1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 *
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 #include <net/netfilter/nf_conntrack_seqadj.h>
26 #include "nf_internals.h"
27
28 struct nft_ct_helper_obj {
29 struct nf_conntrack_helper *helper4;
30 struct nf_conntrack_helper *helper6;
31 u8 l4proto;
32 };
33
34 #ifdef CONFIG_NF_CONNTRACK_ZONES
35 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
36 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
37 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
38 #endif
39
nft_ct_get_eval_counter(const struct nf_conn_counter * c,enum nft_ct_keys k,enum ip_conntrack_dir d)40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
41 enum nft_ct_keys k,
42 enum ip_conntrack_dir d)
43 {
44 if (d < IP_CT_DIR_MAX)
45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
46 atomic64_read(&c[d].packets);
47
48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50 }
51
nft_ct_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)52 static void nft_ct_get_eval(const struct nft_expr *expr,
53 struct nft_regs *regs,
54 const struct nft_pktinfo *pkt)
55 {
56 const struct nft_ct *priv = nft_expr_priv(expr);
57 u32 *dest = ®s->data[priv->dreg];
58 enum ip_conntrack_info ctinfo;
59 const struct nf_conn *ct;
60 const struct nf_conn_help *help;
61 const struct nf_conntrack_tuple *tuple;
62 const struct nf_conntrack_helper *helper;
63 unsigned int state;
64
65 ct = nf_ct_get(pkt->skb, &ctinfo);
66
67 switch (priv->key) {
68 case NFT_CT_STATE:
69 if (ct)
70 state = NF_CT_STATE_BIT(ctinfo);
71 else if (ctinfo == IP_CT_UNTRACKED)
72 state = NF_CT_STATE_UNTRACKED_BIT;
73 else
74 state = NF_CT_STATE_INVALID_BIT;
75 *dest = state;
76 return;
77 default:
78 break;
79 }
80
81 if (!ct || nf_ct_is_template(ct))
82 goto err;
83
84 switch (priv->key) {
85 case NFT_CT_DIRECTION:
86 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
87 return;
88 case NFT_CT_STATUS:
89 *dest = ct->status;
90 return;
91 #ifdef CONFIG_NF_CONNTRACK_MARK
92 case NFT_CT_MARK:
93 *dest = READ_ONCE(ct->mark);
94 return;
95 #endif
96 #ifdef CONFIG_NF_CONNTRACK_SECMARK
97 case NFT_CT_SECMARK:
98 *dest = ct->secmark;
99 return;
100 #endif
101 case NFT_CT_EXPIRATION:
102 *dest = jiffies_to_msecs(nf_ct_expires(ct));
103 return;
104 case NFT_CT_HELPER:
105 if (ct->master == NULL)
106 goto err;
107 help = nfct_help(ct->master);
108 if (help == NULL)
109 goto err;
110 helper = rcu_dereference(help->helper);
111 if (helper == NULL)
112 goto err;
113 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
114 return;
115 #ifdef CONFIG_NF_CONNTRACK_LABELS
116 case NFT_CT_LABELS: {
117 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
118
119 if (labels)
120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
121 else
122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
123 return;
124 }
125 #endif
126 case NFT_CT_BYTES:
127 case NFT_CT_PKTS: {
128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
129 u64 count = 0;
130
131 if (acct)
132 count = nft_ct_get_eval_counter(acct->counter,
133 priv->key, priv->dir);
134 memcpy(dest, &count, sizeof(count));
135 return;
136 }
137 case NFT_CT_AVGPKT: {
138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140
141 if (acct) {
142 pcnt = nft_ct_get_eval_counter(acct->counter,
143 NFT_CT_PKTS, priv->dir);
144 bcnt = nft_ct_get_eval_counter(acct->counter,
145 NFT_CT_BYTES, priv->dir);
146 if (pcnt != 0)
147 avgcnt = div64_u64(bcnt, pcnt);
148 }
149
150 memcpy(dest, &avgcnt, sizeof(avgcnt));
151 return;
152 }
153 case NFT_CT_L3PROTOCOL:
154 nft_reg_store8(dest, nf_ct_l3num(ct));
155 return;
156 case NFT_CT_PROTOCOL:
157 nft_reg_store8(dest, nf_ct_protonum(ct));
158 return;
159 #ifdef CONFIG_NF_CONNTRACK_ZONES
160 case NFT_CT_ZONE: {
161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
162 u16 zoneid;
163
164 if (priv->dir < IP_CT_DIR_MAX)
165 zoneid = nf_ct_zone_id(zone, priv->dir);
166 else
167 zoneid = zone->id;
168
169 nft_reg_store16(dest, zoneid);
170 return;
171 }
172 #endif
173 case NFT_CT_ID:
174 *dest = nf_ct_get_id(ct);
175 return;
176 default:
177 break;
178 }
179
180 tuple = &ct->tuplehash[priv->dir].tuple;
181 switch (priv->key) {
182 case NFT_CT_SRC:
183 memcpy(dest, tuple->src.u3.all, priv->len);
184 return;
185 case NFT_CT_DST:
186 memcpy(dest, tuple->dst.u3.all, priv->len);
187 return;
188 case NFT_CT_PROTO_SRC:
189 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
190 return;
191 case NFT_CT_PROTO_DST:
192 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
193 return;
194 case NFT_CT_SRC_IP:
195 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
196 goto err;
197 *dest = (__force __u32)tuple->src.u3.ip;
198 return;
199 case NFT_CT_DST_IP:
200 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
201 goto err;
202 *dest = (__force __u32)tuple->dst.u3.ip;
203 return;
204 case NFT_CT_SRC_IP6:
205 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
206 goto err;
207 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
208 return;
209 case NFT_CT_DST_IP6:
210 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
211 goto err;
212 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
213 return;
214 default:
215 break;
216 }
217 return;
218 err:
219 regs->verdict.code = NFT_BREAK;
220 }
221
222 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_set_zone_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)223 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
224 struct nft_regs *regs,
225 const struct nft_pktinfo *pkt)
226 {
227 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
228 const struct nft_ct *priv = nft_expr_priv(expr);
229 struct sk_buff *skb = pkt->skb;
230 enum ip_conntrack_info ctinfo;
231 u16 value = nft_reg_load16(®s->data[priv->sreg]);
232 struct nf_conn *ct;
233 int oldcnt;
234
235 ct = nf_ct_get(skb, &ctinfo);
236 if (ct) /* already tracked */
237 return;
238
239 zone.id = value;
240
241 switch (priv->dir) {
242 case IP_CT_DIR_ORIGINAL:
243 zone.dir = NF_CT_ZONE_DIR_ORIG;
244 break;
245 case IP_CT_DIR_REPLY:
246 zone.dir = NF_CT_ZONE_DIR_REPL;
247 break;
248 default:
249 break;
250 }
251
252 ct = this_cpu_read(nft_ct_pcpu_template);
253
254 __refcount_inc(&ct->ct_general.use, &oldcnt);
255 if (likely(oldcnt == 1)) {
256 nf_ct_zone_add(ct, &zone);
257 } else {
258 refcount_dec(&ct->ct_general.use);
259 /* previous skb got queued to userspace, allocate temporary
260 * one until percpu template can be reused.
