xref: /linux/net/netfilter/nft_ct.c (revision 66182ca873a4e87b3496eca79d57f86b76d7f52d)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5  *
6  * Development of this code funded by Astaro AG (http://www.astaro.com/)
7  */
8 
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 #include <net/netfilter/nf_conntrack_seqadj.h>
26 #include "nf_internals.h"
27 
28 struct nft_ct_helper_obj  {
29 	struct nf_conntrack_helper *helper4;
30 	struct nf_conntrack_helper *helper6;
31 	u8 l4proto;
32 };
33 
34 #ifdef CONFIG_NF_CONNTRACK_ZONES
35 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
36 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
37 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
38 #endif
39 
nft_ct_get_eval_counter(const struct nf_conn_counter * c,enum nft_ct_keys k,enum ip_conntrack_dir d)40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
41 				   enum nft_ct_keys k,
42 				   enum ip_conntrack_dir d)
43 {
44 	if (d < IP_CT_DIR_MAX)
45 		return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
46 					   atomic64_read(&c[d].packets);
47 
48 	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
49 	       nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50 }
51 
nft_ct_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)52 static void nft_ct_get_eval(const struct nft_expr *expr,
53 			    struct nft_regs *regs,
54 			    const struct nft_pktinfo *pkt)
55 {
56 	const struct nft_ct *priv = nft_expr_priv(expr);
57 	u32 *dest = &regs->data[priv->dreg];
58 	enum ip_conntrack_info ctinfo;
59 	const struct nf_conn *ct;
60 	const struct nf_conn_help *help;
61 	const struct nf_conntrack_tuple *tuple;
62 	const struct nf_conntrack_helper *helper;
63 	unsigned int state;
64 
65 	ct = nf_ct_get(pkt->skb, &ctinfo);
66 
67 	switch (priv->key) {
68 	case NFT_CT_STATE:
69 		if (ct)
70 			state = NF_CT_STATE_BIT(ctinfo);
71 		else if (ctinfo == IP_CT_UNTRACKED)
72 			state = NF_CT_STATE_UNTRACKED_BIT;
73 		else
74 			state = NF_CT_STATE_INVALID_BIT;
75 		*dest = state;
76 		return;
77 	default:
78 		break;
79 	}
80 
81 	if (ct == NULL)
82 		goto err;
83 
84 	switch (priv->key) {
85 	case NFT_CT_DIRECTION:
86 		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
87 		return;
88 	case NFT_CT_STATUS:
89 		*dest = ct->status;
90 		return;
91 #ifdef CONFIG_NF_CONNTRACK_MARK
92 	case NFT_CT_MARK:
93 		*dest = READ_ONCE(ct->mark);
94 		return;
95 #endif
96 #ifdef CONFIG_NF_CONNTRACK_SECMARK
97 	case NFT_CT_SECMARK:
98 		*dest = ct->secmark;
99 		return;
100 #endif
101 	case NFT_CT_EXPIRATION:
102 		*dest = jiffies_to_msecs(nf_ct_expires(ct));
103 		return;
104 	case NFT_CT_HELPER:
105 		if (ct->master == NULL)
106 			goto err;
107 		help = nfct_help(ct->master);
108 		if (help == NULL)
109 			goto err;
110 		helper = rcu_dereference(help->helper);
111 		if (helper == NULL)
112 			goto err;
113 		strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
114 		return;
115 #ifdef CONFIG_NF_CONNTRACK_LABELS
116 	case NFT_CT_LABELS: {
117 		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
118 
119 		if (labels)
120 			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
121 		else
122 			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
123 		return;
124 	}
125 #endif
126 	case NFT_CT_BYTES:
127 	case NFT_CT_PKTS: {
128 		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
129 		u64 count = 0;
130 
131 		if (acct)
132 			count = nft_ct_get_eval_counter(acct->counter,
133 							priv->key, priv->dir);
134 		memcpy(dest, &count, sizeof(count));
135 		return;
136 	}
137 	case NFT_CT_AVGPKT: {
138 		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 		u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140 
141 		if (acct) {
142 			pcnt = nft_ct_get_eval_counter(acct->counter,
143 						       NFT_CT_PKTS, priv->dir);
144 			bcnt = nft_ct_get_eval_counter(acct->counter,
145 						       NFT_CT_BYTES, priv->dir);
146 			if (pcnt != 0)
147 				avgcnt = div64_u64(bcnt, pcnt);
148 		}
149 
150 		memcpy(dest, &avgcnt, sizeof(avgcnt));
151 		return;
152 	}
153 	case NFT_CT_L3PROTOCOL:
154 		nft_reg_store8(dest, nf_ct_l3num(ct));
155 		return;
156 	case NFT_CT_PROTOCOL:
157 		nft_reg_store8(dest, nf_ct_protonum(ct));
158 		return;
159 #ifdef CONFIG_NF_CONNTRACK_ZONES
160 	case NFT_CT_ZONE: {
161 		const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
162 		u16 zoneid;
163 
164 		if (priv->dir < IP_CT_DIR_MAX)
165 			zoneid = nf_ct_zone_id(zone, priv->dir);
166 		else
167 			zoneid = zone->id;
168 
169 		nft_reg_store16(dest, zoneid);
170 		return;
171 	}
172 #endif
173 	case NFT_CT_ID:
174 		*dest = nf_ct_get_id(ct);
175 		return;
176 	default:
177 		break;
178 	}
179 
180 	tuple = &ct->tuplehash[priv->dir].tuple;
181 	switch (priv->key) {
182 	case NFT_CT_SRC:
183 		memcpy(dest, tuple->src.u3.all,
184 		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
185 		return;
186 	case NFT_CT_DST:
187 		memcpy(dest, tuple->dst.u3.all,
188 		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
