1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 *
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 #include <net/netfilter/nf_conntrack_seqadj.h>
26 #include "nf_internals.h"
27
28 struct nft_ct_helper_obj {
29 struct nf_conntrack_helper *helper4;
30 struct nf_conntrack_helper *helper6;
31 u8 l4proto;
32 };
33
34 #ifdef CONFIG_NF_CONNTRACK_ZONES
35 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
36 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
37 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
38 #endif
39
nft_ct_get_eval_counter(const struct nf_conn_counter * c,enum nft_ct_keys k,enum ip_conntrack_dir d)40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
41 enum nft_ct_keys k,
42 enum ip_conntrack_dir d)
43 {
44 if (d < IP_CT_DIR_MAX)
45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
46 atomic64_read(&c[d].packets);
47
48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50 }
51
nft_ct_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)52 static void nft_ct_get_eval(const struct nft_expr *expr,
53 struct nft_regs *regs,
54 const struct nft_pktinfo *pkt)
55 {
56 const struct nft_ct *priv = nft_expr_priv(expr);
57 u32 *dest = ®s->data[priv->dreg];
58 enum ip_conntrack_info ctinfo;
59 const struct nf_conn *ct;
60 const struct nf_conn_help *help;
61 const struct nf_conntrack_tuple *tuple;
62 const struct nf_conntrack_helper *helper;
63 unsigned int state;
64
65 ct = nf_ct_get(pkt->skb, &ctinfo);
66
67 switch (priv->key) {
68 case NFT_CT_STATE:
69 if (ct)
70 state = NF_CT_STATE_BIT(ctinfo);
71 else if (ctinfo == IP_CT_UNTRACKED)
72 state = NF_CT_STATE_UNTRACKED_BIT;
73 else
74 state = NF_CT_STATE_INVALID_BIT;
75 *dest = state;
76 return;
77 default:
78 break;
79 }
80
81 if (ct == NULL)
82 goto err;
83
84 switch (priv->key) {
85 case NFT_CT_DIRECTION:
86 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
87 return;
88 case NFT_CT_STATUS:
89 *dest = ct->status;
90 return;
91 #ifdef CONFIG_NF_CONNTRACK_MARK
92 case NFT_CT_MARK:
93 *dest = READ_ONCE(ct->mark);
94 return;
95 #endif
96 #ifdef CONFIG_NF_CONNTRACK_SECMARK
97 case NFT_CT_SECMARK:
98 *dest = ct->secmark;
99 return;
100 #endif
101 case NFT_CT_EXPIRATION:
102 *dest = jiffies_to_msecs(nf_ct_expires(ct));
103 return;
104 case NFT_CT_HELPER:
105 if (ct->master == NULL)
106 goto err;
107 help = nfct_help(ct->master);
108 if (help == NULL)
109 goto err;
110 helper = rcu_dereference(help->helper);
111 if (helper == NULL)
112 goto err;
113 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
114 return;
115 #ifdef CONFIG_NF_CONNTRACK_LABELS
116 case NFT_CT_LABELS: {
117 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
118
119 if (labels)
120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
121 else
122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
123 return;
124 }
125 #endif
126 case NFT_CT_BYTES:
127 case NFT_CT_PKTS: {
128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
129 u64 count = 0;
130
131 if (acct)
132 count = nft_ct_get_eval_counter(acct->counter,
133 priv->key, priv->dir);
134 memcpy(dest, &count, sizeof(count));
135 return;
136 }
137 case NFT_CT_AVGPKT: {
138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140
141 if (acct) {
142 pcnt = nft_ct_get_eval_counter(acct->counter,
143 NFT_CT_PKTS, priv->dir);
144 bcnt = nft_ct_get_eval_counter(acct->counter,
145 NFT_CT_BYTES, priv->dir);
146 if (pcnt != 0)
147 avgcnt = div64_u64(bcnt, pcnt);
148 }
149
150 memcpy(dest, &avgcnt, sizeof(avgcnt));
151 return;
152 }
153 case NFT_CT_L3PROTOCOL:
154 nft_reg_store8(dest, nf_ct_l3num(ct));
155 return;
156 case NFT_CT_PROTOCOL:
157 nft_reg_store8(dest, nf_ct_protonum(ct));
158 return;
159 #ifdef CONFIG_NF_CONNTRACK_ZONES
160 case NFT_CT_ZONE: {
161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
162 u16 zoneid;
163
164 if (priv->dir < IP_CT_DIR_MAX)
165 zoneid = nf_ct_zone_id(zone, priv->dir);
166 else
167 zoneid = zone->id;
168
169 nft_reg_store16(dest, zoneid);
170 return;
171 }
172 #endif
173 case NFT_CT_ID:
174 *dest = nf_ct_get_id(ct);
175 return;
176 default:
177 break;
178 }
179
180 tuple = &ct->tuplehash[priv->dir].tuple;
181 switch (priv->key) {
182 case NFT_CT_SRC:
183 memcpy(dest, tuple->src.u3.all,
184 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
185 return;
186 case NFT_CT_DST:
187 memcpy(dest, tuple->dst.u3.all,
188 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
189 return;
190 case NFT_CT_PROTO_SRC:
191 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
192 return;
193 case NFT_CT_PROTO_DST:
194 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
195 return;
196 case NFT_CT_SRC_IP:
197 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
