1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org> 5 * 6 * Development of this code funded by Astaro AG (http://www.astaro.com/) 7 */ 8 9 #include <linux/kernel.h> 10 #include <linux/init.h> 11 #include <linux/module.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables_core.h> 16 #include <net/netfilter/nf_conntrack.h> 17 #include <net/netfilter/nf_conntrack_acct.h> 18 #include <net/netfilter/nf_conntrack_tuple.h> 19 #include <net/netfilter/nf_conntrack_helper.h> 20 #include <net/netfilter/nf_conntrack_ecache.h> 21 #include <net/netfilter/nf_conntrack_labels.h> 22 #include <net/netfilter/nf_conntrack_timeout.h> 23 #include <net/netfilter/nf_conntrack_l4proto.h> 24 #include <net/netfilter/nf_conntrack_expect.h> 25 #include <net/netfilter/nf_conntrack_seqadj.h> 26 #include "nf_internals.h" 27 28 struct nft_ct_helper_obj { 29 struct nf_conntrack_helper *helper4; 30 struct nf_conntrack_helper *helper6; 31 u8 l4proto; 32 }; 33 34 #ifdef CONFIG_NF_CONNTRACK_ZONES 35 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template); 36 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly; 37 static DEFINE_MUTEX(nft_ct_pcpu_mutex); 38 #endif 39 40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c, 41 enum nft_ct_keys k, 42 enum ip_conntrack_dir d) 43 { 44 if (d < IP_CT_DIR_MAX) 45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) : 46 atomic64_read(&c[d].packets); 47 48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) + 49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY); 50 } 51 52 static void nft_ct_get_eval(const struct nft_expr *expr, 53 struct nft_regs *regs, 54 const struct nft_pktinfo *pkt) 55 { 56 const struct nft_ct *priv = nft_expr_priv(expr); 57 u32 *dest = ®s->data[priv->dreg]; 58 enum ip_conntrack_info ctinfo; 59 const struct nf_conn *ct; 60 const struct nf_conn_help *help; 61 const struct nf_conntrack_tuple *tuple; 62 const struct nf_conntrack_helper *helper; 63 unsigned int state; 64 65 ct = nf_ct_get(pkt->skb, &ctinfo); 66 67 switch (priv->key) { 68 case NFT_CT_STATE: 69 if (ct) 70 state = NF_CT_STATE_BIT(ctinfo); 71 else if (ctinfo == IP_CT_UNTRACKED) 72 state = NF_CT_STATE_UNTRACKED_BIT; 73 else 74 state = NF_CT_STATE_INVALID_BIT; 75 *dest = state; 76 return; 77 default: 78 break; 79 } 80 81 if (!ct || nf_ct_is_template(ct)) 82 goto err; 83 84 switch (priv->key) { 85 case NFT_CT_DIRECTION: 86 nft_reg_store8(dest, CTINFO2DIR(ctinfo)); 87 return; 88 case NFT_CT_STATUS: 89 *dest = ct->status; 90 return; 91 #ifdef CONFIG_NF_CONNTRACK_MARK 92 case NFT_CT_MARK: 93 *dest = READ_ONCE(ct->mark); 94 return; 95 #endif 96 #ifdef CONFIG_NF_CONNTRACK_SECMARK 97 case NFT_CT_SECMARK: 98 *dest = ct->secmark; 99 return; 100 #endif 101 case NFT_CT_EXPIRATION: 102 *dest = jiffies_to_msecs(nf_ct_expires(ct)); 103 return; 104 case NFT_CT_HELPER: 105 if (ct->master == NULL) 106 goto err; 107 help = nfct_help(ct->master); 108 if (help == NULL) 109 goto err; 110 helper = rcu_dereference(help->helper); 111 if (helper == NULL) 112 goto err; 113 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN); 114 return; 115 #ifdef CONFIG_NF_CONNTRACK_LABELS 116 case NFT_CT_LABELS: { 117 struct nf_conn_labels *labels = nf_ct_labels_find(ct); 118 119 if (labels) 120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE); 121 else 122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE); 123 return; 124 } 125 #endif 126 case NFT_CT_BYTES: 127 case NFT_CT_PKTS: { 128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct); 129 u64 count = 0; 130 131 if (acct) 132 count = nft_ct_get_eval_counter(acct->counter, 133 priv->key, priv->dir); 134 memcpy(dest, &count, sizeof(count)); 135 return; 136 } 137 case NFT_CT_AVGPKT: { 138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct); 139 u64 avgcnt = 0, bcnt = 0, pcnt = 0; 140 141 if (acct) { 142 pcnt = nft_ct_get_eval_counter(acct->counter, 143 NFT_CT_PKTS, priv->dir); 144 bcnt = nft_ct_get_eval_counter(acct->counter, 145 NFT_CT_BYTES, priv->dir); 146 if (pcnt != 0) 147 avgcnt = div64_u64(bcnt, pcnt); 148 } 149 150 memcpy(dest, &avgcnt, sizeof(avgcnt)); 151 return; 152 } 153 case NFT_CT_L3PROTOCOL: 154 nft_reg_store8(dest, nf_ct_l3num(ct)); 155 return; 156 case NFT_CT_PROTOCOL: 157 nft_reg_store8(dest, nf_ct_protonum(ct)); 158 return; 159 #ifdef CONFIG_NF_CONNTRACK_ZONES 160 case NFT_CT_ZONE: { 161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct); 162 u16 zoneid; 163 164 if (priv->dir < IP_CT_DIR_MAX) 165 zoneid = nf_ct_zone_id(zone, priv->dir); 166 else 167 zoneid = zone->id; 168 169 nft_reg_store16(dest, zoneid); 170 return; 171 } 172 #endif 173 case NFT_CT_ID: 174 *dest = nf_ct_get_id(ct); 175 return; 176 default: 177 break; 178 } 179 180 tuple = &ct->tuplehash[priv->dir].tuple; 181 switch (priv->key) { 182 case NFT_CT_SRC: 183 memcpy(dest, tuple->src.u3.all, priv->len); 184 return; 185 case NFT_CT_DST: 186 memcpy(dest, tuple->dst.u3.all, priv->len); 187 return; 188 case NFT_CT_PROTO_SRC: 189 nft_reg_store16(dest, (__force u16)tuple->src.u.all); 190 return; 191 case NFT_CT_PROTO_DST: 192 nft_reg_store16(dest, (__force u16)tuple->dst.u.all); 193 return; 194 case NFT_CT_SRC_IP: 195 if (nf_ct_l3num(ct) != NFPROTO_IPV4) 196 goto err; 197 *dest = (__force __u32)tuple->src.u3.ip; 