1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 *
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 #include <net/netfilter/nf_conntrack_seqadj.h>
26 #include "nf_internals.h"
27
28 struct nft_ct_helper_obj {
29 struct nf_conntrack_helper *helper4;
30 struct nf_conntrack_helper *helper6;
31 u8 l4proto;
32 };
33
34 #ifdef CONFIG_NF_CONNTRACK_ZONES
35 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
36 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
37 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
38 #endif
39
nft_ct_get_eval_counter(const struct nf_conn_counter * c,enum nft_ct_keys k,enum ip_conntrack_dir d)40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
41 enum nft_ct_keys k,
42 enum ip_conntrack_dir d)
43 {
44 if (d < IP_CT_DIR_MAX)
45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
46 atomic64_read(&c[d].packets);
47
48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50 }
51
nft_ct_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)52 static void nft_ct_get_eval(const struct nft_expr *expr,
53 struct nft_regs *regs,
54 const struct nft_pktinfo *pkt)
55 {
56 const struct nft_ct *priv = nft_expr_priv(expr);
57 u32 *dest = ®s->data[priv->dreg];
58 enum ip_conntrack_info ctinfo;
59 const struct nf_conn *ct;
60 const struct nf_conn_help *help;
61 const struct nf_conntrack_tuple *tuple;
62 const struct nf_conntrack_helper *helper;
63 unsigned int state;
64
65 ct = nf_ct_get(pkt->skb, &ctinfo);
66
67 switch (priv->key) {
68 case NFT_CT_STATE:
69 if (ct)
70 state = NF_CT_STATE_BIT(ctinfo);
71 else if (ctinfo == IP_CT_UNTRACKED)
72 state = NF_CT_STATE_UNTRACKED_BIT;
73 else
74 state = NF_CT_STATE_INVALID_BIT;
75 *dest = state;
76 return;
77 default:
78 break;
79 }
80
81 if (!ct || nf_ct_is_template(ct))
82 goto err;
83
84 switch (priv->key) {
85 case NFT_CT_DIRECTION:
86 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
87 return;
88 case NFT_CT_STATUS:
89 *dest = ct->status;
90 return;
91 #ifdef CONFIG_NF_CONNTRACK_MARK
92 case NFT_CT_MARK:
93 *dest = READ_ONCE(ct->mark);
94 return;
95 #endif
96 #ifdef CONFIG_NF_CONNTRACK_SECMARK
97 case NFT_CT_SECMARK:
98 *dest = ct->secmark;
99 return;
100 #endif
101 case NFT_CT_EXPIRATION:
102 *dest = jiffies_to_msecs(nf_ct_expires(ct));
103 return;
104 case NFT_CT_HELPER:
105 if (ct->master == NULL)
106 goto err;
107 help = nfct_help(ct->master);
108 if (help == NULL)
109 goto err;
110 helper = rcu_dereference(help->helper);
111 if (helper == NULL)
112 goto err;
113 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
114 return;
115 #ifdef CONFIG_NF_CONNTRACK_LABELS
116 case NFT_CT_LABELS: {
117 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
118
119 if (labels)
120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
121 else
122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
123 return;
124 }
125 #endif
126 case NFT_CT_BYTES:
127 case NFT_CT_PKTS: {
128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
129 u64 count = 0;
130
131 if (acct)
132 count = nft_ct_get_eval_counter(acct->counter,
133 priv->key, priv->dir);
134 memcpy(dest, &count, sizeof(count));
135 return;
136 }
137 case NFT_CT_AVGPKT: {
138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140
141 if (acct) {
142 pcnt = nft_ct_get_eval_counter(acct->counter,
143 NFT_CT_PKTS, priv->dir);
144 bcnt = nft_ct_get_eval_counter(acct->counter,
145 NFT_CT_BYTES, priv->dir);
146 if (pcnt != 0)
147 avgcnt = div64_u64(bcnt, pcnt);
148 }
149
150 memcpy(dest, &avgcnt, sizeof(avgcnt));
151 return;
152 }
153 case NFT_CT_L3PROTOCOL:
154 nft_reg_store8(dest, nf_ct_l3num(ct));
155 return;
156 case NFT_CT_PROTOCOL:
157 nft_reg_store8(dest, nf_ct_protonum(ct));
158 return;
159 #ifdef CONFIG_NF_CONNTRACK_ZONES
160 case NFT_CT_ZONE: {
161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
162 u16 zoneid;
163
164 if (priv->dir < IP_CT_DIR_MAX)
165 zoneid = nf_ct_zone_id(zone, priv->dir);
166 else
167 zoneid = zone->id;
168
169 nft_reg_store16(dest, zoneid);
170 return;
171 }
172 #endif
173 case NFT_CT_ID:
174 *dest = nf_ct_get_id(ct);
175 return;
176 default:
177 break;
178 }
179
180 tuple = &ct->tuplehash[priv->dir].tuple;
181 switch (priv->key) {
182 case NFT_CT_SRC:
183 memcpy(dest, tuple->src.u3.all, priv->len);
184 return;
185 case NFT_CT_DST:
186 memcpy(dest, tuple->dst.u3.all, priv->len);
187 return;
188 case NFT_CT_PROTO_SRC:
189 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
190 return;
191 case NFT_CT_PROTO_DST:
192 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
193 return;
194 case NFT_CT_SRC_IP:
195 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
196 goto err;
197 *dest = (__force __u32)tuple->src.u3.ip;
