1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 *
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 #include <net/netfilter/nf_conntrack_seqadj.h>
26 #include "nf_internals.h"
27
28 struct nft_ct_helper_obj {
29 struct nf_conntrack_helper *helper4;
30 struct nf_conntrack_helper *helper6;
31 u8 l4proto;
32 };
33
34 #ifdef CONFIG_NF_CONNTRACK_ZONES
35 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
36 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
37 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
38 #endif
39
nft_ct_get_eval_counter(const struct nf_conn_counter * c,enum nft_ct_keys k,enum ip_conntrack_dir d)40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
41 enum nft_ct_keys k,
42 enum ip_conntrack_dir d)
43 {
44 if (d < IP_CT_DIR_MAX)
45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
46 atomic64_read(&c[d].packets);
47
48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50 }
51
nft_ct_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)52 static void nft_ct_get_eval(const struct nft_expr *expr,
53 struct nft_regs *regs,
54 const struct nft_pktinfo *pkt)
55 {
56 const struct nft_ct *priv = nft_expr_priv(expr);
57 u32 *dest = ®s->data[priv->dreg];
58 enum ip_conntrack_info ctinfo;
59 const struct nf_conn *ct;
60 const struct nf_conn_help *help;
61 const struct nf_conntrack_tuple *tuple;
62 const struct nf_conntrack_helper *helper;
63 unsigned int state;
64
65 ct = nf_ct_get(pkt->skb, &ctinfo);
66
67 switch (priv->key) {
68 case NFT_CT_STATE:
69 if (ct)
70 state = NF_CT_STATE_BIT(ctinfo);
71 else if (ctinfo == IP_CT_UNTRACKED)
72 state = NF_CT_STATE_UNTRACKED_BIT;
73 else
74 state = NF_CT_STATE_INVALID_BIT;
75 *dest = state;
76 return;
77 default:
78 break;
79 }
80
81 if (ct == NULL)
82 goto err;
83
84 switch (priv->key) {
85 case NFT_CT_DIRECTION:
86 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
87 return;
88 case NFT_CT_STATUS:
89 *dest = ct->status;
90 return;
91 #ifdef CONFIG_NF_CONNTRACK_MARK
92 case NFT_CT_MARK:
93 *dest = READ_ONCE(ct->mark);
94 return;
95 #endif
96 #ifdef CONFIG_NF_CONNTRACK_SECMARK
97 case NFT_CT_SECMARK:
98 *dest = ct->secmark;
99 return;
100 #endif
101 case NFT_CT_EXPIRATION:
102 *dest = jiffies_to_msecs(nf_ct_expires(ct));
103 return;
104 case NFT_CT_HELPER:
105 if (ct->master == NULL)
106 goto err;
107 help = nfct_help(ct->master);
108 if (help == NULL)
109 goto err;
110 helper = rcu_dereference(help->helper);
111 if (helper == NULL)
112 goto err;
113 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
114 return;
115 #ifdef CONFIG_NF_CONNTRACK_LABELS
116 case NFT_CT_LABELS: {
117 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
118
119 if (labels)
120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
121 else
122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
123 return;
124 }
125 #endif
126 case NFT_CT_BYTES:
127 case NFT_CT_PKTS: {
128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
129 u64 count = 0;
130
131 if (acct)
132 count = nft_ct_get_eval_counter(acct->counter,
133 priv->key, priv->dir);
134 memcpy(dest, &count, sizeof(count));
135 return;
136 }
137 case NFT_CT_AVGPKT: {
138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140
141 if (acct) {
142 pcnt = nft_ct_get_eval_counter(acct->counter,
143 NFT_CT_PKTS, priv->dir);
144 bcnt = nft_ct_get_eval_counter(acct->counter,
145 NFT_CT_BYTES, priv->dir);
146 if (pcnt != 0)
147 avgcnt = div64_u64(bcnt, pcnt);
148 }
149
150 memcpy(dest, &avgcnt, sizeof(avgcnt));
151 return;
152 }
153 case NFT_CT_L3PROTOCOL:
154 nft_reg_store8(dest, nf_ct_l3num(ct));
155 return;
156 case NFT_CT_PROTOCOL:
157 nft_reg_store8(dest, nf_ct_protonum(ct));
158 return;
159 #ifdef CONFIG_NF_CONNTRACK_ZONES
160 case NFT_CT_ZONE: {
161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
162 u16 zoneid;
163
164 if (priv->dir < IP_CT_DIR_MAX)
165 zoneid = nf_ct_zone_id(zone, priv->dir);
166 else
167 zoneid = zone->id;
168
169 nft_reg_store16(dest, zoneid);
170 return;
171 }
172 #endif
173 case NFT_CT_ID:
174 *dest = nf_ct_get_id(ct);
175 return;
176 default:
177 break;
178 }
179
180 tuple = &ct->tuplehash[priv->dir].tuple;
181 switch (priv->key) {
182 case NFT_CT_SRC:
183 memcpy(dest, tuple->src.u3.all,
184 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
185 return;
186 case NFT_CT_DST:
187 memcpy(dest, tuple->dst.u3.all,
188 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
189 return;
190 case NFT_CT_PROTO_SRC:
191 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
192 return;
193 case NFT_CT_PROTO_DST:
194 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
195 return;
196 case NFT_CT_SRC_IP:
197 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
198 goto err;
199 *dest = (__force __u32)tuple->src.u3.ip;
200 return;
201 case NFT_CT_DST_IP:
202 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
203 goto err;
204 *dest = (__force __u32)tuple->dst.u3.ip;
205 return;