189 		return;
190 	case NFT_CT_PROTO_SRC:
191 		nft_reg_store16(dest, (__force u16)tuple->src.u.all);
192 		return;
193 	case NFT_CT_PROTO_DST:
194 		nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
195 		return;
196 	case NFT_CT_SRC_IP:
197 		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
198 			goto err;
199 		*dest = (__force __u32)tuple->src.u3.ip;
200 		return;
201 	case NFT_CT_DST_IP:
202 		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
203 			goto err;
204 		*dest = (__force __u32)tuple->dst.u3.ip;
205 		return;
206 	case NFT_CT_SRC_IP6:
207 		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
208 			goto err;
209 		memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
210 		return;
211 	case NFT_CT_DST_IP6:
212 		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
213 			goto err;
214 		memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
215 		return;
216 	default:
217 		break;
218 	}
219 	return;
220 err:
221 	regs->verdict.code = NFT_BREAK;
222 }
223 
224 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_set_zone_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)225 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
226 				 struct nft_regs *regs,
227 				 const struct nft_pktinfo *pkt)
228 {
229 	struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
230 	const struct nft_ct *priv = nft_expr_priv(expr);
231 	struct sk_buff *skb = pkt->skb;
232 	enum ip_conntrack_info ctinfo;
233 	u16 value = nft_reg_load16(&regs->data[priv->sreg]);
234 	struct nf_conn *ct;
235 	int oldcnt;
236 
237 	ct = nf_ct_get(skb, &ctinfo);
238 	if (ct) /* already tracked */
239 		return;
240 
241 	zone.id = value;
242 
243 	switch (priv->dir) {
244 	case IP_CT_DIR_ORIGINAL:
245 		zone.dir = NF_CT_ZONE_DIR_ORIG;
246 		break;
247 	case IP_CT_DIR_REPLY:
248 		zone.dir = NF_CT_ZONE_DIR_REPL;
249 		break;
250 	default:
251 		break;
252 	}
253 
254 	ct = this_cpu_read(nft_ct_pcpu_template);
255 
256 	__refcount_inc(&ct->ct_general.use, &oldcnt);
257 	if (likely(oldcnt == 1)) {
258 		nf_ct_zone_add(ct, &zone);
259 	} else {
260 		refcount_dec(&ct->ct_general.use);
261 		/* previous skb got queued to userspace, allocate temporary
262 		 * one until percpu template can be reused.
263 		 */
264 		ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
265 		if (!ct) {
266 			regs->verdict.code = NF_DROP;
267 			return;
268 		}
269 		__set_bit(IPS_CONFIRMED_BIT, &ct->status);
270 	}
271 
272 	nf_ct_set(skb, ct, IP_CT_NEW);
273 }
274 #endif
275 
nft_ct_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)276 static void nft_ct_set_eval(const struct nft_expr *expr,
277 			    struct nft_regs *regs,
278 			    const struct nft_pktinfo *pkt)
279 {
280 	const struct nft_ct *priv = nft_expr_priv(expr);
281 	struct sk_buff *skb = pkt->skb;
282 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
283 	u32 value = regs->data[priv->sreg];
284 #endif
285 	enum ip_conntrack_info ctinfo;
286 	struct nf_conn *ct;
287 
288 	ct = nf_ct_get(skb, &ctinfo);
289 	if (ct == NULL || nf_ct_is_template(ct))
290 		return;
291 
292 	switch (priv->key) {
293 #ifdef CONFIG_NF_CONNTRACK_MARK
294 	case NFT_CT_MARK:
295 		if (READ_ONCE(ct->mark) != value) {
296 			WRITE_ONCE(ct->mark, value);
297 			nf_conntrack_event_cache(IPCT_MARK, ct);
298 		}
299 		break;
300 #endif
301 #ifdef CONFIG_NF_CONNTRACK_SECMARK
302 	case NFT_CT_SECMARK:
303 		if (ct->secmark != value) {
304 			ct->secmark = value;
305 			nf_conntrack_event_cache(IPCT_SECMARK, ct);
306 		}
307 		break;
308 #endif
309 #ifdef CONFIG_NF_CONNTRACK_LABELS
310 	case NFT_CT_LABELS:
311 		nf_connlabels_replace(ct,
312 				      &regs->data[priv->sreg],
313 				      &regs->data[priv->sreg],
314 				      NF_CT_LABELS_MAX_SIZE / sizeof(u32));
315 		break;
316 #endif
317 #ifdef CONFIG_NF_CONNTRACK_EVENTS
318 	case NFT_CT_EVENTMASK: {
319 		struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
320 		u32 ctmask = regs->data[priv->sreg];
321 
322 		if (e) {
323 			if (e->ctmask != ctmask)
324 				e->ctmask = ctmask;
325 			break;
326 		}
327 
328 		if (ctmask && !nf_ct_is_confirmed(ct))
329 			nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
330 		break;
331 	}
332 #endif
333 	default:
334 		break;
335 	}
336 }
337 
338 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
339 	[NFTA_CT_DREG]		= NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
340 	[NFTA_CT_KEY]		= NLA_POLICY_MAX(NLA_BE32, 255),
341 	[NFTA_CT_DIRECTION]	= NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY),
342 	[NFTA_CT_SREG]		= NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
343 };
344 
345 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_tmpl_put_pcpu(void)346 static void nft_ct_tmpl_put_pcpu(void)
347 {
348 	struct nf_conn *ct;
349 	int cpu;
350 
351 	for_each_possible_cpu(cpu) {
352 		ct = per_cpu(nft_ct_pcpu_template, cpu);
353 		if (!ct)
354 			break;
355 		nf_ct_put(ct);
356 		per_cpu(nft_ct_pcpu_template, cpu) = NULL;
357 	}
358 }
359 
nft_ct_tmpl_alloc_pcpu(void)360 static bool nft_ct_tmpl_alloc_pcpu(void)