198 return;
199 case NFT_CT_DST_IP:
200 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
201 goto err;
202 *dest = (__force __u32)tuple->dst.u3.ip;
203 return;
204 case NFT_CT_SRC_IP6:
205 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
206 goto err;
207 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
208 return;
209 case NFT_CT_DST_IP6:
210 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
211 goto err;
212 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
213 return;
214 default:
215 break;
216 }
217 return;
218 err:
219 regs->verdict.code = NFT_BREAK;
220 }
221
222 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_set_zone_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)223 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
224 struct nft_regs *regs,
225 const struct nft_pktinfo *pkt)
226 {
227 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
228 const struct nft_ct *priv = nft_expr_priv(expr);
229 struct sk_buff *skb = pkt->skb;
230 enum ip_conntrack_info ctinfo;
231 u16 value = nft_reg_load16(®s->data[priv->sreg]);
232 struct nf_conn *ct;
233 int oldcnt;
234
235 ct = nf_ct_get(skb, &ctinfo);
236 if (ct) /* already tracked */
237 return;
238
239 zone.id = value;
240
241 switch (priv->dir) {
242 case IP_CT_DIR_ORIGINAL:
243 zone.dir = NF_CT_ZONE_DIR_ORIG;
244 break;
245 case IP_CT_DIR_REPLY:
246 zone.dir = NF_CT_ZONE_DIR_REPL;
247 break;
248 default:
249 break;
250 }
251
252 ct = this_cpu_read(nft_ct_pcpu_template);
253
254 __refcount_inc(&ct->ct_general.use, &oldcnt);
255 if (likely(oldcnt == 1)) {
256 nf_ct_zone_add(ct, &zone);
257 } else {
258 refcount_dec(&ct->ct_general.use);
259 /* previous skb got queued to userspace, allocate temporary
260 * one until percpu template can be reused.
261 */
262 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
263 if (!ct) {
264 regs->verdict.code = NF_DROP;
265 return;
266 }
267 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
268 }
269
270 nf_ct_set(skb, ct, IP_CT_NEW);
271 }
272 #endif
273
nft_ct_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)274 static void nft_ct_set_eval(const struct nft_expr *expr,
275 struct nft_regs *regs,
276 const struct nft_pktinfo *pkt)
277 {
278 const struct nft_ct *priv = nft_expr_priv(expr);
279 struct sk_buff *skb = pkt->skb;
280 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
281 u32 value = regs->data[priv->sreg];
282 #endif
283 enum ip_conntrack_info ctinfo;
284 struct nf_conn *ct;
285
286 ct = nf_ct_get(skb, &ctinfo);
287 if (ct == NULL || nf_ct_is_template(ct))
288 return;
289
290 switch (priv->key) {
291 #ifdef CONFIG_NF_CONNTRACK_MARK
292 case NFT_CT_MARK:
293 if (READ_ONCE(ct->mark) != value) {
294 WRITE_ONCE(ct->mark, value);
295 nf_conntrack_event_cache(IPCT_MARK, ct);
296 }
297 break;
298 #endif
299 #ifdef CONFIG_NF_CONNTRACK_SECMARK
300 case NFT_CT_SECMARK:
301 if (ct->secmark != value) {
302 ct->secmark = value;
303 nf_conntrack_event_cache(IPCT_SECMARK, ct);
304 }
305 break;
306 #endif
307 #ifdef CONFIG_NF_CONNTRACK_LABELS
308 case NFT_CT_LABELS:
309 nf_connlabels_replace(ct,
310 ®s->data[priv->sreg],
311 ®s->data[priv->sreg],
312 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
313 break;
314 #endif
315 #ifdef CONFIG_NF_CONNTRACK_EVENTS
316 case NFT_CT_EVENTMASK: {
317 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
318 u32 ctmask = regs->data[priv->sreg];
319
320 if (e) {
321 if (e->ctmask != ctmask)
322 e->ctmask = ctmask;
323 break;
324 }
325
326 if (ctmask && !nf_ct_is_confirmed(ct))
327 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
328 break;
329 }
330 #endif
331 default:
332 break;
333 }
334 }
335
336 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
337 [NFTA_CT_DREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
338 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
339 [NFTA_CT_DIRECTION] = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY),
340 [NFTA_CT_SREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
341 };
342
343 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_tmpl_put_pcpu(void)344 static void nft_ct_tmpl_put_pcpu(void)
345 {
346 struct nf_conn *ct;
347 int cpu;
348
349 for_each_possible_cpu(cpu) {
350 ct = per_cpu(nft_ct_pcpu_template, cpu);
351 if (!ct)
352 break;
353 nf_ct_put(ct);
354 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
355 }
356 }
357
nft_ct_tmpl_alloc_pcpu(void)358 static bool nft_ct_tmpl_alloc_pcpu(void)
359 {
360 struct nf_conntrack_zone zone = { .id = 0 };
361 struct nf_conn *tmp;
362 int cpu;
363
364 if (nft_ct_pcpu_template_refcnt)
365 return true;
366
367 for_each_possible_cpu(cpu) {
