439                 case NFPROTO_IPV4:
 440                         len = sizeof_field(struct nf_conntrack_tuple,
 441                                            src.u3.ip);
 442                         break;
 443                 case NFPROTO_IPV6:
 444                 case NFPROTO_INET:
 445                         len = sizeof_field(struct nf_conntrack_tuple,
 446                                            src.u3.ip6);
 447                         break;
 448                 default:
 449                         return -EAFNOSUPPORT;
 450                 }
 451                 break;
 452         case NFT_CT_SRC_IP:
 453         case NFT_CT_DST_IP:
 454                 if (tb[NFTA_CT_DIRECTION] == NULL)
 455                         return -EINVAL;
 456
 457                 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
 458                 break;
 459         case NFT_CT_SRC_IP6:
 460         case NFT_CT_DST_IP6:
 461                 if (tb[NFTA_CT_DIRECTION] == NULL)
 462                         return -EINVAL;
 463
 464                 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
 465                 break;
 466         case NFT_CT_PROTO_SRC:
 467         case NFT_CT_PROTO_DST:
 468                 if (tb[NFTA_CT_DIRECTION] == NULL)
 469                         return -EINVAL;
 470                 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
 471                 break;
 472         case NFT_CT_BYTES:
 473         case NFT_CT_PKTS:
 474         case NFT_CT_AVGPKT:
 475                 len = sizeof(u64);
 476                 break;
 477 #ifdef CONFIG_NF_CONNTRACK_ZONES
 478         case NFT_CT_ZONE:
 479                 len = sizeof(u16);
 480                 break;
 481 #endif
 482         case NFT_CT_ID:
 483                 len = sizeof(u32);
 484                 break;
 485         default:
 486                 return -EOPNOTSUPP;
 487         }
 488
 489         if (tb[NFTA_CT_DIRECTION] != NULL) {
 490                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 491                 switch (priv->dir) {
 492                 case IP_CT_DIR_ORIGINAL:
 493                 case IP_CT_DIR_REPLY:
 494                         break;
 495                 default:
 496                         return -EINVAL;
 497                 }
 498         }
 499
 500         err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
 501                                        NFT_DATA_VALUE, len);
 502         if (err < 0)
 503                 return err;
 504
 505         err = nf_ct_netns_get(ctx->net, ctx->family);
 506         if (err < 0)
 507                 return err;
 508
 509         if (priv->key == NFT_CT_BYTES ||
 510             priv->key == NFT_CT_PKTS  ||
 511             priv->key == NFT_CT_AVGPKT)
 512                 nf_ct_set_acct(ctx->net, true);
 513
 514         return 0;
 515 }
 516
 517 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 518 {
 519         switch (priv->key) {
 520 #ifdef CONFIG_NF_CONNTRACK_LABELS
 521         case NFT_CT_LABELS:
 522                 nf_connlabels_put(ctx->net);
 523                 break;
 524 #endif
 525 #ifdef CONFIG_NF_CONNTRACK_ZONES
 526         case NFT_CT_ZONE:
 527                 mutex_lock(&nft_ct_pcpu_mutex);
 528                 if (--nft_ct_pcpu_template_refcnt == 0)
 529                         nft_ct_tmpl_put_pcpu();
 530                 mutex_unlock(&nft_ct_pcpu_mutex);
 531                 break;
 532 #endif
 533         default:
 534                 break;
 535         }
 536 }
 537
 538 static int nft_ct_set_init(const struct nft_ctx *ctx,
 539                            const struct nft_expr *expr,
 540                            const struct nlattr * const tb[])
 541 {
 542         struct nft_ct *priv = nft_expr_priv(expr);
 543         unsigned int len;
 544         int err;
 545
 546         priv->dir = IP_CT_DIR_MAX;
 547         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 548         switch (priv->key) {
 549 #ifdef CONFIG_NF_CONNTRACK_MARK
 550         case NFT_CT_MARK:
 551                 if (tb[NFTA_CT_DIRECTION])
 552                         return -EINVAL;
 553                 len = sizeof_field(struct nf_conn, mark);
 554                 break;
 555 #endif
 556 #ifdef CONFIG_NF_CONNTRACK_LABELS
 557         case NFT_CT_LABELS:
 558                 if (tb[NFTA_CT_DIRECTION])
 559                         return -EINVAL;
 560                 len = NF_CT_LABELS_MAX_SIZE;
 561                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 562                 if (err)
 563                         return err;
 564                 break;
 565 #endif
 566 #ifdef CONFIG_NF_CONNTRACK_ZONES
 567         case NFT_CT_ZONE:
 568                 mutex_lock(&nft_ct_pcpu_mutex);