261 */
262 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
263 if (!ct) {
264 regs->verdict.code = NF_DROP;
265 return;
266 }
267 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
268 }
269
270 nf_ct_set(skb, ct, IP_CT_NEW);
271 }
272 #endif
273
nft_ct_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)274 static void nft_ct_set_eval(const struct nft_expr *expr,
275 struct nft_regs *regs,
276 const struct nft_pktinfo *pkt)
277 {
278 const struct nft_ct *priv = nft_expr_priv(expr);
279 struct sk_buff *skb = pkt->skb;
280 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
281 u32 value = regs->data[priv->sreg];
282 #endif
283 enum ip_conntrack_info ctinfo;
284 struct nf_conn *ct;
285
286 ct = nf_ct_get(skb, &ctinfo);
287 if (ct == NULL || nf_ct_is_template(ct))
288 return;
289
290 switch (priv->key) {
291 #ifdef CONFIG_NF_CONNTRACK_MARK
292 case NFT_CT_MARK:
293 if (READ_ONCE(ct->mark) != value) {
294 WRITE_ONCE(ct->mark, value);
295 nf_conntrack_event_cache(IPCT_MARK, ct);
296 }
297 break;
298 #endif
299 #ifdef CONFIG_NF_CONNTRACK_SECMARK
300 case NFT_CT_SECMARK:
301 if (ct->secmark != value) {
302 ct->secmark = value;
303 nf_conntrack_event_cache(IPCT_SECMARK, ct);
304 }
305 break;
306 #endif
307 #ifdef CONFIG_NF_CONNTRACK_LABELS
308 case NFT_CT_LABELS:
309 nf_connlabels_replace(ct,
310 ®s->data[priv->sreg],
311 ®s->data[priv->sreg],
312 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
313 break;
314 #endif
315 #ifdef CONFIG_NF_CONNTRACK_EVENTS
316 case NFT_CT_EVENTMASK: {
317 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
318 u32 ctmask = regs->data[priv->sreg];
319
320 if (e) {
321 if (e->ctmask != ctmask)
322 e->ctmask = ctmask;
323 break;
324 }
325
326 if (ctmask && !nf_ct_is_confirmed(ct))
327 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
328 break;
329 }
330 #endif
331 default:
332 break;
333 }
334 }
335
336 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
337 [NFTA_CT_DREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
338 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
339 [NFTA_CT_DIRECTION] = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY),
340 [NFTA_CT_SREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
341 };
342
343 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_tmpl_put_pcpu(void)344 static void nft_ct_tmpl_put_pcpu(void)
345 {
346 struct nf_conn *ct;
347 int cpu;
348
349 for_each_possible_cpu(cpu) {
350 ct = per_cpu(nft_ct_pcpu_template, cpu);
351 if (!ct)
352 break;
353 nf_ct_put(ct);
354 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
355 }
356 }
357
nft_ct_tmpl_alloc_pcpu(void)358 static bool nft_ct_tmpl_alloc_pcpu(void)
359 {
360 struct nf_conntrack_zone zone = { .id = 0 };
361 struct nf_conn *tmp;
362 int cpu;
363
364 if (nft_ct_pcpu_template_refcnt)
365 return true;
366
367 for_each_possible_cpu(cpu) {
368 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
369 if (!tmp) {
370 nft_ct_tmpl_put_pcpu();
371 return false;
372 }
373
374 __set_bit(IPS_CONFIRMED_BIT, &tmp->status);
375 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
376 }
377
378 return true;
379 }
380 #endif
381
__nft_ct_get_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)382 static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
383 {
384 #ifdef CONFIG_NF_CONNTRACK_LABELS
385 if (priv->key == NFT_CT_LABELS)
386 nf_connlabels_put(ctx->net);
387 #endif
388 }
389
nft_ct_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])390 static int nft_ct_get_init(const struct nft_ctx *ctx,
391 const struct nft_expr *expr,
392 const struct nlattr * const tb[])
393 {
394 struct nft_ct *priv = nft_expr_priv(expr);
395 unsigned int len;
396 int err;
397
398 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
399 priv->dir = IP_CT_DIR_MAX;
400 switch (priv->key) {
401 case NFT_CT_DIRECTION:
402 if (tb[NFTA_CT_DIRECTION] != NULL)
403 return -EINVAL;
404 len = sizeof(u8);
405 break;
406 case NFT_CT_STATE:
407 case NFT_CT_STATUS:
408 #ifdef CONFIG_NF_CONNTRACK_MARK
409 case NFT_CT_MARK:
410 #endif
411 #ifdef CONFIG_NF_CONNTRACK_SECMARK
412 case NFT_CT_SECMARK:
413 #endif
414 case NFT_CT_EXPIRATION:
415 if (tb[NFTA_CT_DIRECTION] != NULL)
416 return -EINVAL;
417 len = sizeof(u32);
418 break;
419 #ifdef CONFIG_NF_CONNTRACK_LABELS
420 case NFT_CT_LABELS:
421 if (tb[NFTA_CT_DIRECTION] != NULL)
422 return -EINVAL;
423 len = NF_CT_LABELS_MAX_SIZE;
424
425 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
426 if (err)
427 return err;
428 break;
429 #endif
430 case NFT_CT_HELPER:
431 if (tb[NFTA_CT_DIRECTION] != NULL)
432 return -EINVAL;
433 len = NF_CT_HELPER_NAME_LEN;
434 break;
435
436 case NFT_CT_L3PROTOCOL:
437 case NFT_CT_PROTOCOL:
438 /* For compatibility, do not report error if NFTA_CT_DIRECTION
439 * attribute is specified.