198 goto err;
199 *dest = (__force __u32)tuple->src.u3.ip;
200 return;
201 case NFT_CT_DST_IP:
202 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
203 goto err;
204 *dest = (__force __u32)tuple->dst.u3.ip;
205 return;
206 case NFT_CT_SRC_IP6:
207 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
208 goto err;
209 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
210 return;
211 case NFT_CT_DST_IP6:
212 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
213 goto err;
214 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
215 return;
216 default:
217 break;
218 }
219 return;
220 err:
221 regs->verdict.code = NFT_BREAK;
222 }
223
224 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_set_zone_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)225 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
226 struct nft_regs *regs,
227 const struct nft_pktinfo *pkt)
228 {
229 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
230 const struct nft_ct *priv = nft_expr_priv(expr);
231 struct sk_buff *skb = pkt->skb;
232 enum ip_conntrack_info ctinfo;
233 u16 value = nft_reg_load16(®s->data[priv->sreg]);
234 struct nf_conn *ct;
235 int oldcnt;
236
237 ct = nf_ct_get(skb, &ctinfo);
238 if (ct) /* already tracked */
239 return;
240
241 zone.id = value;
242
243 switch (priv->dir) {
244 case IP_CT_DIR_ORIGINAL:
245 zone.dir = NF_CT_ZONE_DIR_ORIG;
246 break;
247 case IP_CT_DIR_REPLY:
248 zone.dir = NF_CT_ZONE_DIR_REPL;
249 break;
250 default:
251 break;
252 }
253
254 ct = this_cpu_read(nft_ct_pcpu_template);
255
256 __refcount_inc(&ct->ct_general.use, &oldcnt);
257 if (likely(oldcnt == 1)) {
258 nf_ct_zone_add(ct, &zone);
259 } else {
260 refcount_dec(&ct->ct_general.use);
261 /* previous skb got queued to userspace, allocate temporary
262 * one until percpu template can be reused.
263 */
264 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
265 if (!ct) {
266 regs->verdict.code = NF_DROP;
267 return;
268 }
269 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
270 }
271
272 nf_ct_set(skb, ct, IP_CT_NEW);
273 }
274 #endif
275
nft_ct_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)276 static void nft_ct_set_eval(const struct nft_expr *expr,
277 struct nft_regs *regs,
278 const struct nft_pktinfo *pkt)
279 {
280 const struct nft_ct *priv = nft_expr_priv(expr);
281 struct sk_buff *skb = pkt->skb;
282 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
283 u32 value = regs->data[priv->sreg];
284 #endif
285 enum ip_conntrack_info ctinfo;
286 struct nf_conn *ct;
287
288 ct = nf_ct_get(skb, &ctinfo);
289 if (ct == NULL || nf_ct_is_template(ct))
290 return;
291
292 switch (priv->key) {
293 #ifdef CONFIG_NF_CONNTRACK_MARK
294 case NFT_CT_MARK:
295 if (READ_ONCE(ct->mark) != value) {
296 WRITE_ONCE(ct->mark, value);
297 nf_conntrack_event_cache(IPCT_MARK, ct);
298 }
299 break;
300 #endif
301 #ifdef CONFIG_NF_CONNTRACK_SECMARK
302 case NFT_CT_SECMARK:
303 if (ct->secmark != value) {
304 ct->secmark = value;
305 nf_conntrack_event_cache(IPCT_SECMARK, ct);
306 }
307 break;
308 #endif
309 #ifdef CONFIG_NF_CONNTRACK_LABELS
310 case NFT_CT_LABELS:
311 nf_connlabels_replace(ct,
312 ®s->data[priv->sreg],
313 ®s->data[priv->sreg],
314 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
315 break;
316 #endif
317 #ifdef CONFIG_NF_CONNTRACK_EVENTS
318 case NFT_CT_EVENTMASK: {
319 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
320 u32 ctmask = regs->data[priv->sreg];
321
322 if (e) {
323 if (e->ctmask != ctmask)
324 e->ctmask = ctmask;
325 break;
326 }
327
328 if (ctmask && !nf_ct_is_confirmed(ct))
329 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
330 break;
331 }
332 #endif
333 default:
334 break;
335 }
336 }
337
338 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
339 [NFTA_CT_DREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
340 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
341 [NFTA_CT_DIRECTION] = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY),
342 [NFTA_CT_SREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
343 };
344
345 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_tmpl_put_pcpu(void)346 static void nft_ct_tmpl_put_pcpu(void)
347 {
348 struct nf_conn *ct;
349 int cpu;
350
351 for_each_possible_cpu(cpu) {
352 ct = per_cpu(nft_ct_pcpu_template, cpu);
353 if (!ct)
354 break;
355 nf_ct_put(ct);
356 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
357 }
358 }
359
nft_ct_tmpl_alloc_pcpu(void)360 static bool nft_ct_tmpl_alloc_pcpu(void)
361 {
362 struct nf_conntrack_zone zone = { .id = 0 };
363 struct nf_conn *tmp;
364 int cpu;
365
366 if (nft_ct_pcpu_template_refcnt)
367 return true;
368