368 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
369 if (!tmp) {
370 nft_ct_tmpl_put_pcpu();
371 return false;
372 }
373
374 __set_bit(IPS_CONFIRMED_BIT, &tmp->status);
375 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
376 }
377
378 return true;
379 }
380 #endif
381
__nft_ct_get_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)382 static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
383 {
384 #ifdef CONFIG_NF_CONNTRACK_LABELS
385 if (priv->key == NFT_CT_LABELS)
386 nf_connlabels_put(ctx->net);
387 #endif
388 }
389
nft_ct_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])390 static int nft_ct_get_init(const struct nft_ctx *ctx,
391 const struct nft_expr *expr,
392 const struct nlattr * const tb[])
393 {
394 struct nft_ct *priv = nft_expr_priv(expr);
395 unsigned int len;
396 int err;
397
398 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
399 priv->dir = IP_CT_DIR_MAX;
400 switch (priv->key) {
401 case NFT_CT_DIRECTION:
402 if (tb[NFTA_CT_DIRECTION] != NULL)
403 return -EINVAL;
404 len = sizeof(u8);
405 break;
406 case NFT_CT_STATE:
407 case NFT_CT_STATUS:
408 #ifdef CONFIG_NF_CONNTRACK_MARK
409 case NFT_CT_MARK:
410 #endif
411 #ifdef CONFIG_NF_CONNTRACK_SECMARK
412 case NFT_CT_SECMARK:
413 #endif
414 case NFT_CT_EXPIRATION:
415 if (tb[NFTA_CT_DIRECTION] != NULL)
416 return -EINVAL;
417 len = sizeof(u32);
418 break;
419 #ifdef CONFIG_NF_CONNTRACK_LABELS
420 case NFT_CT_LABELS:
421 if (tb[NFTA_CT_DIRECTION] != NULL)
422 return -EINVAL;
423 len = NF_CT_LABELS_MAX_SIZE;
424
425 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
426 if (err)
427 return err;
428 break;
429 #endif
430 case NFT_CT_HELPER:
431 if (tb[NFTA_CT_DIRECTION] != NULL)
432 return -EINVAL;
433 len = NF_CT_HELPER_NAME_LEN;
434 break;
435
436 case NFT_CT_L3PROTOCOL:
437 case NFT_CT_PROTOCOL:
438 /* For compatibility, do not report error if NFTA_CT_DIRECTION
439 * attribute is specified.
440 */
441 len = sizeof(u8);
442 break;
443 case NFT_CT_SRC:
444 case NFT_CT_DST:
445 if (tb[NFTA_CT_DIRECTION] == NULL)
446 return -EINVAL;
447
448 switch (ctx->family) {
449 case NFPROTO_IPV4:
450 len = sizeof_field(struct nf_conntrack_tuple,
451 src.u3.ip);
452 break;
453 case NFPROTO_IPV6:
454 case NFPROTO_INET:
455 len = sizeof_field(struct nf_conntrack_tuple,
456 src.u3.ip6);
457 break;
458 default:
459 return -EAFNOSUPPORT;
460 }
461 break;
462 case NFT_CT_SRC_IP:
463 case NFT_CT_DST_IP:
464 if (tb[NFTA_CT_DIRECTION] == NULL)
465 return -EINVAL;
466
467 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
468 break;
469 case NFT_CT_SRC_IP6:
470 case NFT_CT_DST_IP6:
471 if (tb[NFTA_CT_DIRECTION] == NULL)
472 return -EINVAL;
473
474 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
475 break;
476 case NFT_CT_PROTO_SRC:
477 case NFT_CT_PROTO_DST:
478 if (tb[NFTA_CT_DIRECTION] == NULL)
479 return -EINVAL;
480 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
481 break;
482 case NFT_CT_BYTES:
483 case NFT_CT_PKTS:
484 case NFT_CT_AVGPKT:
485 len = sizeof(u64);
486 break;
487 #ifdef CONFIG_NF_CONNTRACK_ZONES
488 case NFT_CT_ZONE:
489 len = sizeof(u16);
490 break;
491 #endif
492 case NFT_CT_ID:
493 if (tb[NFTA_CT_DIRECTION])
494 return -EINVAL;
495
496 len = sizeof(u32);
497 break;
498 default:
499 return -EOPNOTSUPP;
500 }
501
502 if (tb[NFTA_CT_DIRECTION] != NULL) {
503 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
504 switch (priv->dir) {
505 case IP_CT_DIR_ORIGINAL:
506 case IP_CT_DIR_REPLY:
507 break;
508 default:
509 err = -EINVAL;
510 goto err;
511 }
512 }
513
514 priv->len = len;
515 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
516 NFT_DATA_VALUE, len);
517 if (err < 0)
518 goto err;
519
520 err = nf_ct_netns_get(ctx->net, ctx->family);
521 if (err < 0)
522 goto err;
523
524 if (priv->key == NFT_CT_BYTES ||
525 priv->key == NFT_CT_PKTS ||
526 priv->key == NFT_CT_AVGPKT)
527 nf_ct_set_acct(ctx->net, true);
528
529 return 0;
530 err:
531 __nft_ct_get_destroy(ctx, priv);
532 return err;
533 }
534
__nft_ct_set_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)535 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
536 {
537 switch (priv->key) {
538 #ifdef CONFIG_NF_CONNTRACK_LABELS
539 case NFT_CT_LABELS:
540 nf_connlabels_put(ctx->net);
541 break;
542 #endif
543 #ifdef CONFIG_NF_CONNTRACK_ZONES
544 case NFT_CT_ZONE:
545 nf_queue_nf_hook_drop(ctx->net);
546 mutex_lock(&nft_ct_pcpu_mutex);
547 if (--nft_ct_pcpu_template_refcnt == 0)
548 nft_ct_tmpl_put_pcpu();
549 mutex_unlock(&nft_ct_pcpu_mutex);
550 break;
551 #endif
552 default:
553 break;
554 }
555 }
556
nft_ct_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])557 static int nft_ct_set_init(const struct nft_ctx *ctx,
