1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org> 5 * 6 * Development of this code funded by Astaro AG (http://www.astaro.com/) 7 */ 8 9 #include <linux/kernel.h> 10 #include <linux/init.h> 11 #include <linux/module.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables_core.h> 16 #include <net/netfilter/nf_conntrack.h> 17 #include <net/netfilter/nf_conntrack_acct.h> 18 #include <net/netfilter/nf_conntrack_tuple.h> 19 #include <net/netfilter/nf_conntrack_helper.h> 20 #include <net/netfilter/nf_conntrack_ecache.h> 21 #include <net/netfilter/nf_conntrack_labels.h> 22 #include <net/netfilter/nf_conntrack_timeout.h> 23 #include <net/netfilter/nf_conntrack_l4proto.h> 24 #include <net/netfilter/nf_conntrack_expect.h> 25 #include <net/netfilter/nf_conntrack_seqadj.h> 26 #include "nf_internals.h" 27 28 struct nft_ct_helper_obj { 29 struct nf_conntrack_helper *helper4; 30 struct nf_conntrack_helper *helper6; 31 u8 l4proto; 32 }; 33 34 #ifdef CONFIG_NF_CONNTRACK_ZONES 35 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template); 36 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly; 37 static DEFINE_MUTEX(nft_ct_pcpu_mutex); 38 #endif 39 40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c, 41 enum nft_ct_keys k, 42 enum ip_conntrack_dir d) 43 { 44 if (d < IP_CT_DIR_MAX) 45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) : 46 atomic64_read(&c[d].packets); 47 48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) + 49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY); 50 } 51 52 static void nft_ct_get_eval(const struct nft_expr *expr, 53 struct nft_regs *regs, 54 const struct nft_pktinfo *pkt) 55 { 56 const struct nft_ct *priv = nft_expr_priv(expr); 57 u32 *dest = ®s->data[priv->dreg]; 58 enum ip_conntrack_info ctinfo; 59 const struct nf_conn *ct; 60 const struct nf_conn_help *help; 61 const struct nf_conntrack_tuple *tuple; 62 const struct nf_conntrack_helper *helper; 63 unsigned int state; 64 65 ct = nf_ct_get(pkt->skb, &ctinfo); 66 67 switch (priv->key) { 68 case NFT_CT_STATE: 69 if (ct) 70 state = NF_CT_STATE_BIT(ctinfo); 71 else if (ctinfo == IP_CT_UNTRACKED) 72 state = NF_CT_STATE_UNTRACKED_BIT; 73 else 74 state = NF_CT_STATE_INVALID_BIT; 75 *dest = state; 76 return; 77 default: 78 break; 79 } 80 81 if (!ct || nf_ct_is_template(ct)) 82 goto err; 83 84 switch (priv->key) { 85 case NFT_CT_DIRECTION: 86 nft_reg_store8(dest, CTINFO2DIR(ctinfo)); 87 return; 88 case NFT_CT_STATUS: 89 *dest = ct->status; 90 return; 91 #ifdef CONFIG_NF_CONNTRACK_MARK 92 case NFT_CT_MARK: 93 *dest = READ_ONCE(ct->mark); 94 return; 95 #endif 96 #ifdef CONFIG_NF_CONNTRACK_SECMARK 97 case NFT_CT_SECMARK: 98 *dest = ct->secmark; 99 return; 100 #endif 101 case NFT_CT_EXPIRATION: 102 *dest = jiffies_to_msecs(nf_ct_expires(ct)); 103 return; 104 case NFT_CT_HELPER: 105 if (ct->master == NULL) 106 goto err; 107 help = nfct_help(ct->master); 108 if (help == NULL) 109 goto err; 110 helper = rcu_dereference(help->helper); 111 if (helper == NULL) 112 goto err; 113 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN); 114 return; 115 #ifdef CONFIG_NF_CONNTRACK_LABELS 116 case NFT_CT_LABELS: { 117 struct nf_conn_labels *labels = nf_ct_labels_find(ct); 118 119 if (labels) 120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE); 121 else 122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE); 123 return; 124 } 125 #endif 126 case NFT_CT_BYTES: 127 case NFT_CT_PKTS: { 128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct); 129 u64 count = 0; 130 131 if (acct) 132 count = nft_ct_get_eval_counter(acct->counter, 133 priv->key, priv->dir); 134 memcpy(dest, &count, sizeof(count)); 135 return; 136 } 137 case NFT_CT_AVGPKT: { 138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct); 139 u64 avgcnt = 0, bcnt = 0, pcnt = 0; 140 141 if (acct) { 142 pcnt = nft_ct_get_eval_counter(acct->counter, 143 NFT_CT_PKTS, priv->dir); 144 bcnt = nft_ct_get_eval_counter(acct->counter, 145 NFT_CT_BYTES, priv->dir); 146 if (pcnt != 0) 147 avgcnt = div64_u64(bcnt, pcnt); 148 } 149 150 memcpy(dest, &avgcnt, sizeof(avgcnt)); 151 return; 152 } 153 case NFT_CT_L3PROTOCOL: 154 nft_reg_store8(dest, nf_ct_l3num(ct)); 155 return; 156 case NFT_CT_PROTOCOL: 157 nft_reg_store8(dest, nf_ct_protonum(ct)); 158 return; 159 #ifdef CONFIG_NF_CONNTRACK_ZONES 160 case NFT_CT_ZONE: { 161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct); 162 u16 zoneid; 163 164 if (priv->dir < IP_CT_DIR_MAX) 165 zoneid = nf_ct_zone_id(zone, priv->dir); 166 else 167 zoneid = zone->id; 168 169 nft_reg_store16(dest, zoneid); 170 return; 171 } 172 #endif 173 case NFT_CT_ID: 174 *dest = nf_ct_get_id(ct); 175 return; 176 default: 177 break; 178 } 179 180 tuple = &ct->tuplehash[priv->dir].tuple; 181 switch (priv->key) { 182 