361 {
362 	struct nf_conntrack_zone zone = { .id = 0 };
363 	struct nf_conn *tmp;
364 	int cpu;
365 
366 	if (nft_ct_pcpu_template_refcnt)
367 		return true;
368 
369 	for_each_possible_cpu(cpu) {
370 		tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
371 		if (!tmp) {
372 			nft_ct_tmpl_put_pcpu();
373 			return false;
374 		}
375 
376 		__set_bit(IPS_CONFIRMED_BIT, &tmp->status);
377 		per_cpu(nft_ct_pcpu_template, cpu) = tmp;
378 	}
379 
380 	return true;
381 }
382 #endif
383 
__nft_ct_get_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)384 static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
385 {
386 #ifdef CONFIG_NF_CONNTRACK_LABELS
387 	if (priv->key == NFT_CT_LABELS)
388 		nf_connlabels_put(ctx->net);
389 #endif
390 }
391 
nft_ct_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])392 static int nft_ct_get_init(const struct nft_ctx *ctx,
393 			   const struct nft_expr *expr,
394 			   const struct nlattr * const tb[])
395 {
396 	struct nft_ct *priv = nft_expr_priv(expr);
397 	unsigned int len;
398 	int err;
399 
400 	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
401 	priv->dir = IP_CT_DIR_MAX;
402 	switch (priv->key) {
403 	case NFT_CT_DIRECTION:
404 		if (tb[NFTA_CT_DIRECTION] != NULL)
405 			return -EINVAL;
406 		len = sizeof(u8);
407 		break;
408 	case NFT_CT_STATE:
409 	case NFT_CT_STATUS:
410 #ifdef CONFIG_NF_CONNTRACK_MARK
411 	case NFT_CT_MARK:
412 #endif
413 #ifdef CONFIG_NF_CONNTRACK_SECMARK
414 	case NFT_CT_SECMARK:
415 #endif
416 	case NFT_CT_EXPIRATION:
417 		if (tb[NFTA_CT_DIRECTION] != NULL)
418 			return -EINVAL;
419 		len = sizeof(u32);
420 		break;
421 #ifdef CONFIG_NF_CONNTRACK_LABELS
422 	case NFT_CT_LABELS:
423 		if (tb[NFTA_CT_DIRECTION] != NULL)
424 			return -EINVAL;
425 		len = NF_CT_LABELS_MAX_SIZE;
426 
427 		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
428 		if (err)
429 			return err;
430 		break;
431 #endif
432 	case NFT_CT_HELPER:
433 		if (tb[NFTA_CT_DIRECTION] != NULL)
434 			return -EINVAL;
435 		len = NF_CT_HELPER_NAME_LEN;
436 		break;
437 
438 	case NFT_CT_L3PROTOCOL:
439 	case NFT_CT_PROTOCOL:
440 		/* For compatibility, do not report error if NFTA_CT_DIRECTION
441 		 * attribute is specified.
442 		 */
443 		len = sizeof(u8);
444 		break;
445 	case NFT_CT_SRC:
446 	case NFT_CT_DST:
447 		if (tb[NFTA_CT_DIRECTION] == NULL)
448 			return -EINVAL;
449 
450 		switch (ctx->family) {
451 		case NFPROTO_IPV4:
452 			len = sizeof_field(struct nf_conntrack_tuple,
453 					   src.u3.ip);
454 			break;
455 		case NFPROTO_IPV6:
456 		case NFPROTO_INET:
457 			len = sizeof_field(struct nf_conntrack_tuple,
458 					   src.u3.ip6);
459 			break;
460 		default:
461 			return -EAFNOSUPPORT;
462 		}
463 		break;
464 	case NFT_CT_SRC_IP:
465 	case NFT_CT_DST_IP:
466 		if (tb[NFTA_CT_DIRECTION] == NULL)
467 			return -EINVAL;
468 
469 		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
470 		break;
471 	case NFT_CT_SRC_IP6:
472 	case NFT_CT_DST_IP6:
473 		if (tb[NFTA_CT_DIRECTION] == NULL)
474 			return -EINVAL;
475 
476 		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
477 		break;
478 	case NFT_CT_PROTO_SRC:
479 	case NFT_CT_PROTO_DST:
480 		if (tb[NFTA_CT_DIRECTION] == NULL)
481 			return -EINVAL;
482 		len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
483 		break;
484 	case NFT_CT_BYTES:
485 	case NFT_CT_PKTS:
486 	case NFT_CT_AVGPKT:
487 		len = sizeof(u64);
488 		break;
489 #ifdef CONFIG_NF_CONNTRACK_ZONES
490 	case NFT_CT_ZONE:
491 		len = sizeof(u16);
492 		break;
493 #endif
494 	case NFT_CT_ID:
495 		if (tb[NFTA_CT_DIRECTION])
496 			return -EINVAL;
497 
498 		len = sizeof(u32);
499 		break;
500 	default:
501 		return -EOPNOTSUPP;
502 	}
503 
504 	if (tb[NFTA_CT_DIRECTION] != NULL) {
505 		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
506 		switch (priv->dir) {
507 		case IP_CT_DIR_ORIGINAL:
508 		case IP_CT_DIR_REPLY:
509 			break;
510 		default:
511 			err = -EINVAL;
512 			goto err;
513 		}
514 	}
515 
516 	priv->len = len;
517 	err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
518 				       NFT_DATA_VALUE, len);
519 	if (err < 0)
520 		goto err;
521 
522 	err = nf_ct_netns_get(ctx->net, ctx->family);
523 	if (err < 0)
524 		goto err;
525 
526 	if (priv->key == NFT_CT_BYTES ||
527 	    priv->key == NFT_CT_PKTS  ||
528 	    priv->key == NFT_CT_AVGPKT)
529 		nf_ct_set_acct(ctx->net, true);
530 
531 	return 0;
532 err:
533 	__nft_ct_get_destroy(ctx, priv);
534 	return err;
535 }
536 
__nft_ct_set_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)537 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
538 {
539 	switch (priv->key) {
540 #ifdef CONFIG_NF_CONNTRACK_LABELS
541 	case NFT_CT_LABELS:
542 		nf_connlabels_put(ctx->net);
543 		break;
544 #endif
545 #ifdef CONFIG_NF_CONNTRACK_ZONES
546 	case NFT_CT_ZONE:
547 		nf_queue_nf_hook_drop(ctx->net);
548 		mutex_lock(&nft_ct_pcpu_mutex);
549 		if (--nft_ct_pcpu_template_refcnt == 0)
550 			nft_ct_tmpl_put_pcpu();