206 case NFT_CT_SRC_IP6:
207 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
208 goto err;
209 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
210 return;
211 case NFT_CT_DST_IP6:
212 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
213 goto err;
214 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
215 return;
216 default:
217 break;
218 }
219 return;
220 err:
221 regs->verdict.code = NFT_BREAK;
222 }
223
224 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_set_zone_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)225 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
226 struct nft_regs *regs,
227 const struct nft_pktinfo *pkt)
228 {
229 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
230 const struct nft_ct *priv = nft_expr_priv(expr);
231 struct sk_buff *skb = pkt->skb;
232 enum ip_conntrack_info ctinfo;
233 u16 value = nft_reg_load16(®s->data[priv->sreg]);
234 struct nf_conn *ct;
235 int oldcnt;
236
237 ct = nf_ct_get(skb, &ctinfo);
238 if (ct) /* already tracked */
239 return;
240
241 zone.id = value;
242
243 switch (priv->dir) {
244 case IP_CT_DIR_ORIGINAL:
245 zone.dir = NF_CT_ZONE_DIR_ORIG;
246 break;
247 case IP_CT_DIR_REPLY:
248 zone.dir = NF_CT_ZONE_DIR_REPL;
249 break;
250 default:
251 break;
252 }
253
254 ct = this_cpu_read(nft_ct_pcpu_template);
255
256 __refcount_inc(&ct->ct_general.use, &oldcnt);
257 if (likely(oldcnt == 1)) {
258 nf_ct_zone_add(ct, &zone);
259 } else {
260 refcount_dec(&ct->ct_general.use);
261 /* previous skb got queued to userspace, allocate temporary
262 * one until percpu template can be reused.
263 */
264 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
265 if (!ct) {
266 regs->verdict.code = NF_DROP;
267 return;
268 }
269 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
270 }
271
272 nf_ct_set(skb, ct, IP_CT_NEW);
273 }
274 #endif
275
nft_ct_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)276 static void nft_ct_set_eval(const struct nft_expr *expr,
277 struct nft_regs *regs,
278 const struct nft_pktinfo *pkt)
279 {
280 const struct nft_ct *priv = nft_expr_priv(expr);
281 struct sk_buff *skb = pkt->skb;
282 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
283 u32 value = regs->data[priv->sreg];
284 #endif
285 enum ip_conntrack_info ctinfo;
286 struct nf_conn *ct;
287
288 ct = nf_ct_get(skb, &ctinfo);
289 if (ct == NULL || nf_ct_is_template(ct))
290 return;
291
292 switch (priv->key) {
293 #ifdef CONFIG_NF_CONNTRACK_MARK
294 case NFT_CT_MARK:
295 if (READ_ONCE(ct->mark) != value) {
296 WRITE_ONCE(ct->mark, value);
297 nf_conntrack_event_cache(IPCT_MARK, ct);
298 }
299 break;
300 #endif
301 #ifdef CONFIG_NF_CONNTRACK_SECMARK
302 case NFT_CT_SECMARK:
303 if (ct->secmark != value) {
304 ct->secmark = value;
305 nf_conntrack_event_cache(IPCT_SECMARK, ct);
306 }
307 break;
308 #endif
309 #ifdef CONFIG_NF_CONNTRACK_LABELS
310 case NFT_CT_LABELS:
311 nf_connlabels_replace(ct,
312 ®s->data[priv->sreg],
313 ®s->data[priv->sreg],
314 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
315 break;
316 #endif
317 #ifdef CONFIG_NF_CONNTRACK_EVENTS
318 case NFT_CT_EVENTMASK: {
319 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
320 u32 ctmask = regs->data[priv->sreg];
321
322 if (e) {
323 if (e->ctmask != ctmask)
324 e->ctmask = ctmask;
325 break;
326 }
327
328 if (ctmask && !nf_ct_is_confirmed(ct))
329 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
330 break;
331 }
332 #endif
333 default:
334 break;
335 }
336 }
337
338 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
339 [NFTA_CT_DREG] = { .type = NLA_U32 },
340 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
341 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
342 [NFTA_CT_SREG] = { .type = NLA_U32 },
343 };
344
345 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_tmpl_put_pcpu(void)346 static void nft_ct_tmpl_put_pcpu(void)
347 {
348 struct nf_conn *ct;
349 int cpu;
350
351 for_each_possible_cpu(cpu) {
352 ct = per_cpu(nft_ct_pcpu_template, cpu);
353 if (!ct)
354 break;
355 nf_ct_put(ct);
356 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
357 }
358 }
359
nft_ct_tmpl_alloc_pcpu(void)360 static bool nft_ct_tmpl_alloc_pcpu(void)
361 {
362 struct nf_conntrack_zone zone = { .id = 0 };
363 struct nf_conn *tmp;
364 int cpu;
365
366 if (nft_ct_pcpu_template_refcnt)
367 return true;
368
369 for_each_possible_cpu(cpu) {
370 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
371 if (!tmp) {
372 nft_ct_tmpl_put_pcpu();
373 return false;
374 }
375
376 __set_bit(IPS_CONFIRMED_BIT, &tmp->status);
377 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
378 }
379
380 return true;
381 }
382 #endif
383
__nft_ct_get_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)384 static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
385 {
386 #ifdef CONFIG_NF_CONNTRACK_LABELS
387 if (priv->key == NFT_CT_LABELS)
388 nf_connlabels_put(ctx->net);
389 #endif
390 }
391