case NFT_CT_SRC: 183 memcpy(dest, tuple->src.u3.all, priv->len); 184 return; 185 case NFT_CT_DST: 186 memcpy(dest, tuple->dst.u3.all, priv->len); 187 return; 188 case NFT_CT_PROTO_SRC: 189 nft_reg_store16(dest, (__force u16)tuple->src.u.all); 190 return; 191 case NFT_CT_PROTO_DST: 192 nft_reg_store16(dest, (__force u16)tuple->dst.u.all); 193 return; 194 case NFT_CT_SRC_IP: 195 if (nf_ct_l3num(ct) != NFPROTO_IPV4) 196 goto err; 197 *dest = (__force __u32)tuple->src.u3.ip; 198 return; 199 case NFT_CT_DST_IP: 200 if (nf_ct_l3num(ct) != NFPROTO_IPV4) 201 goto err; 202 *dest = (__force __u32)tuple->dst.u3.ip; 203 return; 204 case NFT_CT_SRC_IP6: 205 if (nf_ct_l3num(ct) != NFPROTO_IPV6) 206 goto err; 207 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr)); 208 return; 209 case NFT_CT_DST_IP6: 210 if (nf_ct_l3num(ct) != NFPROTO_IPV6) 211 goto err; 212 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr)); 213 return; 214 default: 215 break; 216 } 217 return; 218 err: 219 regs->verdict.code = NFT_BREAK; 220 } 221 222 #ifdef CONFIG_NF_CONNTRACK_ZONES 223 static void nft_ct_set_zone_eval(const struct nft_expr *expr, 224 struct nft_regs *regs, 225 const struct nft_pktinfo *pkt) 226 { 227 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR }; 228 const struct nft_ct *priv = nft_expr_priv(expr); 229 struct sk_buff *skb = pkt->skb; 230 enum ip_conntrack_info ctinfo; 231 u16 value = nft_reg_load16(®s->data[priv->sreg]); 232 struct nf_conn *ct; 233 int oldcnt; 234 235 ct = nf_ct_get(skb, &ctinfo); 236 if (ct) /* already tracked */ 237 return; 238 239 zone.id = value; 240 241 switch (priv->dir) { 242 case IP_CT_DIR_ORIGINAL: 243 zone.dir = NF_CT_ZONE_DIR_ORIG; 244 break; 245 case IP_CT_DIR_REPLY: 246 zone.dir = NF_CT_ZONE_DIR_REPL; 247 break; 248 default: 249 break; 250 } 251 252 ct = this_cpu_read(nft_ct_pcpu_template); 253 254 __refcount_inc(&ct->ct_general.use, &oldcnt); 255 if (likely(oldcnt == 1)) { 256 nf_ct_zone_add(ct, &zone); 257 } else { 258 refcount_dec(&ct->ct_general.use); 259 /* previous skb got queued to userspace, allocate temporary 260 * one until percpu template can be reused. 261 */ 262 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC); 263 if (!ct) { 264 regs->verdict.code = NF_DROP; 265 return; 266 } 267 __set_bit(IPS_CONFIRMED_BIT, &ct->status); 268 } 269 270 nf_ct_set(skb, ct, IP_CT_NEW); 271 } 272 #endif 273 274 static void nft_ct_set_eval(const struct nft_expr *expr, 275 struct nft_regs *regs, 276 const struct nft_pktinfo *pkt) 277 { 278 const struct nft_ct *priv = nft_expr_priv(expr); 279 struct sk_buff *skb = pkt->skb; 280 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK) 281 u32 value = regs->data[priv->sreg]; 282 #endif 283 enum ip_conntrack_info ctinfo; 284 struct nf_conn *ct; 285 286 ct = nf_ct_get(skb, &ctinfo); 287 if (ct == NULL || nf_ct_is_template(ct)) 288 return; 289 290 switch (priv->key) { 291 #ifdef CONFIG_NF_CONNTRACK_MARK 292 case NFT_CT_MARK: 293 if (READ_ONCE(ct->mark) != value) { 294 WRITE_ONCE(ct->mark, value); 295 nf_conntrack_event_cache(IPCT_MARK, ct); 296 } 297 break; 298 #endif 299 #ifdef CONFIG_NF_CONNTRACK_SECMARK 300 case NFT_CT_SECMARK: 301 if (ct->secmark != value) { 302 ct->secmark = value; 303 nf_conntrack_event_cache(IPCT_SECMARK, ct); 304 } 305 break; 306 #endif 307 #ifdef CONFIG_NF_CONNTRACK_LABELS 308 case NFT_CT_LABELS: 309 nf_connlabels_replace(ct, 310 ®s->data[priv->sreg], 311 ®s->data[priv->sreg], 312 NF_CT_LABELS_MAX_SIZE / sizeof(u32)); 313 break; 314 #endif 315 #ifdef CONFIG_NF_CONNTRACK_EVENTS 316 case NFT_CT_EVENTMASK: { 317 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct); 318 u32 ctmask = regs->data[priv->sreg]; 319 320 if (e) { 321 if (e->ctmask != ctmask) 322 e->ctmask = ctmask; 323 break; 324 } 325 326 if (ctmask && !nf_ct_is_confirmed(ct)) 327 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC); 328 break; 329 } 330 #endif 331 default: 332 break; 333 } 334 } 335 336 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = { 337 [NFTA_CT_DREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX), 338 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255), 339 [NFTA_CT_DIRECTION] = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY), 340 [NFTA_CT_SREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX), 341 }; 342 343 #ifdef CONFIG_NF_CONNTRACK_ZONES 344 static void nft_ct_tmpl_put_pcpu(void) 345 { 346 struct nf_conn *ct; 347 int cpu; 348 349 for_each_possible_cpu(cpu) { 350 ct = per_cpu(nft_ct_pcpu_template, cpu); 351 if (!ct) 352 break; 353 nf_ct_put(ct); 354 per_cpu(nft_ct_pcpu_template, cpu) = NULL; 355 } 356 } 357 358 static bool nft_ct_tmpl_alloc_pcpu(void) 359 { 360 struct nf_conntrack_zone zone = { .id = 0 }; 361 struct nf_conn *tmp; 362 int cpu; 363 364 if (nft_ct_pcpu_template_refcnt) 365 return true; 366 367 for_each_possible_cpu(cpu) { 368 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL); 369 if (!tmp) { 370 nft_ct_tmpl_put_pcpu(); 371 return false; 372 } 373 374 __set_bit(IPS_CONFIRMED_BIT, &tmp->status); 375 per_cpu(nft_ct_pcpu_template, cpu) = tmp; 376 } 377 378 return true; 379 } 380 #endif 381 382 static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) 383 { 384 #ifdef CONFIG_NF_CONNTRACK_LABELS 385 if (priv->key == NFT_CT_LABELS) 386 nf_connlabels_put(ctx->net); 387 #endif 388 } 389 390 static int nft_ct_get_init(const struct nft_ctx *ctx, 391 const struct nft_expr *expr, 392 const struct nlattr * const tb[]) 393 { 394 struct nft_ct *priv = nft_expr_priv(expr); 395 unsigned int len; 396 int err; 397 398 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY])); 399 priv->dir = IP_CT_DIR_MAX; 400 switch (priv->key) { 401 case NFT_CT_DIRECTION: 402 if (tb[NFTA_CT_DIRECTION] != NULL) 403 return -EINVAL; 404 len = sizeof(u8); 405 break; 406 case NFT_CT_STATE: 407 case NFT_CT_STATUS: 408 #ifdef CONFIG_NF_CONNTRACK_MARK 409 case NFT_CT_MARK: 410 #endif 411 #ifdef CONFIG_NF_CONNTRACK_SECMARK 412 case NFT_CT_SECMARK: 413 #endif 414 case NFT_CT_EXPIRATION: 415 if (tb[NFTA_CT_DIRECTION] != NULL) 416 return -EINVAL; 417 len = sizeof(u32); 418 break; 419 #ifdef CONFIG_NF_CONNTRACK_LABELS 420 case NFT_CT_LABELS: 421 if (tb[NFTA_CT_DIRECTION] != NULL) 422 return -EINVAL; 423 len = NF_CT_LABELS_MAX_SIZE; 424 425 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1); 426 if (err) 427 return err; 428 break; 429 #endif 430 case NFT_CT_HELPER: 431 if (tb[NFTA_CT_DIRECTION] != NULL) 432 return -EINVAL; 433 len = NF_CT_HELPER_NAME_LEN; 434 break; 435 436 case NFT_CT_L3PROTOCOL: 437 case NFT_CT_PROTOCOL: 438 /* For compatibility, do not report error if NFTA_CT_DIRECTION 439 * attribute is specified. 440 */ 441 len = sizeof(u8); 442 break; 443 case NFT_CT_SRC: 444 case NFT_CT_DST: 445 if (tb[NFTA_CT_DIRECTION] == NULL) 446 return -EINVAL; 447 448 switch (ctx->family) { 449 case NFPROTO_IPV4: 450 len = sizeof_field(struct nf_conntrack_tuple, 451 src.u3.ip); 452 break; 453 case NFPROTO_IPV6: 454 case NFPROTO_INET: 455 len = sizeof_field(struct nf_conntrack_tuple, 456 src.u3.ip6); 457 break; 458 default: 459 return -EAFNOSUPPORT; 460 } 461 break; 462 case NFT_CT_SRC_IP: 463 case NFT_CT_DST_IP: 464 if (tb[NFTA_CT_DIRECTION] == NULL) 465 return -EINVAL; 466 467 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip); 468 break; 469 case NFT_CT_SRC_IP6: 470 case NFT_CT_DST_IP6: 471 if (tb[NFTA_CT_DIRECTION] == NULL) 472 return -EINVAL; 473 474 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6); 475 break; 476 case NFT_CT_PROTO_SRC: 477 case NFT_CT_PROTO_DST: 478 if (tb[NFTA_CT_DIRECTION] == NULL) 479 return -EINVAL; 480 len = sizeof_field(struct nf_conntrack_tuple, src.u.all); 481 break; 482 case NFT_CT_BYTES: 483 case NFT_CT_PKTS: 484 case NFT_CT_AVGPKT: 485 len = sizeof(u64); 486 break; 487 #ifdef CONFIG_NF_CONNTRACK_ZONES 488 case NFT_CT_ZONE: 489 len = sizeof(u16); 490 break; 491 #endif 492 case NFT_CT_ID: 493 if (tb[NFTA_CT_DIRECTION]) 494 return -EINVAL; 495 496 len = sizeof(u32); 497 break; 498 default: 499 return -EOPNOTSUPP; 500 } 501 502 if (tb[NFTA_CT_DIRECTION] != NULL) { 503 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]); 504 switch (priv->dir) { 505 case IP_CT_DIR_ORIGINAL: 506 case IP_CT_DIR_REPLY: 507 break; 508 default: 509 err = -EINVAL; 510 goto err; 511 } 512 } 513 514 priv->len = len; 515 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL, 516 NFT_DATA_VALUE, len); 517 if (err < 0) 518 goto err; 519 520 err = nf_ct_netns_get(ctx->net, ctx->family); 521 if (err < 0) 522 goto err; 523 524 if (priv->key == NFT_CT_BYTES || 525 priv->key == NFT_CT_PKTS || 526 priv->key == NFT_CT_AVGPKT) 527 nf_ct_set_acct(ctx->net, true); 528 529 return 0; 530 err: 531 __nft_ct_get_destroy(ctx, priv); 532 return err; 533 } 534 535 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) 536 { 537 switch (priv->key) { 538 #ifdef CONFIG_NF_CONNTRACK_LABELS 539 case NFT_CT_LABELS: 540 nf_connlabels_put(ctx->net); 541 break; 542 #endif 543 #ifdef CONFIG_NF_CONNTRACK_ZONES 544 case NFT_CT_ZONE: 545 nf_queue_nf_hook_drop(ctx->net); 546 mutex_lock(&nft_ct_pcpu_mutex); 547 if (--nft_ct_pcpu_template_refcnt == 0) 548 nft_ct_tmpl_put_pcpu(); 549 mutex_unlock(&nft_ct_pcpu_mutex); 550 break; 551 #endif 552 default: 553 break; 554 } 555 } 556 557 static int nft_ct_set_init(const struct nft_ctx *ctx, 558 const struct nft_expr *expr, 559 const struct nlattr * const tb[]) 560 { 561 struct nft_ct *priv = nft_expr_priv(expr); 562 unsigned int len; 563 int err; 564 565 priv->dir = IP_CT_DIR_MAX; 566 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY])); 