369 for_each_possible_cpu(cpu) {
370 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
371 if (!tmp) {
372 nft_ct_tmpl_put_pcpu();
373 return false;
374 }
375
376 __set_bit(IPS_CONFIRMED_BIT, &tmp->status);
377 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
378 }
379
380 return true;
381 }
382 #endif
383
__nft_ct_get_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)384 static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
385 {
386 #ifdef CONFIG_NF_CONNTRACK_LABELS
387 if (priv->key == NFT_CT_LABELS)
388 nf_connlabels_put(ctx->net);
389 #endif
390 }
391
nft_ct_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])392 static int nft_ct_get_init(const struct nft_ctx *ctx,
393 const struct nft_expr *expr,
394 const struct nlattr * const tb[])
395 {
396 struct nft_ct *priv = nft_expr_priv(expr);
397 unsigned int len;
398 int err;
399
400 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
401 priv->dir = IP_CT_DIR_MAX;
402 switch (priv->key) {
403 case NFT_CT_DIRECTION:
404 if (tb[NFTA_CT_DIRECTION] != NULL)
405 return -EINVAL;
406 len = sizeof(u8);
407 break;
408 case NFT_CT_STATE:
409 case NFT_CT_STATUS:
410 #ifdef CONFIG_NF_CONNTRACK_MARK
411 case NFT_CT_MARK:
412 #endif
413 #ifdef CONFIG_NF_CONNTRACK_SECMARK
414 case NFT_CT_SECMARK:
415 #endif
416 case NFT_CT_EXPIRATION:
417 if (tb[NFTA_CT_DIRECTION] != NULL)
418 return -EINVAL;
419 len = sizeof(u32);
420 break;
421 #ifdef CONFIG_NF_CONNTRACK_LABELS
422 case NFT_CT_LABELS:
423 if (tb[NFTA_CT_DIRECTION] != NULL)
424 return -EINVAL;
425 len = NF_CT_LABELS_MAX_SIZE;
426
427 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
428 if (err)
429 return err;
430 break;
431 #endif
432 case NFT_CT_HELPER:
433 if (tb[NFTA_CT_DIRECTION] != NULL)
434 return -EINVAL;
435 len = NF_CT_HELPER_NAME_LEN;
436 break;
437
438 case NFT_CT_L3PROTOCOL:
439 case NFT_CT_PROTOCOL:
440 /* For compatibility, do not report error if NFTA_CT_DIRECTION
441 * attribute is specified.
442 */
443 len = sizeof(u8);
444 break;
445 case NFT_CT_SRC:
446 case NFT_CT_DST:
447 if (tb[NFTA_CT_DIRECTION] == NULL)
448 return -EINVAL;
449
450 switch (ctx->family) {
451 case NFPROTO_IPV4:
452 len = sizeof_field(struct nf_conntrack_tuple,
453 src.u3.ip);
454 break;
455 case NFPROTO_IPV6:
456 case NFPROTO_INET:
457 len = sizeof_field(struct nf_conntrack_tuple,
458 src.u3.ip6);
459 break;
460 default:
461 return -EAFNOSUPPORT;
462 }
463 break;
464 case NFT_CT_SRC_IP:
465 case NFT_CT_DST_IP:
466 if (tb[NFTA_CT_DIRECTION] == NULL)
467 return -EINVAL;
468
469 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
470 break;
471 case NFT_CT_SRC_IP6:
472 case NFT_CT_DST_IP6:
473 if (tb[NFTA_CT_DIRECTION] == NULL)
474 return -EINVAL;
475
476 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
477 break;
478 case NFT_CT_PROTO_SRC:
479 case NFT_CT_PROTO_DST:
480 if (tb[NFTA_CT_DIRECTION] == NULL)
481 return -EINVAL;
482 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
483 break;
484 case NFT_CT_BYTES:
485 case NFT_CT_PKTS:
486 case NFT_CT_AVGPKT:
487 len = sizeof(u64);
488 break;
489 #ifdef CONFIG_NF_CONNTRACK_ZONES
490 case NFT_CT_ZONE:
491 len = sizeof(u16);
492 break;
493 #endif
494 case NFT_CT_ID:
495 if (tb[NFTA_CT_DIRECTION])
496 return -EINVAL;
497
498 len = sizeof(u32);
499 break;
500 default:
501 return -EOPNOTSUPP;
502 }
503
504 if (tb[NFTA_CT_DIRECTION] != NULL) {
505 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
506 switch (priv->dir) {
507 case IP_CT_DIR_ORIGINAL:
508 case IP_CT_DIR_REPLY:
509 break;
510 default:
511 err = -EINVAL;
512 goto err;
513 }
514 }
515
516 priv->len = len;
517 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
518 NFT_DATA_VALUE, len);
519 if (err < 0)
520 goto err;
521
522 err = nf_ct_netns_get(ctx->net, ctx->family);
523 if (err < 0)
524 goto err;
525
526 if (priv->key == NFT_CT_BYTES ||
527 priv->key == NFT_CT_PKTS ||
528 priv->key == NFT_CT_AVGPKT)
529 nf_ct_set_acct(ctx->net, true);
530
531 return 0;
532 err:
533 __nft_ct_get_destroy(ctx, priv);
534 return err;
535 }
536
__nft_ct_set_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)537 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
538 {
539 switch (priv->key) {
540 #ifdef CONFIG_NF_CONNTRACK_LABELS
541 case NFT_CT_LABELS:
542 nf_connlabels_put(ctx->net);
543 break;
544 #endif
545 #ifdef CONFIG_NF_CONNTRACK_ZONES
546 case NFT_CT_ZONE:
547 nf_queue_nf_hook_drop(ctx->net);
548 mutex_lock(&nft_ct_pcpu_mutex);
549 if (--nft_ct_pcpu_template_refcnt == 0)
550 nft_ct_tmpl_put_pcpu();
551 mutex_unlock(&nft_ct_pcpu_mutex);
552 break;
553 #endif
554 default:
555 break;
556 }
557 }
558
nft_ct_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])559 static int nft_ct_set_init(const struct nft_ctx *ctx,