551 		mutex_unlock(&nft_ct_pcpu_mutex);
552 		break;
553 #endif
554 	default:
555 		break;
556 	}
557 }
558 
nft_ct_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])559 static int nft_ct_set_init(const struct nft_ctx *ctx,
560 			   const struct nft_expr *expr,
561 			   const struct nlattr * const tb[])
562 {
563 	struct nft_ct *priv = nft_expr_priv(expr);
564 	unsigned int len;
565 	int err;
566 
567 	priv->dir = IP_CT_DIR_MAX;
568 	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
569 	switch (priv->key) {
570 #ifdef CONFIG_NF_CONNTRACK_MARK
571 	case NFT_CT_MARK:
572 		if (tb[NFTA_CT_DIRECTION])
573 			return -EINVAL;
574 		len = sizeof_field(struct nf_conn, mark);
575 		break;
576 #endif
577 #ifdef CONFIG_NF_CONNTRACK_LABELS
578 	case NFT_CT_LABELS:
579 		if (tb[NFTA_CT_DIRECTION])
580 			return -EINVAL;
581 		len = NF_CT_LABELS_MAX_SIZE;
582 		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
583 		if (err)
584 			return err;
585 		break;
586 #endif
587 #ifdef CONFIG_NF_CONNTRACK_ZONES
588 	case NFT_CT_ZONE:
589 		mutex_lock(&nft_ct_pcpu_mutex);
590 		if (!nft_ct_tmpl_alloc_pcpu()) {
591 			mutex_unlock(&nft_ct_pcpu_mutex);
592 			return -ENOMEM;
593 		}
594 		nft_ct_pcpu_template_refcnt++;
595 		mutex_unlock(&nft_ct_pcpu_mutex);
596 		len = sizeof(u16);
597 		break;
598 #endif
599 #ifdef CONFIG_NF_CONNTRACK_EVENTS
600 	case NFT_CT_EVENTMASK:
601 		if (tb[NFTA_CT_DIRECTION])
602 			return -EINVAL;
603 		len = sizeof(u32);
604 		break;
605 #endif
606 #ifdef CONFIG_NF_CONNTRACK_SECMARK
607 	case NFT_CT_SECMARK:
608 		if (tb[NFTA_CT_DIRECTION])
609 			return -EINVAL;
610 		len = sizeof(u32);
611 		break;
612 #endif
613 	default:
614 		return -EOPNOTSUPP;
615 	}
616 
617 	if (tb[NFTA_CT_DIRECTION]) {
618 		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
619 		switch (priv->dir) {
620 		case IP_CT_DIR_ORIGINAL:
621 		case IP_CT_DIR_REPLY:
622 			break;
623 		default:
624 			err = -EINVAL;
625 			goto err1;
626 		}
627 	}
628 
629 	priv->len = len;
630 	err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len);
631 	if (err < 0)
632 		goto err1;
633 
634 	err = nf_ct_netns_get(ctx->net, ctx->family);
635 	if (err < 0)
636 		goto err1;
637 
638 	return 0;
639 
640 err1:
641 	__nft_ct_set_destroy(ctx, priv);
642 	return err;
643 }
644 
nft_ct_get_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)645 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
646 			       const struct nft_expr *expr)
647 {
648 	struct nft_ct *priv = nft_expr_priv(expr);
649 
650 	__nft_ct_get_destroy(ctx, priv);
651 	nf_ct_netns_put(ctx->net, ctx->family);
652 }
653 
nft_ct_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)654 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
655 			       const struct nft_expr *expr)
656 {
657 	struct nft_ct *priv = nft_expr_priv(expr);
658 
659 	__nft_ct_set_destroy(ctx, priv);
660 	nf_ct_netns_put(ctx->net, ctx->family);
661 }
662 
nft_ct_get_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)663 static int nft_ct_get_dump(struct sk_buff *skb,
664 			   const struct nft_expr *expr, bool reset)
665 {
666 	const struct nft_ct *priv = nft_expr_priv(expr);
667 
668 	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
669 		goto nla_put_failure;
670 	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
671 		goto nla_put_failure;
672 
673 	switch (priv->key) {
674 	case NFT_CT_SRC:
675 	case NFT_CT_DST:
676 	case NFT_CT_SRC_IP:
677 	case NFT_CT_DST_IP:
678 	case NFT_CT_SRC_IP6:
679 	case NFT_CT_DST_IP6:
680 	case NFT_CT_PROTO_SRC:
681 	case NFT_CT_PROTO_DST:
682 		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
683 			goto nla_put_failure;
684 		break;
685 	case NFT_CT_BYTES:
686 	case NFT_CT_PKTS:
687 	case NFT_CT_AVGPKT:
688 	case NFT_CT_ZONE:
689 		if (priv->dir < IP_CT_DIR_MAX &&
690 		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
691 			goto nla_put_failure;
692 		break;
693 	default:
694 		break;
695 	}
696 
697 	return 0;
698 
699 nla_put_failure:
700 	return -1;
701 }
702 
nft_ct_set_dump(struct sk_buff * skb,const struct nft_expr * expr,bool reset)703 static int nft_ct_set_dump(struct sk_buff *skb,
704 			   const struct nft_expr *expr, bool reset)
705 {
706 	const struct nft_ct *priv = nft_expr_priv(expr);
707 
708 	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
709 		goto nla_put_failure;
710 	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
711 		goto nla_put_failure;
712 
713 	switch (priv->key) {
714 	case NFT_CT_ZONE:
715 		if (priv->dir < IP_CT_DIR_MAX &&
716 		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
717 			goto nla_put_failure;
718 		break;
719 	default:
720 		break;
721 	}
722 
723 	return 0;
724 
725 nla_put_failure:
726 	return -1;
727 }
728 
729 static struct nft_expr_type nft_ct_type;
730 static const struct nft_expr_ops nft_ct_get_ops = {
731 	.type		= &nft_ct_type,
732 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
733 	.eval		= nft_ct_get_eval,
734 	.init		= nft_ct_get_init,
735 	.destroy	= nft_ct_get_destroy,