567 switch (priv->key) { 568 #ifdef CONFIG_NF_CONNTRACK_MARK 569 case NFT_CT_MARK: 570 if (tb[NFTA_CT_DIRECTION]) 571 return -EINVAL; 572 len = sizeof_field(struct nf_conn, mark); 573 break; 574 #endif 575 #ifdef CONFIG_NF_CONNTRACK_LABELS 576 case NFT_CT_LABELS: 577 if (tb[NFTA_CT_DIRECTION]) 578 return -EINVAL; 579 len = NF_CT_LABELS_MAX_SIZE; 580 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1); 581 if (err) 582 return err; 583 break; 584 #endif 585 #ifdef CONFIG_NF_CONNTRACK_ZONES 586 case NFT_CT_ZONE: 587 mutex_lock(&nft_ct_pcpu_mutex); 588 if (!nft_ct_tmpl_alloc_pcpu()) { 589 mutex_unlock(&nft_ct_pcpu_mutex); 590 return -ENOMEM; 591 } 592 nft_ct_pcpu_template_refcnt++; 593 mutex_unlock(&nft_ct_pcpu_mutex); 594 len = sizeof(u16); 595 break; 596 #endif 597 #ifdef CONFIG_NF_CONNTRACK_EVENTS 598 case NFT_CT_EVENTMASK: 599 if (tb[NFTA_CT_DIRECTION]) 600 return -EINVAL; 601 len = sizeof(u32); 602 break; 603 #endif 604 #ifdef CONFIG_NF_CONNTRACK_SECMARK 605 case NFT_CT_SECMARK: 606 if (tb[NFTA_CT_DIRECTION]) 607 return -EINVAL; 608 len = sizeof(u32); 609 break; 610 #endif 611 default: 612 return -EOPNOTSUPP; 613 } 614 615 if (tb[NFTA_CT_DIRECTION]) { 616 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]); 617 switch (priv->dir) { 618 case IP_CT_DIR_ORIGINAL: 619 case IP_CT_DIR_REPLY: 620 break; 621 default: 622 err = -EINVAL; 623 goto err1; 624 } 625 } 626 627 priv->len = len; 628 err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len); 629 if (err < 0) 630 goto err1; 631 632 err = nf_ct_netns_get(ctx->net, ctx->family); 633 if (err < 0) 634 goto err1; 635 636 return 0; 637 638 err1: 639 __nft_ct_set_destroy(ctx, priv); 640 return err; 641 } 642 643 static void nft_ct_get_destroy(const struct nft_ctx *ctx, 644 const struct nft_expr *expr) 645 { 646 struct nft_ct *priv = nft_expr_priv(expr); 647 648 __nft_ct_get_destroy(ctx, priv); 649 nf_ct_netns_put(ctx->net, ctx->family); 650 } 651 652 static void nft_ct_set_destroy(const struct nft_ctx *ctx, 653 const struct nft_expr *expr) 654 { 655 struct nft_ct *priv = nft_expr_priv(expr); 656 657 __nft_ct_set_destroy(ctx, priv); 658 nf_ct_netns_put(ctx->net, ctx->family); 659 } 660 661 static int nft_ct_get_dump(struct sk_buff *skb, 662 const struct nft_expr *expr, bool reset) 663 { 664 const struct nft_ct *priv = nft_expr_priv(expr); 665 666 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg)) 667 goto nla_put_failure; 668 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key))) 669 goto nla_put_failure; 670 671 switch (priv->key) { 672 case NFT_CT_SRC: 673 case NFT_CT_DST: 674 case NFT_CT_SRC_IP: 675 case NFT_CT_DST_IP: 676 case NFT_CT_SRC_IP6: 677 case NFT_CT_DST_IP6: 678 case NFT_CT_PROTO_SRC: 679 case NFT_CT_PROTO_DST: 680 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir)) 681 goto nla_put_failure; 682 break; 683 case NFT_CT_BYTES: 684 case NFT_CT_PKTS: 685 case NFT_CT_AVGPKT: 686 case NFT_CT_ZONE: 687 if (priv->dir < IP_CT_DIR_MAX && 688 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir)) 689 goto nla_put_failure; 690 break; 691 default: 692 break; 693 } 694 695 return 0; 696 697 nla_put_failure: 698 return -1; 699 } 700 701 static int nft_ct_set_dump(struct sk_buff *skb, 702 const struct nft_expr *expr, bool reset) 703 { 704 const struct nft_ct *priv = nft_expr_priv(expr); 705 706 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg)) 707 goto nla_put_failure; 708 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key))) 709 goto nla_put_failure; 710 711 switch (priv->key) { 712 case NFT_CT_ZONE: 713 if (priv->dir < IP_CT_DIR_MAX && 714 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir)) 715 goto nla_put_failure; 716 break; 717 default: 718 break; 719 } 720 721 return 0; 722 723 nla_put_failure: 724 return -1; 725 } 726 727 static struct nft_expr_type nft_ct_type; 728 static const struct nft_expr_ops nft_ct_get_ops = { 729 .type = &nft_ct_type, 730 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 731 .eval = nft_ct_get_eval, 732 .init = nft_ct_get_init, 733 .destroy = nft_ct_get_destroy, 734 .dump = nft_ct_get_dump, 735 }; 736 737 #ifdef CONFIG_MITIGATION_RETPOLINE 738 static const struct nft_expr_ops nft_ct_get_fast_ops = { 739 .type = &nft_ct_type, 740 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 741 .eval = nft_ct_get_fast_eval, 742 .init = nft_ct_get_init, 743 .destroy = nft_ct_get_destroy, 744 .dump = nft_ct_get_dump, 745 }; 746 #endif 747 748 static const struct nft_expr_ops nft_ct_set_ops = { 749 .type = &nft_ct_type, 750 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 751 .eval = nft_ct_set_eval, 752 .init = nft_ct_set_init, 753 .destroy = nft_ct_set_destroy, 754 .dump = nft_ct_set_dump, 755 }; 756 757 #ifdef CONFIG_NF_CONNTRACK_ZONES 