440 */
441 len = sizeof(u8);
442 break;
443 case NFT_CT_SRC:
444 case NFT_CT_DST:
445 if (tb[NFTA_CT_DIRECTION] == NULL)
446 return -EINVAL;
447
448 switch (ctx->family) {
449 case NFPROTO_IPV4:
450 len = sizeof_field(struct nf_conntrack_tuple,
451 src.u3.ip);
452 break;
453 case NFPROTO_IPV6:
454 case NFPROTO_INET:
455 len = sizeof_field(struct nf_conntrack_tuple,
456 src.u3.ip6);
457 break;
458 default:
459 return -EAFNOSUPPORT;
460 }
461 break;
462 case NFT_CT_SRC_IP:
463 case NFT_CT_DST_IP:
464 if (tb[NFTA_CT_DIRECTION] == NULL)
465 return -EINVAL;
466
467 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
468 break;
469 case NFT_CT_SRC_IP6:
470 case NFT_CT_DST_IP6:
471 if (tb[NFTA_CT_DIRECTION] == NULL)
472 return -EINVAL;
473
474 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
475 break;
476 case NFT_CT_PROTO_SRC:
477 case NFT_CT_PROTO_DST:
478 if (tb[NFTA_CT_DIRECTION] == NULL)
479 return -EINVAL;
480 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
481 break;
482 case NFT_CT_BYTES:
483 case NFT_CT_PKTS:
484 case NFT_CT_AVGPKT:
485 len = sizeof(u64);
486 break;
487 #ifdef CONFIG_NF_CONNTRACK_ZONES
488 case NFT_CT_ZONE:
489 len = sizeof(u16);
490 break;
491 #endif
492 case NFT_CT_ID:
493 if (tb[NFTA_CT_DIRECTION])
494 return -EINVAL;
495
496 len = sizeof(u32);
497 break;
498 default:
499 return -EOPNOTSUPP;
500 }
501
502 if (tb[NFTA_CT_DIRECTION] != NULL) {
503 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
504 switch (priv->dir) {
505 case IP_CT_DIR_ORIGINAL:
506 case IP_CT_DIR_REPLY:
507 break;
508 default:
509 err = -EINVAL;
510 goto err;
511 }
512 }
513
514 priv->len = len;
515 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
516 NFT_DATA_VALUE, len);
517 if (err < 0)
518 goto err;
519
520 err = nf_ct_netns_get(ctx->net, ctx->family);
521 if (err < 0)
522 goto err;
523
524 if (priv->key == NFT_CT_BYTES ||
525 priv->key == NFT_CT_PKTS ||
526 priv->key == NFT_CT_AVGPKT)
527 nf_ct_set_acct(ctx->net, true);
528
529 return 0;
530 err:
531 __nft_ct_get_destroy(ctx, priv);
532 return err;
533 }
534
__nft_ct_set_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)535 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
536 {
537 switch (priv->key) {
538 #ifdef CONFIG_NF_CONNTRACK_LABELS
539 case NFT_CT_LABELS:
540 nf_connlabels_put(ctx->net);
541 break;
542 #endif
543 #ifdef CONFIG_NF_CONNTRACK_ZONES
544 case NFT_CT_ZONE:
545 nf_queue_nf_hook_drop(ctx->net);
546 mutex_lock(&nft_ct_pcpu_mutex);
547 if (--nft_ct_pcpu_template_refcnt == 0)
548 nft_ct_tmpl_put_pcpu();
549 mutex_unlock(&nft_ct_pcpu_mutex);
550 break;
551 #endif
552 default:
553 break;
554 }
555 }
556
nft_ct_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])557 static int nft_ct_set_init(const struct nft_ctx *ctx,
558 const struct nft_expr *expr,
559 const struct nlattr * const tb[])
560 {
561 struct nft_ct *priv = nft_expr_priv(expr);
562 unsigned int len;
563 int err;
564
565 priv->dir = IP_CT_DIR_MAX;
566 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
567 switch (priv->key) {
568 #ifdef CONFIG_NF_CONNTRACK_MARK
569 case NFT_CT_MARK:
570 if (tb[NFTA_CT_DIRECTION])
571 return -EINVAL;
572 len = sizeof_field(struct nf_conn, mark);
573 break;
574 #endif
575 #ifdef CONFIG_NF_CONNTRACK_LABELS
576 case NFT_CT_LABELS:
577 if (tb[NFTA_CT_DIRECTION])
578 return -EINVAL;
579 len = NF_CT_LABELS_MAX_SIZE;
580 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
581 if (err)
582 return err;
583 break;
584 #endif
585 #ifdef CONFIG_NF_CONNTRACK_ZONES
586 case NFT_CT_ZONE:
587 mutex_lock(&nft_ct_pcpu_mutex);
588 if (!nft_ct_tmpl_alloc_pcpu()) {
589 mutex_unlock(&nft_ct_pcpu_mutex);
590 return -ENOMEM;
591 }
592 nft_ct_pcpu_template_refcnt++;
593 mutex_unlock(&nft_ct_pcpu_mutex);
594 len = sizeof(u16);
595 break;
596 #endif
597 #ifdef CONFIG_NF_CONNTRACK_EVENTS
598 case NFT_CT_EVENTMASK:
599 if (tb[NFTA_CT_DIRECTION])
600 return -EINVAL;
601 len = sizeof(u32);
602 break;
603 #endif
604 #ifdef CONFIG_NF_CONNTRACK_SECMARK
605 case NFT_CT_SECMARK:
606 if (tb[NFTA_CT_DIRECTION])
607 return -EINVAL;
608 len = sizeof(u32);
609 break;
610 #endif
611 default:
612 return -EOPNOTSUPP;
613 }
614
615 if (tb[NFTA_CT_DIRECTION]) {
616 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
617 switch (priv->dir) {
618 case IP_CT_DIR_ORIGINAL:
619 case IP_CT_DIR_REPLY:
620 break;
621 default:
622 err = -EINVAL;
623 goto err1;
624 }
625 }
626
627 priv->len = len;
628 err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len);
629 if (err < 0)
630 goto err1;
631
632 err = nf_ct_netns_get(ctx->net, ctx->family);
633 if (err < 0)
634 goto err1;
635
636 return 0;
637
638 err1:
639 __nft_ct_set_destroy(ctx, priv);
640 return err;
641 }
642
nft_ct_get_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)643 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
644 const struct nft_expr *expr)
645 {
646 struct nft_ct *priv = nft_expr_priv(expr);
647
648 __nft_ct_get_destroy(ctx, priv);
649 nf_ct_netns_put(ctx->net, ctx->family);
650 }
651
nft_ct_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)652 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
653 const struct nft_expr *expr)
654 {
655 struct nft_ct *priv = nft_expr_priv(expr);
656
657 __nft_ct_set_destroy(ctx, priv);
658 nf_ct_netns_put(ctx->net, ctx->family);
659 }