560 const struct nft_expr *expr,
561 const struct nlattr * const tb[])
562 {
563 struct nft_ct *priv = nft_expr_priv(expr);
564 unsigned int len;
565 int err;
566
567 priv->dir = IP_CT_DIR_MAX;
568 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
569 switch (priv->key) {
570 #ifdef CONFIG_NF_CONNTRACK_MARK
571 case NFT_CT_MARK:
572 if (tb[NFTA_CT_DIRECTION])
573 return -EINVAL;
574 len = sizeof_field(struct nf_conn, mark);
575 break;
576 #endif
577 #ifdef CONFIG_NF_CONNTRACK_LABELS
578 case NFT_CT_LABELS:
579 if (tb[NFTA_CT_DIRECTION])
580 return -EINVAL;
581 len = NF_CT_LABELS_MAX_SIZE;
582 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
583 if (err)
584 return err;
585 break;
586 #endif
587 #ifdef CONFIG_NF_CONNTRACK_ZONES
588 case NFT_CT_ZONE:
589 mutex_lock(&nft_ct_pcpu_mutex);
590 if (!nft_ct_tmpl_alloc_pcpu()) {
591 mutex_unlock(&nft_ct_pcpu_mutex);
592 return -ENOMEM;
593 }
594 nft_ct_pcpu_template_refcnt++;
595 mutex_unlock(&nft_ct_pcpu_mutex);
596 len = sizeof(u16);
597 break;
598 #endif
599 #ifdef CONFIG_NF_CONNTRACK_EVENTS
600 case NFT_CT_EVENTMASK:
601 if (tb[NFTA_CT_DIRECTION])
602 return -EINVAL;
603 len = sizeof(u32);
604 break;
605 #endif
606 #ifdef CONFIG_NF_CONNTRACK_SECMARK
607 case NFT_CT_SECMARK:
608 if (tb[NFTA_CT_DIRECTION])
609 return -EINVAL;
610 len = sizeof(u32);
611 break;
612 #endif
613 default:
614 return -EOPNOTSUPP;
615 }
616
617 if (tb[NFTA_CT_DIRECTION]) {
618 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
619 switch (priv->dir) {
620 case IP_CT_DIR_ORIGINAL:
621 case IP_CT_DIR_REPLY:
622 break;
623 default:
624 err = -EINVAL;
625 goto err1;
626 }
627 }
628
629 priv->len = len;
630 err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len);
631 if (err < 0)
632 goto err1;
633
634 err = nf_ct_netns_get(ctx->net, ctx->family);
635 if (err < 0)
636 goto err1;
637
638 return 0;
639
640 err1:
641 __nft_ct_set_destroy(ctx, priv);
642 return err;
643 }
644
nft_ct_get_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)645 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
646 const struct nft_expr *expr)
647 {
648 struct nft_ct *priv = nft_expr_priv(expr);
649
650 __nft_ct_get_destroy(ctx, priv);
651 nf_ct_netns_put(ctx->net, ctx->family);
652 }
653
nft_ct_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)654 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
655 const struct nft_expr *expr)
656 {
657 struct nft_ct *priv = nft_expr_priv(expr);
658
659 __nft_ct_set_destroy(ctx, priv);
660 nf_ct_netns_put(ctx->net, ctx->family);
661 }
662
nft_ct_get_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)663 static int nft_ct_get_dump(struct sk_buff *skb,
664 const struct nft_expr *expr, bool reset)
665 {
666 const struct nft_ct *priv = nft_expr_priv(expr);
667
668 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
669 goto nla_put_failure;
670 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
671 goto nla_put_failure;
672
673 switch (priv->key) {
674 case NFT_CT_SRC:
675 case NFT_CT_DST:
676 case NFT_CT_SRC_IP:
677 case NFT_CT_DST_IP:
678 case NFT_CT_SRC_IP6:
679 case NFT_CT_DST_IP6:
680 case NFT_CT_PROTO_SRC:
681 case NFT_CT_PROTO_DST:
682 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
683 goto nla_put_failure;
684 break;
685 case NFT_CT_BYTES:
686 case NFT_CT_PKTS:
687 case NFT_CT_AVGPKT:
688 case NFT_CT_ZONE:
689 if (priv->dir < IP_CT_DIR_MAX &&
690 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
691 goto nla_put_failure;
692 break;
693 default:
694 break;
695 }
696
697 return 0;
698
699 nla_put_failure:
700 return -1;
701 }
702
nft_ct_set_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)703 static int nft_ct_set_dump(struct sk_buff *skb,
704 const struct nft_expr *expr, bool reset)
705 {
706 const struct nft_ct *priv = nft_expr_priv(expr);
707
708 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
709 goto nla_put_failure;
710 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
711 goto nla_put_failure;
712
713 switch (priv->key) {
714 case NFT_CT_ZONE:
715 if (priv->dir < IP_CT_DIR_MAX &&
716 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
717 goto nla_put_failure;
718 break;
719 default:
720 break;
721 }
722
723 return 0;
724
725 nla_put_failure:
726 return -1;
727 }
728
729 static struct nft_expr_type nft_ct_type;
730 static const struct nft_expr_ops nft_ct_get_ops = {
731 .type = &nft_ct_type,
732 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
733 .eval = nft_ct_get_eval,
734 .init = nft_ct_get_init,
735 .destroy = nft_ct_get_destroy,
736 .dump = nft_ct_get_dump,
737 };
738
739 #ifdef CONFIG_MITIGATION_RETPOLINE
