net/netfilter/nft_ct.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   4  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   5  *
   6  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   7  */
   8
   9 #include <linux/kernel.h>
  10 #include <linux/init.h>
  11 #include <linux/module.h>
  12 #include <linux/netlink.h>
  13 #include <linux/netfilter.h>
  14 #include <linux/netfilter/nf_tables.h>
  15 #include <net/netfilter/nf_tables.h>
  16 #include <net/netfilter/nf_conntrack.h>
  17 #include <net/netfilter/nf_conntrack_acct.h>
  18 #include <net/netfilter/nf_conntrack_tuple.h>
  19 #include <net/netfilter/nf_conntrack_helper.h>
  20 #include <net/netfilter/nf_conntrack_ecache.h>
  21 #include <net/netfilter/nf_conntrack_labels.h>
  22 #include <net/netfilter/nf_conntrack_timeout.h>
  23 #include <net/netfilter/nf_conntrack_l4proto.h>
  24 #include <net/netfilter/nf_conntrack_expect.h>
  25
  26 struct nft_ct {
  27         enum nft_ct_keys        key:8;
  28         enum ip_conntrack_dir   dir:8;
  29         union {
  30                 u8              dreg;
  31                 u8              sreg;
  32         };
  33 };
  34
  35 struct nft_ct_helper_obj  {
  36         struct nf_conntrack_helper *helper4;
  37         struct nf_conntrack_helper *helper6;
  38         u8 l4proto;
  39 };
  40
  41 #ifdef CONFIG_NF_CONNTRACK_ZONES
  42 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  43 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  44 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
  45 #endif
  46
  47 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  48                                    enum nft_ct_keys k,
  49                                    enum ip_conntrack_dir d)
  50 {
  51         if (d < IP_CT_DIR_MAX)
  52                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  53                                            atomic64_read(&c[d].packets);
  54
  55         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  56                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  57 }
  58
  59 static void nft_ct_get_eval(const struct nft_expr *expr,
  60                             struct nft_regs *regs,
  61                             const struct nft_pktinfo *pkt)
  62 {
  63         const struct nft_ct *priv = nft_expr_priv(expr);
  64         u32 *dest = &regs->data[priv->dreg];
  65         enum ip_conntrack_info ctinfo;
  66         const struct nf_conn *ct;
  67         const struct nf_conn_help *help;
  68         const struct nf_conntrack_tuple *tuple;
  69         const struct nf_conntrack_helper *helper;
  70         unsigned int state;
  71
  72         ct = nf_ct_get(pkt->skb, &ctinfo);
  73
  74         switch (priv->key) {
  75         case NFT_CT_STATE:
  76                 if (ct)
  77                         state = NF_CT_STATE_BIT(ctinfo);
  78                 else if (ctinfo == IP_CT_UNTRACKED)
  79                         state = NF_CT_STATE_UNTRACKED_BIT;
  80                 else
  81                         state = NF_CT_STATE_INVALID_BIT;
  82                 *dest = state;
  83                 return;
  84         default:
  85                 break;
  86         }
  87
  88         if (ct == NULL)
  89                 goto err;
  90
  91         switch (priv->key) {
  92         case NFT_CT_DIRECTION:
  93                 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
  94                 return;
  95         case NFT_CT_STATUS:
  96                 *dest = ct->status;
  97                 return;
  98 #ifdef CONFIG_NF_CONNTRACK_MARK
  99         case NFT_CT_MARK:
 100                 *dest = ct->mark;
 101                 return;
 102 #endif
 103 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 104         case NFT_CT_SECMARK:
 105                 *dest = ct->secmark;
 106                 return;
 107 #endif
 108         case NFT_CT_EXPIRATION:
 109                 *dest = jiffies_to_msecs(nf_ct_expires(ct));
 110                 return;
 111         case NFT_CT_HELPER:
 112                 if (ct->master == NULL)
 113                         goto err;
 114                 help = nfct_help(ct->master);
 115                 if (help == NULL)
 116                         goto err;
 117                 helper = rcu_dereference(help->helper);
 118                 if (helper == NULL)
 119                         goto err;
 120                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 121                 return;
 122 #ifdef CONFIG_NF_CONNTRACK_LABELS
 123         case NFT_CT_LABELS: {
 124                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 125
 126                 if (labels)
 127                         memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 128                 else
 129                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 130                 return;
 131         }
 132 #endif
 133         case NFT_CT_BYTES:
 134         case NFT_CT_PKTS: {
 135                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 136                 u64 count = 0;
 137
 138                 if (acct)
 139                         count = nft_ct_get_eval_counter(acct->counter,
 140                                                         priv->key, priv->dir);
 141                 memcpy(dest, &count, sizeof(count));
 142                 return;
 143         }
 144         case NFT_CT_AVGPKT: {
 145                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 146                 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 147
 148                 if (acct) {
 149                         pcnt = nft_ct_get_eval_counter(acct->counter,
 150                                                        NFT_CT_PKTS, priv->dir);
 151                         bcnt = nft_ct_get_eval_counter(acct->counter,
 152                                                        NFT_CT_BYTES, priv->dir);
 153                         if (pcnt != 0)
 154                                 avgcnt = div64_u64(bcnt, pcnt);
 155                 }
 156
 157                 memcpy(dest, &avgcnt, sizeof(avgcnt));
 158                 return;
 159         }
 160         case NFT_CT_L3PROTOCOL:
 161                 nft_reg_store8(dest, nf_ct_l3num(ct));