198 return; 199 case NFT_CT_DST_IP: 200 if (nf_ct_l3num(ct) != NFPROTO_IPV4) 201 goto err; 202 *dest = (__force __u32)tuple->dst.u3.ip; 203 return; 204 case NFT_CT_SRC_IP6: 205 if (nf_ct_l3num(ct) != NFPROTO_IPV6) 206 goto err; 207 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr)); 208 return; 209 case NFT_CT_DST_IP6: 210 if (nf_ct_l3num(ct) != NFPROTO_IPV6) 211 goto err; 212 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr)); 213 return; 214 default: 215 break; 216 } 217 return; 218 err: 219 regs->verdict.code = NFT_BREAK; 220 } 221 222 #ifdef CONFIG_NF_CONNTRACK_ZONES 223 static void nft_ct_set_zone_eval(const struct nft_expr *expr, 224 struct nft_regs *regs, 225 const struct nft_pktinfo *pkt) 226 { 227 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR }; 228 const struct nft_ct *priv = nft_expr_priv(expr); 229 struct sk_buff *skb = pkt->skb; 230 enum ip_conntrack_info ctinfo; 231 u16 value = nft_reg_load16(®s->data[priv->sreg]); 232 struct nf_conn *ct; 233 int oldcnt; 234 235 ct = nf_ct_get(skb, &ctinfo); 236 if (ct) /* already tracked */ 237 return; 238 239 zone.id = value; 240 241 switch (priv->dir) { 242 case IP_CT_DIR_ORIGINAL: 243 zone.dir = NF_CT_ZONE_DIR_ORIG; 244 break; 245 case IP_CT_DIR_REPLY: 246 zone.dir = NF_CT_ZONE_DIR_REPL; 247 break; 248 default: 249 break; 250 } 251 252 ct = this_cpu_read(nft_ct_pcpu_template); 253 254 __refcount_inc(&ct->ct_general.use, &oldcnt); 255 if (likely(oldcnt == 1)) { 256 nf_ct_zone_add(ct, &zone); 257 } else { 258 refcount_dec(&ct->ct_general.use); 259 /* previous skb got queued to userspace, allocate temporary 260 * one until percpu template can be reused. 261 */ 262 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC); 263 if (!ct) { 264 regs->verdict.code = NF_DROP; 265 return; 266 } 267 __set_bit(IPS_CONFIRMED_BIT, &ct->status); 268 } 269 270 nf_ct_set(skb, ct, IP_CT_NEW); 271 } 272 #endif 273 274 static void nft_ct_set_eval(const struct nft_expr *expr, 275 struct nft_regs *regs, 276 const struct nft_pktinfo *pkt) 277 { 278 const struct nft_ct *priv = nft_expr_priv(expr); 279 struct sk_buff *skb = pkt->skb; 280 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK) 281 u32 value = regs->data[priv->sreg]; 282 #endif 283 enum ip_conntrack_info ctinfo; 284 struct nf_conn *ct; 285 286 ct = nf_ct_get(skb, &ctinfo); 287 if (ct == NULL || nf_ct_is_template(ct)) 288 return; 289 290 switch (priv->key) { 291 #ifdef CONFIG_NF_CONNTRACK_MARK 292 case NFT_CT_MARK: 293 if (READ_ONCE(ct->mark) != value) { 294 WRITE_ONCE(ct->mark, value); 295 nf_conntrack_event_cache(IPCT_MARK, ct); 296 } 297 break; 298 #endif 299 #ifdef CONFIG_NF_CONNTRACK_SECMARK 300 case NFT_CT_SECMARK: 301 if (ct->secmark != value) { 302 ct->secmark = value; 303 nf_conntrack_event_cache(IPCT_SECMARK, ct); 304 } 305 break; 306 #endif 307 #ifdef CONFIG_NF_CONNTRACK_LABELS 308 case NFT_CT_LABELS: 309 nf_connlabels_replace(ct, 310 ®s->data[priv->sreg], 311 ®s->data[priv->sreg], 312 NF_CT_LABELS_MAX_SIZE / sizeof(u32)); 313 break; 314 #endif 315 #ifdef CONFIG_NF_CONNTRACK_EVENTS 316 case NFT_CT_EVENTMASK: { 317 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct); 318 u32 ctmask = regs->data[priv->sreg]; 319 320 if (e) { 321 if (e->ctmask != ctmask) 322 e->ctmask = ctmask; 323 break; 324 } 325 326 if (ctmask && !nf_ct_is_confirmed(ct)) 327 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC); 328 break; 329 } 330 #endif 331 default: 332 break; 333 } 334 } 335 336 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = { 337 [NFTA_CT_DREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX), 338 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255), 339 [NFTA_CT_DIRECTION] = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY), 340 [NFTA_CT_SREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX), 341 }; 342 343 #ifdef CONFIG_NF_CONNTRACK_ZONES 344 static void nft_ct_tmpl_put_pcpu(void) 345 { 346 struct nf_conn *ct; 347 int cpu; 348 349 for_each_possible_cpu(cpu) { 350 ct = per_cpu(nft_ct_pcpu_template, cpu); 351 if (!ct) 352 break; 353 nf_ct_put(ct); 354 per_cpu(nft_ct_pcpu_template, cpu) = NULL; 355 } 356 } 357 358 static bool nft_ct_tmpl_alloc_pcpu(void) 359 { 360 struct nf_conntrack_zone zone = { .id = 0 }; 361 struct nf_conn *tmp; 362 int cpu; 363 364 if (nft_ct_pcpu_template_refcnt) 365 return true; 366 367 for_each_possible_cpu(cpu) { 368 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL); 369 if (!tmp) { 370 nft_ct_tmpl_put_pcpu(); 371 return false; 372 } 373 374 __set_bit(IPS_CONFIRMED_BIT, &tmp->status); 375 per_cpu(nft_ct_pcpu_template, cpu) = tmp; 376 } 377 378 return true; 379 } 380 #endif 381 382 static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) 383 { 384 #ifdef CONFIG_NF_CONNTRACK_LABELS 385 if (priv->key == NFT_CT_LABELS) 386 nf_connlabels_put(ctx->net); 387 #endif 388 } 389 390 static int nft_ct_get_init(const struct nft_ctx *ctx, 391 const struct nft_expr *expr, 392 const struct nlattr * const tb[]) 393 { 394 struct nft_ct *priv = nft_expr_priv(expr); 395 unsigned int len; 396 int err; 397 398 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY])); 399 priv->dir = IP_CT_DIR_MAX; 400 switch (priv->key) { 401 case NFT_CT_DIRECTION: 402 if (tb[NFTA_CT_DIRECTION] != NULL) 