740 static const struct nft_expr_ops nft_ct_get_fast_ops = {
741 .type = &nft_ct_type,
742 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
743 .eval = nft_ct_get_fast_eval,
744 .init = nft_ct_get_init,
745 .destroy = nft_ct_get_destroy,
746 .dump = nft_ct_get_dump,
747 };
748 #endif
749
750 static const struct nft_expr_ops nft_ct_set_ops = {
751 .type = &nft_ct_type,
752 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
753 .eval = nft_ct_set_eval,
754 .init = nft_ct_set_init,
755 .destroy = nft_ct_set_destroy,
756 .dump = nft_ct_set_dump,
757 };
758
759 #ifdef CONFIG_NF_CONNTRACK_ZONES
760 static const struct nft_expr_ops nft_ct_set_zone_ops = {
761 .type = &nft_ct_type,
762 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
763 .eval = nft_ct_set_zone_eval,
764 .init = nft_ct_set_init,
765 .destroy = nft_ct_set_destroy,
766 .dump = nft_ct_set_dump,
767 };
768 #endif
769
770 static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])771 nft_ct_select_ops(const struct nft_ctx *ctx,
772 const struct nlattr * const tb[])
773 {
774 if (tb[NFTA_CT_KEY] == NULL)
775 return ERR_PTR(-EINVAL);
776
777 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
778 return ERR_PTR(-EINVAL);
779
780 if (tb[NFTA_CT_DREG]) {
781 #ifdef CONFIG_MITIGATION_RETPOLINE
782 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
783
784 switch (k) {
785 case NFT_CT_STATE:
786 case NFT_CT_DIRECTION:
787 case NFT_CT_STATUS:
788 case NFT_CT_MARK:
789 case NFT_CT_SECMARK:
790 return &nft_ct_get_fast_ops;
791 }
792 #endif
793 return &nft_ct_get_ops;
794 }
795
796 if (tb[NFTA_CT_SREG]) {
797 #ifdef CONFIG_NF_CONNTRACK_ZONES
798 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
799 return &nft_ct_set_zone_ops;
800 #endif
801 return &nft_ct_set_ops;
802 }
803
804 return ERR_PTR(-EINVAL);
805 }
806
807 static struct nft_expr_type nft_ct_type __read_mostly = {
808 .name = "ct",
809 .select_ops = nft_ct_select_ops,
810 .policy = nft_ct_policy,
811 .maxattr = NFTA_CT_MAX,
812 .owner = THIS_MODULE,
813 };
814
nft_notrack_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)815 static void nft_notrack_eval(const struct nft_expr *expr,
816 struct nft_regs *regs,
817 const struct nft_pktinfo *pkt)
818 {
819 struct sk_buff *skb = pkt->skb;
820 enum ip_conntrack_info ctinfo;
821 struct nf_conn *ct;
822
823 ct = nf_ct_get(pkt->skb, &ctinfo);
824 /* Previously seen (loopback or untracked)? Ignore. */
825 if (ct || ctinfo == IP_CT_UNTRACKED)
826 return;
827
828 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
829 }
830
831 static struct nft_expr_type nft_notrack_type;
832 static const struct nft_expr_ops nft_notrack_ops = {
833 .type = &nft_notrack_type,
834 .size = NFT_EXPR_SIZE(0),
835 .eval = nft_notrack_eval,
836 };
837
838 static struct nft_expr_type nft_notrack_type __read_mostly = {
839 .name = "notrack",
840 .ops = &nft_notrack_ops,
841 .owner = THIS_MODULE,
842 };
843
844 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
845 static int
nft_ct_timeout_parse_policy(void * timeouts,const struct nf_conntrack_l4proto * l4proto,struct net * net,const struct nlattr * attr)846 nft_ct_timeout_parse_policy(void *timeouts,
847 const struct nf_conntrack_l4proto *l4proto,
848 struct net *net, const struct nlattr *attr)
849 {
850 struct nlattr **tb;
851 int ret = 0;
852
853 tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1);
854
855 if (!tb)
856 return -ENOMEM;
857
858 ret = nla_parse_nested_deprecated(tb,
859 l4proto->ctnl_timeout.nlattr_max,
860 attr,
861 l4proto->ctnl_timeout.nla_policy,
862 NULL);
863 if (ret < 0)
864 goto err;
865
866 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
867
868 err:
869 kfree(tb);
870 return ret;
871 }
872
873 struct nft_ct_timeout_obj {
874 struct nf_ct_timeout *timeout;
875 u8 l4proto;
876 };
877
nft_ct_timeout_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)878 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
879 struct nft_regs *regs,
880 const struct nft_pktinfo *pkt)
881 {
882 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
883 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
884 struct nf_conn_timeout *timeout;
885 const unsigned int *values;
886
887 if (priv->l4proto != pkt->tprot)
888 return;
889
890 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
891 return;
892
893 timeout = nf_ct_timeout_find(ct);
894 if (!timeout) {
895 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
896 if (!timeout) {
897 regs->verdict.code = NF_DROP;
898 return;
899 }
900 }
901
902 rcu_assign_pointer(timeout->timeout, priv->timeout);
903
904 /* adjust the timeout as per 'new' state. ct is unconfirmed,
905 * so the current timestamp must not be added.