660
nft_ct_get_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)661 static int nft_ct_get_dump(struct sk_buff *skb,
662 const struct nft_expr *expr, bool reset)
663 {
664 const struct nft_ct *priv = nft_expr_priv(expr);
665
666 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
667 goto nla_put_failure;
668 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
669 goto nla_put_failure;
670
671 switch (priv->key) {
672 case NFT_CT_SRC:
673 case NFT_CT_DST:
674 case NFT_CT_SRC_IP:
675 case NFT_CT_DST_IP:
676 case NFT_CT_SRC_IP6:
677 case NFT_CT_DST_IP6:
678 case NFT_CT_PROTO_SRC:
679 case NFT_CT_PROTO_DST:
680 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
681 goto nla_put_failure;
682 break;
683 case NFT_CT_BYTES:
684 case NFT_CT_PKTS:
685 case NFT_CT_AVGPKT:
686 case NFT_CT_ZONE:
687 if (priv->dir < IP_CT_DIR_MAX &&
688 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
689 goto nla_put_failure;
690 break;
691 default:
692 break;
693 }
694
695 return 0;
696
697 nla_put_failure:
698 return -1;
699 }
700
nft_ct_set_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)701 static int nft_ct_set_dump(struct sk_buff *skb,
702 const struct nft_expr *expr, bool reset)
703 {
704 const struct nft_ct *priv = nft_expr_priv(expr);
705
706 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
707 goto nla_put_failure;
708 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
709 goto nla_put_failure;
710
711 switch (priv->key) {
712 case NFT_CT_ZONE:
713 if (priv->dir < IP_CT_DIR_MAX &&
714 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
715 goto nla_put_failure;
716 break;
717 default:
718 break;
719 }
720
721 return 0;
722
723 nla_put_failure:
724 return -1;
725 }
726
727 static struct nft_expr_type nft_ct_type;
728 static const struct nft_expr_ops nft_ct_get_ops = {
729 .type = &nft_ct_type,
730 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
731 .eval = nft_ct_get_eval,
732 .init = nft_ct_get_init,
733 .destroy = nft_ct_get_destroy,
734 .dump = nft_ct_get_dump,
735 };
736
737 #ifdef CONFIG_MITIGATION_RETPOLINE
738 static const struct nft_expr_ops nft_ct_get_fast_ops = {
739 .type = &nft_ct_type,
740 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
741 .eval = nft_ct_get_fast_eval,
742 .init = nft_ct_get_init,
743 .destroy = nft_ct_get_destroy,
744 .dump = nft_ct_get_dump,
745 };
746 #endif
747
748 static const struct nft_expr_ops nft_ct_set_ops = {
749 .type = &nft_ct_type,
750 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
751 .eval = nft_ct_set_eval,
752 .init = nft_ct_set_init,
753 .destroy = nft_ct_set_destroy,
754 .dump = nft_ct_set_dump,
755 };
756
757 #ifdef CONFIG_NF_CONNTRACK_ZONES
758 static const struct nft_expr_ops nft_ct_set_zone_ops = {
759 .type = &nft_ct_type,
760 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
761 .eval = nft_ct_set_zone_eval,
762 .init = nft_ct_set_init,
763 .destroy = nft_ct_set_destroy,
764 .dump = nft_ct_set_dump,
765 };
766 #endif
767
768 static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])769 nft_ct_select_ops(const struct nft_ctx *ctx,
770 const struct nlattr * const tb[])
771 {
772 if (tb[NFTA_CT_KEY] == NULL)
773 return ERR_PTR(-EINVAL);
774
775 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
776 return ERR_PTR(-EINVAL);
777
778 if (tb[NFTA_CT_DREG]) {
779 #ifdef CONFIG_MITIGATION_RETPOLINE
780 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
781
782 switch (k) {
783 case NFT_CT_STATE:
784 case NFT_CT_DIRECTION:
785 case NFT_CT_STATUS:
786 case NFT_CT_MARK:
787 case NFT_CT_SECMARK:
788 return &nft_ct_get_fast_ops;
789 }
790 #endif
791 return &nft_ct_get_ops;
792 }
793
794 if (tb[NFTA_CT_SREG]) {
795 #ifdef CONFIG_NF_CONNTRACK_ZONES
796 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
797 return &nft_ct_set_zone_ops;
798 #endif
799 return &nft_ct_set_ops;
800 }
801
802 return ERR_PTR(-EINVAL);
803 }
804
805 static struct nft_expr_type nft_ct_type __read_mostly = {
806 .name = "ct",
807 .select_ops = nft_ct_select_ops,
808 .policy = nft_ct_policy,
809 .maxattr = NFTA_CT_MAX,
810 .owner = THIS_MODULE,
811 };
812
nft_notrack_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)813 static void nft_notrack_eval(const struct nft_expr *expr,
814 struct nft_regs *regs,
815 const struct nft_pktinfo *pkt)
816 {
817 struct sk_buff *skb = pkt->skb;
818 enum ip_conntrack_info ctinfo;
819 struct nf_conn *ct;
820
821 ct = nf_ct_get(pkt->skb, &ctinfo);
822 /* Previously seen (loopback or untracked)? Ignore. */
823 if (ct || ctinfo == IP_CT_UNTRACKED)
824 return;
825
826 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
827 }
828
829 static struct nft_expr_type nft_notrack_type;
830 static const struct nft_expr_ops nft_notrack_ops = {
831 .type = &nft_notrack_type,
832 .size = NFT_EXPR_SIZE(0),
833 .eval = nft_notrack_eval,
834 };
835
836 static struct nft_expr_type nft_notrack_type __read_mostly = {
837 .name = "notrack",
838 .ops = &nft_notrack_ops,
839 .owner = THIS_MODULE,
840 };
841
842 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
843 static int
nft_ct_timeout_parse_policy(void * timeouts,const struct nf_conntrack_l4proto * l4proto,struct net * net,const struct nlattr * attr)844 nft_ct_timeout_parse_policy(void *timeouts,
845 const struct nf_conntrack_l4proto *l4proto,