403 return -EINVAL; 404 len = sizeof(u8); 405 break; 406 case NFT_CT_STATE: 407 case NFT_CT_STATUS: 408 #ifdef CONFIG_NF_CONNTRACK_MARK 409 case NFT_CT_MARK: 410 #endif 411 #ifdef CONFIG_NF_CONNTRACK_SECMARK 412 case NFT_CT_SECMARK: 413 #endif 414 case NFT_CT_EXPIRATION: 415 if (tb[NFTA_CT_DIRECTION] != NULL) 416 return -EINVAL; 417 len = sizeof(u32); 418 break; 419 #ifdef CONFIG_NF_CONNTRACK_LABELS 420 case NFT_CT_LABELS: 421 if (tb[NFTA_CT_DIRECTION] != NULL) 422 return -EINVAL; 423 len = NF_CT_LABELS_MAX_SIZE; 424 425 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1); 426 if (err) 427 return err; 428 break; 429 #endif 430 case NFT_CT_HELPER: 431 if (tb[NFTA_CT_DIRECTION] != NULL) 432 return -EINVAL; 433 len = NF_CT_HELPER_NAME_LEN; 434 break; 435 436 case NFT_CT_L3PROTOCOL: 437 case NFT_CT_PROTOCOL: 438 /* For compatibility, do not report error if NFTA_CT_DIRECTION 439 * attribute is specified. 440 */ 441 len = sizeof(u8); 442 break; 443 case NFT_CT_SRC: 444 case NFT_CT_DST: 445 if (tb[NFTA_CT_DIRECTION] == NULL) 446 return -EINVAL; 447 448 switch (ctx->family) { 449 case NFPROTO_IPV4: 450 len = sizeof_field(struct nf_conntrack_tuple, 451 src.u3.ip); 452 break; 453 case NFPROTO_IPV6: 454 case NFPROTO_INET: 455 len = sizeof_field(struct nf_conntrack_tuple, 456 src.u3.ip6); 457 break; 458 default: 459 return -EAFNOSUPPORT; 460 } 461 break; 462 case NFT_CT_SRC_IP: 463 case NFT_CT_DST_IP: 464 if (tb[NFTA_CT_DIRECTION] == NULL) 465 return -EINVAL; 466 467 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip); 468 break; 469 case NFT_CT_SRC_IP6: 470 case NFT_CT_DST_IP6: 471 if (tb[NFTA_CT_DIRECTION] == NULL) 472 return -EINVAL; 473 474 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6); 475 break; 476 case NFT_CT_PROTO_SRC: 477 case NFT_CT_PROTO_DST: 478 if (tb[NFTA_CT_DIRECTION] == NULL) 479 return -EINVAL; 480 len = sizeof_field(struct nf_conntrack_tuple, src.u.all); 481 break; 482 case NFT_CT_BYTES: 483 case NFT_CT_PKTS: 484 case NFT_CT_AVGPKT: 485 len = sizeof(u64); 486 break; 487 #ifdef CONFIG_NF_CONNTRACK_ZONES 488 case NFT_CT_ZONE: 489 len = sizeof(u16); 490 break; 491 #endif 492 case NFT_CT_ID: 493 if (tb[NFTA_CT_DIRECTION]) 494 return -EINVAL; 495 496 len = sizeof(u32); 497 break; 498 default: 499 return -EOPNOTSUPP; 500 } 501 502 if (tb[NFTA_CT_DIRECTION] != NULL) { 503 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]); 504 switch (priv->dir) { 505 case IP_CT_DIR_ORIGINAL: 506 case IP_CT_DIR_REPLY: 507 break; 508 default: 509 err = -EINVAL; 510 goto err; 511 } 512 } 513 514 priv->len = len; 515 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL, 516 NFT_DATA_VALUE, len); 517 if (err < 0) 518 goto err; 519 520 err = nf_ct_netns_get(ctx->net, ctx->family); 521 if (err < 0) 522 goto err; 523 524 if (priv->key == NFT_CT_BYTES || 525 priv->key == NFT_CT_PKTS || 526 priv->key == NFT_CT_AVGPKT) 527 nf_ct_set_acct(ctx->net, true); 528 529 return 0; 530 err: 531 __nft_ct_get_destroy(ctx, priv); 532 return err; 533 } 534 535 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) 536 { 537 switch (priv->key) { 538 #ifdef CONFIG_NF_CONNTRACK_LABELS 539 case NFT_CT_LABELS: 540 nf_connlabels_put(ctx->net); 541 break; 542 #endif 543 #ifdef CONFIG_NF_CONNTRACK_ZONES 544 case NFT_CT_ZONE: 545 nf_queue_nf_hook_drop(ctx->net, NULL); 546 mutex_lock(&nft_ct_pcpu_mutex); 547 if (--nft_ct_pcpu_template_refcnt == 0) 548 nft_ct_tmpl_put_pcpu(); 549 mutex_unlock(&nft_ct_pcpu_mutex); 550 break; 551 #endif 552 default: 553 break; 554 } 555 } 556 557 static int nft_ct_set_init(const struct nft_ctx *ctx, 558 const struct nft_expr *expr, 559 const struct nlattr * const tb[]) 560 { 561 struct nft_ct *priv = nft_expr_priv(expr); 562 unsigned int len; 563 int err; 564 565 priv->dir = IP_CT_DIR_MAX; 566 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY])); 567 switch (priv->key) { 568 #ifdef CONFIG_NF_CONNTRACK_MARK 569 case NFT_CT_MARK: 570 if (tb[NFTA_CT_DIRECTION]) 571 return -EINVAL; 572 len = sizeof_field(struct nf_conn, mark); 573 break; 574 #endif 575 #ifdef CONFIG_NF_CONNTRACK_LABELS 576 case NFT_CT_LABELS: 577 if (tb[NFTA_CT_DIRECTION]) 578 return -EINVAL; 579 len = NF_CT_LABELS_MAX_SIZE; 580 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1); 581 if (err) 582 return err; 583 break; 584 #endif 585 #ifdef CONFIG_NF_CONNTRACK_ZONES 586 case NFT_CT_ZONE: 587 mutex_lock(&nft_ct_pcpu_mutex); 588 if (!nft_ct_tmpl_alloc_pcpu()) { 589 mutex_unlock(&nft_ct_pcpu_mutex); 590 return -ENOMEM; 591 } 592 nft_ct_pcpu_template_refcnt++; 593 mutex_unlock(&nft_ct_pcpu_mutex); 594 len = sizeof(u16); 595 break; 596 #endif 597 #ifdef CONFIG_NF_CONNTRACK_EVENTS 598 case NFT_CT_EVENTMASK: 599 if (tb[NFTA_CT_DIRECTION]) 600 return -EINVAL; 601 len = sizeof(u32); 602 break; 603 #endif 604 #ifdef CONFIG_NF_CONNTRACK_SECMARK 605 case NFT_CT_SECMARK: 606 if (tb[NFTA_CT_DIRECTION]) 607 return -EINVAL; 608 len = sizeof(u32); 609 break; 610 #endif 611 default: 612 return -EOPNOTSUPP; 613 } 614 615 if (tb[NFTA_CT_DIRECTION]) { 616 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]); 617 switch (priv->dir) { 618 case IP_CT_DIR_ORIGINAL: 619 case IP_CT_DIR_REPLY: 620 break; 621 default: 622 err = -EINVAL; 623 goto err1; 624 } 625 } 626 627 priv->len = len; 628 err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len); 629 if (err < 0) 630 goto err1; 631 632 err = nf_ct_netns_get(ctx->net, ctx->family); 633 if (err < 0) 634 goto err1; 635 636 return 0; 637 638 err1: 639 __nft_ct_set_destroy(ctx, priv); 640 return err; 641 } 642 643 static void nft_ct_get_destroy(const struct nft_ctx *ctx, 644 const struct nft_expr *expr) 645 { 646 struct nft_ct *priv = nft_expr_priv(expr); 647 648 __nft_ct_get_destroy(ctx, priv); 649 nf_ct_netns_put(ctx->net, ctx->family); 650 } 651 652 static void nft_ct_set_destroy(const struct nft_ctx *ctx, 653 const struct nft_expr *expr) 654 { 655 struct nft_ct *priv = nft_expr_priv(expr); 656 657 __nft_ct_set_destroy(ctx, priv); 658 nf_ct_netns_put(ctx->net, ctx->family); 659 } 660 661 static int nft_ct_get_dump(struct sk_buff *skb, 662 const struct nft_expr *expr, bool reset) 663 { 664 const struct nft_ct *priv = nft_expr_priv(expr); 665 666 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg)) 667 goto nla_put_failure; 668 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key))) 669 goto nla_put_failure; 670 671 switch (priv->key) { 672 case NFT_CT_SRC: 673 case NFT_CT_DST: 674 case NFT_CT_SRC_IP: 675 case NFT_CT_DST_IP: 676 case NFT_CT_SRC_IP6: 677 case NFT_CT_DST_IP6: 678 case NFT_CT_PROTO_SRC: 679 case NFT_CT_PROTO_DST: 680 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir)) 681 goto nla_put_failure; 682 break; 683 case NFT_CT_BYTES: 684 case NFT_CT_PKTS: 685 case NFT_CT_AVGPKT: 686 case NFT_CT_ZONE: 687 if (priv->dir < IP_CT_DIR_MAX && 688 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir)) 689 goto nla_put_failure; 690 break; 691 default: 692 break; 693 } 694 695 return 0; 696 697 nla_put_failure: 698 return -1; 699 } 700 701 static int nft_ct_set_dump(struct sk_buff *skb, 702 const struct nft_expr *expr, bool reset) 703 { 704 const struct nft_ct *priv = nft_expr_priv(expr); 705 706 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg)) 707 goto nla_put_failure; 708 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key))) 709 goto nla_put_failure; 710 711 switch (priv->key) { 712 case NFT_CT_ZONE: 713 if (priv->dir < IP_CT_DIR_MAX && 714 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir)) 715 goto nla_put_failure; 716 break; 717 default: 718 break; 719 } 720 721 return 0; 722 723 nla_put_failure: 724 return -1; 725 } 726 727 static struct nft_expr_type nft_ct_type; 728 static const struct nft_expr_ops nft_ct_get_ops = { 729 .type = &nft_ct_type, 730 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 731 .eval = nft_ct_get_eval, 732 .init = nft_ct_get_init, 733 .destroy = nft_ct_get_destroy, 734 .dump = nft_ct_get_dump, 735 }; 736 737 #ifdef CONFIG_MITIGATION_RETPOLINE 738 static const struct nft_expr_ops nft_ct_get_fast_ops = { 739 .type = &nft_ct_type, 740 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 741 .eval = nft_ct_get_fast_eval, 742 .init = nft_ct_get_init, 743 .destroy = nft_ct_get_destroy, 744 .dump = nft_ct_get_dump, 745 }; 746 #endif 747 748 static const struct nft_expr_ops nft_ct_set_ops = { 749 .type = &nft_ct_type, 750 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 751 .eval = nft_ct_set_eval, 752 .init = nft_ct_set_init, 753 .destroy = nft_ct_set_destroy, 754 .dump = nft_ct_set_dump, 755 }; 756 757 #ifdef CONFIG_NF_CONNTRACK_ZONES 758 static const struct nft_expr_ops nft_ct_set_zone_ops = { 759 .type = &nft_ct_type, 760 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)), 761 .eval = nft_ct_set_zone_eval, 762 .init = nft_ct_set_init, 763 .destroy = nft_ct_set_destroy, 764 .dump = nft_ct_set_dump, 765 }; 766 #endif 767 768 static const struct nft_expr_ops * 769 nft_ct_select_ops(const struct nft_ctx *ctx, 770 const struct nlattr * const tb[]) 771 { 772 if (tb[NFTA_CT_KEY] == NULL) 773 return ERR_PTR(-EINVAL); 774 775 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG]) 776 return ERR_PTR(-EINVAL); 777 778 if (tb[NFTA_CT_DREG]) { 779 #ifdef CONFIG_MITIGATION_RETPOLINE 780 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY])); 781 782 switch (k) { 783 case NFT_CT_STATE: 784 case NFT_CT_DIRECTION: 785 case NFT_CT_STATUS: 786 case NFT_CT_MARK: 787 case NFT_CT_SECMARK: 788 return &nft_ct_get_fast_ops; 789 } 790 #endif 791 return &nft_ct_get_ops; 792 } 793 794 if (tb[NFTA_CT_SREG]) { 795 #ifdef CONFIG_NF_CONNTRACK_ZONES 796 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE)) 797 return &nft_ct_set_zone_ops; 798 #endif 799 return &nft_ct_set_ops; 800 } 801 802 return ERR_PTR(-EINVAL); 803 } 804 805 static struct nft_expr_type nft_ct_type __read_mostly = { 806 .name = "ct", 807 .select_ops = nft_ct_select_ops, 808 .policy = nft_ct_policy, 809 .maxattr = NFTA_CT_MAX, 810 .owner = THIS_MODULE, 811 }; 812 813 static void nft_notrack_eval(const struct nft_expr *expr, 814 struct nft_regs *regs, 815 const struct nft_pktinfo *pkt) 816 { 817 struct sk_buff *skb = pkt->skb; 818 enum ip_conntrack_info ctinfo; 819 struct nf_conn *ct; 820 821 ct = nf_ct_get(pkt->skb, &ctinfo); 822 /* Previously seen (loopback or untracked)? Ignore. */ 823 if (ct || ctinfo == IP_CT_UNTRACKED) 824 return; 825 826 nf_ct_set(skb, ct, IP_CT_UNTRACKED); 827 } 828 829 static struct nft_expr_type