 162                 return;
 163         case NFT_CT_PROTOCOL:
 164                 nft_reg_store8(dest, nf_ct_protonum(ct));
 165                 return;
 166 #ifdef CONFIG_NF_CONNTRACK_ZONES
 167         case NFT_CT_ZONE: {
 168                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 169                 u16 zoneid;
 170
 171                 if (priv->dir < IP_CT_DIR_MAX)
 172                         zoneid = nf_ct_zone_id(zone, priv->dir);
 173                 else
 174                         zoneid = zone->id;
 175
 176                 nft_reg_store16(dest, zoneid);
 177                 return;
 178         }
 179 #endif
 180         case NFT_CT_ID:
 181                 *dest = nf_ct_get_id(ct);
 182                 return;
 183         default:
 184                 break;
 185         }
 186
 187         tuple = &ct->tuplehash[priv->dir].tuple;
 188         switch (priv->key) {
 189         case NFT_CT_SRC:
 190                 memcpy(dest, tuple->src.u3.all,
 191                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 192                 return;
 193         case NFT_CT_DST:
 194                 memcpy(dest, tuple->dst.u3.all,
 195                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 196                 return;
 197         case NFT_CT_PROTO_SRC:
 198                 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
 199                 return;
 200         case NFT_CT_PROTO_DST:
 201                 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
 202                 return;
 203         case NFT_CT_SRC_IP:
 204                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 205                         goto err;
 206                 *dest = tuple->src.u3.ip;
 207                 return;
 208         case NFT_CT_DST_IP:
 209                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 210                         goto err;
 211                 *dest = tuple->dst.u3.ip;
 212                 return;
 213         case NFT_CT_SRC_IP6:
 214                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 215                         goto err;
 216                 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
 217                 return;
 218         case NFT_CT_DST_IP6:
 219                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 220                         goto err;
 221                 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
 222                 return;
 223         default:
 224                 break;
 225         }
 226         return;
 227 err:
 228         regs->verdict.code = NFT_BREAK;
 229 }
 230
 231 #ifdef CONFIG_NF_CONNTRACK_ZONES
 232 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 233                                  struct nft_regs *regs,
 234                                  const struct nft_pktinfo *pkt)
 235 {
 236         struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 237         const struct nft_ct *priv = nft_expr_priv(expr);
 238         struct sk_buff *skb = pkt->skb;
 239         enum ip_conntrack_info ctinfo;
 240         u16 value = nft_reg_load16(&regs->data[priv->sreg]);
 241         struct nf_conn *ct;
 242
 243         ct = nf_ct_get(skb, &ctinfo);
 244         if (ct) /* already tracked */
 245                 return;
 246
 247         zone.id = value;
 248
 249         switch (priv->dir) {
 250         case IP_CT_DIR_ORIGINAL:
 251                 zone.dir = NF_CT_ZONE_DIR_ORIG;
 252                 break;
 253         case IP_CT_DIR_REPLY:
 254                 zone.dir = NF_CT_ZONE_DIR_REPL;
 255                 break;
 256         default:
 257                 break;
 258         }
 259
 260         ct = this_cpu_read(nft_ct_pcpu_template);
 261
 262         if (likely(refcount_read(&ct->ct_general.use) == 1)) {
 263                 refcount_inc(&ct->ct_general.use);
 264                 nf_ct_zone_add(ct, &zone);
 265         } else {
 266                 /* previous skb got queued to userspace, allocate temporary
 267                  * one until percpu template can be reused.
 268                  */
 269                 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 270                 if (!ct) {
 271                         regs->verdict.code = NF_DROP;
 272                         return;
 273                 }
 274         }
 275
 276         nf_ct_set(skb, ct, IP_CT_NEW);
 277 }
 278 #endif
 279
 280 static void nft_ct_set_eval(const struct nft_expr *expr,
 281                             struct nft_regs *regs,
 282                             const struct nft_pktinfo *pkt)
 283 {
 284         const struct nft_ct *priv = nft_expr_priv(expr);
 285         struct sk_buff *skb = pkt->skb;
 286 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
 287         u32 value = regs->data[priv->sreg];
 288 #endif
 289         enum ip_conntrack_info ctinfo;
 290         struct nf_conn *ct;
 291
 292         ct = nf_ct_get(skb, &ctinfo);
 293         if (ct == NULL || nf_ct_is_template(ct))
 294                 return;
 295
 296         switch (priv->key) {
 297 #ifdef CONFIG_NF_CONNTRACK_MARK
 298         case NFT_CT_MARK:
 299                 if (ct->mark != value) {
 300                         ct->mark = value;
 301                         nf_conntrack_event_cache(IPCT_MARK, ct);
 302                 }
 303                 break;
 304 #endif
 305 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 306         case NFT_CT_SECMARK:
 307                 if (ct->secmark != value) {
 308                         ct->secmark = value;
 309                         nf_conntrack_event_cache(IPCT_SECMARK, ct);
 310                 }
 311                 break;
 312 #endif
 313 #ifdef CONFIG_NF_CONNTRACK_LABELS
 314         case NFT_CT_LABELS:
 315                 nf_connlabels_replace(ct,
 316                                       &regs->data[priv->sreg],
 317                                       &regs->data[priv->sreg],
 318                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 319                 break;
 320 #endif
 321 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 322         case NFT_CT_EVENTMASK: {
 323                 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
 324                 u32 ctmask = regs->data[priv->sreg];