736 	.dump		= nft_ct_get_dump,
737 };
738 
739 #ifdef CONFIG_MITIGATION_RETPOLINE
740 static const struct nft_expr_ops nft_ct_get_fast_ops = {
741 	.type		= &nft_ct_type,
742 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
743 	.eval		= nft_ct_get_fast_eval,
744 	.init		= nft_ct_get_init,
745 	.destroy	= nft_ct_get_destroy,
746 	.dump		= nft_ct_get_dump,
747 };
748 #endif
749 
750 static const struct nft_expr_ops nft_ct_set_ops = {
751 	.type		= &nft_ct_type,
752 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
753 	.eval		= nft_ct_set_eval,
754 	.init		= nft_ct_set_init,
755 	.destroy	= nft_ct_set_destroy,
756 	.dump		= nft_ct_set_dump,
757 };
758 
759 #ifdef CONFIG_NF_CONNTRACK_ZONES
760 static const struct nft_expr_ops nft_ct_set_zone_ops = {
761 	.type		= &nft_ct_type,
762 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
763 	.eval		= nft_ct_set_zone_eval,
764 	.init		= nft_ct_set_init,
765 	.destroy	= nft_ct_set_destroy,
766 	.dump		= nft_ct_set_dump,
767 };
768 #endif
769 
770 static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])771 nft_ct_select_ops(const struct nft_ctx *ctx,
772 		    const struct nlattr * const tb[])
773 {
774 	if (tb[NFTA_CT_KEY] == NULL)
775 		return ERR_PTR(-EINVAL);
776 
777 	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
778 		return ERR_PTR(-EINVAL);
779 
780 	if (tb[NFTA_CT_DREG]) {
781 #ifdef CONFIG_MITIGATION_RETPOLINE
782 		u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
783 
784 		switch (k) {
785 		case NFT_CT_STATE:
786 		case NFT_CT_DIRECTION:
787 		case NFT_CT_STATUS:
788 		case NFT_CT_MARK:
789 		case NFT_CT_SECMARK:
790 			return &nft_ct_get_fast_ops;
791 		}
792 #endif
793 		return &nft_ct_get_ops;
794 	}
795 
796 	if (tb[NFTA_CT_SREG]) {
797 #ifdef CONFIG_NF_CONNTRACK_ZONES
798 		if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
799 			return &nft_ct_set_zone_ops;
800 #endif
801 		return &nft_ct_set_ops;
802 	}
803 
804 	return ERR_PTR(-EINVAL);
805 }
806 
807 static struct nft_expr_type nft_ct_type __read_mostly = {
808 	.name		= "ct",
809 	.select_ops	= nft_ct_select_ops,
810 	.policy		= nft_ct_policy,
811 	.maxattr	= NFTA_CT_MAX,
812 	.owner		= THIS_MODULE,
813 };
814 
nft_notrack_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)815 static void nft_notrack_eval(const struct nft_expr *expr,
816 			     struct nft_regs *regs,
817 			     const struct nft_pktinfo *pkt)
818 {
819 	struct sk_buff *skb = pkt->skb;
820 	enum ip_conntrack_info ctinfo;
821 	struct nf_conn *ct;
822 
823 	ct = nf_ct_get(pkt->skb, &ctinfo);
824 	/* Previously seen (loopback or untracked)?  Ignore. */
825 	if (ct || ctinfo == IP_CT_UNTRACKED)
826 		return;
827 
828 	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
829 }
830 
831 static struct nft_expr_type nft_notrack_type;
832 static const struct nft_expr_ops nft_notrack_ops = {
833 	.type		= &nft_notrack_type,
834 	.size		= NFT_EXPR_SIZE(0),
835 	.eval		= nft_notrack_eval,
836 };
837 
838 static struct nft_expr_type nft_notrack_type __read_mostly = {
839 	.name		= "notrack",
840 	.ops		= &nft_notrack_ops,
841 	.owner		= THIS_MODULE,
842 };
843 
844 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
845 static int
nft_ct_timeout_parse_policy(void * timeouts,const struct nf_conntrack_l4proto * l4proto,struct net * net,const struct nlattr * attr)846 nft_ct_timeout_parse_policy(void *timeouts,
847 			    const struct nf_conntrack_l4proto *l4proto,
848 			    struct net *net, const struct nlattr *attr)
849 {
850 	struct nlattr **tb;
851 	int ret = 0;
852 
853 	tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1);
854 
855 	if (!tb)
856 		return -ENOMEM;
857 
858 	ret = nla_parse_nested_deprecated(tb,
859 					  l4proto->ctnl_timeout.nlattr_max,
860 					  attr,
861 					  l4proto->ctnl_timeout.nla_policy,
862 					  NULL);
863 	if (ret < 0)
864 		goto err;
865 
866 	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
867 
868 err:
869 	kfree(tb);
870 	return ret;
871 }
872 
873 struct nft_ct_timeout_obj {
874 	struct nf_ct_timeout    *timeout;
875 	u8			l4proto;
876 };
877 
nft_ct_timeout_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)878 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
879 				    struct nft_regs *regs,
880 				    const struct nft_pktinfo *pkt)
881 {
882 	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
883 	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
884 	struct nf_conn_timeout *timeout;
885 	const unsigned int *values;
886 
887 	if (priv->l4proto != pkt->tprot)
888 		return;
889 
890 	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
891 		return;
892 
893 	timeout = nf_ct_timeout_find(ct);
894 	if (!timeout) {
895 		timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
896 		if (!timeout) {
897 			regs->verdict.code = NF_DROP;
898 			return;
899 		}
900 	}
901 
902 	rcu_assign_pointer(timeout->timeout, priv->timeout);
903 
904 	/* adjust the timeout as per 'new' state. ct is unconfirmed,
905 	 * so the current timestamp must not be added.