nft_ct_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])392 static int nft_ct_get_init(const struct nft_ctx *ctx,
393 const struct nft_expr *expr,
394 const struct nlattr * const tb[])
395 {
396 struct nft_ct *priv = nft_expr_priv(expr);
397 unsigned int len;
398 int err;
399
400 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
401 priv->dir = IP_CT_DIR_MAX;
402 switch (priv->key) {
403 case NFT_CT_DIRECTION:
404 if (tb[NFTA_CT_DIRECTION] != NULL)
405 return -EINVAL;
406 len = sizeof(u8);
407 break;
408 case NFT_CT_STATE:
409 case NFT_CT_STATUS:
410 #ifdef CONFIG_NF_CONNTRACK_MARK
411 case NFT_CT_MARK:
412 #endif
413 #ifdef CONFIG_NF_CONNTRACK_SECMARK
414 case NFT_CT_SECMARK:
415 #endif
416 case NFT_CT_EXPIRATION:
417 if (tb[NFTA_CT_DIRECTION] != NULL)
418 return -EINVAL;
419 len = sizeof(u32);
420 break;
421 #ifdef CONFIG_NF_CONNTRACK_LABELS
422 case NFT_CT_LABELS:
423 if (tb[NFTA_CT_DIRECTION] != NULL)
424 return -EINVAL;
425 len = NF_CT_LABELS_MAX_SIZE;
426
427 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
428 if (err)
429 return err;
430 break;
431 #endif
432 case NFT_CT_HELPER:
433 if (tb[NFTA_CT_DIRECTION] != NULL)
434 return -EINVAL;
435 len = NF_CT_HELPER_NAME_LEN;
436 break;
437
438 case NFT_CT_L3PROTOCOL:
439 case NFT_CT_PROTOCOL:
440 /* For compatibility, do not report error if NFTA_CT_DIRECTION
441 * attribute is specified.
442 */
443 len = sizeof(u8);
444 break;
445 case NFT_CT_SRC:
446 case NFT_CT_DST:
447 if (tb[NFTA_CT_DIRECTION] == NULL)
448 return -EINVAL;
449
450 switch (ctx->family) {
451 case NFPROTO_IPV4:
452 len = sizeof_field(struct nf_conntrack_tuple,
453 src.u3.ip);
454 break;
455 case NFPROTO_IPV6:
456 case NFPROTO_INET:
457 len = sizeof_field(struct nf_conntrack_tuple,
458 src.u3.ip6);
459 break;
460 default:
461 return -EAFNOSUPPORT;
462 }
463 break;
464 case NFT_CT_SRC_IP:
465 case NFT_CT_DST_IP:
466 if (tb[NFTA_CT_DIRECTION] == NULL)
467 return -EINVAL;
468
469 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
470 break;
471 case NFT_CT_SRC_IP6:
472 case NFT_CT_DST_IP6:
473 if (tb[NFTA_CT_DIRECTION] == NULL)
474 return -EINVAL;
475
476 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
477 break;
478 case NFT_CT_PROTO_SRC:
479 case NFT_CT_PROTO_DST:
480 if (tb[NFTA_CT_DIRECTION] == NULL)
481 return -EINVAL;
482 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
483 break;
484 case NFT_CT_BYTES:
485 case NFT_CT_PKTS:
486 case NFT_CT_AVGPKT:
487 len = sizeof(u64);
488 break;
489 #ifdef CONFIG_NF_CONNTRACK_ZONES
490 case NFT_CT_ZONE:
491 len = sizeof(u16);
492 break;
493 #endif
494 case NFT_CT_ID:
495 if (tb[NFTA_CT_DIRECTION])
496 return -EINVAL;
497
498 len = sizeof(u32);
499 break;
500 default:
501 return -EOPNOTSUPP;
502 }
503
504 if (tb[NFTA_CT_DIRECTION] != NULL) {
505 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
506 switch (priv->dir) {
507 case IP_CT_DIR_ORIGINAL:
508 case IP_CT_DIR_REPLY:
509 break;
510 default:
511 err = -EINVAL;
512 goto err;
513 }
514 }
515
516 priv->len = len;
517 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
518 NFT_DATA_VALUE, len);
519 if (err < 0)
520 goto err;
521
522 err = nf_ct_netns_get(ctx->net, ctx->family);
523 if (err < 0)
524 goto err;
525
526 if (priv->key == NFT_CT_BYTES ||
527 priv->key == NFT_CT_PKTS ||
528 priv->key == NFT_CT_AVGPKT)
529 nf_ct_set_acct(ctx->net, true);
530
531 return 0;
532 err:
533 __nft_ct_get_destroy(ctx, priv);
534 return err;
535 }
536
__nft_ct_set_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)537 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
538 {
539 switch (priv->key) {
540 #ifdef CONFIG_NF_CONNTRACK_LABELS
541 case NFT_CT_LABELS:
542 nf_connlabels_put(ctx->net);
543 break;
544 #endif
545 #ifdef CONFIG_NF_CONNTRACK_ZONES
546 case NFT_CT_ZONE:
547 nf_queue_nf_hook_drop(ctx->net);
548 mutex_lock(&nft_ct_pcpu_mutex);
549 if (--nft_ct_pcpu_template_refcnt == 0)
550 nft_ct_tmpl_put_pcpu();
551 mutex_unlock(&nft_ct_pcpu_mutex);
552 break;
553 #endif
554 default:
555 break;
556 }
557 }
558
nft_ct_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])559 static int nft_ct_set_init(const struct nft_ctx *ctx,
560 const struct nft_expr *expr,
561 const struct nlattr * const tb[])
562 {
563 struct nft_ct *priv = nft_expr_priv(expr);
564 unsigned int len;
565 int err;
566
567 priv->dir = IP_CT_DIR_MAX;
568 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
569 switch (priv->key) {
570 #ifdef CONFIG_NF_CONNTRACK_MARK
571 case NFT_CT_MARK:
572 if (tb[NFTA_CT_DIRECTION])
573 return -EINVAL;
574 len = sizeof_field(struct nf_conn, mark);
575 break;
576 #endif
577 #ifdef CONFIG_NF_CONNTRACK_LABELS
578 case NFT_CT_LABELS:
579 if (tb[NFTA_CT_DIRECTION])
580 return -EINVAL;
581 len = NF_CT_LABELS_MAX_SIZE;
582 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
583 if (err)
584 return err;
585 break;
586 #endif
587 #ifdef CONFIG_NF_CONNTRACK_ZONES
588 case NFT_CT_ZONE:
589 mutex_lock(&nft_ct_pcpu_mutex);
590 if (!nft_ct_tmpl_alloc_pcpu()) {
591 mutex_unlock(&nft_ct_pcpu_mutex);
592 return -ENOMEM;
593 }
594 nft_ct_pcpu_template_refcnt++;
595 mutex_unlock(&nft_ct_pcpu_mutex);
596 len = sizeof(u16);
597 break;
598 #endif
599 #ifdef CONFIG_NF_CONNTRACK_EVENTS
600 case NFT_CT_EVENTMASK:
601 if (tb[NFTA_CT_DIRECTION])
602 return -EINVAL;
603 len = sizeof(u32);
604 break;
605 #endif
606 #ifdef CONFIG_NF_CONNTRACK_SECMARK
607 case NFT_CT_SECMARK:
608 if (tb[NFTA_CT_DIRECTION])
609 return -EINVAL;
610 len = sizeof(u32);
611 break;
612 #endif
613 default:
614 return -EOPNOTSUPP;
615 }
616
617 if (tb[NFTA_CT_DIRECTION]) {
618 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
619 switch (priv->dir) {
620 case IP_CT_DIR_ORIGINAL:
621 case IP_CT_DIR_REPLY:
622 break;
623 default:
624 err = -EINVAL;
625 goto err1;
626 }
627 }
628
629 priv->len = len;
630 err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len);
631 if (err < 0)
632 goto err1;
633
634 err = nf_ct_netns_get(ctx->net, ctx->family);
635 if (err < 0)
636 goto err1;
637
638 return 0;
639
640 err1:
641 __nft_ct_set_destroy(ctx, priv);
642 return err;
643 }
644
nft_ct_get_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)645 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
646 const struct nft_expr *expr)
647 {
648 struct nft_ct *priv = nft_expr_priv(expr);
649
650 __nft_ct_get_destroy(ctx, priv);
651 nf_ct_netns_put(ctx->net, ctx->family);
652 }
653
nft_ct_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)654 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
655 const struct nft_expr *expr)
656 {
657 struct nft_ct *priv = nft_expr_priv(expr);
658
659 __nft_ct_set_destroy(ctx, priv);
660 nf_ct_netns_put(ctx->net, ctx->family);
661 }
662
nft_ct_get_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)663 static int nft_ct_get_dump(struct sk_buff *skb,
664 const struct nft_expr *expr, bool reset)
665 {
666 const struct nft_ct *priv = nft_expr_priv(expr);
667
668 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
669 goto nla_put_failure;
670 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
671 goto nla_put_failure;
672
673 switch (priv->key) {
674 case NFT_CT_SRC:
675 case NFT_CT_DST:
676 case NFT_CT_SRC_IP:
677 case NFT_CT_DST_IP:
678 case NFT_CT_SRC_IP6:
679 case NFT_CT_DST_IP6:
680 case NFT_CT_PROTO_SRC:
681 case NFT_CT_PROTO_DST:
682 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
683 goto nla_put_failure;
684 break;
685 case NFT_CT_BYTES:
686 case NFT_CT_PKTS:
687 case NFT_CT_AVGPKT:
688 case NFT_CT_ZONE:
689 if (priv->dir < IP_CT_DIR_MAX &&
690 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
691 goto nla_put_failure;
692 break;
693 default:
694 break;
695 }
696
697 return 0;
698
699 nla_put_failure:
700 return -1;
701 }
702
nft_ct_get_reduce(struct nft_regs_track * track,const struct nft_expr * expr)703 static bool nft_ct_get_reduce(struct nft_regs_track *track,
704 const struct nft_expr *expr)
705 {
706 const struct nft_ct *priv = nft_expr_priv(expr);
707 const struct nft_ct *ct;
708
709 if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
710 nft_reg_track_update(track, expr, priv->dreg, priv->len);
711 return false;
712 }
713
714 ct = nft_expr_priv(track->regs[priv->dreg].selector);
715 if (priv->key != ct->key) {
716 nft_reg_track_update(track, expr, priv->dreg, priv->len);
717 return false;
718 }
719
720 if (!track->regs[priv->dreg].bitwise)
721 return true;
722
723 return nft_expr_reduce_bitwise(track, expr);
724 }
725
nft_ct_set_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)726 static int nft_ct_set_dump(struct sk_buff *skb,
727 const struct nft_expr *expr, bool reset)
728 {
729 const struct nft_ct *priv = nft_expr_priv(expr);
730
731 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
732 goto nla_put_failure;
733 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
734 goto nla_put_failure;
735
736 switch (priv->key) {
737 case NFT_CT_ZONE:
738 if (priv->dir < IP_CT_DIR_MAX &&
739 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
740 goto nla_put_failure;
741 break;
742 default:
743 break;
744 }
745
746 return 0;
747
748 nla_put_failure:
749 return -1;
750 }
751
752 static struct nft_expr_type nft_ct_type;
753 static const struct nft_expr_ops nft_ct_get_ops = {
754 .type = &nft_ct_type,
755 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
756 .eval = nft_ct_get_eval,
757 .init = nft_ct_get_init,
758 .destroy = nft_ct_get_destroy,
759 .dump = nft_ct_get_dump,
760 .reduce = nft_ct_get_reduce,
761 };
762
nft_ct_set_reduce(struct nft_regs_track * track,const struct nft_expr * expr)763 static bool nft_ct_set_reduce(struct nft_regs_track *track,
764 const struct nft_expr *expr)
765 {
766 int i;
767
768 for (i = 0; i < NFT_REG32_NUM; i++) {
769 if (!track->regs[i].selector)
770 continue;
771
772 if (track->regs[i].selector->ops != &nft_ct_get_ops)
773 continue;
774