906 */
907 values = nf_ct_timeout_data(timeout);
908 if (values)
909 nf_ct_refresh(ct, values[0]);
910 }
911
nft_ct_timeout_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)912 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
913 const struct nlattr * const tb[],
914 struct nft_object *obj)
915 {
916 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
917 const struct nf_conntrack_l4proto *l4proto;
918 struct nf_ct_timeout *timeout;
919 int l3num = ctx->family;
920 __u8 l4num;
921 int ret;
922
923 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
924 !tb[NFTA_CT_TIMEOUT_DATA])
925 return -EINVAL;
926
927 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
928 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
929
930 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
931 priv->l4proto = l4num;
932
933 l4proto = nf_ct_l4proto_find(l4num);
934
935 if (l4proto->l4proto != l4num) {
936 ret = -EOPNOTSUPP;
937 goto err_proto_put;
938 }
939
940 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
941 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
942 if (timeout == NULL) {
943 ret = -ENOMEM;
944 goto err_proto_put;
945 }
946
947 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
948 tb[NFTA_CT_TIMEOUT_DATA]);
949 if (ret < 0)
950 goto err_free_timeout;
951
952 timeout->l3num = l3num;
953 timeout->l4proto = l4proto;
954
955 ret = nf_ct_netns_get(ctx->net, ctx->family);
956 if (ret < 0)
957 goto err_free_timeout;
958
959 priv->timeout = timeout;
960 return 0;
961
962 err_free_timeout:
963 kfree(timeout);
964 err_proto_put:
965 return ret;
966 }
967
nft_ct_timeout_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)968 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
969 struct nft_object *obj)
970 {
971 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
972 struct nf_ct_timeout *timeout = priv->timeout;
973
974 nf_queue_nf_hook_drop(ctx->net);
975 nf_ct_untimeout(ctx->net, timeout);
976 nf_ct_netns_put(ctx->net, ctx->family);
977 kfree_rcu(priv->timeout, rcu);
978 }
979
nft_ct_timeout_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)980 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
981 struct nft_object *obj, bool reset)
982 {
983 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
984 const struct nf_ct_timeout *timeout = priv->timeout;
985 struct nlattr *nest_params;
986 int ret;
987
988 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
989 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
990 return -1;
991
992 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
993 if (!nest_params)
994 return -1;
995
996 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
997 if (ret < 0)
998 return -1;
999 nla_nest_end(skb, nest_params);
1000 return 0;
1001 }
1002
1003 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1004 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1005 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1006 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
1007 };
1008
1009 static struct nft_object_type nft_ct_timeout_obj_type;
1010
1011 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1012 .type = &nft_ct_timeout_obj_type,
1013 .size = sizeof(struct nft_ct_timeout_obj),
1014 .eval = nft_ct_timeout_obj_eval,
1015 .init = nft_ct_timeout_obj_init,
1016 .destroy = nft_ct_timeout_obj_destroy,
1017 .dump = nft_ct_timeout_obj_dump,
1018 };
1019
1020 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1021 .type = NFT_OBJECT_CT_TIMEOUT,
1022 .ops = &nft_ct_timeout_obj_ops,
1023 .maxattr = NFTA_CT_TIMEOUT_MAX,
1024 .policy = nft_ct_timeout_policy,
1025 .owner = THIS_MODULE,
1026 };
1027 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1028
nft_ct_helper_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1029 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1030 const struct nlattr * const tb[],
1031 struct nft_object *obj)
1032 {
1033 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1034 struct nf_conntrack_helper *help4, *help6;
1035 char name[NF_CT_HELPER_NAME_LEN];
1036 int family = ctx->family;
1037 int err;
1038
1039 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1040 return -EINVAL;
1041
1042 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1043 if (!priv->l4proto)
1044 return -ENOENT;
1045
1046 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1047
1048 if (tb[NFTA_CT_HELPER_L3PROTO])
1049 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1050
1051 help4 = NULL;
1052 help6 = NULL;
1053
1054 switch (family) {
1055 case NFPROTO_IPV4:
1056 if (ctx->family == NFPROTO_IPV6)
1057 return -EINVAL;
1058
1059 help4 = nf_conntrack_helper_try_module_get(name, family,
1060 priv->l4proto);
1061 break;
1062 case NFPROTO_IPV6:
1063 if (ctx->family == NFPROTO_IPV4)
1064 return -EINVAL;
1065
1066 help6 = nf_conntrack_helper_try_module_get(name, family,
1067 priv->l4proto);
1068 break;
1069 case NFPROTO_NETDEV:
1070 case NFPROTO_BRIDGE:
1071 case NFPROTO_INET:
1072 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1073 priv->l4proto);
1074 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1075 priv->l4proto);
1076 break;
1077 default:
1078 return -EAFNOSUPPORT;
1079 }
1080
1081 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1082 if (!help4 && !help6)