558 const struct nft_expr *expr,
559 const struct nlattr * const tb[])
560 {
561 struct nft_ct *priv = nft_expr_priv(expr);
562 unsigned int len;
563 int err;
564
565 priv->dir = IP_CT_DIR_MAX;
566 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
567 switch (priv->key) {
568 #ifdef CONFIG_NF_CONNTRACK_MARK
569 case NFT_CT_MARK:
570 if (tb[NFTA_CT_DIRECTION])
571 return -EINVAL;
572 len = sizeof_field(struct nf_conn, mark);
573 break;
574 #endif
575 #ifdef CONFIG_NF_CONNTRACK_LABELS
576 case NFT_CT_LABELS:
577 if (tb[NFTA_CT_DIRECTION])
578 return -EINVAL;
579 len = NF_CT_LABELS_MAX_SIZE;
580 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
581 if (err)
582 return err;
583 break;
584 #endif
585 #ifdef CONFIG_NF_CONNTRACK_ZONES
586 case NFT_CT_ZONE:
587 mutex_lock(&nft_ct_pcpu_mutex);
588 if (!nft_ct_tmpl_alloc_pcpu()) {
589 mutex_unlock(&nft_ct_pcpu_mutex);
590 return -ENOMEM;
591 }
592 nft_ct_pcpu_template_refcnt++;
593 mutex_unlock(&nft_ct_pcpu_mutex);
594 len = sizeof(u16);
595 break;
596 #endif
597 #ifdef CONFIG_NF_CONNTRACK_EVENTS
598 case NFT_CT_EVENTMASK:
599 if (tb[NFTA_CT_DIRECTION])
600 return -EINVAL;
601 len = sizeof(u32);
602 break;
603 #endif
604 #ifdef CONFIG_NF_CONNTRACK_SECMARK
605 case NFT_CT_SECMARK:
606 if (tb[NFTA_CT_DIRECTION])
607 return -EINVAL;
608 len = sizeof(u32);
609 break;
610 #endif
611 default:
612 return -EOPNOTSUPP;
613 }
614
615 if (tb[NFTA_CT_DIRECTION]) {
616 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
617 switch (priv->dir) {
618 case IP_CT_DIR_ORIGINAL:
619 case IP_CT_DIR_REPLY:
620 break;
621 default:
622 err = -EINVAL;
623 goto err1;
624 }
625 }
626
627 priv->len = len;
628 err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len);
629 if (err < 0)
630 goto err1;
631
632 err = nf_ct_netns_get(ctx->net, ctx->family);
633 if (err < 0)
634 goto err1;
635
636 return 0;
637
638 err1:
639 __nft_ct_set_destroy(ctx, priv);
640 return err;
641 }
642
nft_ct_get_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)643 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
644 const struct nft_expr *expr)
645 {
646 struct nft_ct *priv = nft_expr_priv(expr);
647
648 __nft_ct_get_destroy(ctx, priv);
649 nf_ct_netns_put(ctx->net, ctx->family);
650 }
651
nft_ct_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)652 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
653 const struct nft_expr *expr)
654 {
655 struct nft_ct *priv = nft_expr_priv(expr);
656
657 __nft_ct_set_destroy(ctx, priv);
658 nf_ct_netns_put(ctx->net, ctx->family);
659 }
660
nft_ct_get_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)661 static int nft_ct_get_dump(struct sk_buff *skb,
662 const struct nft_expr *expr, bool reset)
663 {
664 const struct nft_ct *priv = nft_expr_priv(expr);
665
666 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
667 goto nla_put_failure;
668 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
669 goto nla_put_failure;
670
671 switch (priv->key) {
672 case NFT_CT_SRC:
673 case NFT_CT_DST:
674 case NFT_CT_SRC_IP:
675 case NFT_CT_DST_IP:
676 case NFT_CT_SRC_IP6:
677 case NFT_CT_DST_IP6:
678 case NFT_CT_PROTO_SRC:
679 case NFT_CT_PROTO_DST:
680 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
681 goto nla_put_failure;
682 break;
683 case NFT_CT_BYTES:
684 case NFT_CT_PKTS:
685 case NFT_CT_AVGPKT:
686 case NFT_CT_ZONE:
687 if (priv->dir < IP_CT_DIR_MAX &&
688 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
689 goto nla_put_failure;
690 break;
691 default:
692 break;
693 }
694
695 return 0;
696
697 nla_put_failure:
698 return -1;
699 }
700
nft_ct_set_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)701 static int nft_ct_set_dump(struct sk_buff *skb,
702 const struct nft_expr *expr, bool reset)
703 {
704 const struct nft_ct *priv = nft_expr_priv(expr);
705
706 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
707 goto nla_put_failure;
708 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
709 goto nla_put_failure;
710
711 switch (priv->key) {
712 case NFT_CT_ZONE:
713 if (priv->dir < IP_CT_DIR_MAX &&
714 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
715 goto nla_put_failure;
716 break;
717 default:
718 break;
719 }
720
721 return 0;
722
723 nla_put_failure:
724 return -1;
725 }
726
727 static struct nft_expr_type nft_ct_type;
728 static const struct nft_expr_ops nft_ct_get_ops = {
729 .type = &nft_ct_type,
730 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
731 .eval = nft_ct_get_eval,
732 .init = nft_ct_get_init,
733 .destroy = nft_ct_get_destroy,
734 .dump = nft_ct_get_dump,
735 };
736
737 #ifdef CONFIG_MITIGATION_RETPOLINE