775 __nft_reg_track_cancel(track, i);
776 }
777
778 return false;
779 }
780
781 #ifdef CONFIG_MITIGATION_RETPOLINE
782 static const struct nft_expr_ops nft_ct_get_fast_ops = {
783 .type = &nft_ct_type,
784 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
785 .eval = nft_ct_get_fast_eval,
786 .init = nft_ct_get_init,
787 .destroy = nft_ct_get_destroy,
788 .dump = nft_ct_get_dump,
789 .reduce = nft_ct_set_reduce,
790 };
791 #endif
792
793 static const struct nft_expr_ops nft_ct_set_ops = {
794 .type = &nft_ct_type,
795 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
796 .eval = nft_ct_set_eval,
797 .init = nft_ct_set_init,
798 .destroy = nft_ct_set_destroy,
799 .dump = nft_ct_set_dump,
800 .reduce = nft_ct_set_reduce,
801 };
802
803 #ifdef CONFIG_NF_CONNTRACK_ZONES
804 static const struct nft_expr_ops nft_ct_set_zone_ops = {
805 .type = &nft_ct_type,
806 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
807 .eval = nft_ct_set_zone_eval,
808 .init = nft_ct_set_init,
809 .destroy = nft_ct_set_destroy,
810 .dump = nft_ct_set_dump,
811 .reduce = nft_ct_set_reduce,
812 };
813 #endif
814
815 static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])816 nft_ct_select_ops(const struct nft_ctx *ctx,
817 const struct nlattr * const tb[])
818 {
819 if (tb[NFTA_CT_KEY] == NULL)
820 return ERR_PTR(-EINVAL);
821
822 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
823 return ERR_PTR(-EINVAL);
824
825 if (tb[NFTA_CT_DREG]) {
826 #ifdef CONFIG_MITIGATION_RETPOLINE
827 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
828
829 switch (k) {
830 case NFT_CT_STATE:
831 case NFT_CT_DIRECTION:
832 case NFT_CT_STATUS:
833 case NFT_CT_MARK:
834 case NFT_CT_SECMARK:
835 return &nft_ct_get_fast_ops;
836 }
837 #endif
838 return &nft_ct_get_ops;
839 }
840
841 if (tb[NFTA_CT_SREG]) {
842 #ifdef CONFIG_NF_CONNTRACK_ZONES
843 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
844 return &nft_ct_set_zone_ops;
845 #endif
846 return &nft_ct_set_ops;
847 }
848
849 return ERR_PTR(-EINVAL);
850 }
851
852 static struct nft_expr_type nft_ct_type __read_mostly = {
853 .name = "ct",
854 .select_ops = nft_ct_select_ops,
855 .policy = nft_ct_policy,
856 .maxattr = NFTA_CT_MAX,
857 .owner = THIS_MODULE,
858 };
859
nft_notrack_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)860 static void nft_notrack_eval(const struct nft_expr *expr,
861 struct nft_regs *regs,
862 const struct nft_pktinfo *pkt)
863 {
864 struct sk_buff *skb = pkt->skb;
865 enum ip_conntrack_info ctinfo;
866 struct nf_conn *ct;
867
868 ct = nf_ct_get(pkt->skb, &ctinfo);
869 /* Previously seen (loopback or untracked)? Ignore. */
870 if (ct || ctinfo == IP_CT_UNTRACKED)
871 return;
872
873 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
874 }
875
876 static struct nft_expr_type nft_notrack_type;
877 static const struct nft_expr_ops nft_notrack_ops = {
878 .type = &nft_notrack_type,
879 .size = NFT_EXPR_SIZE(0),
880 .eval = nft_notrack_eval,
881 .reduce = NFT_REDUCE_READONLY,
882 };
883
884 static struct nft_expr_type nft_notrack_type __read_mostly = {
885 .name = "notrack",
886 .ops = &nft_notrack_ops,
887 .owner = THIS_MODULE,
888 };
889
890 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
891 static int
nft_ct_timeout_parse_policy(void * timeouts,const struct nf_conntrack_l4proto * l4proto,struct net * net,const struct nlattr * attr)892 nft_ct_timeout_parse_policy(void *timeouts,
893 const struct nf_conntrack_l4proto *l4proto,
894 struct net *net, const struct nlattr *attr)
895 {
896 struct nlattr **tb;
897 int ret = 0;
898
899 tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1);
900
901 if (!tb)
902 return -ENOMEM;
903
904 ret = nla_parse_nested_deprecated(tb,
905 l4proto->ctnl_timeout.nlattr_max,
906 attr,
907 l4proto->ctnl_timeout.nla_policy,
908 NULL);
909 if (ret < 0)
910 goto err;
911
912 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
913
914 err:
915 kfree(tb);
916 return ret;
917 }
918
919 struct nft_ct_timeout_obj {
920 struct nf_ct_timeout *timeout;
921 u8 l4proto;
922 };
923
nft_ct_timeout_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)924 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
925 struct nft_regs *regs,
926 const struct nft_pktinfo *pkt)
927 {
928 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
929 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
930 struct nf_conn_timeout *timeout;
931 const unsigned int *values;
932
933 if (priv->l4proto != pkt->tprot)
934 return;
935
936 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
937 return;
938
939 timeout = nf_ct_timeout_find(ct);
940 if (!timeout) {
941 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
942 if (!timeout) {
943 regs->verdict.code = NF_DROP;
944 return;
945 }
946 }
947
948 rcu_assign_pointer(timeout->timeout, priv->timeout);
949
950 /* adjust the timeout as per 'new' state. ct is unconfirmed,
951 * so the current timestamp must not be added.