846 struct net *net, const struct nlattr *attr)
847 {
848 struct nlattr **tb;
849 int ret = 0;
850
851 tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1);
852
853 if (!tb)
854 return -ENOMEM;
855
856 ret = nla_parse_nested_deprecated(tb,
857 l4proto->ctnl_timeout.nlattr_max,
858 attr,
859 l4proto->ctnl_timeout.nla_policy,
860 NULL);
861 if (ret < 0)
862 goto err;
863
864 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
865
866 err:
867 kfree(tb);
868 return ret;
869 }
870
871 struct nft_ct_timeout_obj {
872 struct nf_ct_timeout *timeout;
873 u8 l4proto;
874 };
875
nft_ct_timeout_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)876 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
877 struct nft_regs *regs,
878 const struct nft_pktinfo *pkt)
879 {
880 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
881 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
882 struct nf_conn_timeout *timeout;
883 const unsigned int *values;
884
885 if (priv->l4proto != pkt->tprot)
886 return;
887
888 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
889 return;
890
891 timeout = nf_ct_timeout_find(ct);
892 if (!timeout) {
893 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
894 if (!timeout) {
895 regs->verdict.code = NF_DROP;
896 return;
897 }
898 }
899
900 /* adjust the timeout as per 'new' state. ct is unconfirmed,
901 * so the current timestamp must not be added.
902 */
903 values = nf_ct_timeout_data(timeout);
904 if (values)
905 nf_ct_refresh(ct, values[0]);
906 }
907
nft_ct_timeout_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)908 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
909 const struct nlattr * const tb[],
910 struct nft_object *obj)
911 {
912 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
913 const struct nf_conntrack_l4proto *l4proto;
914 struct nf_ct_timeout *timeout;
915 int l3num = ctx->family;
916 __u8 l4num;
917 int ret;
918
919 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
920 !tb[NFTA_CT_TIMEOUT_DATA])
921 return -EINVAL;
922
923 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
924 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
925
926 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
927 priv->l4proto = l4num;
928
929 l4proto = nf_ct_l4proto_find(l4num);
930
931 if (l4proto->l4proto != l4num) {
932 ret = -EOPNOTSUPP;
933 goto err_proto_put;
934 }
935
936 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
937 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
938 if (timeout == NULL) {
939 ret = -ENOMEM;
940 goto err_proto_put;
941 }
942
943 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
944 tb[NFTA_CT_TIMEOUT_DATA]);
945 if (ret < 0)
946 goto err_free_timeout;
947
948 timeout->l3num = l3num;
949 timeout->l4proto = l4proto;
950 refcount_set(&timeout->refcnt, 1);
951
952 ret = nf_ct_netns_get(ctx->net, ctx->family);
953 if (ret < 0)
954 goto err_free_timeout;
955
956 priv->timeout = timeout;
957 return 0;
958
959 err_free_timeout:
960 kfree(timeout);
961 err_proto_put:
962 return ret;
963 }
964
nft_ct_timeout_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)965 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
966 struct nft_object *obj)
967 {
968 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
969 struct nf_ct_timeout *timeout = priv->timeout;
970
971 nf_ct_untimeout(ctx->net, timeout);
972 nf_ct_netns_put(ctx->net, ctx->family);
973 if (refcount_dec_and_test(&timeout->refcnt))
974 kfree_rcu(priv->timeout, rcu);
975 }
976
nft_ct_timeout_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)977 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
978 struct nft_object *obj, bool reset)
979 {
980 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
981 const struct nf_ct_timeout *timeout = priv->timeout;
982 struct nlattr *nest_params;
983 int ret;
984
985 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
986 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
987 return -1;
988
989 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
990 if (!nest_params)
991 return -1;
992
993 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
994 if (ret < 0)
995 return -1;
996 nla_nest_end(skb, nest_params);
997 return 0;
998 }
999
1000 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1001 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1002 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1003 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
1004 };
1005
1006 static struct nft_object_type nft_ct_timeout_obj_type;
1007
1008 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1009 .type = &nft_ct_timeout_obj_type,
1010 .size = sizeof(struct nft_ct_timeout_obj),
1011 .eval = nft_ct_timeout_obj_eval,
1012 .init = nft_ct_timeout_obj_init,
1013 .destroy = nft_ct_timeout_obj_destroy,
1014 .dump = nft_ct_timeout_obj_dump,
1015 };
1016
1017 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1018 .type = NFT_OBJECT_CT_TIMEOUT,
1019 .ops = &nft_ct_timeout_obj_ops,
1020 .maxattr = NFTA_CT_TIMEOUT_MAX,
1021 .policy = nft_ct_timeout_policy,
1022 .owner = THIS_MODULE,
1023 };
1024 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1025
nft_ct_helper_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1026 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1027 const struct nlattr * const tb[],