 569                 if (!nft_ct_tmpl_alloc_pcpu()) {
 570                         mutex_unlock(&nft_ct_pcpu_mutex);
 571                         return -ENOMEM;
 572                 }
 573                 nft_ct_pcpu_template_refcnt++;
 574                 mutex_unlock(&nft_ct_pcpu_mutex);
 575                 len = sizeof(u16);
 576                 break;
 577 #endif
 578 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 579         case NFT_CT_EVENTMASK:
 580                 if (tb[NFTA_CT_DIRECTION])
 581                         return -EINVAL;
 582                 len = sizeof(u32);
 583                 break;
 584 #endif
 585 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 586         case NFT_CT_SECMARK:
 587                 if (tb[NFTA_CT_DIRECTION])
 588                         return -EINVAL;
 589                 len = sizeof(u32);
 590                 break;
 591 #endif
 592         default:
 593                 return -EOPNOTSUPP;
 594         }
 595
 596         if (tb[NFTA_CT_DIRECTION]) {
 597                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 598                 switch (priv->dir) {
 599                 case IP_CT_DIR_ORIGINAL:
 600                 case IP_CT_DIR_REPLY:
 601                         break;
 602                 default:
 603                         err = -EINVAL;
 604                         goto err1;
 605                 }
 606         }
 607
 608         err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
 609         if (err < 0)
 610                 goto err1;
 611
 612         err = nf_ct_netns_get(ctx->net, ctx->family);
 613         if (err < 0)
 614                 goto err1;
 615
 616         return 0;
 617
 618 err1:
 619         __nft_ct_set_destroy(ctx, priv);
 620         return err;
 621 }
 622
 623 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 624                                const struct nft_expr *expr)
 625 {
 626         nf_ct_netns_put(ctx->net, ctx->family);
 627 }
 628
 629 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 630                                const struct nft_expr *expr)
 631 {
 632         struct nft_ct *priv = nft_expr_priv(expr);
 633
 634         __nft_ct_set_destroy(ctx, priv);
 635         nf_ct_netns_put(ctx->net, ctx->family);
 636 }
 637
 638 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 639 {
 640         const struct nft_ct *priv = nft_expr_priv(expr);
 641
 642         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 643                 goto nla_put_failure;
 644         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 645                 goto nla_put_failure;
 646
 647         switch (priv->key) {
 648         case NFT_CT_SRC:
 649         case NFT_CT_DST:
 650         case NFT_CT_SRC_IP:
 651         case NFT_CT_DST_IP:
 652         case NFT_CT_SRC_IP6:
 653         case NFT_CT_DST_IP6:
 654         case NFT_CT_PROTO_SRC:
 655         case NFT_CT_PROTO_DST:
 656                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 657                         goto nla_put_failure;
 658                 break;
 659         case NFT_CT_BYTES:
 660         case NFT_CT_PKTS:
 661         case NFT_CT_AVGPKT:
 662         case NFT_CT_ZONE:
 663                 if (priv->dir < IP_CT_DIR_MAX &&
 664                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 665                         goto nla_put_failure;
 666                 break;
 667         default:
 668                 break;
 669         }
 670
 671         return 0;
 672
 673 nla_put_failure:
 674         return -1;
 675 }
 676
 677 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 678 {
 679         const struct nft_ct *priv = nft_expr_priv(expr);
 680
 681         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 682                 goto nla_put_failure;
 683         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 684                 goto nla_put_failure;
 685
 686         switch (priv->key) {
 687         case NFT_CT_ZONE:
 688                 if (priv->dir < IP_CT_DIR_MAX &&
 689                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 690                         goto nla_put_failure;
 691                 break;
 692         default:
 693                 break;
 694         }
 695
 696         return 0;
 697
 698 nla_put_failure:
 699         return -1;
 700 }
 701
 702 static struct nft_expr_type nft_ct_type;
 703 static const struct nft_expr_ops nft_ct_get_ops = {
 704         .type           = &nft_ct_type,
 705         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 706         .eval           = nft_ct_get_eval,
 707         .init           = nft_ct_get_init,
 708         .destroy        = nft_ct_get_destroy,
 709         .dump           = nft_ct_get_dump,
 710 };
 711