738 static const struct nft_expr_ops nft_ct_get_fast_ops = {
739 .type = &nft_ct_type,
740 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
741 .eval = nft_ct_get_fast_eval,
742 .init = nft_ct_get_init,
743 .destroy = nft_ct_get_destroy,
744 .dump = nft_ct_get_dump,
745 };
746 #endif
747
748 static const struct nft_expr_ops nft_ct_set_ops = {
749 .type = &nft_ct_type,
750 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
751 .eval = nft_ct_set_eval,
752 .init = nft_ct_set_init,
753 .destroy = nft_ct_set_destroy,
754 .dump = nft_ct_set_dump,
755 };
756
757 #ifdef CONFIG_NF_CONNTRACK_ZONES
758 static const struct nft_expr_ops nft_ct_set_zone_ops = {
759 .type = &nft_ct_type,
760 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
761 .eval = nft_ct_set_zone_eval,
762 .init = nft_ct_set_init,
763 .destroy = nft_ct_set_destroy,
764 .dump = nft_ct_set_dump,
765 };
766 #endif
767
768 static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])769 nft_ct_select_ops(const struct nft_ctx *ctx,
770 const struct nlattr * const tb[])
771 {
772 if (tb[NFTA_CT_KEY] == NULL)
773 return ERR_PTR(-EINVAL);
774
775 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
776 return ERR_PTR(-EINVAL);
777
778 if (tb[NFTA_CT_DREG]) {
779 #ifdef CONFIG_MITIGATION_RETPOLINE
780 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
781
782 switch (k) {
783 case NFT_CT_STATE:
784 case NFT_CT_DIRECTION:
785 case NFT_CT_STATUS:
786 case NFT_CT_MARK:
787 case NFT_CT_SECMARK:
788 return &nft_ct_get_fast_ops;
789 }
790 #endif
791 return &nft_ct_get_ops;
792 }
793
794 if (tb[NFTA_CT_SREG]) {
795 #ifdef CONFIG_NF_CONNTRACK_ZONES
796 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
797 return &nft_ct_set_zone_ops;
798 #endif
799 return &nft_ct_set_ops;
800 }
801
802 return ERR_PTR(-EINVAL);
803 }
804
805 static struct nft_expr_type nft_ct_type __read_mostly = {
806 .name = "ct",
807 .select_ops = nft_ct_select_ops,
808 .policy = nft_ct_policy,
809 .maxattr = NFTA_CT_MAX,
810 .owner = THIS_MODULE,
811 };
812
nft_notrack_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)813 static void nft_notrack_eval(const struct nft_expr *expr,
814 struct nft_regs *regs,
815 const struct nft_pktinfo *pkt)
816 {
817 struct sk_buff *skb = pkt->skb;
818 enum ip_conntrack_info ctinfo;
819 struct nf_conn *ct;
820
821 ct = nf_ct_get(pkt->skb, &ctinfo);
822 /* Previously seen (loopback or untracked)? Ignore. */
823 if (ct || ctinfo == IP_CT_UNTRACKED)
824 return;
825
826 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
827 }
828
829 static struct nft_expr_type nft_notrack_type;
830 static const struct nft_expr_ops nft_notrack_ops = {
831 .type = &nft_notrack_type,
832 .size = NFT_EXPR_SIZE(0),
833 .eval = nft_notrack_eval,
834 };
835
836 static struct nft_expr_type nft_notrack_type __read_mostly = {
837 .name = "notrack",
838 .ops = &nft_notrack_ops,
839 .owner = THIS_MODULE,
840 };
841
842 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
843 static int
nft_ct_timeout_parse_policy(void * timeouts,const struct nf_conntrack_l4proto * l4proto,struct net * net,const struct nlattr * attr)844 nft_ct_timeout_parse_policy(void *timeouts,
845 const struct nf_conntrack_l4proto *l4proto,
846 struct net *net, const struct nlattr *attr)
847 {
848 struct nlattr **tb;
849 int ret = 0;
850
851 tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1);
852
853 if (!tb)
854 return -ENOMEM;
855
856 ret = nla_parse_nested_deprecated(tb,
857 l4proto->ctnl_timeout.nlattr_max,
858 attr,
859 l4proto->ctnl_timeout.nla_policy,
860 NULL);
861 if (ret < 0)
862 goto err;
863
864 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
865
866 err:
867 kfree(tb);
868 return ret;
869 }
870
871 struct nft_ct_timeout_obj {
872 struct nf_ct_timeout *timeout;
873 u8 l4proto;
874 };
875
nft_ct_timeout_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)876 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
877 struct nft_regs *regs,
878 const struct nft_pktinfo *pkt)
879 {
880 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
881 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
882 struct nf_conn_timeout *timeout;
883 const unsigned int *values;
884
885 if (priv->l4proto != pkt->tprot)
886 return;
887
888 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
889 return;
890
891 timeout = nf_ct_timeout_find(ct);
892 if (!timeout) {
893 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
894 if (!timeout) {
895 regs->verdict.code = NF_DROP;
896 return;
897 }
898 }
899
900 rcu_assign_pointer(timeout->timeout, priv->timeout);
901
902 /* adjust the timeout as per 'new' state. ct is unconfirmed,
903 * so the current timestamp must not be added.