758 static const struct nft_expr_ops nft_ct_set_zone_ops = { 759 .type = &nft_ct_type, 760 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 761 .eval = nft_ct_set_zone_eval, 762 .init = nft_ct_set_init, 763 .destroy = nft_ct_set_destroy, 764 .dump = nft_ct_set_dump, 765 }; 766 #endif 767 768 static const struct nft_expr_ops * 769 nft_ct_select_ops(const struct nft_ctx *ctx, 770 const struct nlattr * const tb[]) 771 { 772 if (tb[NFTA_CT_KEY] == NULL) 773 return ERR_PTR(-EINVAL); 774 775 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG]) 776 return ERR_PTR(-EINVAL); 777 778 if (tb[NFTA_CT_DREG]) { 779 #ifdef CONFIG_MITIGATION_RETPOLINE 780 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY])); 781 782 switch (k) { 783 case NFT_CT_STATE: 784 case NFT_CT_DIRECTION: 785 case NFT_CT_STATUS: 786 case NFT_CT_MARK: 787 case NFT_CT_SECMARK: 788 return &nft_ct_get_fast_ops; 789 } 790 #endif 791 return &nft_ct_get_ops; 792 } 793 794 if (tb[NFTA_CT_SREG]) { 795 #ifdef CONFIG_NF_CONNTRACK_ZONES 796 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE)) 797 return &nft_ct_set_zone_ops; 798 #endif 799 return &nft_ct_set_ops; 800 } 801 802 return ERR_PTR(-EINVAL); 803 } 804 805 static struct nft_expr_type nft_ct_type __read_mostly = { 806 .name = "ct", 807 .select_ops = nft_ct_select_ops, 808 .policy = nft_ct_policy, 809 .maxattr = NFTA_CT_MAX, 810 .owner = THIS_MODULE, 811 }; 812 813 static void nft_notrack_eval(const struct nft_expr *expr, 814 struct nft_regs *regs, 815 const struct nft_pktinfo *pkt) 816 { 817 struct sk_buff *skb = pkt->skb; 818 enum ip_conntrack_info ctinfo; 819 struct nf_conn *ct; 820 821 ct = nf_ct_get(pkt->skb, &ctinfo); 822 /* Previously seen (loopback or untracked)? Ignore. */ 823 if (ct || ctinfo == IP_CT_UNTRACKED) 824 return; 825 826 nf_ct_set(skb, ct, IP_CT_UNTRACKED); 827 } 828 829 static struct nft_expr_type nft_notrack_type; 830 static const struct nft_expr_ops nft_notrack_ops = { 831 .type = &nft_notrack_type, 832 .size = NFT_EXPR_SIZE(0), 833 .eval = nft_notrack_eval, 834 }; 835 836 static struct nft_expr_type nft_notrack_type __read_mostly = { 837 .name = "notrack", 838 .ops = &nft_notrack_ops, 839 .owner = THIS_MODULE, 840 }; 841 842 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 843 static int 844 nft_ct_timeout_parse_policy(void *timeouts, 845 const struct nf_conntrack_l4proto *l4proto, 846 struct net *net, const struct nlattr *attr) 847 { 848 struct nlattr **tb; 849 int ret = 0; 850 851 tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1); 852 853 if (!tb) 854 return -ENOMEM; 855 856 ret = nla_parse_nested_deprecated(tb, 857 l4proto->ctnl_timeout.nlattr_max, 858 attr, 859 l4proto->ctnl_timeout.nla_policy, 860 NULL); 861 if (ret < 0) 862 goto err; 863 864 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts); 865 866 err: 867 kfree(tb); 868 return ret; 869 } 870 871 struct nft_ct_timeout_obj { 872 struct nf_ct_timeout *timeout; 873 u8 l4proto; 874 }; 875 876 static void nft_ct_timeout_obj_eval(struct nft_object *obj, 877 struct nft_regs *regs, 878 const struct nft_pktinfo *pkt) 879 { 880 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 881 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb); 882 struct nf_conn_timeout *timeout; 883 const unsigned int *values; 884 885 if (priv->l4proto != pkt->tprot) 886 return; 887 888 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct)) 889 return; 890 891 timeout = nf_ct_timeout_find(ct); 892 if (!timeout) { 893 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC); 894 if (!timeout) { 895 regs->verdict.code = NF_DROP; 896 return; 897 } 898 } 899 900 /* adjust the timeout as per 'new' state. ct is unconfirmed, 901 * so the current timestamp must not be added. 902 */ 903 values = nf_ct_timeout_data(timeout); 904 if (values) 905 nf_ct_refresh(ct, values[0]); 906 } 907 908 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx, 909 const struct nlattr * const tb[], 910 struct nft_object *obj) 911 { 912 struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 913 const struct nf_conntrack_l4proto *l4proto; 914 struct nf_ct_timeout *timeout; 915 int l3num = ctx->family; 916 __u8 l4num; 917 int ret; 918 919 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] || 920 !tb[NFTA_CT_TIMEOUT_DATA]) 921 return -EINVAL; 922 923 if (tb[NFTA_CT_TIMEOUT_L3PROTO]) 924 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO])); 925 926 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]); 927 priv->l4proto = l4num; 928 929 l4proto = nf_ct_l4proto_find(l4num); 930 931 if (l4proto->l4proto != l4num) { 932 ret = -EOPNOTSUPP; 933 goto err_proto_put; 934 } 935 936 timeout = kzalloc(sizeof(struct nf_ct_timeout) + 937 l4proto->ctnl_timeout.obj_size, GFP_KERNEL); 938 if (timeout == NULL) { 939 ret = -ENOMEM; 940 goto err_proto_put; 941 } 942 943 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net, 944 tb[NFTA_CT_TIMEOUT_DATA]); 945 if (ret < 0) 946 goto err_free_timeout; 947 948 timeout->l3num = l3num; 949 timeout->l4proto = l4proto; 950 refcount_set(&timeout->refcnt, 1); 951 952 ret = nf_ct_netns_get(ctx->net, ctx->family); 953 if (ret < 0) 954 goto err_free_timeout; 955 956 priv->timeout = timeout; 957 return 0; 958 959 err_free_timeout: 960 kfree(timeout); 961 err_proto_put: 962 return ret; 963 } 964 965 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, 966 struct nft_object *obj) 967 { 968 struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 969 struct nf_ct_timeout *timeout = priv->timeout; 970 971 nf_ct_untimeout(ctx->net, timeout); 972 nf_ct_netns_put(ctx->net, ctx->family); 973 if (refcount_dec_and_test(&timeout->refcnt)) 974 kfree_rcu(priv->timeout, rcu); 975 } 976 977 static int nft_ct_timeout_obj_dump(struct sk_buff *skb, 978 struct nft_object *obj, bool reset) 979 { 980 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 981 const struct nf_ct_timeout *timeout = priv->timeout; 982 struct nlattr *nest_params; 983 int ret; 984 985 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) || 986 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num))) 987 return -1; 988 989 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA); 990 if (!nest_params) 991 return -1; 992 993 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data); 994 if (ret < 0) 995 return -1; 996 nla_nest_end(skb, nest_params); 997 return 0; 998 } 999 1000 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = { 1001 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 }, 1002 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 }, 1003 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED }, 1004 }; 1005 1006 static struct nft_object_type nft_ct_timeout_obj_type; 1007 1008 static const struct nft_object_ops nft_ct_timeout_obj_ops = { 1009 .type = &nft_ct_timeout_obj_type, 1010 .size = sizeof(struct nft_ct_timeout_obj), 1011 .eval = nft_ct_timeout_obj_eval, 1012 .init = nft_ct_timeout_obj_init, 1013 .destroy = nft_ct_timeout_obj_destroy, 1014 .dump = nft_ct_timeout_obj_dump, 1015 }; 1016 1017 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = { 1018 .type = NFT_OBJECT_CT_TIMEOUT, 1019 .ops = &nft_ct_timeout_obj_ops, 1020 .maxattr = NFTA_CT_TIMEOUT_MAX, 1021 .policy = nft_ct_timeout_policy, 1022 .owner = THIS_MODULE, 1023 }; 1024 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ 1025 1026 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx, 1027 const struct nlattr * const tb[], 1028 struct nft_object *obj) 1029 { 1030 struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1031 struct nf_conntrack_helper *help4, *help6; 1032 char name[NF_CT_HELPER_NAME_LEN]; 1033 int family = ctx->family; 1034 int err; 1035 1036 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO]) 1037 return -EINVAL; 1038 1039 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]); 1040 if (!priv->l4proto) 1041 return -ENOENT; 1042 1043 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name)); 1044 1045 if (tb[NFTA_CT_HELPER_L3PROTO]) 1046 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO])); 1047 1048 help4 = NULL; 1049 help6 = NULL; 1050 1051 switch (family) { 1052 case NFPROTO_IPV4: 1053 if (ctx->family == NFPROTO_IPV6) 1054 return -EINVAL; 1055 1056 help4 = nf_conntrack_helper_try_module_get(name, family, 1057 priv->l4proto); 1058 break; 1059 case NFPROTO_IPV6: 1060 if (ctx->family == NFPROTO_IPV4) 1061 return -EINVAL; 1062 1063 help6 = nf_conntrack_helper_try_module_get(name, family, 1064 priv->l4proto); 1065 break; 1066 case NFPROTO_NETDEV: 1067 case NFPROTO_BRIDGE: 1068 case NFPROTO_INET: 1069 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4, 1070 priv->l4proto); 1071 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6, 1072 priv->l4proto); 1073 break; 1074 default: 1075 return -EAFNOSUPPORT; 1076 } 1077 1078 /* && is intentional; only error if INET found neither ipv4 or ipv6 */ 1079 if (!help4 && !help6) 1080 return -ENOENT; 1081 1082 priv->helper4 = help4; 1083 priv->helper6 = help6; 1084 1085 err = nf_ct_netns_get(ctx->net, ctx->family); 1086 if (err < 0) 1087 goto err_put_helper; 1088 1089 return 0; 1090 1091 err_put_helper: 1092 if (priv->helper4) 1093 nf_conntrack_helper_put(priv->helper4); 1094 if (priv->helper6) 1095 nf_conntrack_helper_put(priv->helper6); 1096 return err; 1097 } 1098 1099 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx, 1100 struct nft_object *obj) 1101 { 1102 struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1103 1104 if (priv->helper4) 1105 nf_conntrack_helper_put(priv->helper4); 1106 if (priv->helper6) 