 325
 326                 if (e) {
 327                         if (e->ctmask != ctmask)
 328                                 e->ctmask = ctmask;
 329                         break;
 330                 }
 331
 332                 if (ctmask && !nf_ct_is_confirmed(ct))
 333                         nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
 334                 break;
 335         }
 336 #endif
 337         default:
 338                 break;
 339         }
 340 }
 341
 342 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 343         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 344         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 345         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 346         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 347 };
 348
 349 #ifdef CONFIG_NF_CONNTRACK_ZONES
 350 static void nft_ct_tmpl_put_pcpu(void)
 351 {
 352         struct nf_conn *ct;
 353         int cpu;
 354
 355         for_each_possible_cpu(cpu) {
 356                 ct = per_cpu(nft_ct_pcpu_template, cpu);
 357                 if (!ct)
 358                         break;
 359                 nf_ct_put(ct);
 360                 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 361         }
 362 }
 363
 364 static bool nft_ct_tmpl_alloc_pcpu(void)
 365 {
 366         struct nf_conntrack_zone zone = { .id = 0 };
 367         struct nf_conn *tmp;
 368         int cpu;
 369
 370         if (nft_ct_pcpu_template_refcnt)
 371                 return true;
 372
 373         for_each_possible_cpu(cpu) {
 374                 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 375                 if (!tmp) {
 376                         nft_ct_tmpl_put_pcpu();
 377                         return false;
 378                 }
 379
 380                 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 381         }
 382
 383         return true;
 384 }
 385 #endif
 386
 387 static int nft_ct_get_init(const struct nft_ctx *ctx,
 388                            const struct nft_expr *expr,
 389                            const struct nlattr * const tb[])
 390 {
 391         struct nft_ct *priv = nft_expr_priv(expr);
 392         unsigned int len;
 393         int err;
 394
 395         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 396         priv->dir = IP_CT_DIR_MAX;
 397         switch (priv->key) {
 398         case NFT_CT_DIRECTION:
 399                 if (tb[NFTA_CT_DIRECTION] != NULL)
 400                         return -EINVAL;
 401                 len = sizeof(u8);
 402                 break;
 403         case NFT_CT_STATE:
 404         case NFT_CT_STATUS:
 405 #ifdef CONFIG_NF_CONNTRACK_MARK
 406         case NFT_CT_MARK:
 407 #endif
 408 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 409         case NFT_CT_SECMARK:
 410 #endif
 411         case NFT_CT_EXPIRATION:
 412                 if (tb[NFTA_CT_DIRECTION] != NULL)
 413                         return -EINVAL;
 414                 len = sizeof(u32);
 415                 break;
 416 #ifdef CONFIG_NF_CONNTRACK_LABELS
 417         case NFT_CT_LABELS:
 418                 if (tb[NFTA_CT_DIRECTION] != NULL)
 419                         return -EINVAL;
 420                 len = NF_CT_LABELS_MAX_SIZE;
 421                 break;
 422 #endif
 423         case NFT_CT_HELPER:
 424                 if (tb[NFTA_CT_DIRECTION] != NULL)
 425                         return -EINVAL;
 426                 len = NF_CT_HELPER_NAME_LEN;
 427                 break;
 428
 429         case NFT_CT_L3PROTOCOL:
 430         case NFT_CT_PROTOCOL:
 431                 /* For compatibility, do not report error if NFTA_CT_DIRECTION
 432                  * attribute is specified.
 433                  */
 434                 len = sizeof(u8);
 435                 break;
 436         case NFT_CT_SRC:
 437         case NFT_CT_DST:
 438                 if (tb[NFTA_CT_DIRECTION] == NULL)
 439                         return -EINVAL;
 440
 441                 switch (ctx->family) {
 442                 case NFPROTO_IPV4:
 443                         len = sizeof_field(struct nf_conntrack_tuple,
 444                                            src.u3.ip);
 445                         break;
 446                 case NFPROTO_IPV6:
 447                 case NFPROTO_INET:
 448                         len = sizeof_field(struct nf_conntrack_tuple,
 449                                            src.u3.ip6);
 450                         break;
 451                 default:
 452                         return -EAFNOSUPPORT;
 453                 }
 454                 break;
 455         case NFT_CT_SRC_IP:
 456         case NFT_CT_DST_IP:
 457                 if (tb[NFTA_CT_DIRECTION] == NULL)
 458                         return -EINVAL;
 459
 460                 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
 461                 break;
 462         case NFT_CT_SRC_IP6:
 463         case NFT_CT_DST_IP6:
 464                 if (tb[NFTA_CT_DIRECTION] == NULL)
 465                         return -EINVAL;
 466
 467                 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
 468                 break;
 469         case NFT_CT_PROTO_SRC:
 470         case NFT_CT_PROTO_DST:
 471                 if (tb[NFTA_CT_DIRECTION] == NULL)
 472                         return -EINVAL;
 473                 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
 474                 break;
 475         case NFT_CT_BYTES:
 476         case NFT_CT_PKTS:
 477         case NFT_CT_AVGPKT:
 478                 len = sizeof(u64);
 479                 break;
 480 #ifdef CONFIG_NF_CONNTRACK_ZONES
 481         case NFT_CT_ZONE:
 482                 len = sizeof(u16);
 483                 break;
 484 #endif
 485         case NFT_CT_ID:
 486                 len = sizeof(u32);
 487                 break;
 488         default:
 489                 return -EOPNOTSUPP;
 490         }
 491
 492         if (tb[NFTA_CT_DIRECTION] != NULL) {
 493                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 494                 switch (priv->dir) {
 495                 case IP_CT_DIR_ORIGINAL:
 496                 case IP_CT_DIR_REPLY:
 497                         break;
 498                 default:
 499                         return -EINVAL;