1028 struct nft_object *obj)
1029 {
1030 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1031 struct nf_conntrack_helper *help4, *help6;
1032 char name[NF_CT_HELPER_NAME_LEN];
1033 int family = ctx->family;
1034 int err;
1035
1036 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1037 return -EINVAL;
1038
1039 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1040 if (!priv->l4proto)
1041 return -ENOENT;
1042
1043 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1044
1045 if (tb[NFTA_CT_HELPER_L3PROTO])
1046 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1047
1048 help4 = NULL;
1049 help6 = NULL;
1050
1051 switch (family) {
1052 case NFPROTO_IPV4:
1053 if (ctx->family == NFPROTO_IPV6)
1054 return -EINVAL;
1055
1056 help4 = nf_conntrack_helper_try_module_get(name, family,
1057 priv->l4proto);
1058 break;
1059 case NFPROTO_IPV6:
1060 if (ctx->family == NFPROTO_IPV4)
1061 return -EINVAL;
1062
1063 help6 = nf_conntrack_helper_try_module_get(name, family,
1064 priv->l4proto);
1065 break;
1066 case NFPROTO_NETDEV:
1067 case NFPROTO_BRIDGE:
1068 case NFPROTO_INET:
1069 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1070 priv->l4proto);
1071 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1072 priv->l4proto);
1073 break;
1074 default:
1075 return -EAFNOSUPPORT;
1076 }
1077
1078 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1079 if (!help4 && !help6)
1080 return -ENOENT;
1081
1082 priv->helper4 = help4;
1083 priv->helper6 = help6;
1084
1085 err = nf_ct_netns_get(ctx->net, ctx->family);
1086 if (err < 0)
1087 goto err_put_helper;
1088
1089 return 0;
1090
1091 err_put_helper:
1092 if (priv->helper4)
1093 nf_conntrack_helper_put(priv->helper4);
1094 if (priv->helper6)
1095 nf_conntrack_helper_put(priv->helper6);
1096 return err;
1097 }
1098
nft_ct_helper_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1099 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1100 struct nft_object *obj)
1101 {
1102 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1103
1104 if (priv->helper4)
1105 nf_conntrack_helper_put(priv->helper4);
1106 if (priv->helper6)
1107 nf_conntrack_helper_put(priv->helper6);
1108
1109 nf_ct_netns_put(ctx->net, ctx->family);
1110 }
1111
nft_ct_helper_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1112 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1113 struct nft_regs *regs,
1114 const struct nft_pktinfo *pkt)
1115 {
1116 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1117 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1118 struct nf_conntrack_helper *to_assign = NULL;
1119 struct nf_conn_help *help;
1120
1121 if (!ct ||
1122 nf_ct_is_confirmed(ct) ||
1123 nf_ct_is_template(ct) ||
1124 priv->l4proto != nf_ct_protonum(ct))
1125 return;
1126
1127 switch (nf_ct_l3num(ct)) {
1128 case NFPROTO_IPV4:
1129 to_assign = priv->helper4;
1130 break;
1131 case NFPROTO_IPV6:
1132 to_assign = priv->helper6;
1133 break;
1134 default:
1135 DEBUG_NET_WARN_ON_ONCE(1);
1136 return;
1137 }
1138
1139 if (!to_assign)
1140 return;
1141
1142 if (test_bit(IPS_HELPER_BIT, &ct->status))
1143 return;
1144
1145 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1146 if (help && refcount_inc_not_zero(&to_assign->ct_refcnt)) {
1147 rcu_assign_pointer(help->helper, to_assign);
1148
1149 if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
1150 if (!nfct_seqadj_ext_add(ct))
1151 regs->verdict.code = NF_DROP;
1152 }
1153 }
1154
nft_ct_helper_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1155 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1156 struct nft_object *obj, bool reset)
1157 {
1158 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1159 const struct nf_conntrack_helper *helper;
1160 u16 family;
1161
1162 if (priv->helper4 && priv->helper6) {
1163 family = NFPROTO_INET;
1164 helper = priv->helper4;
1165 } else if (priv->helper6) {
1166 family = NFPROTO_IPV6;
1167 helper = priv->helper6;
1168 } else {
1169 family = NFPROTO_IPV4;
1170 helper = priv->helper4;
1171 }
1172
1173 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1174 return -1;
1175
1176 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1177 return -1;
1178
1179 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1180 return -1;
1181
1182 return 0;
1183 }
1184
1185 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1186 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1187 .len = NF_CT_HELPER_NAME_LEN - 1 },
1188 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1189 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1190 };
1191
1192 static struct nft_object_type nft_ct_helper_obj_type;
1193 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1194 .type = &nft_ct_helper_obj_type,
1195 .size = sizeof(struct nft_ct_helper_obj),
1196 .eval = nft_ct_helper_obj_eval,
1197 .init = nft_ct_helper_obj_init,
1198 .destroy = nft_ct_helper_obj_destroy,
1199 .dump = nft_ct_helper_obj_dump,
1200 };
1201
1202 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1203 .type = NFT_OBJECT_CT_HELPER,
1204 .ops = &nft_ct_helper_obj_ops,
1205 .maxattr = NFTA_CT_HELPER_MAX,
1206 .policy = nft_ct_helper_policy,
1207 .owner = THIS_MODULE,
1208 };
1209
1210 struct nft_ct_expect_obj {
1211 u16 l3num;
1212 __be16 dport;
1213 u8 l4proto;
1214 u8 size;
1215 u32 timeout;
1216