906 	 */
907 	values = nf_ct_timeout_data(timeout);
908 	if (values)
909 		nf_ct_refresh(ct, values[0]);
910 }
911 
nft_ct_timeout_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)912 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
913 				   const struct nlattr * const tb[],
914 				   struct nft_object *obj)
915 {
916 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
917 	const struct nf_conntrack_l4proto *l4proto;
918 	struct nf_ct_timeout *timeout;
919 	int l3num = ctx->family;
920 	__u8 l4num;
921 	int ret;
922 
923 	if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
924 	    !tb[NFTA_CT_TIMEOUT_DATA])
925 		return -EINVAL;
926 
927 	if (tb[NFTA_CT_TIMEOUT_L3PROTO])
928 		l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
929 
930 	l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
931 	priv->l4proto = l4num;
932 
933 	l4proto = nf_ct_l4proto_find(l4num);
934 
935 	if (l4proto->l4proto != l4num) {
936 		ret = -EOPNOTSUPP;
937 		goto err_proto_put;
938 	}
939 
940 	timeout = kzalloc(sizeof(struct nf_ct_timeout) +
941 			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
942 	if (timeout == NULL) {
943 		ret = -ENOMEM;
944 		goto err_proto_put;
945 	}
946 
947 	ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
948 					  tb[NFTA_CT_TIMEOUT_DATA]);
949 	if (ret < 0)
950 		goto err_free_timeout;
951 
952 	timeout->l3num = l3num;
953 	timeout->l4proto = l4proto;
954 
955 	ret = nf_ct_netns_get(ctx->net, ctx->family);
956 	if (ret < 0)
957 		goto err_free_timeout;
958 
959 	priv->timeout = timeout;
960 	return 0;
961 
962 err_free_timeout:
963 	kfree(timeout);
964 err_proto_put:
965 	return ret;
966 }
967 
nft_ct_timeout_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)968 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
969 				       struct nft_object *obj)
970 {
971 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
972 	struct nf_ct_timeout *timeout = priv->timeout;
973 
974 	nf_queue_nf_hook_drop(ctx->net);
975 	nf_ct_untimeout(ctx->net, timeout);
976 	nf_ct_netns_put(ctx->net, ctx->family);
977 	kfree_rcu(priv->timeout, rcu);
978 }
979 
nft_ct_timeout_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)980 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
981 				   struct nft_object *obj, bool reset)
982 {
983 	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
984 	const struct nf_ct_timeout *timeout = priv->timeout;
985 	struct nlattr *nest_params;
986 	int ret;
987 
988 	if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
989 	    nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
990 		return -1;
991 
992 	nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
993 	if (!nest_params)
994 		return -1;
995 
996 	ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
997 	if (ret < 0)
998 		return -1;
999 	nla_nest_end(skb, nest_params);
1000 	return 0;
1001 }
1002 
1003 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1004 	[NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1005 	[NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1006 	[NFTA_CT_TIMEOUT_DATA]	  = {.type = NLA_NESTED },
1007 };
1008 
1009 static struct nft_object_type nft_ct_timeout_obj_type;
1010 
1011 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1012 	.type		= &nft_ct_timeout_obj_type,
1013 	.size		= sizeof(struct nft_ct_timeout_obj),
1014 	.eval		= nft_ct_timeout_obj_eval,
1015 	.init		= nft_ct_timeout_obj_init,
1016 	.destroy	= nft_ct_timeout_obj_destroy,
1017 	.dump		= nft_ct_timeout_obj_dump,
1018 };
1019 
1020 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1021 	.type		= NFT_OBJECT_CT_TIMEOUT,
1022 	.ops		= &nft_ct_timeout_obj_ops,
1023 	.maxattr	= NFTA_CT_TIMEOUT_MAX,
1024 	.policy		= nft_ct_timeout_policy,
1025 	.owner		= THIS_MODULE,
1026 };
1027 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1028 
nft_ct_helper_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1029 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1030 				  const struct nlattr * const tb[],
1031 				  struct nft_object *obj)
1032 {
1033 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1034 	struct nf_conntrack_helper *help4, *help6;
1035 	char name[NF_CT_HELPER_NAME_LEN];
1036 	int family = ctx->family;
1037 	int err;
1038 
1039 	if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1040 		return -EINVAL;
1041 
1042 	priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1043 	if (!priv->l4proto)
1044 		return -ENOENT;
1045 
1046 	nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1047 
1048 	if (tb[NFTA_CT_HELPER_L3PROTO])
1049 		family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1050 
1051 	help4 = NULL;
1052 	help6 = NULL;
1053 
1054 	switch (family) {
1055 	case NFPROTO_IPV4:
1056 		if (ctx->family == NFPROTO_IPV6)
1057 			return -EINVAL;
1058 
1059 		help4 = nf_conntrack_helper_try_module_get(name, family,
1060 							   priv->l4proto);
1061 		break;
1062 	case NFPROTO_IPV6:
1063 		if (ctx->family == NFPROTO_IPV4)
1064 			return -EINVAL;
1065 
1066 		help6 = nf_conntrack_helper_try_module_get(name, family,
1067 							   priv->l4proto);
1068 		break;
1069 	case NFPROTO_NETDEV:
1070 	case NFPROTO_BRIDGE:
1071 	case NFPROTO_INET:
1072 		help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1073 							   priv->l4proto);
1074 		help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1075 							   priv->l4proto);
1076 		break;
1077 	default:
1078 		return -EAFNOSUPPORT;
1079 	}
1080 
1081 	/* && is intentional; only error if INET found neither ipv4 or ipv6 */
