1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
35 struct nft_ct_helper_obj {
36 struct nf_conntrack_helper *helper4;
37 struct nf_conntrack_helper *helper6;
41 #ifdef CONFIG_NF_CONNTRACK_ZONES
42 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
43 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
44 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
47 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
49 enum ip_conntrack_dir d)
51 if (d < IP_CT_DIR_MAX)
52 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
53 atomic64_read(&c[d].packets);
55 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
56 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
59 static void nft_ct_get_eval(const struct nft_expr *expr,
60 struct nft_regs *regs,
61 const struct nft_pktinfo *pkt)
63 const struct nft_ct *priv = nft_expr_priv(expr);
64 u32 *dest = ®s->data[priv->dreg];
65 enum ip_conntrack_info ctinfo;
66 const struct nf_conn *ct;
67 const struct nf_conn_help *help;
68 const struct nf_conntrack_tuple *tuple;
69 const struct nf_conntrack_helper *helper;
72 ct = nf_ct_get(pkt->skb, &ctinfo);
77 state = NF_CT_STATE_BIT(ctinfo);
78 else if (ctinfo == IP_CT_UNTRACKED)
79 state = NF_CT_STATE_UNTRACKED_BIT;
81 state = NF_CT_STATE_INVALID_BIT;
92 case NFT_CT_DIRECTION:
93 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
98 #ifdef CONFIG_NF_CONNTRACK_MARK
103 #ifdef CONFIG_NF_CONNTRACK_SECMARK
108 case NFT_CT_EXPIRATION:
109 *dest = jiffies_to_msecs(nf_ct_expires(ct));
112 if (ct->master == NULL)
114 help = nfct_help(ct->master);
117 helper = rcu_dereference(help->helper);
120 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
122 #ifdef CONFIG_NF_CONNTRACK_LABELS
123 case NFT_CT_LABELS: {
124 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
127 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
129 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
135 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 count = nft_ct_get_eval_counter(acct->counter,
140 priv->key, priv->dir);
141 memcpy(dest, &count, sizeof(count));
144 case NFT_CT_AVGPKT: {
145 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
146 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
149 pcnt = nft_ct_get_eval_counter(acct->counter,
150 NFT_CT_PKTS, priv->dir);
151 bcnt = nft_ct_get_eval_counter(acct->counter,
152 NFT_CT_BYTES, priv->dir);
154 avgcnt = div64_u64(bcnt, pcnt);
157 memcpy(dest, &avgcnt, sizeof(avgcnt));
160 case NFT_CT_L3PROTOCOL:
161 nft_reg_store8(dest, nf_ct_l3num(ct));
163 case NFT_CT_PROTOCOL:
164 nft_reg_store8(dest, nf_ct_protonum(ct));
166 #ifdef CONFIG_NF_CONNTRACK_ZONES
168 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
171 if (priv->dir < IP_CT_DIR_MAX)
172 zoneid = nf_ct_zone_id(zone, priv->dir);
176 nft_reg_store16(dest, zoneid);
181 *dest = nf_ct_get_id(ct);
187 tuple = &ct->tuplehash[priv->dir].tuple;
190 memcpy(dest, tuple->src.u3.all,
191 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
194 memcpy(dest, tuple->dst.u3.all,
195 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
197 case NFT_CT_PROTO_SRC:
198 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
200 case NFT_CT_PROTO_DST:
201 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
204 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
206 *dest = tuple->src.u3.ip;
209 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
211 *dest = tuple->dst.u3.ip;
214 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
216 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
219 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
221 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
228 regs->verdict.code = NFT_BREAK;