 712 static const struct nft_expr_ops nft_ct_set_ops = {
 713         .type           = &nft_ct_type,
 714         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 715         .eval           = nft_ct_set_eval,
 716         .init           = nft_ct_set_init,
 717         .destroy        = nft_ct_set_destroy,
 718         .dump           = nft_ct_set_dump,
 719 };
 720
 721 #ifdef CONFIG_NF_CONNTRACK_ZONES
 722 static const struct nft_expr_ops nft_ct_set_zone_ops = {
 723         .type           = &nft_ct_type,
 724         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 725         .eval           = nft_ct_set_zone_eval,
 726         .init           = nft_ct_set_init,
 727         .destroy        = nft_ct_set_destroy,
 728         .dump           = nft_ct_set_dump,
 729 };
 730 #endif
 731
 732 static const struct nft_expr_ops *
 733 nft_ct_select_ops(const struct nft_ctx *ctx,
 734                     const struct nlattr * const tb[])
 735 {
 736         if (tb[NFTA_CT_KEY] == NULL)
 737                 return ERR_PTR(-EINVAL);
 738
 739         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 740                 return ERR_PTR(-EINVAL);
 741
 742         if (tb[NFTA_CT_DREG])
 743                 return &nft_ct_get_ops;
 744
 745         if (tb[NFTA_CT_SREG]) {
 746 #ifdef CONFIG_NF_CONNTRACK_ZONES
 747                 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 748                         return &nft_ct_set_zone_ops;
 749 #endif
 750                 return &nft_ct_set_ops;
 751         }
 752
 753         return ERR_PTR(-EINVAL);
 754 }
 755
 756 static struct nft_expr_type nft_ct_type __read_mostly = {
 757         .name           = "ct",
 758         .select_ops     = nft_ct_select_ops,
 759         .policy         = nft_ct_policy,
 760         .maxattr        = NFTA_CT_MAX,
 761         .owner          = THIS_MODULE,
 762 };
 763
 764 static void nft_notrack_eval(const struct nft_expr *expr,
 765                              struct nft_regs *regs,
 766                              const struct nft_pktinfo *pkt)
 767 {
 768         struct sk_buff *skb = pkt->skb;
 769         enum ip_conntrack_info ctinfo;
 770         struct nf_conn *ct;
 771
 772         ct = nf_ct_get(pkt->skb, &ctinfo);
 773         /* Previously seen (loopback or untracked)?  Ignore. */
 774         if (ct || ctinfo == IP_CT_UNTRACKED)
 775                 return;
 776
 777         nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 778 }
 779
 780 static struct nft_expr_type nft_notrack_type;
 781 static const struct nft_expr_ops nft_notrack_ops = {
 782         .type           = &nft_notrack_type,
 783         .size           = NFT_EXPR_SIZE(0),
 784         .eval           = nft_notrack_eval,
 785 };
 786
 787 static struct nft_expr_type nft_notrack_type __read_mostly = {
 788         .name           = "notrack",
 789         .ops            = &nft_notrack_ops,
 790         .owner          = THIS_MODULE,
 791 };
 792
 793 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 794 static int
 795 nft_ct_timeout_parse_policy(void *timeouts,
 796                             const struct nf_conntrack_l4proto *l4proto,
 797                             struct net *net, const struct nlattr *attr)
 798 {
 799         struct nlattr **tb;
 800         int ret = 0;
 801
 802         tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
 803                      GFP_KERNEL);
 804
 805         if (!tb)
 806                 return -ENOMEM;
 807
 808         ret = nla_parse_nested_deprecated(tb,
 809                                           l4proto->ctnl_timeout.nlattr_max,
 810                                           attr,
 811                                           l4proto->ctnl_timeout.nla_policy,
 812                                           NULL);
 813         if (ret < 0)
 814                 goto err;
 815
 816         ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 817
 818 err:
 819         kfree(tb);
 820         return ret;
 821 }
 822
 823 struct nft_ct_timeout_obj {
 824         struct nf_ct_timeout    *timeout;
 825         u8                      l4proto;
 826 };
 827
 828 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 829                                     struct nft_regs *regs,
 830                                     const struct nft_pktinfo *pkt)
 831 {
 832         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 833         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
 834         struct nf_conn_timeout *timeout;
 835         const unsigned int *values;
 836
 837         if (priv->l4proto != pkt->tprot)
 838                 return;
 839
 840         if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
 841                 return;
 842
 843         timeout = nf_ct_timeout_find(ct);