nft_notrack_type; 830 static const struct nft_expr_ops nft_notrack_ops = { 831 .type = &nft_notrack_type, 832 .size = NFT_EXPR_SIZE(0), 833 .eval = nft_notrack_eval, 834 }; 835 836 static struct nft_expr_type nft_notrack_type __read_mostly = { 837 .name = "notrack", 838 .ops = &nft_notrack_ops, 839 .owner = THIS_MODULE, 840 }; 841 842 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 843 static int 844 nft_ct_timeout_parse_policy(void *timeouts, 845 const struct nf_conntrack_l4proto *l4proto, 846 struct net *net, const struct nlattr *attr) 847 { 848 struct nlattr **tb; 849 int ret = 0; 850 851 tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1, 852 GFP_KERNEL_ACCOUNT); 853 854 if (!tb) 855 return -ENOMEM; 856 857 ret = nla_parse_nested_deprecated(tb, 858 l4proto->ctnl_timeout.nlattr_max, 859 attr, 860 l4proto->ctnl_timeout.nla_policy, 861 NULL); 862 if (ret < 0) 863 goto err; 864 865 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts); 866 867 err: 868 kfree(tb); 869 return ret; 870 } 871 872 struct nft_ct_timeout_obj { 873 struct nf_ct_timeout *timeout; 874 u8 l4proto; 875 }; 876 877 static void nft_ct_timeout_obj_eval(struct nft_object *obj, 878 struct nft_regs *regs, 879 const struct nft_pktinfo *pkt) 880 { 881 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 882 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb); 883 struct nf_conn_timeout *timeout; 884 const unsigned int *values; 885 886 if (priv->l4proto != pkt->tprot) 887 return; 888 889 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct)) 890 return; 891 892 timeout = nf_ct_timeout_find(ct); 893 if (!timeout) { 894 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC); 895 if (!timeout) { 896 regs->verdict.code = NF_DROP; 897 return; 898 } 899 } 900 901 /* adjust the timeout as per 'new' state. ct is unconfirmed, 902 * so the current timestamp must not be added. 903 */ 904 values = nf_ct_timeout_data(timeout); 905 if (values) 906 nf_ct_refresh(ct, values[0]); 907 } 908 909 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx, 910 const struct nlattr * const tb[], 911 struct nft_object *obj) 912 { 913 struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 914 const struct nf_conntrack_l4proto *l4proto; 915 struct nf_ct_timeout *timeout; 916 int l3num = ctx->family; 917 __u8 l4num; 918 int ret; 919 920 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] || 921 !tb[NFTA_CT_TIMEOUT_DATA]) 922 return -EINVAL; 923 924 if (tb[NFTA_CT_TIMEOUT_L3PROTO]) 925 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO])); 926 927 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]); 928 priv->l4proto = l4num; 929 930 l4proto = nf_ct_l4proto_find(l4num); 931 932 if (l4proto->l4proto != l4num) { 933 ret = -EOPNOTSUPP; 934 goto err_proto_put; 935 } 936 937 timeout = kzalloc(sizeof(struct nf_ct_timeout) + 938 l4proto->ctnl_timeout.obj_size, GFP_KERNEL_ACCOUNT); 939 if (timeout == NULL) { 940 ret = -ENOMEM; 941 goto err_proto_put; 942 } 943 944 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net, 945 tb[NFTA_CT_TIMEOUT_DATA]); 946 if (ret < 0) 947 goto err_free_timeout; 948 949 timeout->l3num = l3num; 950 timeout->l4proto = l4proto; 951 refcount_set(&timeout->refcnt, 1); 952 953 ret = nf_ct_netns_get(ctx->net, ctx->family); 954 if (ret < 0) 955 goto err_free_timeout; 956 957 priv->timeout = timeout; 958 return 0; 959 960 err_free_timeout: 961 kfree(timeout); 962 err_proto_put: 963 return ret; 964 } 965 966 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, 967 struct nft_object *obj) 968 { 969 struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 970 struct nf_ct_timeout *timeout = priv->timeout; 971 972 nf_ct_untimeout(ctx->net, timeout); 973 nf_ct_netns_put(ctx->net, ctx->family); 974 if (refcount_dec_and_test(&timeout->refcnt)) 975 kfree_rcu(priv->timeout, rcu); 976 } 977 978 static int nft_ct_timeout_obj_dump(struct sk_buff *skb, 979 struct nft_object *obj, bool reset) 980 { 981 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj); 982 const struct nf_ct_timeout *timeout = priv->timeout; 983 struct nlattr *nest_params; 984 int ret; 985 986 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) || 987 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num))) 988 return -1; 989 990 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA); 991 if (!nest_params) 992 return -1; 993 994 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data); 995 if (ret < 0) 996 return -1; 997 nla_nest_end(skb, nest_params); 998 return 0; 999 } 1000 1001 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = { 1002 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 }, 1003 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 }, 1004 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED }, 1005 }; 1006 1007 static struct nft_object_type nft_ct_timeout_obj_type; 1008 1009 static const struct nft_object_ops nft_ct_timeout_obj_ops = { 1010 .type = &nft_ct_timeout_obj_type, 1011 .size = sizeof(struct nft_ct_timeout_obj), 1012 .eval = nft_ct_timeout_obj_eval, 1013 .init = nft_ct_timeout_obj_init, 1014 .destroy = nft_ct_timeout_obj_destroy, 1015 .dump = nft_ct_timeout_obj_dump, 1016 }; 1017 1018 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = { 1019 .type = NFT_OBJECT_CT_TIMEOUT, 1020 .ops = &nft_ct_timeout_obj_ops, 1021 .maxattr = NFTA_CT_TIMEOUT_MAX, 1022 .policy = nft_ct_timeout_policy, 1023 .owner = THIS_MODULE, 1024 }; 1025 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ 1026 1027 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx, 1028 const struct nlattr * const tb[], 1029 struct nft_object *obj) 1030 { 1031 struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1032 struct nf_conntrack_helper *help4, *help6; 1033 char name[NF_CT_HELPER_NAME_LEN]; 1034 int family = ctx->family; 1035 int err; 1036 1037 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO]) 1038 return -EINVAL; 1039 1040 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]); 1041 if (!priv->l4proto) 1042 return -ENOENT; 1043 1044 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name)); 1045 1046 if (tb[NFTA_CT_HELPER_L3PROTO]) 1047 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO])); 1048 1049 help4 = NULL; 1050 help6 = NULL; 1051 1052 switch (family) { 1053 case NFPROTO_IPV4: 1054 if (ctx->family == NFPROTO_IPV6) 1055 return -EINVAL; 1056 1057 help4 = nf_conntrack_helper_try_module_get(name, family, 1058 priv->l4proto); 1059 break; 1060 case NFPROTO_IPV6: 1061 if (ctx->family == NFPROTO_IPV4) 1062 return -EINVAL; 1063 1064 help6 = nf_conntrack_helper_try_module_get(name, family, 1065 priv->l4proto); 1066 break; 1067 case NFPROTO_NETDEV: 1068 case NFPROTO_BRIDGE: 1069 case NFPROTO_INET: 1070 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4, 1071 priv->l4proto); 1072 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6, 1073 priv->l4proto); 1074 break; 1075 default: 1076 return -EAFNOSUPPORT; 1077 } 1078 1079 /* && is intentional; only error if INET found neither ipv4 or ipv6 */ 1080 if (!help4 && !help6) 1081 return -ENOENT; 1082 1083 priv->helper4 = help4; 1084 priv->helper6 = help6; 1085 1086 err = nf_ct_netns_get(ctx->net, ctx->family); 1087 if (err < 0) 1088 goto err_put_helper; 1089 1090 return 0; 1091 1092 err_put_helper: 1093 if (priv->helper4) 1094 nf_conntrack_helper_put(priv->helper4); 1095 if (priv->helper6) 1096 nf_conntrack_helper_put(priv->helper6); 1097 return err; 1098 } 1099 1100 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx, 1101 struct nft_object *obj) 1102 { 1103 struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1104 1105 if (priv->helper4) 1106 nf_conntrack_helper_put(priv->helper4); 1107 if (priv->helper6) 1108 nf_conntrack_helper_put(priv->helper6); 1109 1110 nf_ct_netns_put(ctx->net, ctx->family); 1111 } 1112 1113 static void nft_ct_helper_obj_eval(struct nft_object *obj, 1114 struct nft_regs *regs, 1115 const struct nft_pktinfo *pkt) 1116 { 1117 const struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1118 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb); 1119 struct nf_conntrack_helper *to_assign = NULL; 1120 struct nf_conn_help *help; 1121 1122 if (!ct || 1123 nf_ct_is_confirmed(ct) || 1124 nf_ct_is_template(ct) || 1125 priv->l4proto != nf_ct_protonum(ct)) 1126 return; 1127 1128 switch (nf_ct_l3num(ct)) { 1129 case NFPROTO_IPV4: 1130 to_assign = priv->helper4; 1131 break; 1132 case NFPROTO_IPV6: 1133 to_assign = priv->helper6; 1134 break; 1135 default: 1136 DEBUG_NET_WARN_ON_ONCE(1); 1137 return; 1138 } 1139 1140 if (!to_assign) 1141 return; 1142 1143 if (test_bit(IPS_HELPER_BIT, &ct->status)) 1144 return; 1145 1146 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); 1147 if (help && refcount_inc_not_zero(&to_assign->ct_refcnt)) { 1148 rcu_assign_pointer(help->helper, to_assign); 1149 1150 if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct)) 1151 if (!nfct_seqadj_ext_add(ct)) 1152 regs->verdict.code = NF_DROP; 1153 } 1154 } 1155 1156 static int nft_ct_helper_obj_dump(struct sk_buff *skb, 1157 struct nft_object *obj, bool reset) 1158 { 1159 const struct nft_ct_helper_obj *priv = nft_obj_data(obj); 1160 const struct nf_conntrack_helper *helper; 1161 u16 family; 1162 1163 if (priv->helper4 && priv->helper6) { 1164 family = NFPROTO_INET; 1165 helper = priv->helper4; 1166 } else if (priv->helper6) { 1167 family = NFPROTO_IPV6; 1168 helper = priv->helper6; 1169 } else { 1170 family = NFPROTO_IPV4; 1171 helper = priv->helper4; 1172 } 1173 1174 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name)) 1175 return -1; 1176 1177 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto)) 1178 return -1; 1179 1180 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family))) 1181 return -1; 1182 1183 return 0; 1184 } 1185 1186 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = { 1187 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING, 1188 .len = NF_CT_HELPER_NAME_LEN - 1 }, 1189 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 }, 1190 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 }, 1191 }; 1192 1193 static struct nft_object_type nft_ct_helper_obj_type; 1194 static const struct nft_object_ops nft_ct_helper_obj_ops = { 1195 .type = &nft_ct_helper_obj_type, 1196 .size = sizeof(struct nft_ct_helper_obj), 1197 .eval = nft_ct_helper_obj_eval, 1198 .init = nft_ct_helper_obj_init, 1199 .destroy = nft_ct_helper_obj_destroy, 1200 .dump = nft_ct_helper_obj_dump, 1201 }; 1202 1203 