1107 nf_conntrack_helper_put(priv->helper6); 1108 1109 nf_ct_netns_put(ctx->net, ctx->family); 1110 } 1111 1112 static void nft_ct_helper_obj_eval(struct nft_object *obj, 1113 struct nft_regs *regs, 1114 const struct nft_pktinfo *pkt) 1115 { 1116 const struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1117 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb); 1118 struct nf_conntrack_helper *to_assign = NULL; 1119 struct nf_conn_help *help; 1120 1121 if (!ct || 1122 nf_ct_is_confirmed(ct) || 1123 nf_ct_is_template(ct) || 1124 priv->l4proto != nf_ct_protonum(ct)) 1125 return; 1126 1127 switch (nf_ct_l3num(ct)) { 1128 case NFPROTO_IPV4: 1129 to_assign = priv->helper4; 1130 break; 1131 case NFPROTO_IPV6: 1132 to_assign = priv->helper6; 1133 break; 1134 default: 1135 DEBUG_NET_WARN_ON_ONCE(1); 1136 return; 1137 } 1138 1139 if (!to_assign) 1140 return; 1141 1142 if (test_bit(IPS_HELPER_BIT, &ct->status)) 1143 return; 1144 1145 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); 1146 if (help && refcount_inc_not_zero(&to_assign->ct_refcnt)) { 1147 rcu_assign_pointer(help->helper, to_assign); 1148 set_bit(IPS_HELPER_BIT, &ct->status); 1149 1150 if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct)) 1151 if (!nfct_seqadj_ext_add(ct)) 1152 regs->verdict.code = NF_DROP; 1153 } 1154 } 1155 1156 static int nft_ct_helper_obj_dump(struct sk_buff *skb, 1157 struct nft_object *obj, bool reset) 1158 { 1159 const struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1160 const struct nf_conntrack_helper *helper; 1161 u16 family; 1162 1163 if (priv->helper4 && priv->helper6) { 1164 family = NFPROTO_INET; 1165 helper = priv->helper4; 1166 } else if (priv->helper6) { 1167 family = NFPROTO_IPV6; 1168 helper = priv->helper6; 1169 } else { 1170 family = NFPROTO_IPV4; 1171 helper = priv->helper4; 1172 } 1173 1174 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name)) 1175 return -1; 1176 1177 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto)) 1178 return -1; 1179 1180 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family))) 1181 return -1; 1182 1183 return 0; 1184 } 1185 1186 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = { 1187 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING, 1188 .len = NF_CT_HELPER_NAME_LEN - 1 }, 1189 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 }, 1190 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 }, 1191 }; 1192 1193 static struct nft_object_type nft_ct_helper_obj_type; 1194 static const struct nft_object_ops nft_ct_helper_obj_ops = { 1195 .type = &nft_ct_helper_obj_type, 1196 .size = sizeof(struct nft_ct_helper_obj), 1197 .eval = nft_ct_helper_obj_eval, 1198 .init = nft_ct_helper_obj_init, 1199 .destroy = nft_ct_helper_obj_destroy, 1200 .dump = nft_ct_helper_obj_dump, 1201 }; 1202 1203 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = { 1204 .type = NFT_OBJECT_CT_HELPER, 1205 .ops = &nft_ct_helper_obj_ops, 1206 .maxattr = NFTA_CT_HELPER_MAX, 1207 .policy = nft_ct_helper_policy, 1208 .owner = THIS_MODULE, 1209 }; 1210 1211 struct nft_ct_expect_obj { 1212 u16 l3num; 1213 __be16 dport; 1214 u8 l4proto; 1215 u8 size; 1216 u32 timeout; 1217 }; 1218 1219 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx, 1220 const struct nlattr * const tb[], 1221 struct nft_object *obj) 1222 { 1223 struct nft_ct_expect_obj *priv = nft_obj_data(obj); 1224 1225 if (!tb[NFTA_CT_EXPECT_L4PROTO] || 1226 !tb[NFTA_CT_EXPECT_DPORT] || 1227 !tb[NFTA_CT_EXPECT_TIMEOUT] || 1228 !tb[NFTA_CT_EXPECT_SIZE]) 1229 return -EINVAL; 1230 1231 priv->l3num = ctx->family; 1232 if (tb[NFTA_CT_EXPECT_L3PROTO]) 1233 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO])); 1234 1235 switch (priv->l3num) { 1236 case NFPROTO_IPV4: 1237 case NFPROTO_IPV6: 1238 if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET) 1239 break; 1240 1241 return -EINVAL; 1242 case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */ 1243 default: 1244 return -EAFNOSUPPORT; 1245 } 1246 1247 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]); 1248 switch (priv->l4proto) { 1249 case IPPROTO_TCP: 1250 case IPPROTO_UDP: 1251 case IPPROTO_DCCP: 1252 case IPPROTO_SCTP: 1253 break; 1254 default: 1255 return -EOPNOTSUPP; 1256 } 1257 1258 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]); 1259 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]); 1260 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]); 1261 1262 return nf_ct_netns_get(ctx->net, ctx->family); 1263 } 1264 1265 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx, 1266 struct nft_object *obj) 1267 { 1268 nf_ct_netns_put(ctx->net, ctx->family); 1269 } 1270 1271 static int nft_ct_expect_obj_dump(struct sk_buff *skb, 1272 struct nft_object *obj, bool reset) 1273 { 1274 