231 #ifdef CONFIG_NF_CONNTRACK_ZONES
232 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
233 struct nft_regs *regs,
234 const struct nft_pktinfo *pkt)
236 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
237 const struct nft_ct *priv = nft_expr_priv(expr);
238 struct sk_buff *skb = pkt->skb;
239 enum ip_conntrack_info ctinfo;
240 u16 value = nft_reg_load16(®s->data[priv->sreg]);
243 ct = nf_ct_get(skb, &ctinfo);
244 if (ct) /* already tracked */
250 case IP_CT_DIR_ORIGINAL:
251 zone.dir = NF_CT_ZONE_DIR_ORIG;
253 case IP_CT_DIR_REPLY:
254 zone.dir = NF_CT_ZONE_DIR_REPL;
260 ct = this_cpu_read(nft_ct_pcpu_template);
262 if (likely(atomic_read(&ct->ct_general.use) == 1)) {
263 nf_ct_zone_add(ct, &zone);
265 /* previous skb got queued to userspace */
266 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
268 regs->verdict.code = NF_DROP;
273 atomic_inc(&ct->ct_general.use);
274 nf_ct_set(skb, ct, IP_CT_NEW);
278 static void nft_ct_set_eval(const struct nft_expr *expr,
279 struct nft_regs *regs,
280 const struct nft_pktinfo *pkt)
282 const struct nft_ct *priv = nft_expr_priv(expr);
283 struct sk_buff *skb = pkt->skb;
284 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
285 u32 value = regs->data[priv->sreg];
287 enum ip_conntrack_info ctinfo;
290 ct = nf_ct_get(skb, &ctinfo);
291 if (ct == NULL || nf_ct_is_template(ct))
295 #ifdef CONFIG_NF_CONNTRACK_MARK
297 if (ct->mark != value) {
299 nf_conntrack_event_cache(IPCT_MARK, ct);
303 #ifdef CONFIG_NF_CONNTRACK_SECMARK
305 if (ct->secmark != value) {
307 nf_conntrack_event_cache(IPCT_SECMARK, ct);
311 #ifdef CONFIG_NF_CONNTRACK_LABELS
313 nf_connlabels_replace(ct,
314 ®s->data[priv->sreg],
315 ®s->data[priv->sreg],
316 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
319 #ifdef CONFIG_NF_CONNTRACK_EVENTS
320 case NFT_CT_EVENTMASK: {
321 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
322 u32 ctmask = regs->data[priv->sreg];
325 if (e->ctmask != ctmask)
330 if (ctmask && !nf_ct_is_confirmed(ct))
331 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
340 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
341 [NFTA_CT_DREG] = { .type = NLA_U32 },
342 [NFTA_CT_KEY] = { .type = NLA_U32 },
343 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
344 [NFTA_CT_SREG] = { .type = NLA_U32 },
347 #ifdef CONFIG_NF_CONNTRACK_ZONES
348 static void nft_ct_tmpl_put_pcpu(void)
353 for_each_possible_cpu(cpu) {
354 ct = per_cpu(nft_ct_pcpu_template, cpu);
358 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
362 static bool nft_ct_tmpl_alloc_pcpu(void)
364 struct nf_conntrack_zone zone = { .id = 0 };
368 if (nft_ct_pcpu_template_refcnt)
371 for_each_possible_cpu(cpu) {
372 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
374 nft_ct_tmpl_put_pcpu();
378 atomic_set(&tmp->ct_general.use, 1);
379 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
386 static int nft_ct_get_init(const struct nft_ctx *ctx,
387 const struct nft_expr *expr,
388 const struct nlattr * const tb[])
390 struct nft_ct *priv = nft_expr_priv(expr);
394 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
395 priv->dir = IP_CT_DIR_MAX;
397 case NFT_CT_DIRECTION:
398 if (tb[NFTA_CT_DIRECTION] != NULL)
404 #ifdef CONFIG_NF_CONNTRACK_MARK
407 #ifdef CONFIG_NF_CONNTRACK_SECMARK
410 case NFT_CT_EXPIRATION:
411 if (tb[NFTA_CT_DIRECTION] != NULL)
415 #ifdef CONFIG_NF_CONNTRACK_LABELS
417 if (tb[NFTA_CT_DIRECTION] != NULL)
419 len = NF_CT_LABELS_MAX_SIZE;
423 if (tb[NFTA_CT_DIRECTION] != NULL)
425 len = NF_CT_HELPER_NAME_LEN;
428 case NFT_CT_L3PROTOCOL:
429 case NFT_CT_PROTOCOL:
430 /* For compatibility, do not report error if NFTA_CT_DIRECTION
431 * attribute is specified.