 500                 }
 501         }
 502
 503         err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
 504                                        NFT_DATA_VALUE, len);
 505         if (err < 0)
 506                 return err;
 507
 508         err = nf_ct_netns_get(ctx->net, ctx->family);
 509         if (err < 0)
 510                 return err;
 511
 512         if (priv->key == NFT_CT_BYTES ||
 513             priv->key == NFT_CT_PKTS  ||
 514             priv->key == NFT_CT_AVGPKT)
 515                 nf_ct_set_acct(ctx->net, true);
 516
 517         return 0;
 518 }
 519
 520 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 521 {
 522         switch (priv->key) {
 523 #ifdef CONFIG_NF_CONNTRACK_LABELS
 524         case NFT_CT_LABELS:
 525                 nf_connlabels_put(ctx->net);
 526                 break;
 527 #endif
 528 #ifdef CONFIG_NF_CONNTRACK_ZONES
 529         case NFT_CT_ZONE:
 530                 mutex_lock(&nft_ct_pcpu_mutex);
 531                 if (--nft_ct_pcpu_template_refcnt == 0)
 532                         nft_ct_tmpl_put_pcpu();
 533                 mutex_unlock(&nft_ct_pcpu_mutex);
 534                 break;
 535 #endif
 536         default:
 537                 break;
 538         }
 539 }
 540
 541 static int nft_ct_set_init(const struct nft_ctx *ctx,
 542                            const struct nft_expr *expr,
 543                            const struct nlattr * const tb[])
 544 {
 545         struct nft_ct *priv = nft_expr_priv(expr);
 546         unsigned int len;
 547         int err;
 548
 549         priv->dir = IP_CT_DIR_MAX;
 550         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 551         switch (priv->key) {
 552 #ifdef CONFIG_NF_CONNTRACK_MARK
 553         case NFT_CT_MARK:
 554                 if (tb[NFTA_CT_DIRECTION])
 555                         return -EINVAL;
 556                 len = sizeof_field(struct nf_conn, mark);
 557                 break;
 558 #endif
 559 #ifdef CONFIG_NF_CONNTRACK_LABELS
 560         case NFT_CT_LABELS:
 561                 if (tb[NFTA_CT_DIRECTION])
 562                         return -EINVAL;
 563                 len = NF_CT_LABELS_MAX_SIZE;
 564                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 565                 if (err)
 566                         return err;
 567                 break;
 568 #endif
 569 #ifdef CONFIG_NF_CONNTRACK_ZONES
 570         case NFT_CT_ZONE:
 571                 mutex_lock(&nft_ct_pcpu_mutex);
 572                 if (!nft_ct_tmpl_alloc_pcpu()) {
 573                         mutex_unlock(&nft_ct_pcpu_mutex);
 574                         return -ENOMEM;
 575                 }
 576                 nft_ct_pcpu_template_refcnt++;
 577                 mutex_unlock(&nft_ct_pcpu_mutex);
 578                 len = sizeof(u16);
 579                 break;
 580 #endif
 581 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 582         case NFT_CT_EVENTMASK:
 583                 if (tb[NFTA_CT_DIRECTION])
 584                         return -EINVAL;
 585                 len = sizeof(u32);
 586                 break;
 587 #endif
 588 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 589         case NFT_CT_SECMARK:
 590                 if (tb[NFTA_CT_DIRECTION])
 591                         return -EINVAL;
 592                 len = sizeof(u32);
 593                 break;
 594 #endif
 595         default:
 596                 return -EOPNOTSUPP;
 597         }
 598
 599         if (tb[NFTA_CT_DIRECTION]) {
 600                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 601                 switch (priv->dir) {
 602                 case IP_CT_DIR_ORIGINAL:
 603                 case IP_CT_DIR_REPLY:
 604                         break;
 605                 default:
 606                         err = -EINVAL;
 607                         goto err1;
 608                 }
 609         }
 610
 611         err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
 612         if (err < 0)
 613                 goto err1;
 614
 615         err = nf_ct_netns_get(ctx->net, ctx->family);
 616         if (err < 0)
 617                 goto err1;
 618
 619         return 0;
 620
 621 err1:
 622         __nft_ct_set_destroy(ctx, priv);
 623         return err;
 624 }
 625
 626 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 627                                const struct nft_expr *expr)
 628 {
 629         nf_ct_netns_put(ctx->net, ctx->family);
 630 }
 631
 632 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 633                                const struct nft_expr *expr)
 634 {
 635         struct nft_ct *priv = nft_expr_priv(expr);
 636
 637         __nft_ct_set_destroy(ctx, priv);
 638         nf_ct_netns_put(ctx->net, ctx->family);
 639 }
 640
 641 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 642 {
 643         const struct nft_ct *priv = nft_expr_priv(expr);
 644
 645         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 646                 goto nla_put_failure;
 647         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 648                 goto nla_put_failure;
 649
 650         switch (priv->key) {
 651         case NFT_CT_SRC:
 652         case NFT_CT_DST:
 653         case NFT_CT_SRC_IP:
 654         case NFT_CT_DST_IP:
 655         case NFT_CT_SRC_IP6:
 656         case NFT_CT_DST_IP6:
 657         case NFT_CT_PROTO_SRC:
 658         case NFT_CT_PROTO_DST:
 659                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 660                         goto nla_put_failure;
 661                 break;
 662         case NFT_CT_BYTES:
 663         case NFT_CT_PKTS:
 664         case NFT_CT_AVGPKT:
 665         case NFT_CT_ZONE:
 666                 if (priv->dir < IP_CT_DIR_MAX &&
 667                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 668                         goto nla_put_failure;
 669                 break;
 670         default:
 671                 break;
 672         }
 673
 674         return 0;
 675
 676 nla_put_failure:
 677         return -1;
 678 }
 679
 680 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 681 {
 682         const struct nft_ct *priv = nft_expr_priv(expr);
 683
 684         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 685                 goto nla_put_failure;