952 */
953 values = nf_ct_timeout_data(timeout);
954 if (values)
955 nf_ct_refresh(ct, values[0]);
956 }
957
nft_ct_timeout_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)958 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
959 const struct nlattr * const tb[],
960 struct nft_object *obj)
961 {
962 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
963 const struct nf_conntrack_l4proto *l4proto;
964 struct nf_ct_timeout *timeout;
965 int l3num = ctx->family;
966 __u8 l4num;
967 int ret;
968
969 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
970 !tb[NFTA_CT_TIMEOUT_DATA])
971 return -EINVAL;
972
973 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
974 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
975
976 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
977 priv->l4proto = l4num;
978
979 l4proto = nf_ct_l4proto_find(l4num);
980
981 if (l4proto->l4proto != l4num) {
982 ret = -EOPNOTSUPP;
983 goto err_proto_put;
984 }
985
986 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
987 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
988 if (timeout == NULL) {
989 ret = -ENOMEM;
990 goto err_proto_put;
991 }
992
993 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
994 tb[NFTA_CT_TIMEOUT_DATA]);
995 if (ret < 0)
996 goto err_free_timeout;
997
998 timeout->l3num = l3num;
999 timeout->l4proto = l4proto;
1000
1001 ret = nf_ct_netns_get(ctx->net, ctx->family);
1002 if (ret < 0)
1003 goto err_free_timeout;
1004
1005 priv->timeout = timeout;
1006 return 0;
1007
1008 err_free_timeout:
1009 kfree(timeout);
1010 err_proto_put:
1011 return ret;
1012 }
1013
nft_ct_timeout_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1014 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
1015 struct nft_object *obj)
1016 {
1017 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
1018 struct nf_ct_timeout *timeout = priv->timeout;
1019
1020 nf_queue_nf_hook_drop(ctx->net);
1021 nf_ct_untimeout(ctx->net, timeout);
1022 nf_ct_netns_put(ctx->net, ctx->family);
1023 kfree(priv->timeout);
1024 }
1025
nft_ct_timeout_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1026 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
1027 struct nft_object *obj, bool reset)
1028 {
1029 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
1030 const struct nf_ct_timeout *timeout = priv->timeout;
1031 struct nlattr *nest_params;
1032 int ret;
1033
1034 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
1035 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
1036 return -1;
1037
1038 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
1039 if (!nest_params)
1040 return -1;
1041
1042 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
1043 if (ret < 0)
1044 return -1;
1045 nla_nest_end(skb, nest_params);
1046 return 0;
1047 }
1048
1049 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1050 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1051 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1052 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
1053 };
1054
1055 static struct nft_object_type nft_ct_timeout_obj_type;
1056
1057 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1058 .type = &nft_ct_timeout_obj_type,
1059 .size = sizeof(struct nft_ct_timeout_obj),
1060 .eval = nft_ct_timeout_obj_eval,
1061 .init = nft_ct_timeout_obj_init,
1062 .destroy = nft_ct_timeout_obj_destroy,
1063 .dump = nft_ct_timeout_obj_dump,
1064 };
1065
1066 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1067 .type = NFT_OBJECT_CT_TIMEOUT,
1068 .ops = &nft_ct_timeout_obj_ops,
1069 .maxattr = NFTA_CT_TIMEOUT_MAX,
1070 .policy = nft_ct_timeout_policy,
1071 .owner = THIS_MODULE,
1072 };
1073 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1074
nft_ct_helper_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1075 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1076 const struct nlattr * const tb[],
1077 struct nft_object *obj)
1078 {
1079 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1080 struct nf_conntrack_helper *help4, *help6;
1081 char name[NF_CT_HELPER_NAME_LEN];
1082 int family = ctx->family;
1083 int err;
1084
1085 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1086 return -EINVAL;
1087
1088 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1089 if (!priv->l4proto)
1090 return -ENOENT;
1091
1092 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1093
1094 if (tb[NFTA_CT_HELPER_L3PROTO])
1095 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1096
1097 help4 = NULL;
1098 help6 = NULL;
1099
1100 switch (family) {
1101 case NFPROTO_IPV4:
1102 if (ctx->family == NFPROTO_IPV6)
1103 return -EINVAL;
1104
1105 help4 = nf_conntrack_helper_try_module_get(name, family,
1106 priv->l4proto);
1107 break;
1108 case NFPROTO_IPV6:
1109 if (ctx->family == NFPROTO_IPV4)
1110 return -EINVAL;
1111
1112 help6 = nf_conntrack_helper_try_module_get(name, family,
1113 priv->l4proto);
1114 break;
1115 case NFPROTO_NETDEV:
1116 case NFPROTO_BRIDGE:
1117 case NFPROTO_INET:
1118 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1119 priv->l4proto);
1120 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1121 priv->l4proto);
1122 break;
1123 default:
1124 return -EAFNOSUPPORT;
1125 }
1126