 844         if (!timeout) {
 845                 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
 846                 if (!timeout) {
 847                         regs->verdict.code = NF_DROP;
 848                         return;
 849                 }
 850         }
 851
 852         rcu_assign_pointer(timeout->timeout, priv->timeout);
 853
 854         /* adjust the timeout as per 'new' state. ct is unconfirmed,
 855          * so the current timestamp must not be added.
 856          */
 857         values = nf_ct_timeout_data(timeout);
 858         if (values)
 859                 nf_ct_refresh(ct, pkt->skb, values[0]);
 860 }
 861
 862 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 863                                    const struct nlattr * const tb[],
 864                                    struct nft_object *obj)
 865 {
 866         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 867         const struct nf_conntrack_l4proto *l4proto;
 868         struct nf_ct_timeout *timeout;
 869         int l3num = ctx->family;
 870         __u8 l4num;
 871         int ret;
 872
 873         if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
 874             !tb[NFTA_CT_TIMEOUT_DATA])
 875                 return -EINVAL;
 876
 877         if (tb[NFTA_CT_TIMEOUT_L3PROTO])
 878                 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
 879
 880         l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
 881         priv->l4proto = l4num;
 882
 883         l4proto = nf_ct_l4proto_find(l4num);
 884
 885         if (l4proto->l4proto != l4num) {
 886                 ret = -EOPNOTSUPP;
 887                 goto err_proto_put;
 888         }
 889
 890         timeout = kzalloc(sizeof(struct nf_ct_timeout) +
 891                           l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
 892         if (timeout == NULL) {
 893                 ret = -ENOMEM;
 894                 goto err_proto_put;
 895         }
 896
 897         ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
 898                                           tb[NFTA_CT_TIMEOUT_DATA]);
 899         if (ret < 0)
 900                 goto err_free_timeout;
 901
 902         timeout->l3num = l3num;
 903         timeout->l4proto = l4proto;
 904
 905         ret = nf_ct_netns_get(ctx->net, ctx->family);
 906         if (ret < 0)
 907                 goto err_free_timeout;
 908
 909         priv->timeout = timeout;
 910         return 0;
 911
 912 err_free_timeout:
 913         kfree(timeout);
 914 err_proto_put:
 915         return ret;
 916 }
 917
 918 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
 919                                        struct nft_object *obj)
 920 {
 921         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 922         struct nf_ct_timeout *timeout = priv->timeout;
 923
 924         nf_ct_untimeout(ctx->net, timeout);
 925         nf_ct_netns_put(ctx->net, ctx->family);
 926         kfree(priv->timeout);
 927 }
 928
 929 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
 930                                    struct nft_object *obj, bool reset)
 931 {
 932         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 933         const struct nf_ct_timeout *timeout = priv->timeout;
 934         struct nlattr *nest_params;
 935         int ret;
 936
 937         if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
 938             nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
 939                 return -1;
 940
 941         nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
 942         if (!nest_params)
 943                 return -1;
 944
 945         ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
 946         if (ret < 0)
 947                 return -1;
 948         nla_nest_end(skb, nest_params);
 949         return 0;
 950 }
 951
 952 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
 953         [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
 954         [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
 955         [NFTA_CT_TIMEOUT_DATA]    = {.type = NLA_NESTED },
 956 };
 957
 958 static struct nft_object_type nft_ct_timeout_obj_type;
 959
 960 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
 961         .type           = &nft_ct_timeout_obj_type,
 962         .size           = sizeof(struct nft_ct_timeout_obj),
 963         .eval           = nft_ct_timeout_obj_eval,
 964         .init           = nft_ct_timeout_obj_init,
 965         .destroy        = nft_ct_timeout_obj_destroy,
 966         .dump           = nft_ct_timeout_obj_dump,
 967 };
 968
 969 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
 970         .type           = NFT_OBJECT_CT_TIMEOUT,
 971         .ops            = &nft_ct_timeout_obj_ops,