1217 struct nf_conntrack_helper *helper;
1218 };
1219
nft_ct_expect_timeout_get(const struct nlattr * attr,u32 * val)1220 static int nft_ct_expect_timeout_get(const struct nlattr *attr, u32 *val)
1221 {
1222 unsigned long jiffies_val = msecs_to_jiffies(nla_get_u32(attr));
1223
1224 if (jiffies_val > UINT_MAX)
1225 return -ERANGE;
1226
1227 *val = jiffies_val;
1228 return 0;
1229 }
1230
1231 #if IS_ENABLED(CONFIG_NF_NAT)
nft_ct_nat_follow_master(struct nf_conn * ct,struct nf_conntrack_expect * this)1232 static void nft_ct_nat_follow_master(struct nf_conn *ct, struct nf_conntrack_expect *this)
1233 {
1234 const struct nf_ct_helper_expectfn *expfn;
1235
1236 expfn = nf_ct_helper_expectfn_find_by_name("nat-follow-master");
1237 if (expfn)
1238 expfn->expectfn(ct, this);
1239 }
1240 #endif
1241
1242 struct nft_ct_expect_data {
1243 struct nft_ct_expect_obj obj;
1244 enum ip_conntrack_dir dir;
1245 };
1246
ct_expect_help(struct sk_buff * skb,unsigned int protoff,struct nf_conn * ct,enum ip_conntrack_info ctinfo)1247 static int ct_expect_help(struct sk_buff *skb, unsigned int protoff,
1248 struct nf_conn *ct, enum ip_conntrack_info ctinfo)
1249 {
1250 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
1251 struct nft_ct_expect_data *expect_data;
1252 struct nf_conntrack_expect *exp;
1253 int ret = NF_ACCEPT;
1254 u16 l3num;
1255
1256 if (nf_ct_is_confirmed(ct))
1257 return NF_ACCEPT;
1258
1259 expect_data = nfct_help_data(ct);
1260 if (!expect_data)
1261 return NF_ACCEPT;
1262
1263 if (expect_data->dir != dir)
1264 return NF_ACCEPT;
1265
1266 exp = nf_ct_expect_alloc(ct);
1267 if (!exp)
1268 return NF_DROP;
1269
1270 if (expect_data->obj.l3num == NFPROTO_INET)
1271 l3num = nf_ct_l3num(ct);
1272 else
1273 l3num = expect_data->obj.l3num;
1274
1275 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1276 &ct->tuplehash[!dir].tuple.src.u3,
1277 &ct->tuplehash[!dir].tuple.dst.u3,
1278 expect_data->obj.l4proto, NULL, &expect_data->obj.dport);
1279 exp->timeout += expect_data->obj.timeout;
1280
1281 #if IS_ENABLED(CONFIG_NF_NAT)
1282 if (ct->status & IPS_NAT_MASK) {
1283 exp->saved_proto.tcp.port = expect_data->obj.dport;
1284 exp->dir = !dir;
1285 exp->expectfn = nft_ct_nat_follow_master;
1286 }
1287 #endif
1288 if (nf_ct_expect_related(exp, 0) != 0)
1289 ret = NF_ACCEPT;
1290
1291 nf_ct_expect_put(exp);
1292
1293 return ret;
1294 }
1295
nft_ct_expect_helper_alloc(struct nft_ct_expect_obj * priv)1296 static int nft_ct_expect_helper_alloc(struct nft_ct_expect_obj *priv)
1297 {
1298 struct nf_conntrack_helper *ct_expect_helper;
1299
1300 ct_expect_helper = kzalloc_obj(struct nf_conntrack_helper,
1301 GFP_KERNEL_ACCOUNT);
1302 if (!ct_expect_helper)
1303 return -ENOMEM;
1304
1305 snprintf(ct_expect_helper->name, sizeof(ct_expect_helper->name), "%s",
1306 "nft_ct_expect");
1307 ct_expect_helper->me = THIS_MODULE;
1308 ct_expect_helper->expect_policy[NF_CT_EXPECT_CLASS_DEFAULT].max_expected = priv->size;
1309 rcu_assign_pointer(ct_expect_helper->help, ct_expect_help);
1310 refcount_set(&ct_expect_helper->ct_refcnt, 1);
1311
1312 /* No need to register this helper, this is internal. */
1313 priv->helper = ct_expect_helper;
1314
1315 return 0;
1316 }
1317
nft_ct_expect_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1318 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1319 const struct nlattr * const tb[],
1320 struct nft_object *obj)
1321 {
1322 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1323 int err;
1324
1325 NF_CT_HELPER_BUILD_BUG_ON(sizeof(struct nft_ct_expect_data));
1326
1327 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1328 !tb[NFTA_CT_EXPECT_DPORT] ||
1329 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1330 !tb[NFTA_CT_EXPECT_SIZE])
1331 return -EINVAL;
1332
1333 priv->l3num = ctx->family;
1334 if (tb[NFTA_CT_EXPECT_L3PROTO])
1335 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1336
1337 switch (priv->l3num) {
1338 case NFPROTO_IPV4:
1339 case NFPROTO_IPV6:
1340 if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1341 break;
1342
1343 return -EINVAL;
1344 case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1345 default:
1346 return -EAFNOSUPPORT;
1347 }
1348
1349 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1350 switch (priv->l4proto) {
1351 case IPPROTO_TCP:
1352 case IPPROTO_UDP:
1353 case IPPROTO_DCCP:
1354 case IPPROTO_SCTP:
1355 break;
1356 default:
1357 return -EOPNOTSUPP;
1358 }
1359
1360 err = nft_ct_expect_timeout_get(tb[NFTA_CT_EXPECT_TIMEOUT], &priv->timeout);
1361 if (err)
1362 return err;
1363
1364 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1365 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1366 if (!priv->size)
1367 priv->size = NF_CT_EXPECT_MAX_CNT;
1368
1369 err = nf_ct_netns_get(ctx->net, ctx->family);
1370 if (err < 0)
1371 return err;
1372
1373 err = nft_ct_expect_helper_alloc(priv);
1374 if (err < 0) {
1375 nf_ct_netns_put(ctx->net, ctx->family);
1376 return err;
1377 }
1378
1379 return err;
1380 }
1381
nft_ct_expect_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1382 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1383 struct nft_object *obj)
1384 {
1385 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1386 struct nf_conntrack_helper *me = priv->helper;
1387
1388 /* This helper is going away, disable it. */