437 if (tb[NFTA_CT_DIRECTION] == NULL)
440 switch (ctx->family) {
442 len = sizeof_field(struct nf_conntrack_tuple,
447 len = sizeof_field(struct nf_conntrack_tuple,
451 return -EAFNOSUPPORT;
456 if (tb[NFTA_CT_DIRECTION] == NULL)
459 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
463 if (tb[NFTA_CT_DIRECTION] == NULL)
466 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
468 case NFT_CT_PROTO_SRC:
469 case NFT_CT_PROTO_DST:
470 if (tb[NFTA_CT_DIRECTION] == NULL)
472 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
479 #ifdef CONFIG_NF_CONNTRACK_ZONES
491 if (tb[NFTA_CT_DIRECTION] != NULL) {
492 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
494 case IP_CT_DIR_ORIGINAL:
495 case IP_CT_DIR_REPLY:
502 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
503 NFT_DATA_VALUE, len);
507 err = nf_ct_netns_get(ctx->net, ctx->family);
511 if (priv->key == NFT_CT_BYTES ||
512 priv->key == NFT_CT_PKTS ||
513 priv->key == NFT_CT_AVGPKT)
514 nf_ct_set_acct(ctx->net, true);
519 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
522 #ifdef CONFIG_NF_CONNTRACK_LABELS
524 nf_connlabels_put(ctx->net);
527 #ifdef CONFIG_NF_CONNTRACK_ZONES
529 mutex_lock(&nft_ct_pcpu_mutex);
530 if (--nft_ct_pcpu_template_refcnt == 0)
531 nft_ct_tmpl_put_pcpu();
532 mutex_unlock(&nft_ct_pcpu_mutex);
540 static int nft_ct_set_init(const struct nft_ctx *ctx,
541 const struct nft_expr *expr,
542 const struct nlattr * const tb[])
544 struct nft_ct *priv = nft_expr_priv(expr);
548 priv->dir = IP_CT_DIR_MAX;
549 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
551 #ifdef CONFIG_NF_CONNTRACK_MARK
553 if (tb[NFTA_CT_DIRECTION])
555 len = sizeof_field(struct nf_conn, mark);
558 #ifdef CONFIG_NF_CONNTRACK_LABELS
560 if (tb[NFTA_CT_DIRECTION])
562 len = NF_CT_LABELS_MAX_SIZE;
563 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
568 #ifdef CONFIG_NF_CONNTRACK_ZONES
570 mutex_lock(&nft_ct_pcpu_mutex);
571 if (!nft_ct_tmpl_alloc_pcpu()) {
572 mutex_unlock(&nft_ct_pcpu_mutex);
575 nft_ct_pcpu_template_refcnt++;
576 mutex_unlock(&nft_ct_pcpu_mutex);
580 #ifdef CONFIG_NF_CONNTRACK_EVENTS
581 case NFT_CT_EVENTMASK:
582 if (tb[NFTA_CT_DIRECTION])
587 #ifdef CONFIG_NF_CONNTRACK_SECMARK
589 if (tb[NFTA_CT_DIRECTION])
598 if (tb[NFTA_CT_DIRECTION]) {
599 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
601 case IP_CT_DIR_ORIGINAL:
602 case IP_CT_DIR_REPLY:
610 err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
614 err = nf_ct_netns_get(ctx->net, ctx->family);
621 __nft_ct_set_destroy(ctx, priv);
625 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
626 const struct nft_expr *expr)
628 nf_ct_netns_put(ctx->net, ctx->family);
631 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
632 const struct nft_expr *expr)
634 struct nft_ct *priv = nft_expr_priv(expr);
636 __nft_ct_set_destroy(ctx, priv);
637 nf_ct_netns_put(ctx->net, ctx->family);
640 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
642 const struct nft_ct *priv = nft_expr_priv(expr);
644 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
645 goto nla_put_failure;
646 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
647 goto nla_put_failure;
656 case NFT_CT_PROTO_SRC:
657 case NFT_CT_PROTO_DST:
658 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
659 goto nla_put_failure;
665 if (priv->dir < IP_CT_DIR_MAX &&
666 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
667 goto nla_put_failure;
679 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
681 const struct nft_ct *priv = nft_expr_priv(expr);
683 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
684 goto nla_put_failure;
685 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