904 */
905 values = nf_ct_timeout_data(timeout);
906 if (values)
907 nf_ct_refresh(ct, values[0]);
908 }
909
nft_ct_timeout_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)910 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
911 const struct nlattr * const tb[],
912 struct nft_object *obj)
913 {
914 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
915 const struct nf_conntrack_l4proto *l4proto;
916 struct nf_ct_timeout *timeout;
917 int l3num = ctx->family;
918 __u8 l4num;
919 int ret;
920
921 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
922 !tb[NFTA_CT_TIMEOUT_DATA])
923 return -EINVAL;
924
925 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
926 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
927
928 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
929 priv->l4proto = l4num;
930
931 l4proto = nf_ct_l4proto_find(l4num);
932
933 if (l4proto->l4proto != l4num) {
934 ret = -EOPNOTSUPP;
935 goto err_proto_put;
936 }
937
938 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
939 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
940 if (timeout == NULL) {
941 ret = -ENOMEM;
942 goto err_proto_put;
943 }
944
945 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
946 tb[NFTA_CT_TIMEOUT_DATA]);
947 if (ret < 0)
948 goto err_free_timeout;
949
950 timeout->l3num = l3num;
951 timeout->l4proto = l4proto;
952
953 ret = nf_ct_netns_get(ctx->net, ctx->family);
954 if (ret < 0)
955 goto err_free_timeout;
956
957 priv->timeout = timeout;
958 return 0;
959
960 err_free_timeout:
961 kfree(timeout);
962 err_proto_put:
963 return ret;
964 }
965
nft_ct_timeout_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)966 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
967 struct nft_object *obj)
968 {
969 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
970 struct nf_ct_timeout *timeout = priv->timeout;
971
972 nf_queue_nf_hook_drop(ctx->net);
973 nf_ct_untimeout(ctx->net, timeout);
974 nf_ct_netns_put(ctx->net, ctx->family);
975 kfree_rcu(priv->timeout, rcu);
976 }
977
nft_ct_timeout_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)978 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
979 struct nft_object *obj, bool reset)
980 {
981 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
982 const struct nf_ct_timeout *timeout = priv->timeout;
983 struct nlattr *nest_params;
984 int ret;
985
986 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
987 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
988 return -1;
989
990 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
991 if (!nest_params)
992 return -1;
993
994 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
995 if (ret < 0)
996 return -1;
997 nla_nest_end(skb, nest_params);
998 return 0;
999 }
1000
1001 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1002 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1003 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1004 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
1005 };
1006
1007 static struct nft_object_type nft_ct_timeout_obj_type;
1008
1009 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1010 .type = &nft_ct_timeout_obj_type,
1011 .size = sizeof(struct nft_ct_timeout_obj),
1012 .eval = nft_ct_timeout_obj_eval,
1013 .init = nft_ct_timeout_obj_init,
1014 .destroy = nft_ct_timeout_obj_destroy,
1015 .dump = nft_ct_timeout_obj_dump,
1016 };
1017
1018 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1019 .type = NFT_OBJECT_CT_TIMEOUT,
1020 .ops = &nft_ct_timeout_obj_ops,
1021 .maxattr = NFTA_CT_TIMEOUT_MAX,
1022 .policy = nft_ct_timeout_policy,
1023 .owner = THIS_MODULE,
1024 };
1025 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1026
nft_ct_helper_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1027 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1028 const struct nlattr * const tb[],
1029 struct nft_object *obj)
1030 {
1031 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1032 struct nf_conntrack_helper *help4, *help6;
1033 char name[NF_CT_HELPER_NAME_LEN];
1034 int family = ctx->family;
1035 int err;
1036
1037 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1038 return -EINVAL;
1039
1040 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1041 if (!priv->l4proto)
1042 return -ENOENT;
1043
1044 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1045
1046 if (tb[NFTA_CT_HELPER_L3PROTO])
1047 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1048
1049 help4 = NULL;
1050 help6 = NULL;
1051
1052 switch (family) {
1053 case NFPROTO_IPV4:
1054 if (ctx->family == NFPROTO_IPV6)
1055 return -EINVAL;
1056
1057 help4 = nf_conntrack_helper_try_module_get(name, family,
1058 priv->l4proto);
1059 break;
1060 case NFPROTO_IPV6:
1061 if (ctx->family == NFPROTO_IPV4)
1062 return -EINVAL;
1063
1064 help6 = nf_conntrack_helper_try_module_get(name, family,
1065 priv->l4proto);
1066 break;
1067 case NFPROTO_NETDEV:
1068 case NFPROTO_BRIDGE:
1069 case NFPROTO_INET:
1070 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1071 priv->l4proto);
1072 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1073 priv->l4proto);
1074 break;
1075 default:
1076 return -EAFNOSUPPORT;
1077 }
1078
1079 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1080 if (!help4 && !help6)