1127 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1128 if (!help4 && !help6)
1129 return -ENOENT;
1130
1131 priv->helper4 = help4;
1132 priv->helper6 = help6;
1133
1134 err = nf_ct_netns_get(ctx->net, ctx->family);
1135 if (err < 0)
1136 goto err_put_helper;
1137
1138 return 0;
1139
1140 err_put_helper:
1141 if (priv->helper4)
1142 nf_conntrack_helper_put(priv->helper4);
1143 if (priv->helper6)
1144 nf_conntrack_helper_put(priv->helper6);
1145 return err;
1146 }
1147
nft_ct_helper_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1148 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1149 struct nft_object *obj)
1150 {
1151 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1152
1153 nf_queue_nf_hook_drop(ctx->net);
1154 if (priv->helper4)
1155 nf_conntrack_helper_put(priv->helper4);
1156 if (priv->helper6)
1157 nf_conntrack_helper_put(priv->helper6);
1158
1159 nf_ct_netns_put(ctx->net, ctx->family);
1160 }
1161
nft_ct_helper_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1162 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1163 struct nft_regs *regs,
1164 const struct nft_pktinfo *pkt)
1165 {
1166 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1167 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1168 struct nf_conntrack_helper *to_assign = NULL;
1169 struct nf_conn_help *help;
1170
1171 if (!ct ||
1172 nf_ct_is_confirmed(ct) ||
1173 nf_ct_is_template(ct) ||
1174 priv->l4proto != nf_ct_protonum(ct))
1175 return;
1176
1177 switch (nf_ct_l3num(ct)) {
1178 case NFPROTO_IPV4:
1179 to_assign = priv->helper4;
1180 break;
1181 case NFPROTO_IPV6:
1182 to_assign = priv->helper6;
1183 break;
1184 default:
1185 WARN_ON_ONCE(1);
1186 return;
1187 }
1188
1189 if (!to_assign)
1190 return;
1191
1192 if (test_bit(IPS_HELPER_BIT, &ct->status))
1193 return;
1194
1195 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1196 if (help) {
1197 rcu_assign_pointer(help->helper, to_assign);
1198 set_bit(IPS_HELPER_BIT, &ct->status);
1199
1200 if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
1201 if (!nfct_seqadj_ext_add(ct))
1202 regs->verdict.code = NF_DROP;
1203 }
1204 }
1205
nft_ct_helper_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1206 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1207 struct nft_object *obj, bool reset)
1208 {
1209 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1210 const struct nf_conntrack_helper *helper;
1211 u16 family;
1212
1213 if (priv->helper4 && priv->helper6) {
1214 family = NFPROTO_INET;
1215 helper = priv->helper4;
1216 } else if (priv->helper6) {
1217 family = NFPROTO_IPV6;
1218 helper = priv->helper6;
1219 } else {
1220 family = NFPROTO_IPV4;
1221 helper = priv->helper4;
1222 }
1223
1224 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1225 return -1;
1226
1227 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1228 return -1;
1229
1230 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1231 return -1;
1232
1233 return 0;
1234 }
1235
1236 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1237 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1238 .len = NF_CT_HELPER_NAME_LEN - 1 },
1239 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1240 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1241 };
1242
1243 static struct nft_object_type nft_ct_helper_obj_type;
1244 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1245 .type = &nft_ct_helper_obj_type,
1246 .size = sizeof(struct nft_ct_helper_obj),
1247 .eval = nft_ct_helper_obj_eval,
1248 .init = nft_ct_helper_obj_init,
1249 .destroy = nft_ct_helper_obj_destroy,
1250 .dump = nft_ct_helper_obj_dump,
1251 };
1252
1253 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1254 .type = NFT_OBJECT_CT_HELPER,
1255 .ops = &nft_ct_helper_obj_ops,
1256 .maxattr = NFTA_CT_HELPER_MAX,
1257 .policy = nft_ct_helper_policy,
1258 .owner = THIS_MODULE,
1259 };
1260
1261 struct nft_ct_expect_obj {
1262 u16 l3num;
1263 __be16 dport;
1264 u8 l4proto;
1265 u8 size;
1266 u32 timeout;
1267 };
1268
nft_ct_expect_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1269 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1270 const struct nlattr * const tb[],
1271 struct nft_object *obj)
1272 {
1273 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1274
1275 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1276 !tb[NFTA_CT_EXPECT_DPORT] ||
1277 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1278 !tb[NFTA_CT_EXPECT_SIZE])
1279 return -EINVAL;
1280
1281 priv->l3num = ctx->family;
1282 if (tb[NFTA_CT_EXPECT_L3PROTO])
1283 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1284
1285 switch (priv->l3num) {
1286 case NFPROTO_IPV4:
1287 case NFPROTO_IPV6:
1288 if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1289 break;
1290
1291 return -EINVAL;
1292 case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1293 default:
1294 return -EAFNOSUPPORT;
1295 }
1296
1297 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1298 switch (priv->l4proto) {
1299 case IPPROTO_TCP:
1300 case IPPROTO_UDP:
1301 case IPPROTO_UDPLITE:
1302 case IPPROTO_DCCP:
1303 case IPPROTO_SCTP:
1304 break;
1305 default:
1306 return -EOPNOTSUPP;
1307 }
1308
1309 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1310 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1311 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1312