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = { 1204 .type = NFT_OBJECT_CT_HELPER, 1205 .ops = &nft_ct_helper_obj_ops, 1206 .maxattr = NFTA_CT_HELPER_MAX, 1207 .policy = nft_ct_helper_policy, 1208 .owner = THIS_MODULE, 1209 }; 1210 1211 struct nft_ct_expect_obj { 1212 u16 l3num; 1213 __be16 dport; 1214 u8 l4proto; 1215 u8 size; 1216 u32 timeout; 1217 1218 struct nf_conntrack_helper *helper; 1219 }; 1220 1221 static int nft_ct_expect_timeout_get(const struct nlattr *attr, u32 *val) 1222 { 1223 unsigned long jiffies_val = msecs_to_jiffies(nla_get_u32(attr)); 1224 1225 if (jiffies_val > UINT_MAX) 1226 return -ERANGE; 1227 1228 *val = jiffies_val; 1229 return 0; 1230 } 1231 1232 #if IS_ENABLED(CONFIG_NF_NAT) 1233 static void nft_ct_nat_follow_master(struct nf_conn *ct, struct nf_conntrack_expect *this) 1234 { 1235 const struct nf_ct_helper_expectfn *expfn; 1236 1237 expfn = nf_ct_helper_expectfn_find_by_name("nat-follow-master"); 1238 if (expfn) 1239 expfn->expectfn(ct, this); 1240 } 1241 #endif 1242 1243 struct nft_ct_expect_data { 1244 struct nft_ct_expect_obj obj; 1245 enum ip_conntrack_dir dir; 1246 }; 1247 1248 static int ct_expect_help(struct sk_buff *skb, unsigned int protoff, 1249 struct nf_conn *ct, enum ip_conntrack_info ctinfo) 1250 { 1251 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo); 1252 struct nft_ct_expect_data *expect_data; 1253 struct nf_conntrack_expect *exp; 1254 int ret = NF_ACCEPT; 1255 u16 l3num; 1256 1257 if (nf_ct_is_confirmed(ct)) 1258 return NF_ACCEPT; 1259 1260 expect_data = nfct_help_data(ct); 1261 if (!expect_data) 1262 return NF_ACCEPT; 1263 1264 if (expect_data->dir != dir) 1265 return NF_ACCEPT; 1266 1267 exp = nf_ct_expect_alloc(ct); 1268 if (!exp) 1269 return NF_DROP; 1270 1271 if (expect_data->obj.l3num == NFPROTO_INET) 1272 l3num = nf_ct_l3num(ct); 1273 else 1274 l3num = expect_data->obj.l3num; 1275 1276 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num, 1277 &ct->tuplehash[!dir].tuple.src.u3, 1278 &ct->tuplehash[!dir].tuple.dst.u3, 1279 expect_data->obj.l4proto, NULL, &expect_data->obj.dport); 1280 exp->timeout += expect_data->obj.timeout; 1281 1282 #if IS_ENABLED(CONFIG_NF_NAT) 1283 if (ct->status & IPS_NAT_MASK) { 1284 exp->saved_proto.tcp.port = expect_data->obj.dport; 1285 exp->dir = !dir; 1286 exp->expectfn = nft_ct_nat_follow_master; 1287 } 1288 #endif 1289 if (nf_ct_expect_related(exp, 0) != 0) 1290 ret = NF_ACCEPT; 1291 1292 nf_ct_expect_put(exp); 1293 1294 return ret; 1295 } 1296 1297 static int nft_ct_expect_helper_alloc(struct nft_ct_expect_obj *priv) 1298 { 1299 struct nf_conntrack_helper *ct_expect_helper; 1300 1301 ct_expect_helper = kzalloc_obj(struct nf_conntrack_helper, 1302 GFP_KERNEL_ACCOUNT); 1303 if (!ct_expect_helper) 1304 return -ENOMEM; 1305 1306 snprintf(ct_expect_helper->name, sizeof(ct_expect_helper->name), "%s", 1307 "nft_ct_expect"); 1308 ct_expect_helper->me = THIS_MODULE; 1309 ct_expect_helper->expect_policy[NF_CT_EXPECT_CLASS_DEFAULT].max_expected = priv->size; 1310 rcu_assign_pointer(ct_expect_helper->help, ct_expect_help); 1311 refcount_set(&ct_expect_helper->ct_refcnt, 1); 1312 1313 /* No need to register this helper, this is internal. */ 1314 priv->helper = ct_expect_helper; 1315 1316 return 0; 1317 } 1318 1319 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx, 1320 const struct nlattr * const tb[], 1321 struct nft_object *obj) 1322 { 1323 struct nft_ct_expect_obj *priv = nft_obj_data(obj); 1324 int err; 1325 1326 NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nft_ct_expect_data)); 1327 1328 if (!tb[NFTA_CT_EXPECT_L4PROTO] || 1329 !tb[NFTA_CT_EXPECT_DPORT] || 1330 !tb[NFTA_CT_EXPECT_TIMEOUT] || 1331 !tb[NFTA_CT_EXPECT_SIZE]) 1332 return -EINVAL; 1333 1334 priv->l3num = ctx->family; 1335 if (tb[NFTA_CT_EXPECT_L3PROTO]) 1336 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO])); 1337 1338 switch (priv->l3num) { 1339 case NFPROTO_IPV4: 1340 case NFPROTO_IPV6: 1341 if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET) 1342 break; 1343 1344 return -EINVAL; 1345 case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */ 1346 default: 1347 return -EAFNOSUPPORT; 1348 } 1349 1350 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]); 1351 switch (priv->l4proto) { 1352 case IPPROTO_TCP: 1353 case IPPROTO_UDP: 1354 case IPPROTO_DCCP: 1355 case IPPROTO_SCTP: 1356 break; 1357 default: 1358 return -EOPNOTSUPP; 1359 } 1360 1361 err = nft_ct_expect_timeout_get(tb[NFTA_CT_EXPECT_TIMEOUT], &priv->timeout); 1362 if (err) 1363 return err; 1364 1365 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]); 1366 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]); 1367 if (!priv->size) 1368 priv->size = NF_CT_EXPECT_MAX_CNT; 1369 1370 err = nf_ct_netns_get(ctx->net, ctx->family); 1371 if (err < 0) 1372 return err; 1373 1374 err = nft_ct_expect_helper_alloc(priv); 1375 if (err < 0) { 1376 nf_ct_netns_put(ctx->net, ctx->family); 1377 return err; 1378 } 1379 1380 return err; 1381 } 1382 1383 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx, 1384 struct nft_object *obj) 1385 { 1386 const struct nft_ct_expect_obj *priv = nft_obj_data(obj); 1387 struct nf_conntrack_helper *me = priv->helper; 1388 1389 /* This helper is going away, disable it. */ 