686 goto nla_put_failure;
690 if (priv->dir < IP_CT_DIR_MAX &&
691 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
692 goto nla_put_failure;
704 static struct nft_expr_type nft_ct_type;
705 static const struct nft_expr_ops nft_ct_get_ops = {
706 .type = &nft_ct_type,
707 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
708 .eval = nft_ct_get_eval,
709 .init = nft_ct_get_init,
710 .destroy = nft_ct_get_destroy,
711 .dump = nft_ct_get_dump,
714 static const struct nft_expr_ops nft_ct_set_ops = {
715 .type = &nft_ct_type,
716 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
717 .eval = nft_ct_set_eval,
718 .init = nft_ct_set_init,
719 .destroy = nft_ct_set_destroy,
720 .dump = nft_ct_set_dump,
723 #ifdef CONFIG_NF_CONNTRACK_ZONES
724 static const struct nft_expr_ops nft_ct_set_zone_ops = {
725 .type = &nft_ct_type,
726 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
727 .eval = nft_ct_set_zone_eval,
728 .init = nft_ct_set_init,
729 .destroy = nft_ct_set_destroy,
730 .dump = nft_ct_set_dump,
734 static const struct nft_expr_ops *
735 nft_ct_select_ops(const struct nft_ctx *ctx,
736 const struct nlattr * const tb[])
738 if (tb[NFTA_CT_KEY] == NULL)
739 return ERR_PTR(-EINVAL);
741 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
742 return ERR_PTR(-EINVAL);
744 if (tb[NFTA_CT_DREG])
745 return &nft_ct_get_ops;
747 if (tb[NFTA_CT_SREG]) {
748 #ifdef CONFIG_NF_CONNTRACK_ZONES
749 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
750 return &nft_ct_set_zone_ops;
752 return &nft_ct_set_ops;
755 return ERR_PTR(-EINVAL);
758 static struct nft_expr_type nft_ct_type __read_mostly = {
760 .select_ops = nft_ct_select_ops,
761 .policy = nft_ct_policy,
762 .maxattr = NFTA_CT_MAX,
763 .owner = THIS_MODULE,
766 static void nft_notrack_eval(const struct nft_expr *expr,
767 struct nft_regs *regs,
768 const struct nft_pktinfo *pkt)
770 struct sk_buff *skb = pkt->skb;
771 enum ip_conntrack_info ctinfo;
774 ct = nf_ct_get(pkt->skb, &ctinfo);
775 /* Previously seen (loopback or untracked)? Ignore. */
776 if (ct || ctinfo == IP_CT_UNTRACKED)
779 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
782 static struct nft_expr_type nft_notrack_type;
783 static const struct nft_expr_ops nft_notrack_ops = {
784 .type = &nft_notrack_type,
785 .size = NFT_EXPR_SIZE(0),
786 .eval = nft_notrack_eval,
789 static struct nft_expr_type nft_notrack_type __read_mostly = {
791 .ops = &nft_notrack_ops,
792 .owner = THIS_MODULE,
795 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
797 nft_ct_timeout_parse_policy(void *timeouts,
798 const struct nf_conntrack_l4proto *l4proto,
799 struct net *net, const struct nlattr *attr)
804 tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
810 ret = nla_parse_nested_deprecated(tb,
811 l4proto->ctnl_timeout.nlattr_max,
813 l4proto->ctnl_timeout.nla_policy,
818 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
825 struct nft_ct_timeout_obj {
826 struct nf_ct_timeout *timeout;
830 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
831 struct nft_regs *regs,
832 const struct nft_pktinfo *pkt)
834 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
835 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
836 struct nf_conn_timeout *timeout;
837 const unsigned int *values;
839 if (priv->l4proto != pkt->tprot)
842 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
845 timeout = nf_ct_timeout_find(ct);
847 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
849 regs->verdict.code = NF_DROP;
854 rcu_assign_pointer(timeout->timeout, priv->timeout);
856 /* adjust the timeout as per 'new' state. ct is unconfirmed,
857 * so the current timestamp must not be added.