1082 	if (!help4 && !help6)
1083 		return -ENOENT;
1084 
1085 	priv->helper4 = help4;
1086 	priv->helper6 = help6;
1087 
1088 	err = nf_ct_netns_get(ctx->net, ctx->family);
1089 	if (err < 0)
1090 		goto err_put_helper;
1091 
1092 	return 0;
1093 
1094 err_put_helper:
1095 	if (priv->helper4)
1096 		nf_conntrack_helper_put(priv->helper4);
1097 	if (priv->helper6)
1098 		nf_conntrack_helper_put(priv->helper6);
1099 	return err;
1100 }
1101 
nft_ct_helper_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1102 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1103 				      struct nft_object *obj)
1104 {
1105 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1106 
1107 	nf_queue_nf_hook_drop(ctx->net);
1108 	if (priv->helper4)
1109 		nf_conntrack_helper_put(priv->helper4);
1110 	if (priv->helper6)
1111 		nf_conntrack_helper_put(priv->helper6);
1112 
1113 	nf_ct_netns_put(ctx->net, ctx->family);
1114 }
1115 
nft_ct_helper_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1116 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1117 				   struct nft_regs *regs,
1118 				   const struct nft_pktinfo *pkt)
1119 {
1120 	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1121 	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1122 	struct nf_conntrack_helper *to_assign = NULL;
1123 	struct nf_conn_help *help;
1124 
1125 	if (!ct ||
1126 	    nf_ct_is_confirmed(ct) ||
1127 	    nf_ct_is_template(ct) ||
1128 	    priv->l4proto != nf_ct_protonum(ct))
1129 		return;
1130 
1131 	switch (nf_ct_l3num(ct)) {
1132 	case NFPROTO_IPV4:
1133 		to_assign = priv->helper4;
1134 		break;
1135 	case NFPROTO_IPV6:
1136 		to_assign = priv->helper6;
1137 		break;
1138 	default:
1139 		WARN_ON_ONCE(1);
1140 		return;
1141 	}
1142 
1143 	if (!to_assign)
1144 		return;
1145 
1146 	if (test_bit(IPS_HELPER_BIT, &ct->status))
1147 		return;
1148 
1149 	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1150 	if (help) {
1151 		rcu_assign_pointer(help->helper, to_assign);
1152 		set_bit(IPS_HELPER_BIT, &ct->status);
1153 
1154 		if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
1155 			if (!nfct_seqadj_ext_add(ct))
1156 				regs->verdict.code = NF_DROP;
1157 	}
1158 }
1159 
nft_ct_helper_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1160 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1161 				  struct nft_object *obj, bool reset)
1162 {
1163 	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1164 	const struct nf_conntrack_helper *helper;
1165 	u16 family;
1166 
1167 	if (priv->helper4 && priv->helper6) {
1168 		family = NFPROTO_INET;
1169 		helper = priv->helper4;
1170 	} else if (priv->helper6) {
1171 		family = NFPROTO_IPV6;
1172 		helper = priv->helper6;
1173 	} else {
1174 		family = NFPROTO_IPV4;
1175 		helper = priv->helper4;
1176 	}
1177 
1178 	if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1179 		return -1;
1180 
1181 	if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1182 		return -1;
1183 
1184 	if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1185 		return -1;
1186 
1187 	return 0;
1188 }
1189 
1190 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1191 	[NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1192 				  .len = NF_CT_HELPER_NAME_LEN - 1 },
1193 	[NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1194 	[NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1195 };
1196 
1197 static struct nft_object_type nft_ct_helper_obj_type;
1198 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1199 	.type		= &nft_ct_helper_obj_type,
1200 	.size		= sizeof(struct nft_ct_helper_obj),
1201 	.eval		= nft_ct_helper_obj_eval,
1202 	.init		= nft_ct_helper_obj_init,
1203 	.destroy	= nft_ct_helper_obj_destroy,
1204 	.dump		= nft_ct_helper_obj_dump,
1205 };
1206 
1207 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1208 	.type		= NFT_OBJECT_CT_HELPER,
1209 	.ops		= &nft_ct_helper_obj_ops,
1210 	.maxattr	= NFTA_CT_HELPER_MAX,
1211 	.policy		= nft_ct_helper_policy,
1212 	.owner		= THIS_MODULE,
1213 };
1214 
1215 struct nft_ct_expect_obj {
1216 	u16		l3num;
1217 	__be16		dport;
1218 	u8		l4proto;
1219 	u8		size;
1220 	u32		timeout;
1221 };
1222 
nft_ct_expect_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1223 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1224 				  const struct nlattr * const tb[],
1225 				  struct nft_object *obj)
1226 {
1227 	struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1228 
1229 	if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1230 	    !tb[NFTA_CT_EXPECT_DPORT] ||
1231 	    !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1232 	    !tb[NFTA_CT_EXPECT_SIZE])
1233 		return -EINVAL;
1234 
1235 	priv->l3num = ctx->family;
1236 	if (tb[NFTA_CT_EXPECT_L3PROTO])
1237 		priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1238 
1239 	switch (priv->l3num) {
1240 	case NFPROTO_IPV4:
1241 	case NFPROTO_IPV6:
1242 		if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1243 			break;
1244 
1245 		return -EINVAL;
1246 	case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1247 	default:
1248 		return -EAFNOSUPPORT;
1249 	}
1250 
1251 	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1252 	switch (priv->l4proto) {
1253 	case IPPROTO_TCP:
1254 	case IPPROTO_UDP:
1255 	case IPPROTO_DCCP:
1256 	case IPPROTO_SCTP:
1257 		break;
1258 	default:
1259 		return -EOPNOTSUPP;
1260 	}
1261 
1262 	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1263 	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1264 	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1265 