1390 rcu_assign_pointer(me->help, NULL); 1391 nf_conntrack_helper_release(me); 1392 nf_ct_netns_put(ctx->net, ctx->family); 1393 } 1394 1395 static int nft_ct_expect_obj_dump(struct sk_buff *skb, 1396 struct nft_object *obj, bool reset) 1397 { 1398 const struct nft_ct_expect_obj *priv = nft_obj_data(obj); 1399 1400 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) || 1401 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) || 1402 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) || 1403 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, jiffies_to_msecs(priv->timeout)) || 1404 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size)) 1405 return -1; 1406 1407 return 0; 1408 } 1409 1410 static void nft_ct_expect_obj_eval(struct nft_object *obj, 1411 struct nft_regs *regs, 1412 const struct nft_pktinfo *pkt) 1413 { 1414 const struct nft_ct_expect_obj *priv = nft_obj_data(obj); 1415 struct nft_ct_expect_data *expect_data; 1416 enum ip_conntrack_info ctinfo; 1417 struct nf_conn_help *help; 1418 struct nf_conn *ct; 1419 1420 ct = nf_ct_get(pkt->skb, &ctinfo); 1421 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) { 1422 regs->verdict.code = NFT_BREAK; 1423 return; 1424 } 1425 1426 help = nfct_help(ct); 1427 if (help) { 1428 regs->verdict.code = NFT_BREAK; 1429 return; 1430 } 1431 1432 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); 1433 if (!help) { 1434 regs->verdict.code = NF_DROP; 1435 return; 1436 } 1437 1438 expect_data = nfct_help_data(ct); 1439 if (!expect_data) { 1440 regs->verdict.code = NFT_BREAK; 1441 return; 1442 } 1443 expect_data->obj = *priv; 1444 expect_data->obj.helper = NULL; 1445 expect_data->dir = CTINFO2DIR(ctinfo); 1446 1447 if (help && refcount_inc_not_zero(&priv->helper->ct_refcnt)) 1448 rcu_assign_pointer(help->helper, priv->helper); 1449 } 1450 1451 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = { 1452 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 }, 1453 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 }, 1454 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 }, 1455 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 }, 1456 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 }, 1457 }; 1458 1459 static struct nft_object_type nft_ct_expect_obj_type; 1460 1461 static const struct nft_object_ops nft_ct_expect_obj_ops = { 1462 .type = &nft_ct_expect_obj_type, 1463 .size = sizeof(struct nft_ct_expect_obj), 1464 .eval = nft_ct_expect_obj_eval, 1465 .init = nft_ct_expect_obj_init, 1466 .destroy = nft_ct_expect_obj_destroy, 1467 .dump = nft_ct_expect_obj_dump, 1468 }; 1469 1470 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = { 1471 .type = NFT_OBJECT_CT_EXPECT, 1472 .ops = &nft_ct_expect_obj_ops, 1473 .maxattr = NFTA_CT_EXPECT_MAX, 1474 .policy = nft_ct_expect_policy, 1475 .owner = THIS_MODULE, 1476 }; 1477 1478 #if IS_ENABLED(CONFIG_NF_NAT) 1479 static struct nf_ct_helper_expectfn nft_ct_nat __read_mostly = { 1480 .name = "nft_ct-follow-master", 1481 .expectfn = nft_ct_nat_follow_master, 1482 }; 1483 #endif 1484 1485 static int __init nft_ct_module_init(void) 1486 { 1487 int err; 1488 1489 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE); 1490 1491 err = nft_register_expr(&nft_ct_type); 1492 if (err < 0) 1493 return err; 1494 1495 err = nft_register_expr(&nft_notrack_type); 1496 if (err < 0) 1497 goto err1; 1498 1499 err = nft_register_obj(&nft_ct_helper_obj_type); 1500 if (err < 0) 1501 goto err2; 1502 1503 err = nft_register_obj(&nft_ct_expect_obj_type); 1504 if (err < 0) 1505 goto err3; 1506 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1507 err = nft_register_obj(&nft_ct_timeout_obj_type); 1508 if (err < 0) 1509 goto err4; 1510 #endif 1511 #if IS_ENABLED(CONFIG_NF_NAT) 1512 nf_ct_helper_expectfn_register(&nft_ct_nat); 1513 #endif 1514 return 0; 1515 1516 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1517 err4: 1518 nft_unregister_obj(&nft_ct_expect_obj_type); 1519 #endif 1520 err3: 1521 nft_unregister_obj(&nft_ct_helper_obj_type); 1522 err2: 1523 nft_unregister_expr(&nft_notrack_type); 1524 err1: 1525 nft_unregister_expr(&nft_ct_type); 1526 return err; 1527 } 1528 1529 static void __exit nft_ct_module_exit(void) 1530 { 1531 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT 1532 nft_unregister_obj(&nft_ct_timeout_obj_type); 1533 #endif 1534 nft_unregister_obj(&nft_ct_expect_obj_type); 1535 nft_unregister_obj(&nft_ct_helper_obj_type); 1536 nft_unregister_expr(&nft_notrack_type); 1537 nft_unregister_expr(&nft_ct_type); 1538 1539 #if IS_ENABLED(CONFIG_NF_NAT) 1540 nf_ct_helper_expectfn_unregister(&nft_ct_nat); 1541 synchronize_rcu(); 1542 nf_ct_helper_expectfn_destroy(&nft_ct_nat); 1543 synchronize_rcu(); 1544 #endif 1545 } 1546 1547 module_init(nft_ct_module_init); 1548 module_exit(nft_ct_module_exit); 1549 1550 MODULE_LICENSE("GPL"); 1551 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 1552 MODULE_ALIAS_NFT_EXPR("ct"); 1553 MODULE_ALIAS_NFT_EXPR("notrack"); 1554 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER); 1555 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT); 1556 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT); 1557 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module"); 1558