1389 rcu_assign_pointer(me->help, NULL);
1390 nf_conntrack_helper_release(me);
1391 nf_ct_netns_put(ctx->net, ctx->family);
1392 }
1393
nft_ct_expect_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1394 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1395 struct nft_object *obj, bool reset)
1396 {
1397 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1398
1399 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1400 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1401 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1402 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, jiffies_to_msecs(priv->timeout)) ||
1403 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1404 return -1;
1405
1406 return 0;
1407 }
1408
nft_ct_expect_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1409 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1410 struct nft_regs *regs,
1411 const struct nft_pktinfo *pkt)
1412 {
1413 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1414 struct nft_ct_expect_data *expect_data;
1415 enum ip_conntrack_info ctinfo;
1416 struct nf_conn_help *help;
1417 struct nf_conn *ct;
1418
1419 ct = nf_ct_get(pkt->skb, &ctinfo);
1420 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1421 regs->verdict.code = NFT_BREAK;
1422 return;
1423 }
1424
1425 help = nfct_help(ct);
1426 if (help) {
1427 regs->verdict.code = NFT_BREAK;
1428 return;
1429 }
1430
1431 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1432 if (!help) {
1433 regs->verdict.code = NF_DROP;
1434 return;
1435 }
1436
1437 expect_data = nfct_help_data(ct);
1438 if (!expect_data) {
1439 regs->verdict.code = NFT_BREAK;
1440 return;
1441 }
1442 expect_data->obj = *priv;
1443 expect_data->obj.helper = NULL;
1444 expect_data->dir = CTINFO2DIR(ctinfo);
1445
1446 if (help && refcount_inc_not_zero(&priv->helper->ct_refcnt))
1447 rcu_assign_pointer(help->helper, priv->helper);
1448 }
1449
1450 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1451 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1452 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1453 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1454 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1455 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1456 };
1457
1458 static struct nft_object_type nft_ct_expect_obj_type;
1459
1460 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1461 .type = &nft_ct_expect_obj_type,
1462 .size = sizeof(struct nft_ct_expect_obj),
1463 .eval = nft_ct_expect_obj_eval,
1464 .init = nft_ct_expect_obj_init,
1465 .destroy = nft_ct_expect_obj_destroy,
1466 .dump = nft_ct_expect_obj_dump,
1467 };
1468
1469 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1470 .type = NFT_OBJECT_CT_EXPECT,
1471 .ops = &nft_ct_expect_obj_ops,
1472 .maxattr = NFTA_CT_EXPECT_MAX,
1473 .policy = nft_ct_expect_policy,
1474 .owner = THIS_MODULE,
1475 };
1476
1477 #if IS_ENABLED(CONFIG_NF_NAT)
1478 static struct nf_ct_helper_expectfn nft_ct_nat __read_mostly = {
1479 .name = "nft_ct-follow-master",
1480 .expectfn = nft_ct_nat_follow_master,
1481 };
1482 #endif
1483
nft_ct_module_init(void)1484 static int __init nft_ct_module_init(void)
1485 {
1486 int err;
1487
1488 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1489
1490 err = nft_register_expr(&nft_ct_type);
1491 if (err < 0)
1492 return err;
1493
1494 err = nft_register_expr(&nft_notrack_type);
1495 if (err < 0)
1496 goto err1;
1497
1498 err = nft_register_obj(&nft_ct_helper_obj_type);
1499 if (err < 0)
1500 goto err2;
1501
1502 err = nft_register_obj(&nft_ct_expect_obj_type);
1503 if (err < 0)
1504 goto err3;
1505 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1506 err = nft_register_obj(&nft_ct_timeout_obj_type);
1507 if (err < 0)
1508 goto err4;
1509 #endif
1510 #if IS_ENABLED(CONFIG_NF_NAT)
1511 nf_ct_helper_expectfn_register(&nft_ct_nat);
1512 #endif
1513 return 0;
1514
1515 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1516 err4:
1517 nft_unregister_obj(&nft_ct_expect_obj_type);
1518 #endif
1519 err3:
1520 nft_unregister_obj(&nft_ct_helper_obj_type);
1521 err2:
1522 nft_unregister_expr(&nft_notrack_type);
1523 err1:
1524 nft_unregister_expr(&nft_ct_type);
1525 return err;
1526 }
1527
nft_ct_module_exit(void)1528 static void __exit nft_ct_module_exit(void)
1529 {
1530 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1531 nft_unregister_obj(&nft_ct_timeout_obj_type);
1532 #endif
1533 nft_unregister_obj(&nft_ct_expect_obj_type);
1534 nft_unregister_obj(&nft_ct_helper_obj_type);
1535 nft_unregister_expr(&nft_notrack_type);
1536 nft_unregister_expr(&nft_ct_type);
1537
1538 #if IS_ENABLED(CONFIG_NF_NAT)
1539 nf_ct_helper_expectfn_unregister(&nft_ct_nat);
1540 synchronize_rcu();
1541 nf_ct_helper_expectfn_destroy(&nft_ct_nat);
1542 synchronize_rcu();
1543 #endif
1544 }
1545
1546 module_init(nft_ct_module_init);
1547 module_exit(nft_ct_module_exit);
1548
1549 MODULE_LICENSE("GPL");
1550 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1551 MODULE_ALIAS_NFT_EXPR("ct");
1552 MODULE_ALIAS_NFT_EXPR("notrack");
1553 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1554 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1555 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1556 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");
1557