1081 return -ENOENT;
1082
1083 priv->helper4 = help4;
1084 priv->helper6 = help6;
1085
1086 err = nf_ct_netns_get(ctx->net, ctx->family);
1087 if (err < 0)
1088 goto err_put_helper;
1089
1090 return 0;
1091
1092 err_put_helper:
1093 if (priv->helper4)
1094 nf_conntrack_helper_put(priv->helper4);
1095 if (priv->helper6)
1096 nf_conntrack_helper_put(priv->helper6);
1097 return err;
1098 }
1099
nft_ct_helper_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1100 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1101 struct nft_object *obj)
1102 {
1103 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1104
1105 nf_queue_nf_hook_drop(ctx->net);
1106 if (priv->helper4)
1107 nf_conntrack_helper_put(priv->helper4);
1108 if (priv->helper6)
1109 nf_conntrack_helper_put(priv->helper6);
1110
1111 nf_ct_netns_put(ctx->net, ctx->family);
1112 }
1113
nft_ct_helper_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1114 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1115 struct nft_regs *regs,
1116 const struct nft_pktinfo *pkt)
1117 {
1118 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1119 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1120 struct nf_conntrack_helper *to_assign = NULL;
1121 struct nf_conn_help *help;
1122
1123 if (!ct ||
1124 nf_ct_is_confirmed(ct) ||
1125 nf_ct_is_template(ct) ||
1126 priv->l4proto != nf_ct_protonum(ct))
1127 return;
1128
1129 switch (nf_ct_l3num(ct)) {
1130 case NFPROTO_IPV4:
1131 to_assign = priv->helper4;
1132 break;
1133 case NFPROTO_IPV6:
1134 to_assign = priv->helper6;
1135 break;
1136 default:
1137 WARN_ON_ONCE(1);
1138 return;
1139 }
1140
1141 if (!to_assign)
1142 return;
1143
1144 if (test_bit(IPS_HELPER_BIT, &ct->status))
1145 return;
1146
1147 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1148 if (help) {
1149 rcu_assign_pointer(help->helper, to_assign);
1150 set_bit(IPS_HELPER_BIT, &ct->status);
1151
1152 if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
1153 if (!nfct_seqadj_ext_add(ct))
1154 regs->verdict.code = NF_DROP;
1155 }
1156 }
1157
nft_ct_helper_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1158 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1159 struct nft_object *obj, bool reset)
1160 {
1161 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1162 const struct nf_conntrack_helper *helper;
1163 u16 family;
1164
1165 if (priv->helper4 && priv->helper6) {
1166 family = NFPROTO_INET;
1167 helper = priv->helper4;
1168 } else if (priv->helper6) {
1169 family = NFPROTO_IPV6;
1170 helper = priv->helper6;
1171 } else {
1172 family = NFPROTO_IPV4;
1173 helper = priv->helper4;
1174 }
1175
1176 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1177 return -1;
1178
1179 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1180 return -1;
1181
1182 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1183 return -1;
1184
1185 return 0;
1186 }
1187
1188 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1189 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1190 .len = NF_CT_HELPER_NAME_LEN - 1 },
1191 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1192 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1193 };
1194
1195 static struct nft_object_type nft_ct_helper_obj_type;
1196 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1197 .type = &nft_ct_helper_obj_type,
1198 .size = sizeof(struct nft_ct_helper_obj),
1199 .eval = nft_ct_helper_obj_eval,
1200 .init = nft_ct_helper_obj_init,
1201 .destroy = nft_ct_helper_obj_destroy,
1202 .dump = nft_ct_helper_obj_dump,
1203 };
1204
1205 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1206 .type = NFT_OBJECT_CT_HELPER,
1207 .ops = &nft_ct_helper_obj_ops,
1208 .maxattr = NFTA_CT_HELPER_MAX,
1209 .policy = nft_ct_helper_policy,
1210 .owner = THIS_MODULE,
1211 };
1212
1213 struct nft_ct_expect_obj {
1214 u16 l3num;
1215 __be16 dport;
1216 u8 l4proto;
1217 u8 size;
1218 u32 timeout;
1219 };
1220
nft_ct_expect_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1221 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1222 const struct nlattr * const tb[],
1223 struct nft_object *obj)
1224 {
1225 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1226
1227 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1228 !tb[NFTA_CT_EXPECT_DPORT] ||
1229 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1230 !tb[NFTA_CT_EXPECT_SIZE])
1231 return -EINVAL;
1232
1233 priv->l3num = ctx->family;
1234 if (tb[NFTA_CT_EXPECT_L3PROTO])
1235 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1236
1237 switch (priv->l3num) {
1238 case NFPROTO_IPV4:
1239 case NFPROTO_IPV6:
1240 if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1241 break;
1242
1243 return -EINVAL;
1244 case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1245 default:
1246 return -EAFNOSUPPORT;
1247 }
1248
1249 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1250 switch (priv->l4proto) {
1251 case IPPROTO_TCP:
1252 case IPPROTO_UDP:
1253 case IPPROTO_DCCP:
1254 case IPPROTO_SCTP:
1255 break;
1256 default:
1257 return -EOPNOTSUPP;
1258 }
1259
1260 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1261 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1262 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1263