1313 return nf_ct_netns_get(ctx->net, ctx->family);
1314 }
1315
nft_ct_expect_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1316 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1317 struct nft_object *obj)
1318 {
1319 nf_ct_netns_put(ctx->net, ctx->family);
1320 }
1321
nft_ct_expect_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1322 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1323 struct nft_object *obj, bool reset)
1324 {
1325 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1326
1327 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1328 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1329 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1330 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1331 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1332 return -1;
1333
1334 return 0;
1335 }
1336
nft_ct_expect_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1337 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1338 struct nft_regs *regs,
1339 const struct nft_pktinfo *pkt)
1340 {
1341 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1342 struct nf_conntrack_expect *exp;
1343 enum ip_conntrack_info ctinfo;
1344 struct nf_conn_help *help;
1345 enum ip_conntrack_dir dir;
1346 u16 l3num = priv->l3num;
1347 struct nf_conn *ct;
1348
1349 ct = nf_ct_get(pkt->skb, &ctinfo);
1350 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1351 regs->verdict.code = NFT_BREAK;
1352 return;
1353 }
1354 dir = CTINFO2DIR(ctinfo);
1355
1356 help = nfct_help(ct);
1357 if (!help)
1358 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1359 if (!help) {
1360 regs->verdict.code = NF_DROP;
1361 return;
1362 }
1363
1364 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1365 regs->verdict.code = NFT_BREAK;
1366 return;
1367 }
1368 if (l3num == NFPROTO_INET)
1369 l3num = nf_ct_l3num(ct);
1370
1371 exp = nf_ct_expect_alloc(ct);
1372 if (exp == NULL) {
1373 regs->verdict.code = NF_DROP;
1374 return;
1375 }
1376 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1377 &ct->tuplehash[!dir].tuple.src.u3,
1378 &ct->tuplehash[!dir].tuple.dst.u3,
1379 priv->l4proto, NULL, &priv->dport);
1380 exp->timeout.expires = jiffies + priv->timeout * HZ;
1381
1382 if (nf_ct_expect_related(exp, 0) != 0)
1383 regs->verdict.code = NF_DROP;
1384 }
1385
1386 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1387 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1388 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1389 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1390 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1391 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1392 };
1393
1394 static struct nft_object_type nft_ct_expect_obj_type;
1395
1396 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1397 .type = &nft_ct_expect_obj_type,
1398 .size = sizeof(struct nft_ct_expect_obj),
1399 .eval = nft_ct_expect_obj_eval,
1400 .init = nft_ct_expect_obj_init,
1401 .destroy = nft_ct_expect_obj_destroy,
1402 .dump = nft_ct_expect_obj_dump,
1403 };
1404
1405 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1406 .type = NFT_OBJECT_CT_EXPECT,
1407 .ops = &nft_ct_expect_obj_ops,
1408 .maxattr = NFTA_CT_EXPECT_MAX,
1409 .policy = nft_ct_expect_policy,
1410 .owner = THIS_MODULE,
1411 };
1412
nft_ct_module_init(void)1413 static int __init nft_ct_module_init(void)
1414 {
1415 int err;
1416
1417 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1418
1419 err = nft_register_expr(&nft_ct_type);
1420 if (err < 0)
1421 return err;
1422
1423 err = nft_register_expr(&nft_notrack_type);
1424 if (err < 0)
1425 goto err1;
1426
1427 err = nft_register_obj(&nft_ct_helper_obj_type);
1428 if (err < 0)
1429 goto err2;
1430
1431 err = nft_register_obj(&nft_ct_expect_obj_type);
1432 if (err < 0)
1433 goto err3;
1434 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1435 err = nft_register_obj(&nft_ct_timeout_obj_type);
1436 if (err < 0)
1437 goto err4;
1438 #endif
1439 return 0;
1440
1441 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1442 err4:
1443 nft_unregister_obj(&nft_ct_expect_obj_type);
1444 #endif
1445 err3:
1446 nft_unregister_obj(&nft_ct_helper_obj_type);
1447 err2:
1448 nft_unregister_expr(&nft_notrack_type);
1449 err1:
1450 nft_unregister_expr(&nft_ct_type);
1451 return err;
1452 }
1453
nft_ct_module_exit(void)1454 static void __exit nft_ct_module_exit(void)
1455 {
1456 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1457 nft_unregister_obj(&nft_ct_timeout_obj_type);
1458 #endif
1459 nft_unregister_obj(&nft_ct_expect_obj_type);
1460 nft_unregister_obj(&nft_ct_helper_obj_type);
1461 nft_unregister_expr(&nft_notrack_type);
1462 nft_unregister_expr(&nft_ct_type);
1463 }
1464
1465 module_init(nft_ct_module_init);
1466 module_exit(nft_ct_module_exit);
1467
1468 MODULE_LICENSE("GPL");
1469 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1470 MODULE_ALIAS_NFT_EXPR("ct");
1471 MODULE_ALIAS_NFT_EXPR("notrack");
1472 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1473 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1474 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1475 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");
1476