859 values = nf_ct_timeout_data(timeout);
861 nf_ct_refresh(ct, pkt->skb, values[0]);
864 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
865 const struct nlattr * const tb[],
866 struct nft_object *obj)
868 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
869 const struct nf_conntrack_l4proto *l4proto;
870 struct nf_ct_timeout *timeout;
871 int l3num = ctx->family;
875 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
876 !tb[NFTA_CT_TIMEOUT_DATA])
879 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
880 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
882 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
883 priv->l4proto = l4num;
885 l4proto = nf_ct_l4proto_find(l4num);
887 if (l4proto->l4proto != l4num) {
892 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
893 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
894 if (timeout == NULL) {
899 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
900 tb[NFTA_CT_TIMEOUT_DATA]);
902 goto err_free_timeout;
904 timeout->l3num = l3num;
905 timeout->l4proto = l4proto;
907 ret = nf_ct_netns_get(ctx->net, ctx->family);
909 goto err_free_timeout;
911 priv->timeout = timeout;
920 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
921 struct nft_object *obj)
923 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
924 struct nf_ct_timeout *timeout = priv->timeout;
926 nf_ct_untimeout(ctx->net, timeout);
927 nf_ct_netns_put(ctx->net, ctx->family);
928 kfree(priv->timeout);
931 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
932 struct nft_object *obj, bool reset)
934 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
935 const struct nf_ct_timeout *timeout = priv->timeout;
936 struct nlattr *nest_params;
939 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
940 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
943 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
947 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
950 nla_nest_end(skb, nest_params);
954 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
955 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
956 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
957 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
960 static struct nft_object_type nft_ct_timeout_obj_type;
962 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
963 .type = &nft_ct_timeout_obj_type,
964 .size = sizeof(struct nft_ct_timeout_obj),
965 .eval = nft_ct_timeout_obj_eval,
966 .init = nft_ct_timeout_obj_init,
967 .destroy = nft_ct_timeout_obj_destroy,
968 .dump = nft_ct_timeout_obj_dump,
971 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
972 .type = NFT_OBJECT_CT_TIMEOUT,
973 .ops = &nft_ct_timeout_obj_ops,
974 .maxattr = NFTA_CT_TIMEOUT_MAX,
975 .policy = nft_ct_timeout_policy,
976 .owner = THIS_MODULE,
978 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
980 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
981 const struct nlattr * const tb[],
982 struct nft_object *obj)
984 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
985 struct nf_conntrack_helper *help4, *help6;
986 char name[NF_CT_HELPER_NAME_LEN];
987 int family = ctx->family;
990 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
993 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
997 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
999 if (tb[NFTA_CT_HELPER_L3PROTO])
1000 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1007 if (ctx->family == NFPROTO_IPV6)
1010 help4 = nf_conntrack_helper_try_module_get(name, family,
1014 if (ctx->family == NFPROTO_IPV4)
1017 help6 = nf_conntrack_helper_try_module_get(name, family,
1020 case NFPROTO_NETDEV:
1021 case NFPROTO_BRIDGE:
1023 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1025 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1029 return -EAFNOSUPPORT;
1032 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1033 if (!help4 && !help6)
1036 priv->helper4 = help4;
1037 priv->helper6 = help6;
1039 err = nf_ct_netns_get(ctx->net, ctx->family);
1041 goto err_put_helper;
1047 nf_conntrack_helper_put(priv->helper4);
1049 nf_conntrack_helper_put(priv->helper6);
1053 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1054 struct nft_object *obj)
1056 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1059 nf_conntrack_helper_put(priv->helper4);
1061 nf_conntrack_helper_put(priv->helper6);
1063 nf_ct_netns_put(ctx->net, ctx->family);
1066 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1067 struct nft_regs *regs,
1068 const struct nft_pktinfo *pkt)
1070 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1071 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1072 struct nf_conntrack_helper *to_assign = NULL;
1073 struct nf_conn_help *help;
1076 nf_ct_is_confirmed(ct) ||
1077 nf_ct_is_template(ct) ||
1078 priv->l4proto != nf_ct_protonum(ct))
1081 switch (nf_ct_l3num(ct)) {
1083 to_assign = priv->helper4;
1086 to_assign = priv->helper6;
1096 if (test_bit(IPS_HELPER_BIT, &ct->status))
1099 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1101 rcu_assign_pointer(help->helper, to_assign);
1102 set_bit(IPS_HELPER_BIT, &ct->status);
1106 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1107 struct nft_object *obj, bool reset)
1109 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1110 const struct nf_conntrack_helper *helper;
1113 if (priv->helper4 && priv->helper6) {
1114 family = NFPROTO_INET;
1115 helper = priv->helper4;
1116 } else if (priv->helper6) {
1117 family = NFPROTO_IPV6;
1118 helper = priv->helper6;
1120 family = NFPROTO_IPV4;
1121 helper = priv->helper4;
1124 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1127 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1130 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1136 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1137 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1138 .len = NF_CT_HELPER_NAME_LEN - 1 },