1264 return nf_ct_netns_get(ctx->net, ctx->family);
1265 }
1266
nft_ct_expect_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1267 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1268 struct nft_object *obj)
1269 {
1270 nf_ct_netns_put(ctx->net, ctx->family);
1271 }
1272
nft_ct_expect_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1273 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1274 struct nft_object *obj, bool reset)
1275 {
1276 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1277
1278 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1279 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1280 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1281 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1282 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1283 return -1;
1284
1285 return 0;
1286 }
1287
nft_ct_expect_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1288 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1289 struct nft_regs *regs,
1290 const struct nft_pktinfo *pkt)
1291 {
1292 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1293 struct nf_conntrack_expect *exp;
1294 enum ip_conntrack_info ctinfo;
1295 struct nf_conn_help *help;
1296 enum ip_conntrack_dir dir;
1297 u16 l3num = priv->l3num;
1298 struct nf_conn *ct;
1299
1300 ct = nf_ct_get(pkt->skb, &ctinfo);
1301 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1302 regs->verdict.code = NFT_BREAK;
1303 return;
1304 }
1305 dir = CTINFO2DIR(ctinfo);
1306
1307 help = nfct_help(ct);
1308 if (!help)
1309 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1310 if (!help) {
1311 regs->verdict.code = NF_DROP;
1312 return;
1313 }
1314
1315 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1316 regs->verdict.code = NFT_BREAK;
1317 return;
1318 }
1319 if (l3num == NFPROTO_INET)
1320 l3num = nf_ct_l3num(ct);
1321
1322 exp = nf_ct_expect_alloc(ct);
1323 if (exp == NULL) {
1324 regs->verdict.code = NF_DROP;
1325 return;
1326 }
1327 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1328 &ct->tuplehash[!dir].tuple.src.u3,
1329 &ct->tuplehash[!dir].tuple.dst.u3,
1330 priv->l4proto, NULL, &priv->dport);
1331 exp->timeout.expires = jiffies + priv->timeout * HZ;
1332
1333 if (nf_ct_expect_related(exp, 0) != 0)
1334 regs->verdict.code = NF_DROP;
1335
1336 nf_ct_expect_put(exp);
1337 }
1338
1339 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1340 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1341 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1342 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1343 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1344 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1345 };
1346
1347 static struct nft_object_type nft_ct_expect_obj_type;
1348
1349 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1350 .type = &nft_ct_expect_obj_type,
1351 .size = sizeof(struct nft_ct_expect_obj),
1352 .eval = nft_ct_expect_obj_eval,
1353 .init = nft_ct_expect_obj_init,
1354 .destroy = nft_ct_expect_obj_destroy,
1355 .dump = nft_ct_expect_obj_dump,
1356 };
1357
1358 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1359 .type = NFT_OBJECT_CT_EXPECT,
1360 .ops = &nft_ct_expect_obj_ops,
1361 .maxattr = NFTA_CT_EXPECT_MAX,
1362 .policy = nft_ct_expect_policy,
1363 .owner = THIS_MODULE,
1364 };
1365
nft_ct_module_init(void)1366 static int __init nft_ct_module_init(void)
1367 {
1368 int err;
1369
1370 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1371
1372 err = nft_register_expr(&nft_ct_type);
1373 if (err < 0)
1374 return err;
1375
1376 err = nft_register_expr(&nft_notrack_type);
1377 if (err < 0)
1378 goto err1;
1379
1380 err = nft_register_obj(&nft_ct_helper_obj_type);
1381 if (err < 0)
1382 goto err2;
1383
1384 err = nft_register_obj(&nft_ct_expect_obj_type);
1385 if (err < 0)
1386 goto err3;
1387 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1388 err = nft_register_obj(&nft_ct_timeout_obj_type);
1389 if (err < 0)
1390 goto err4;
1391 #endif
1392 return 0;
1393
1394 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1395 err4:
1396 nft_unregister_obj(&nft_ct_expect_obj_type);
1397 #endif
1398 err3:
1399 nft_unregister_obj(&nft_ct_helper_obj_type);
1400 err2:
1401 nft_unregister_expr(&nft_notrack_type);
1402 err1:
1403 nft_unregister_expr(&nft_ct_type);
1404 return err;
1405 }
1406
nft_ct_module_exit(void)1407 static void __exit nft_ct_module_exit(void)
1408 {
1409 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1410 nft_unregister_obj(&nft_ct_timeout_obj_type);
1411 #endif
1412 nft_unregister_obj(&nft_ct_expect_obj_type);
1413 nft_unregister_obj(&nft_ct_helper_obj_type);
1414 nft_unregister_expr(&nft_notrack_type);
1415 nft_unregister_expr(&nft_ct_type);
1416 }
1417
1418 module_init(nft_ct_module_init);
1419 module_exit(nft_ct_module_exit);
1420
1421 MODULE_LICENSE("GPL");
1422 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1423 MODULE_ALIAS_NFT_EXPR("ct");
1424 MODULE_ALIAS_NFT_EXPR("notrack");
1425 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1426 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1427 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1428 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");
1429