 686         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 687                 goto nla_put_failure;
 688
 689         switch (priv->key) {
 690         case NFT_CT_ZONE:
 691                 if (priv->dir < IP_CT_DIR_MAX &&
 692                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 693                         goto nla_put_failure;
 694                 break;
 695         default:
 696                 break;
 697         }
 698
 699         return 0;
 700
 701 nla_put_failure:
 702         return -1;
 703 }
 704
 705 static struct nft_expr_type nft_ct_type;
 706 static const struct nft_expr_ops nft_ct_get_ops = {
 707         .type           = &nft_ct_type,
 708         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 709         .eval           = nft_ct_get_eval,
 710         .init           = nft_ct_get_init,
 711         .destroy        = nft_ct_get_destroy,
 712         .dump           = nft_ct_get_dump,
 713 };
 714
 715 static const struct nft_expr_ops nft_ct_set_ops = {
 716         .type           = &nft_ct_type,
 717         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 718         .eval           = nft_ct_set_eval,
 719         .init           = nft_ct_set_init,
 720         .destroy        = nft_ct_set_destroy,
 721         .dump           = nft_ct_set_dump,
 722 };
 723
 724 #ifdef CONFIG_NF_CONNTRACK_ZONES
 725 static const struct nft_expr_ops nft_ct_set_zone_ops = {
 726         .type           = &nft_ct_type,
 727         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 728         .eval           = nft_ct_set_zone_eval,
 729         .init           = nft_ct_set_init,
 730         .destroy        = nft_ct_set_destroy,
 731         .dump           = nft_ct_set_dump,
 732 };
 733 #endif
 734
 735 static const struct nft_expr_ops *
 736 nft_ct_select_ops(const struct nft_ctx *ctx,
 737                     const struct nlattr * const tb[])
 738 {
 739         if (tb[NFTA_CT_KEY] == NULL)
 740                 return ERR_PTR(-EINVAL);
 741
 742         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 743                 return ERR_PTR(-EINVAL);
 744
 745         if (tb[NFTA_CT_DREG])
 746                 return &nft_ct_get_ops;
 747
 748         if (tb[NFTA_CT_SREG]) {
 749 #ifdef CONFIG_NF_CONNTRACK_ZONES
 750                 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 751                         return &nft_ct_set_zone_ops;
 752 #endif
 753                 return &nft_ct_set_ops;
 754         }
 755
 756         return ERR_PTR(-EINVAL);
 757 }
 758
 759 static struct nft_expr_type nft_ct_type __read_mostly = {
 760         .name           = "ct",
 761         .select_ops     = nft_ct_select_ops,
 762         .policy         = nft_ct_policy,
 763         .maxattr        = NFTA_CT_MAX,
 764         .owner          = THIS_MODULE,
 765 };
 766
 767 static void nft_notrack_eval(const struct nft_expr *expr,
 768                              struct nft_regs *regs,
 769                              const struct nft_pktinfo *pkt)
 770 {
 771         struct sk_buff *skb = pkt->skb;
 772         enum ip_conntrack_info ctinfo;
 773         struct nf_conn *ct;
 774
 775         ct = nf_ct_get(pkt->skb, &ctinfo);
 776         /* Previously seen (loopback or untracked)?  Ignore. */
 777         if (ct || ctinfo == IP_CT_UNTRACKED)
 778                 return;
 779
 780         nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 781 }
 782
 783 static struct nft_expr_type nft_notrack_type;
 784 static const struct nft_expr_ops nft_notrack_ops = {
 785         .type           = &nft_notrack_type,
 786         .size           = NFT_EXPR_SIZE(0),
 787         .eval           = nft_notrack_eval,
 788 };
 789
 790 static struct nft_expr_type nft_notrack_type __read_mostly = {
 791         .name           = "notrack",
 792         .ops            = &nft_notrack_ops,
 793         .owner          = THIS_MODULE,
 794 };
 795
 796 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 797 static int
 798 nft_ct_timeout_parse_policy(void *timeouts,
 799                             const struct nf_conntrack_l4proto *l4proto,
 800                             struct net *net, const struct nlattr *attr)
 801 {
 802         struct nlattr **tb;
 803         int ret = 0;
 804
 805         tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
 806                      GFP_KERNEL);
 807
 808         if (!tb)
 809                 return -ENOMEM;
 810
 811         ret = nla_parse_nested_deprecated(tb,
 812                                           l4proto->ctnl_timeout.nlattr_max,
 813                                           attr,
 814                                           l4proto->ctnl_timeout.nla_policy,
 815                                           NULL);
 816         if (ret < 0)
 817                 goto err;
 818
 819         ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 820
 821 err:
 822         kfree(tb);
 823         return ret;
 824 }
 825
 826 struct nft_ct_timeout_obj {
 827         struct nf_ct_timeout    *timeout;
 828         u8                      l4proto;
 829 };
 830
 831 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 832                                     struct nft_regs *regs,
 833                                     const struct nft_pktinfo *pkt)
 834 {
 835         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 836         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
 837         struct nf_conn_timeout *timeout;
 838         const unsigned int *values;
 839
 840         if (priv->l4proto != pkt->tprot)
 841                 return;
 842
 843         if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
 844                 return;
 845
 846         timeout = nf_ct_timeout_find(ct);
 847         if (!timeout) {
 848                 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
 849                 if (!timeout) {
 850                         regs->verdict.code = NF_DROP;
 851                         return;
 852                 }
 853         }
 854
 855         rcu_assign_pointer(timeout->timeout, priv->timeout);
 856
 857         /* adjust the timeout as per 'new' state. ct is unconfirmed,
 858          * so the current timestamp must not be added.