const struct nft_ct_expect_obj *priv = nft_obj_data(obj); 1275 1276 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) || 1277 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) || 1278 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) || 1279 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) || 1280 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size)) 1281 return -1; 1282 1283 return 0; 1284 } 1285 1286 static void nft_ct_expect_obj_eval(struct nft_object *obj, 1287 struct nft_regs *regs, 1288 const struct nft_pktinfo *pkt) 1289 { 1290 const struct nft_ct_expect_obj *priv = nft_obj_data(obj); 1291 struct nf_conntrack_expect *exp; 1292 enum ip_conntrack_info ctinfo; 1293 struct nf_conn_help *help; 1294 enum ip_conntrack_dir dir; 1295 u16 l3num = priv->l3num; 1296 struct nf_conn *ct; 1297 1298 ct = nf_ct_get(pkt->skb, &ctinfo); 1299 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) { 1300 regs->verdict.code = NFT_BREAK; 1301 return; 1302 } 1303 dir = CTINFO2DIR(ctinfo); 1304 1305 help = nfct_help(ct); 1306 if (!help) 1307 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); 1308 if (!help) { 1309 regs->verdict.code = NF_DROP; 1310 return; 1311 } 1312 1313 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) { 1314 regs->verdict.code = NFT_BREAK; 1315 return; 1316 } 1317 if (l3num == NFPROTO_INET) 1318 l3num = nf_ct_l3num(ct); 1319 1320 exp = nf_ct_expect_alloc(ct); 1321 if (exp == NULL) { 1322 regs->verdict.code = NF_DROP; 1323 return; 1324 } 1325 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num, 1326 &ct->tuplehash[!dir].tuple.src.u3, 1327 &ct->tuplehash[!dir].tuple.dst.u3, 1328 priv->l4proto, NULL, &priv->dport); 1329 exp->timeout.expires = jiffies + priv->timeout * HZ; 1330 1331 if (nf_ct_expect_related(exp, 0) != 0) 1332 regs->verdict.code = NF_DROP; 1333 1334 nf_ct_expect_put(exp); 1335 } 1336 1337 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = { 1338 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 }, 1339 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 }, 1340 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 }, 1341 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 }, 1342 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 }, 1343 }; 1344 1345 static struct nft_object_type nft_ct_expect_obj_type; 1346 1347 static const struct nft_object_ops nft_ct_expect_obj_ops = { 1348 .type = &nft_ct_expect_obj_type, 1349 .size = sizeof(struct nft_ct_expect_obj), 1350 .eval = nft_ct_expect_obj_eval, 1351 .init = nft_ct_expect_obj_init, 1352 .destroy = nft_ct_expect_obj_destroy, 1353 .dump = nft_ct_expect_obj_dump, 1354 }; 1355 1356 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = { 1357 .type = NFT_OBJECT_CT_EXPECT, 1358 .ops = &nft_ct_expect_obj_ops, 1359 .maxattr = NFTA_CT_EXPECT_MAX, 1360 .policy = nft_ct_expect_policy, 1361 .owner = THIS_MODULE, 1362 }; 1363 1364 static int __init nft_ct_module_init(void) 1365 { 1366 int err; 1367 1368 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE); 1369 1370 err = nft_register_expr(&nft_ct_type); 1371 if (err < 0) 1372 return err; 1373 1374 err = nft_register_expr(&nft_notrack_type); 1375 if (err < 0) 1376 goto err1; 1377 1378 err = nft_register_obj(&nft_ct_helper_obj_type); 1379 if (err < 0) 1380 goto err2; 1381 1382 err = nft_register_obj(&nft_ct_expect_obj_type); 1383 if (err < 0) 1384 goto err3; 1385 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1386 err = nft_register_obj(&nft_ct_timeout_obj_type); 1387 if (err < 0) 1388 goto err4; 1389 #endif 1390 return 0; 1391 1392 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1393 err4: 1394 nft_unregister_obj(&nft_ct_expect_obj_type); 1395 #endif 1396 err3: 1397 nft_unregister_obj(&nft_ct_helper_obj_type); 1398 err2: 1399 nft_unregister_expr(&nft_notrack_type); 1400 err1: 1401 nft_unregister_expr(&nft_ct_type); 1402 return err; 1403 } 1404 1405 static void __exit nft_ct_module_exit(void) 1406 { 1407 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1408 nft_unregister_obj(&nft_ct_timeout_obj_type); 1409 #endif 1410 nft_unregister_obj(&nft_ct_expect_obj_type); 1411 nft_unregister_obj(&nft_ct_helper_obj_type); 1412 nft_unregister_expr(&nft_notrack_type); 1413 nft_unregister_expr(&nft_ct_type); 1414 } 1415 1416 module_init(nft_ct_module_init); 1417 module_exit(nft_ct_module_exit); 1418 1419 MODULE_LICENSE("GPL"); 1420 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 1421 MODULE_ALIAS_NFT_EXPR("ct"); 1422 MODULE_ALIAS_NFT_EXPR("notrack"); 1423 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER); 1424 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT); 1425 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT); 1426 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module"); 1427