1083 return -ENOENT;
1084
1085 priv->helper4 = help4;
1086 priv->helper6 = help6;
1087
1088 err = nf_ct_netns_get(ctx->net, ctx->family);
1089 if (err < 0)
1090 goto err_put_helper;
1091
1092 return 0;
1093
1094 err_put_helper:
1095 if (priv->helper4)
1096 nf_conntrack_helper_put(priv->helper4);
1097 if (priv->helper6)
1098 nf_conntrack_helper_put(priv->helper6);
1099 return err;
1100 }
1101
nft_ct_helper_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1102 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1103 struct nft_object *obj)
1104 {
1105 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1106
1107 nf_queue_nf_hook_drop(ctx->net);
1108 if (priv->helper4)
1109 nf_conntrack_helper_put(priv->helper4);
1110 if (priv->helper6)
1111 nf_conntrack_helper_put(priv->helper6);
1112
1113 nf_ct_netns_put(ctx->net, ctx->family);
1114 }
1115
nft_ct_helper_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1116 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1117 struct nft_regs *regs,
1118 const struct nft_pktinfo *pkt)
1119 {
1120 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1121 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1122 struct nf_conntrack_helper *to_assign = NULL;
1123 struct nf_conn_help *help;
1124
1125 if (!ct ||
1126 nf_ct_is_confirmed(ct) ||
1127 nf_ct_is_template(ct) ||
1128 priv->l4proto != nf_ct_protonum(ct))
1129 return;
1130
1131 switch (nf_ct_l3num(ct)) {
1132 case NFPROTO_IPV4:
1133 to_assign = priv->helper4;
1134 break;
1135 case NFPROTO_IPV6:
1136 to_assign = priv->helper6;
1137 break;
1138 default:
1139 WARN_ON_ONCE(1);
1140 return;
1141 }
1142
1143 if (!to_assign)
1144 return;
1145
1146 if (test_bit(IPS_HELPER_BIT, &ct->status))
1147 return;
1148
1149 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1150 if (help) {
1151 rcu_assign_pointer(help->helper, to_assign);
1152 set_bit(IPS_HELPER_BIT, &ct->status);
1153
1154 if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
1155 if (!nfct_seqadj_ext_add(ct))
1156 regs->verdict.code = NF_DROP;
1157 }
1158 }
1159
nft_ct_helper_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1160 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1161 struct nft_object *obj, bool reset)
1162 {
1163 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1164 const struct nf_conntrack_helper *helper;
1165 u16 family;
1166
1167 if (priv->helper4 && priv->helper6) {
1168 family = NFPROTO_INET;
1169 helper = priv->helper4;
1170 } else if (priv->helper6) {
1171 family = NFPROTO_IPV6;
1172 helper = priv->helper6;
1173 } else {
1174 family = NFPROTO_IPV4;
1175 helper = priv->helper4;
1176 }
1177
1178 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1179 return -1;
1180
1181 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1182 return -1;
1183
1184 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1185 return -1;
1186
1187 return 0;
1188 }
1189
1190 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1191 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1192 .len = NF_CT_HELPER_NAME_LEN - 1 },
1193 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1194 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1195 };
1196
1197 static struct nft_object_type nft_ct_helper_obj_type;
1198 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1199 .type = &nft_ct_helper_obj_type,
1200 .size = sizeof(struct nft_ct_helper_obj),
1201 .eval = nft_ct_helper_obj_eval,
1202 .init = nft_ct_helper_obj_init,
1203 .destroy = nft_ct_helper_obj_destroy,
1204 .dump = nft_ct_helper_obj_dump,
1205 };
1206
1207 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1208 .type = NFT_OBJECT_CT_HELPER,
1209 .ops = &nft_ct_helper_obj_ops,
1210 .maxattr = NFTA_CT_HELPER_MAX,
1211 .policy = nft_ct_helper_policy,
1212 .owner = THIS_MODULE,
1213 };
1214
1215 struct nft_ct_expect_obj {
1216 u16 l3num;
1217 __be16 dport;
1218 u8 l4proto;
1219 u8 size;
1220 u32 timeout;
1221 };
1222
nft_ct_expect_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1223 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1224 const struct nlattr * const tb[],
1225 struct nft_object *obj)
1226 {
1227 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1228
1229 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1230 !tb[NFTA_CT_EXPECT_DPORT] ||
1231 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1232 !tb[NFTA_CT_EXPECT_SIZE])
1233 return -EINVAL;
1234
1235 priv->l3num = ctx->family;
1236 if (tb[NFTA_CT_EXPECT_L3PROTO])
1237 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1238
1239 switch (priv->l3num) {
1240 case NFPROTO_IPV4:
1241 case NFPROTO_IPV6:
1242 if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1243 break;
1244
1245 return -EINVAL;
1246 case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1247 default:
1248 return -EAFNOSUPPORT;
1249 }
1250
1251 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1252 switch (priv->l4proto) {
1253 case IPPROTO_TCP:
1254 case IPPROTO_UDP:
1255 case IPPROTO_DCCP:
1256 case IPPROTO_SCTP:
1257 break;
1258 default:
1259 return -EOPNOTSUPP;
1260 }
1261
1262 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1263 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1264 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1265