 972         .maxattr        = NFTA_CT_TIMEOUT_MAX,
 973         .policy         = nft_ct_timeout_policy,
 974         .owner          = THIS_MODULE,
 975 };
 976 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 977
 978 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
 979                                   const struct nlattr * const tb[],
 980                                   struct nft_object *obj)
 981 {
 982         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 983         struct nf_conntrack_helper *help4, *help6;
 984         char name[NF_CT_HELPER_NAME_LEN];
 985         int family = ctx->family;
 986         int err;
 987
 988         if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
 989                 return -EINVAL;
 990
 991         priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
 992         if (!priv->l4proto)
 993                 return -ENOENT;
 994
 995         nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
 996
 997         if (tb[NFTA_CT_HELPER_L3PROTO])
 998                 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
 999
1000         help4 = NULL;
1001         help6 = NULL;
1002
1003         switch (family) {
1004         case NFPROTO_IPV4:
1005                 if (ctx->family == NFPROTO_IPV6)
1006                         return -EINVAL;
1007
1008                 help4 = nf_conntrack_helper_try_module_get(name, family,
1009                                                            priv->l4proto);
1010                 break;
1011         case NFPROTO_IPV6:
1012                 if (ctx->family == NFPROTO_IPV4)
1013                         return -EINVAL;
1014
1015                 help6 = nf_conntrack_helper_try_module_get(name, family,
1016                                                            priv->l4proto);
1017                 break;
1018         case NFPROTO_NETDEV:
1019         case NFPROTO_BRIDGE:
1020         case NFPROTO_INET:
1021                 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1022                                                            priv->l4proto);
1023                 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1024                                                            priv->l4proto);
1025                 break;
1026         default:
1027                 return -EAFNOSUPPORT;
1028         }
1029
1030         /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1031         if (!help4 && !help6)
1032                 return -ENOENT;
1033
1034         priv->helper4 = help4;
1035         priv->helper6 = help6;
1036
1037         err = nf_ct_netns_get(ctx->net, ctx->family);
1038         if (err < 0)
1039                 goto err_put_helper;
1040
1041         return 0;
1042
1043 err_put_helper:
1044         if (priv->helper4)
1045                 nf_conntrack_helper_put(priv->helper4);
1046         if (priv->helper6)
1047                 nf_conntrack_helper_put(priv->helper6);
1048         return err;
1049 }
1050
1051 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1052                                       struct nft_object *obj)
1053 {
1054         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1055
1056         if (priv->helper4)
1057                 nf_conntrack_helper_put(priv->helper4);
1058         if (priv->helper6)
1059                 nf_conntrack_helper_put(priv->helper6);
1060
1061         nf_ct_netns_put(ctx->net, ctx->family);
1062 }
1063
1064 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1065                                    struct nft_regs *regs,
1066                                    const struct nft_pktinfo *pkt)
1067 {
1068         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1069         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1070         struct nf_conntrack_helper *to_assign = NULL;
1071         struct nf_conn_help *help;
1072
1073         if (!ct ||
1074             nf_ct_is_confirmed(ct) ||
1075             nf_ct_is_template(ct) ||
1076             priv->l4proto != nf_ct_protonum(ct))
1077                 return;
1078
1079         switch (nf_ct_l3num(ct)) {
1080         case NFPROTO_IPV4:
1081                 to_assign = priv->helper4;
1082                 break;
1083         case NFPROTO_IPV6:
1084                 to_assign = priv->helper6;
1085                 break;
1086         default:
1087                 WARN_ON_ONCE(1);
1088                 return;
1089         }
1090
1091         if (!to_assign)
1092                 return;
1093
1094         if (test_bit(IPS_HELPER_BIT, &ct->status))
1095                 return;
1096
1097         help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1098         if (help) {
1099                 rcu_assign_pointer(help->helper, to_assign);
1100                 set_bit(IPS_HELPER_BIT, &ct->status);