1266 	return nf_ct_netns_get(ctx->net, ctx->family);
1267 }
1268 
nft_ct_expect_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1269 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1270 				       struct nft_object *obj)
1271 {
1272 	nf_ct_netns_put(ctx->net, ctx->family);
1273 }
1274 
nft_ct_expect_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1275 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1276 				  struct nft_object *obj, bool reset)
1277 {
1278 	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1279 
1280 	if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1281 	    nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1282 	    nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1283 	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1284 	    nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1285 		return -1;
1286 
1287 	return 0;
1288 }
1289 
nft_ct_expect_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1290 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1291 				   struct nft_regs *regs,
1292 				   const struct nft_pktinfo *pkt)
1293 {
1294 	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1295 	struct nf_conntrack_expect *exp;
1296 	enum ip_conntrack_info ctinfo;
1297 	struct nf_conn_help *help;
1298 	enum ip_conntrack_dir dir;
1299 	u16 l3num = priv->l3num;
1300 	struct nf_conn *ct;
1301 
1302 	ct = nf_ct_get(pkt->skb, &ctinfo);
1303 	if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1304 		regs->verdict.code = NFT_BREAK;
1305 		return;
1306 	}
1307 	dir = CTINFO2DIR(ctinfo);
1308 
1309 	help = nfct_help(ct);
1310 	if (!help)
1311 		help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1312 	if (!help) {
1313 		regs->verdict.code = NF_DROP;
1314 		return;
1315 	}
1316 
1317 	if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1318 		regs->verdict.code = NFT_BREAK;
1319 		return;
1320 	}
1321 	if (l3num == NFPROTO_INET)
1322 		l3num = nf_ct_l3num(ct);
1323 
1324 	exp = nf_ct_expect_alloc(ct);
1325 	if (exp == NULL) {
1326 		regs->verdict.code = NF_DROP;
1327 		return;
1328 	}
1329 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1330 		          &ct->tuplehash[!dir].tuple.src.u3,
1331 		          &ct->tuplehash[!dir].tuple.dst.u3,
1332 		          priv->l4proto, NULL, &priv->dport);
1333 	exp->timeout.expires = jiffies + priv->timeout * HZ;
1334 
1335 	if (nf_ct_expect_related(exp, 0) != 0)
1336 		regs->verdict.code = NF_DROP;
1337 
1338 	nf_ct_expect_put(exp);
1339 }
1340 
1341 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1342 	[NFTA_CT_EXPECT_L3PROTO]	= { .type = NLA_U16 },
1343 	[NFTA_CT_EXPECT_L4PROTO]	= { .type = NLA_U8 },
1344 	[NFTA_CT_EXPECT_DPORT]		= { .type = NLA_U16 },
1345 	[NFTA_CT_EXPECT_TIMEOUT]	= { .type = NLA_U32 },
1346 	[NFTA_CT_EXPECT_SIZE]		= { .type = NLA_U8 },
1347 };
1348 
1349 static struct nft_object_type nft_ct_expect_obj_type;
1350 
1351 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1352 	.type		= &nft_ct_expect_obj_type,
1353 	.size		= sizeof(struct nft_ct_expect_obj),
1354 	.eval		= nft_ct_expect_obj_eval,
1355 	.init		= nft_ct_expect_obj_init,
1356 	.destroy	= nft_ct_expect_obj_destroy,
1357 	.dump		= nft_ct_expect_obj_dump,
1358 };
1359 
1360 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1361 	.type		= NFT_OBJECT_CT_EXPECT,
1362 	.ops		= &nft_ct_expect_obj_ops,
1363 	.maxattr	= NFTA_CT_EXPECT_MAX,
1364 	.policy		= nft_ct_expect_policy,
1365 	.owner		= THIS_MODULE,
1366 };
1367 
nft_ct_module_init(void)1368 static int __init nft_ct_module_init(void)
1369 {
1370 	int err;
1371 
1372 	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1373 
1374 	err = nft_register_expr(&nft_ct_type);
1375 	if (err < 0)
1376 		return err;
1377 
1378 	err = nft_register_expr(&nft_notrack_type);
1379 	if (err < 0)
1380 		goto err1;
1381 
1382 	err = nft_register_obj(&nft_ct_helper_obj_type);
1383 	if (err < 0)
1384 		goto err2;
1385 
1386 	err = nft_register_obj(&nft_ct_expect_obj_type);
1387 	if (err < 0)
1388 		goto err3;
1389 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1390 	err = nft_register_obj(&nft_ct_timeout_obj_type);
1391 	if (err < 0)
1392 		goto err4;
1393 #endif
1394 	return 0;
1395 
1396 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1397 err4:
1398 	nft_unregister_obj(&nft_ct_expect_obj_type);
1399 #endif
1400 err3:
1401 	nft_unregister_obj(&nft_ct_helper_obj_type);
1402 err2:
1403 	nft_unregister_expr(&nft_notrack_type);
1404 err1:
1405 	nft_unregister_expr(&nft_ct_type);
1406 	return err;
1407 }
1408 
nft_ct_module_exit(void)1409 static void __exit nft_ct_module_exit(void)
1410 {
1411 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1412 	nft_unregister_obj(&nft_ct_timeout_obj_type);
1413 #endif
1414 	nft_unregister_obj(&nft_ct_expect_obj_type);
1415 	nft_unregister_obj(&nft_ct_helper_obj_type);
1416 	nft_unregister_expr(&nft_notrack_type);
1417 	nft_unregister_expr(&nft_ct_type);
1418 }
1419 
1420 module_init(nft_ct_module_init);
1421 module_exit(nft_ct_module_exit);
1422 
1423 MODULE_LICENSE("GPL");
1424 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1425 MODULE_ALIAS_NFT_EXPR("ct");
1426 MODULE_ALIAS_NFT_EXPR("notrack");
1427 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1428 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1429 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1430 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");
1431