1266 return nf_ct_netns_get(ctx->net, ctx->family);
1267 }
1268
nft_ct_expect_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1269 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1270 struct nft_object *obj)
1271 {
1272 nf_ct_netns_put(ctx->net, ctx->family);
1273 }
1274
nft_ct_expect_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1275 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1276 struct nft_object *obj, bool reset)
1277 {
1278 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1279
1280 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1281 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1282 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1283 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1284 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1285 return -1;
1286
1287 return 0;
1288 }
1289
nft_ct_expect_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1290 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1291 struct nft_regs *regs,
1292 const struct nft_pktinfo *pkt)
1293 {
1294 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1295 struct nf_conntrack_expect *exp;
1296 enum ip_conntrack_info ctinfo;
1297 struct nf_conn_help *help;
1298 enum ip_conntrack_dir dir;
1299 u16 l3num = priv->l3num;
1300 struct nf_conn *ct;
1301
1302 ct = nf_ct_get(pkt->skb, &ctinfo);
1303 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1304 regs->verdict.code = NFT_BREAK;
1305 return;
1306 }
1307 dir = CTINFO2DIR(ctinfo);
1308
1309 help = nfct_help(ct);
1310 if (!help)
1311 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1312 if (!help) {
1313 regs->verdict.code = NF_DROP;
1314 return;
1315 }
1316
1317 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1318 regs->verdict.code = NFT_BREAK;
1319 return;
1320 }
1321 if (l3num == NFPROTO_INET)
1322 l3num = nf_ct_l3num(ct);
1323
1324 exp = nf_ct_expect_alloc(ct);
1325 if (exp == NULL) {
1326 regs->verdict.code = NF_DROP;
1327 return;
1328 }
1329 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1330 &ct->tuplehash[!dir].tuple.src.u3,
1331 &ct->tuplehash[!dir].tuple.dst.u3,
1332 priv->l4proto, NULL, &priv->dport);
1333 exp->timeout.expires = jiffies + priv->timeout * HZ;
1334
1335 if (nf_ct_expect_related(exp, 0) != 0)
1336 regs->verdict.code = NF_DROP;
1337
1338 nf_ct_expect_put(exp);
1339 }
1340
1341 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1342 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1343 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1344 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1345 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1346 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1347 };
1348
1349 static struct nft_object_type nft_ct_expect_obj_type;
1350
1351 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1352 .type = &nft_ct_expect_obj_type,
1353 .size = sizeof(struct nft_ct_expect_obj),
1354 .eval = nft_ct_expect_obj_eval,
1355 .init = nft_ct_expect_obj_init,
1356 .destroy = nft_ct_expect_obj_destroy,
1357 .dump = nft_ct_expect_obj_dump,
1358 };
1359
1360 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1361 .type = NFT_OBJECT_CT_EXPECT,
1362 .ops = &nft_ct_expect_obj_ops,
1363 .maxattr = NFTA_CT_EXPECT_MAX,
1364 .policy = nft_ct_expect_policy,
1365 .owner = THIS_MODULE,
1366 };
1367
nft_ct_module_init(void)1368 static int __init nft_ct_module_init(void)
1369 {
1370 int err;
1371
1372 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1373
1374 err = nft_register_expr(&nft_ct_type);
1375 if (err < 0)
1376 return err;
1377
1378 err = nft_register_expr(&nft_notrack_type);
1379 if (err < 0)
1380 goto err1;
1381
1382 err = nft_register_obj(&nft_ct_helper_obj_type);
1383 if (err < 0)
1384 goto err2;
1385
1386 err = nft_register_obj(&nft_ct_expect_obj_type);
1387 if (err < 0)
1388 goto err3;
1389 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1390 err = nft_register_obj(&nft_ct_timeout_obj_type);
1391 if (err < 0)
1392 goto err4;
1393 #endif
1394 return 0;
1395
1396 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1397 err4:
1398 nft_unregister_obj(&nft_ct_expect_obj_type);
1399 #endif
1400 err3:
1401 nft_unregister_obj(&nft_ct_helper_obj_type);
1402 err2:
1403 nft_unregister_expr(&nft_notrack_type);
1404 err1:
1405 nft_unregister_expr(&nft_ct_type);
1406 return err;
1407 }
1408
nft_ct_module_exit(void)1409 static void __exit nft_ct_module_exit(void)
1410 {
1411 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1412 nft_unregister_obj(&nft_ct_timeout_obj_type);
1413 #endif
1414 nft_unregister_obj(&nft_ct_expect_obj_type);
1415 nft_unregister_obj(&nft_ct_helper_obj_type);
1416 nft_unregister_expr(&nft_notrack_type);
1417 nft_unregister_expr(&nft_ct_type);
1418 }
1419
1420 module_init(nft_ct_module_init);
1421 module_exit(nft_ct_module_exit);
1422
1423 MODULE_LICENSE("GPL");
1424 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1425 MODULE_ALIAS_NFT_EXPR("ct");
1426 MODULE_ALIAS_NFT_EXPR("notrack");
1427 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1428 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1429 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1430 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");
1431