1101         }
1102 }
1103
1104 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1105                                   struct nft_object *obj, bool reset)
1106 {
1107         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1108         const struct nf_conntrack_helper *helper;
1109         u16 family;
1110
1111         if (priv->helper4 && priv->helper6) {
1112                 family = NFPROTO_INET;
1113                 helper = priv->helper4;
1114         } else if (priv->helper6) {
1115                 family = NFPROTO_IPV6;
1116                 helper = priv->helper6;
1117         } else {
1118                 family = NFPROTO_IPV4;
1119                 helper = priv->helper4;
1120         }
1121
1122         if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1123                 return -1;
1124
1125         if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1126                 return -1;
1127
1128         if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1129                 return -1;
1130
1131         return 0;
1132 }
1133
1134 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1135         [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1136                                   .len = NF_CT_HELPER_NAME_LEN - 1 },
1137         [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1138         [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1139 };
1140
1141 static struct nft_object_type nft_ct_helper_obj_type;
1142 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1143         .type           = &nft_ct_helper_obj_type,
1144         .size           = sizeof(struct nft_ct_helper_obj),
1145         .eval           = nft_ct_helper_obj_eval,
1146         .init           = nft_ct_helper_obj_init,
1147         .destroy        = nft_ct_helper_obj_destroy,
1148         .dump           = nft_ct_helper_obj_dump,
1149 };
1150
1151 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1152         .type           = NFT_OBJECT_CT_HELPER,
1153         .ops            = &nft_ct_helper_obj_ops,
1154         .maxattr        = NFTA_CT_HELPER_MAX,
1155         .policy         = nft_ct_helper_policy,
1156         .owner          = THIS_MODULE,
1157 };
1158
1159 struct nft_ct_expect_obj {
1160         u16             l3num;
1161         __be16          dport;
1162         u8              l4proto;
1163         u8              size;
1164         u32             timeout;
1165 };
1166
1167 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1168                                   const struct nlattr * const tb[],
1169                                   struct nft_object *obj)
1170 {
1171         struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1172
1173         if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1174             !tb[NFTA_CT_EXPECT_DPORT] ||
1175             !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1176             !tb[NFTA_CT_EXPECT_SIZE])
1177                 return -EINVAL;
1178
1179         priv->l3num = ctx->family;
1180         if (tb[NFTA_CT_EXPECT_L3PROTO])
1181                 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1182
1183         priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1184         priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1185         priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1186         priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1187
1188         return nf_ct_netns_get(ctx->net, ctx->family);
1189 }
1190
1191 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1192                                        struct nft_object *obj)
1193 {
1194         nf_ct_netns_put(ctx->net, ctx->family);
1195 }
1196
1197 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1198                                   struct nft_object *obj, bool reset)
1199 {
1200         const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1201
1202         if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1203             nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1204             nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1205             nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1206             nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1207                 return -1;
1208
1209         return 0;
1210 }
1211
1212 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1213                                    struct nft_regs *regs,
1214                                    const struct nft_pktinfo *pkt)
1215 {
1216         const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1217         struct nf_conntrack_expect *exp;
1218         enum ip_conntrack_info ctinfo;
1219         struct nf_conn_help *help;
1220         enum ip_conntrack_dir dir;