 859          */
 860         values = nf_ct_timeout_data(timeout);
 861         if (values)
 862                 nf_ct_refresh(ct, pkt->skb, values[0]);
 863 }
 864
 865 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 866                                    const struct nlattr * const tb[],
 867                                    struct nft_object *obj)
 868 {
 869         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 870         const struct nf_conntrack_l4proto *l4proto;
 871         struct nf_ct_timeout *timeout;
 872         int l3num = ctx->family;
 873         __u8 l4num;
 874         int ret;
 875
 876         if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
 877             !tb[NFTA_CT_TIMEOUT_DATA])
 878                 return -EINVAL;
 879
 880         if (tb[NFTA_CT_TIMEOUT_L3PROTO])
 881                 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
 882
 883         l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
 884         priv->l4proto = l4num;
 885
 886         l4proto = nf_ct_l4proto_find(l4num);
 887
 888         if (l4proto->l4proto != l4num) {
 889                 ret = -EOPNOTSUPP;
 890                 goto err_proto_put;
 891         }
 892
 893         timeout = kzalloc(sizeof(struct nf_ct_timeout) +
 894                           l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
 895         if (timeout == NULL) {
 896                 ret = -ENOMEM;
 897                 goto err_proto_put;
 898         }
 899
 900         ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
 901                                           tb[NFTA_CT_TIMEOUT_DATA]);
 902         if (ret < 0)
 903                 goto err_free_timeout;
 904
 905         timeout->l3num = l3num;
 906         timeout->l4proto = l4proto;
 907
 908         ret = nf_ct_netns_get(ctx->net, ctx->family);
 909         if (ret < 0)
 910                 goto err_free_timeout;
 911
 912         priv->timeout = timeout;
 913         return 0;
 914
 915 err_free_timeout:
 916         kfree(timeout);
 917 err_proto_put:
 918         return ret;
 919 }
 920
 921 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
 922                                        struct nft_object *obj)
 923 {
 924         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 925         struct nf_ct_timeout *timeout = priv->timeout;
 926
 927         nf_ct_untimeout(ctx->net, timeout);
 928         nf_ct_netns_put(ctx->net, ctx->family);
 929         kfree(priv->timeout);
 930 }
 931
 932 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
 933                                    struct nft_object *obj, bool reset)
 934 {
 935         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 936         const struct nf_ct_timeout *timeout = priv->timeout;
 937         struct nlattr *nest_params;
 938         int ret;
 939
 940         if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
 941             nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
 942                 return -1;
 943
 944         nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
 945         if (!nest_params)
 946                 return -1;
 947
 948         ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
 949         if (ret < 0)
 950                 return -1;
 951         nla_nest_end(skb, nest_params);
 952         return 0;
 953 }
 954
 955 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
 956         [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
 957         [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
 958         [NFTA_CT_TIMEOUT_DATA]    = {.type = NLA_NESTED },
 959 };
 960
 961 static struct nft_object_type nft_ct_timeout_obj_type;
 962
 963 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
 964         .type           = &nft_ct_timeout_obj_type,
 965         .size           = sizeof(struct nft_ct_timeout_obj),
 966         .eval           = nft_ct_timeout_obj_eval,
 967         .init           = nft_ct_timeout_obj_init,
 968         .destroy        = nft_ct_timeout_obj_destroy,
 969         .dump           = nft_ct_timeout_obj_dump,
 970 };
 971
 972 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
 973         .type           = NFT_OBJECT_CT_TIMEOUT,
 974         .ops            = &nft_ct_timeout_obj_ops,
 975         .maxattr        = NFTA_CT_TIMEOUT_MAX,
 976         .policy         = nft_ct_timeout_policy,
 977         .owner          = THIS_MODULE,
 978 };
 979 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 980
 981 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
 982                                   const struct nlattr * const tb[],
 983                                   struct nft_object *obj)
 984 {
 985         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 986         struct nf_conntrack_helper *help4, *help6;
 987         char name[NF_CT_HELPER_NAME_LEN];
 988         int family = ctx->family;
 989         int err;
 990
 991         if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
 992                 return -EINVAL;
 993
 994         priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
 995         if (!priv->l4proto)
 996                 return -ENOENT;
 997
 998         nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
 999
1000         if (tb[NFTA_CT_HELPER_L3PROTO])
1001                 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1002
1003         help4 = NULL;
1004         help6 = NULL;
1005
1006         switch (family) {
1007         case NFPROTO_IPV4:
1008                 if (ctx->family == NFPROTO_IPV6)
1009                         return -EINVAL;
1010
1011                 help4 = nf_conntrack_helper_try_module_get(name, family,
1012                                                            priv->l4proto);
1013                 break;
1014         case NFPROTO_IPV6:
1015                 if (ctx->family == NFPROTO_IPV4)
1016                         return -EINVAL;
1017
1018                 help6 = nf_conntrack_helper_try_module_get(name, family,
1019                                                            priv->l4proto);
1020                 break;
1021         case NFPROTO_NETDEV:
1022         case NFPROTO_BRIDGE:
1023         case NFPROTO_INET:
1024                 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1025                                                            priv->l4proto);
1026                 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1027                                                            priv->l4proto);
1028                 break;
1029         default:
1030                 return -EAFNOSUPPORT;
1031         }
1032
1033         /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1034         if (!help4 && !help6)
1035                 return -ENOENT;
1036
1037         priv->helper4 = help4;
1038         priv->helper6 = help6;
1039
1040         err = nf_ct_netns_get(ctx->net, ctx->family);
1041         if (err < 0)
1042                 goto err_put_helper;
1043
1044         return 0;
1045
1046 err_put_helper:
1047         if (priv->helper4)
1048                 nf_conntrack_helper_put(priv->helper4);
1049         if (priv->helper6)
1050                 nf_conntrack_helper_put(priv->helper6);
1051         return err;
1052 }
1053
1054 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1055                                       struct nft_object *obj)
1056 {
1057         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1058
1059         if (priv->helper4)
1060                 nf_conntrack_helper_put(priv->helper4);
1061         if (priv->helper6)
1062                 nf_conntrack_helper_put(priv->helper6);
1063
1064         nf_ct_netns_put(ctx->net, ctx->family);
1065 }
1066
1067 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1068                                    struct nft_regs *regs,
1069                                    const struct nft_pktinfo *pkt)
1070 {
1071         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1072         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1073         struct nf_conntrack_helper *to_assign = NULL;
1074         struct nf_conn_help *help;
1075
1076         if (!ct ||
1077             nf_ct_is_confirmed(ct) ||
1078             nf_ct_is_template(ct) ||
1079             priv->l4proto != nf_ct_protonum(ct))
1080                 return;
1081
1082         switch (nf_ct_l3num(ct)) {
1083         case NFPROTO_IPV4:
1084                 to_assign = priv->helper4;
1085                 break;
1086         case NFPROTO_IPV6:
1087                 to_assign = priv->helper6;
1088                 break;
1089         default:
1090                 WARN_ON_ONCE(1);
1091                 return;
1092         }
1093
1094         if (!to_assign)
1095                 return;
1096
1097         if (test_bit(IPS_HELPER_BIT, &ct->status))
1098                 return;
1099
1100         help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1101         if (help) {
1102                 rcu_assign_pointer(help->helper, to_assign);
1103                 set_bit(IPS_HELPER_BIT, &ct->status);
1104         }
1105 }
1106
1107 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1108                                   struct nft_object *obj, bool reset)
1109 {
1110         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1111         const struct nf_conntrack_helper *helper;
1112         u16 family;
1113
1114         if (priv->helper4 && priv->helper6) {
1115                 family = NFPROTO_INET;
1116                 helper = priv->helper4;
1117         } else if (priv->helper6) {
1118                 family = NFPROTO_IPV6;
1119                 helper = priv->helper6;
1120         } else {
1121                 family = NFPROTO_IPV4;
1122                 helper = priv->helper4;
1123         }
1124
1125         if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1126                 return -1;
1127
1128         if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1129                 return -1;
1130
1131         if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1132                 return -1;
1133
1134         return 0;
1135 }
1136
1137 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1138         [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1139                                   .len = NF_CT_HELPER_NAME_LEN - 1 },
1140         [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1141         [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1142 };
1143
1144 static struct nft_object_type nft_ct_helper_obj_type;
1145 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1146         .type           = &nft_ct_helper_obj_type,
1147         .size           = sizeof(struct nft_ct_helper_obj),
1148         .eval           = nft_ct_helper_obj_eval,
1149         .init           = nft_ct_helper_obj_init,
1150         .destroy        = nft_ct_helper_obj_destroy,
1151         .dump           = nft_ct_helper_obj_dump,
1152 };
1153
1154 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1155         .type           = NFT_OBJECT_CT_HELPER,
1156         .ops            = &nft_ct_helper_obj_ops,
1157         .maxattr        = NFTA_CT_HELPER_MAX,
1158         .policy         = nft_ct_helper_policy,
1159         .owner          = THIS_MODULE,
1160 };
1161
1162 struct nft_ct_expect_obj {
1163         u16             l3num;
1164         __be16          dport;
1165         u8              l4proto;
1166         u8              size;
1167         u32             timeout;
1168 };
1169
1170 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1171                                   const struct nlattr * const tb[],
1172                                   struct nft_object *obj)
1173 {
1174         struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1175
1176         if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1177             !tb[NFTA_CT_EXPECT_DPORT] ||
1178             !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1179             !tb[NFTA_CT_EXPECT_SIZE])
1180                 return -EINVAL;
1181
1182         priv->l3num = ctx->family;
1183         if (tb[NFTA_CT_EXPECT_L3PROTO])
1184                 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1185
1186         priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1187         priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1188         priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1189         priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1190