1139 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1140 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1143 static struct nft_object_type nft_ct_helper_obj_type;
1144 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1145 .type = &nft_ct_helper_obj_type,
1146 .size = sizeof(struct nft_ct_helper_obj),
1147 .eval = nft_ct_helper_obj_eval,
1148 .init = nft_ct_helper_obj_init,
1149 .destroy = nft_ct_helper_obj_destroy,
1150 .dump = nft_ct_helper_obj_dump,
1153 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1154 .type = NFT_OBJECT_CT_HELPER,
1155 .ops = &nft_ct_helper_obj_ops,
1156 .maxattr = NFTA_CT_HELPER_MAX,
1157 .policy = nft_ct_helper_policy,
1158 .owner = THIS_MODULE,
1161 struct nft_ct_expect_obj {
1169 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1170 const struct nlattr * const tb[],
1171 struct nft_object *obj)
1173 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1175 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1176 !tb[NFTA_CT_EXPECT_DPORT] ||
1177 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1178 !tb[NFTA_CT_EXPECT_SIZE])
1181 priv->l3num = ctx->family;
1182 if (tb[NFTA_CT_EXPECT_L3PROTO])
1183 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1185 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1186 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1187 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1188 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1190 return nf_ct_netns_get(ctx->net, ctx->family);
1193 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1194 struct nft_object *obj)
1196 nf_ct_netns_put(ctx->net, ctx->family);
1199 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1200 struct nft_object *obj, bool reset)
1202 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1204 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1205 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1206 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1207 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1208 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1214 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1215 struct nft_regs *regs,
1216 const struct nft_pktinfo *pkt)
1218 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1219 struct nf_conntrack_expect *exp;
1220 enum ip_conntrack_info ctinfo;
1221 struct nf_conn_help *help;
1222 enum ip_conntrack_dir dir;
1223 u16 l3num = priv->l3num;
1226 ct = nf_ct_get(pkt->skb, &ctinfo);
1227 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1228 regs->verdict.code = NFT_BREAK;
1231 dir = CTINFO2DIR(ctinfo);
1233 help = nfct_help(ct);
1235 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1237 regs->verdict.code = NF_DROP;
1241 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1242 regs->verdict.code = NFT_BREAK;
1245 if (l3num == NFPROTO_INET)
1246 l3num = nf_ct_l3num(ct);
1248 exp = nf_ct_expect_alloc(ct);
1250 regs->verdict.code = NF_DROP;
1253 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1254 &ct->tuplehash[!dir].tuple.src.u3,
1255 &ct->tuplehash[!dir].tuple.dst.u3,
1256 priv->l4proto, NULL, &priv->dport);
1257 exp->timeout.expires = jiffies + priv->timeout * HZ;
1259 if (nf_ct_expect_related(exp, 0) != 0)
1260 regs->verdict.code = NF_DROP;
1263 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1264 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1265 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1266 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1267 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1268 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1271 static struct nft_object_type nft_ct_expect_obj_type;
1273 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1274 .type = &nft_ct_expect_obj_type,
1275 .size = sizeof(struct nft_ct_expect_obj),
1276 .eval = nft_ct_expect_obj_eval,
1277 .init = nft_ct_expect_obj_init,
1278 .destroy = nft_ct_expect_obj_destroy,
1279 .dump = nft_ct_expect_obj_dump,
1282 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1283 .type = NFT_OBJECT_CT_EXPECT,
1284 .ops = &nft_ct_expect_obj_ops,
1285 .maxattr = NFTA_CT_EXPECT_MAX,
1286 .policy = nft_ct_expect_policy,
1287 .owner = THIS_MODULE,
1290 static int __init nft_ct_module_init(void)
1294 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1296 err = nft_register_expr(&nft_ct_type);
1300 err = nft_register_expr(&nft_notrack_type);
1304 err = nft_register_obj(&nft_ct_helper_obj_type);
1308 err = nft_register_obj(&nft_ct_expect_obj_type);
1311 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1312 err = nft_register_obj(&nft_ct_timeout_obj_type);
1318 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1320 nft_unregister_obj(&nft_ct_expect_obj_type);
1323 nft_unregister_obj(&nft_ct_helper_obj_type);
1325 nft_unregister_expr(&nft_notrack_type);
1327 nft_unregister_expr(&nft_ct_type);
1331 static void __exit nft_ct_module_exit(void)
1333 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1334 nft_unregister_obj(&nft_ct_timeout_obj_type);
1336 nft_unregister_obj(&nft_ct_expect_obj_type);
1337 nft_unregister_obj(&nft_ct_helper_obj_type);
1338 nft_unregister_expr(&nft_notrack_type);
1339 nft_unregister_expr(&nft_ct_type);
1342 module_init(nft_ct_module_init);
1343 module_exit(nft_ct_module_exit);
1345 MODULE_LICENSE("GPL");
1346 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1347 MODULE_ALIAS_NFT_EXPR("ct");
1348 MODULE_ALIAS_NFT_EXPR("notrack");
1349 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1350 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1351 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1352 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");