1221         u16 l3num = priv->l3num;
1222         struct nf_conn *ct;
1223
1224         ct = nf_ct_get(pkt->skb, &ctinfo);
1225         if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1226                 regs->verdict.code = NFT_BREAK;
1227                 return;
1228         }
1229         dir = CTINFO2DIR(ctinfo);
1230
1231         help = nfct_help(ct);
1232         if (!help)
1233                 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1234         if (!help) {
1235                 regs->verdict.code = NF_DROP;
1236                 return;
1237         }
1238
1239         if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1240                 regs->verdict.code = NFT_BREAK;
1241                 return;
1242         }
1243         if (l3num == NFPROTO_INET)
1244                 l3num = nf_ct_l3num(ct);
1245
1246         exp = nf_ct_expect_alloc(ct);
1247         if (exp == NULL) {
1248                 regs->verdict.code = NF_DROP;
1249                 return;
1250         }
1251         nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1252                           &ct->tuplehash[!dir].tuple.src.u3,
1253                           &ct->tuplehash[!dir].tuple.dst.u3,
1254                           priv->l4proto, NULL, &priv->dport);
1255         exp->timeout.expires = jiffies + priv->timeout * HZ;
1256
1257         if (nf_ct_expect_related(exp, 0) != 0)
1258                 regs->verdict.code = NF_DROP;
1259 }
1260
1261 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1262         [NFTA_CT_EXPECT_L3PROTO]        = { .type = NLA_U16 },
1263         [NFTA_CT_EXPECT_L4PROTO]        = { .type = NLA_U8 },
1264         [NFTA_CT_EXPECT_DPORT]          = { .type = NLA_U16 },
1265         [NFTA_CT_EXPECT_TIMEOUT]        = { .type = NLA_U32 },
1266         [NFTA_CT_EXPECT_SIZE]           = { .type = NLA_U8 },
1267 };
1268
1269 static struct nft_object_type nft_ct_expect_obj_type;
1270
1271 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1272         .type           = &nft_ct_expect_obj_type,
1273         .size           = sizeof(struct nft_ct_expect_obj),
1274         .eval           = nft_ct_expect_obj_eval,
1275         .init           = nft_ct_expect_obj_init,
1276         .destroy        = nft_ct_expect_obj_destroy,
1277         .dump           = nft_ct_expect_obj_dump,
1278 };
1279
1280 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1281         .type           = NFT_OBJECT_CT_EXPECT,
1282         .ops            = &nft_ct_expect_obj_ops,
1283         .maxattr        = NFTA_CT_EXPECT_MAX,
1284         .policy         = nft_ct_expect_policy,
1285         .owner          = THIS_MODULE,
1286 };
1287
1288 static int __init nft_ct_module_init(void)
1289 {
1290         int err;
1291
1292         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1293
1294         err = nft_register_expr(&nft_ct_type);
1295         if (err < 0)
1296                 return err;
1297
1298         err = nft_register_expr(&nft_notrack_type);
1299         if (err < 0)
1300                 goto err1;
1301
1302         err = nft_register_obj(&nft_ct_helper_obj_type);
1303         if (err < 0)
1304                 goto err2;
1305
1306         err = nft_register_obj(&nft_ct_expect_obj_type);
1307         if (err < 0)
1308                 goto err3;
1309 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1310         err = nft_register_obj(&nft_ct_timeout_obj_type);
1311         if (err < 0)
1312                 goto err4;
1313 #endif
1314         return 0;
1315
1316 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1317 err4:
1318         nft_unregister_obj(&nft_ct_expect_obj_type);
1319 #endif
1320 err3:
1321         nft_unregister_obj(&nft_ct_helper_obj_type);
1322 err2:
1323         nft_unregister_expr(&nft_notrack_type);
1324 err1:
1325         nft_unregister_expr(&nft_ct_type);
1326         return err;
1327 }
1328
1329 static void __exit nft_ct_module_exit(void)
1330 {
1331 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1332         nft_unregister_obj(&nft_ct_timeout_obj_type);
1333 #endif
1334         nft_unregister_obj(&nft_ct_expect_obj_type);
1335         nft_unregister_obj(&nft_ct_helper_obj_type);
1336         nft_unregister_expr(&nft_notrack_type);
1337         nft_unregister_expr(&nft_ct_type);
1338 }
1339
1340 module_init(nft_ct_module_init);
1341 module_exit(nft_ct_module_exit);
1342
1343 MODULE_LICENSE("GPL");
1344 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1345 MODULE_ALIAS_NFT_EXPR("ct");
1346 MODULE_ALIAS_NFT_EXPR("notrack");
1347 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1348 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1349 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1350 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");