1191         return nf_ct_netns_get(ctx->net, ctx->family);
1192 }
1193
1194 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1195                                        struct nft_object *obj)
1196 {
1197         nf_ct_netns_put(ctx->net, ctx->family);
1198 }
1199
1200 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1201                                   struct nft_object *obj, bool reset)
1202 {
1203         const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1204
1205         if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1206             nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1207             nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1208             nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1209             nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1210                 return -1;
1211
1212         return 0;
1213 }
1214
1215 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1216                                    struct nft_regs *regs,
1217                                    const struct nft_pktinfo *pkt)
1218 {
1219         const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1220         struct nf_conntrack_expect *exp;
1221         enum ip_conntrack_info ctinfo;
1222         struct nf_conn_help *help;
1223         enum ip_conntrack_dir dir;
1224         u16 l3num = priv->l3num;
1225         struct nf_conn *ct;
1226
1227         ct = nf_ct_get(pkt->skb, &ctinfo);
1228         if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1229                 regs->verdict.code = NFT_BREAK;
1230                 return;
1231         }
1232         dir = CTINFO2DIR(ctinfo);
1233
1234         help = nfct_help(ct);
1235         if (!help)
1236                 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1237         if (!help) {
1238                 regs->verdict.code = NF_DROP;
1239                 return;
1240         }
1241
1242         if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1243                 regs->verdict.code = NFT_BREAK;
1244                 return;
1245         }
1246         if (l3num == NFPROTO_INET)
1247                 l3num = nf_ct_l3num(ct);
1248
1249         exp = nf_ct_expect_alloc(ct);
1250         if (exp == NULL) {
1251                 regs->verdict.code = NF_DROP;
1252                 return;
1253         }
1254         nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1255                           &ct->tuplehash[!dir].tuple.src.u3,
1256                           &ct->tuplehash[!dir].tuple.dst.u3,
1257                           priv->l4proto, NULL, &priv->dport);
1258         exp->timeout.expires = jiffies + priv->timeout * HZ;
1259
1260         if (nf_ct_expect_related(exp, 0) != 0)
1261                 regs->verdict.code = NF_DROP;
1262 }
1263
1264 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1265         [NFTA_CT_EXPECT_L3PROTO]        = { .type = NLA_U16 },
1266         [NFTA_CT_EXPECT_L4PROTO]        = { .type = NLA_U8 },
1267         [NFTA_CT_EXPECT_DPORT]          = { .type = NLA_U16 },
1268         [NFTA_CT_EXPECT_TIMEOUT]        = { .type = NLA_U32 },
1269         [NFTA_CT_EXPECT_SIZE]           = { .type = NLA_U8 },
1270 };
1271
1272 static struct nft_object_type nft_ct_expect_obj_type;
1273
1274 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1275         .type           = &nft_ct_expect_obj_type,
1276         .size           = sizeof(struct nft_ct_expect_obj),
1277         .eval           = nft_ct_expect_obj_eval,
1278         .init           = nft_ct_expect_obj_init,
1279         .destroy        = nft_ct_expect_obj_destroy,
1280         .dump           = nft_ct_expect_obj_dump,
1281 };
1282
1283 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1284         .type           = NFT_OBJECT_CT_EXPECT,
1285         .ops            = &nft_ct_expect_obj_ops,
1286         .maxattr        = NFTA_CT_EXPECT_MAX,
1287         .policy         = nft_ct_expect_policy,
1288         .owner          = THIS_MODULE,
1289 };
1290
1291 static int __init nft_ct_module_init(void)
1292 {
1293         int err;
1294
1295         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1296
1297         err = nft_register_expr(&nft_ct_type);
1298         if (err < 0)
1299                 return err;
1300
1301         err = nft_register_expr(&nft_notrack_type);
1302         if (err < 0)
1303                 goto err1;
1304
1305         err = nft_register_obj(&nft_ct_helper_obj_type);
1306         if (err < 0)
1307                 goto err2;
1308
1309         err = nft_register_obj(&nft_ct_expect_obj_type);
1310         if (err < 0)
1311                 goto err3;
1312 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1313         err = nft_register_obj(&nft_ct_timeout_obj_type);
1314         if (err < 0)
1315                 goto err4;
1316 #endif
1317         return 0;
1318
1319 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1320 err4:
1321         nft_unregister_obj(&nft_ct_expect_obj_type);
1322 #endif
1323 err3:
1324         nft_unregister_obj(&nft_ct_helper_obj_type);
1325 err2:
1326         nft_unregister_expr(&nft_notrack_type);
1327 err1:
1328         nft_unregister_expr(&nft_ct_type);
1329         return err;
1330 }
1331
1332 static void __exit nft_ct_module_exit(void)
1333 {
1334 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1335         nft_unregister_obj(&nft_ct_timeout_obj_type);
1336 #endif
1337         nft_unregister_obj(&nft_ct_expect_obj_type);
1338         nft_unregister_obj(&nft_ct_helper_obj_type);
1339         nft_unregister_expr(&nft_notrack_type);
1340         nft_unregister_expr(&nft_ct_type);
1341 }
1342
1343 module_init(nft_ct_module_init);
1344 module_exit(nft_ct_module_exit);
1345
1346 MODULE_LICENSE("GPL");
1347 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1348 MODULE_ALIAS_NFT_EXPR("ct");
1349 MODULE_ALIAS_NFT_EXPR("notrack");
1350 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1351 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1352 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1353 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");