1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables_core.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
26 struct nft_ct_helper_obj {
27 struct nf_conntrack_helper *helper4;
28 struct nf_conntrack_helper *helper6;
32 #ifdef CONFIG_NF_CONNTRACK_ZONES
33 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
34 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
35 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
38 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
40 enum ip_conntrack_dir d)
42 if (d < IP_CT_DIR_MAX)
43 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
44 atomic64_read(&c[d].packets);
46 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
47 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50 static void nft_ct_get_eval(const struct nft_expr *expr,
51 struct nft_regs *regs,
52 const struct nft_pktinfo *pkt)
54 const struct nft_ct *priv = nft_expr_priv(expr);
55 u32 *dest = ®s->data[priv->dreg];
56 enum ip_conntrack_info ctinfo;
57 const struct nf_conn *ct;
58 const struct nf_conn_help *help;
59 const struct nf_conntrack_tuple *tuple;
60 const struct nf_conntrack_helper *helper;
63 ct = nf_ct_get(pkt->skb, &ctinfo);
68 state = NF_CT_STATE_BIT(ctinfo);
69 else if (ctinfo == IP_CT_UNTRACKED)
70 state = NF_CT_STATE_UNTRACKED_BIT;
72 state = NF_CT_STATE_INVALID_BIT;
83 case NFT_CT_DIRECTION:
84 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
89 #ifdef CONFIG_NF_CONNTRACK_MARK
91 *dest = READ_ONCE(ct->mark);
94 #ifdef CONFIG_NF_CONNTRACK_SECMARK
99 case NFT_CT_EXPIRATION:
100 *dest = jiffies_to_msecs(nf_ct_expires(ct));
103 if (ct->master == NULL)
105 help = nfct_help(ct->master);
108 helper = rcu_dereference(help->helper);
111 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
113 #ifdef CONFIG_NF_CONNTRACK_LABELS
114 case NFT_CT_LABELS: {
115 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
118 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
120 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
126 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
130 count = nft_ct_get_eval_counter(acct->counter,
131 priv->key, priv->dir);
132 memcpy(dest, &count, sizeof(count));
135 case NFT_CT_AVGPKT: {
136 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
137 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140 pcnt = nft_ct_get_eval_counter(acct->counter,
141 NFT_CT_PKTS, priv->dir);
142 bcnt = nft_ct_get_eval_counter(acct->counter,
143 NFT_CT_BYTES, priv->dir);
145 avgcnt = div64_u64(bcnt, pcnt);
148 memcpy(dest, &avgcnt, sizeof(avgcnt));
151 case NFT_CT_L3PROTOCOL:
152 nft_reg_store8(dest, nf_ct_l3num(ct));
154 case NFT_CT_PROTOCOL:
155 nft_reg_store8(dest, nf_ct_protonum(ct));
157 #ifdef CONFIG_NF_CONNTRACK_ZONES
159 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
162 if (priv->dir < IP_CT_DIR_MAX)
163 zoneid = nf_ct_zone_id(zone, priv->dir);
167 nft_reg_store16(dest, zoneid);
172 *dest = nf_ct_get_id(ct);
178 tuple = &ct->tuplehash[priv->dir].tuple;
181 memcpy(dest, tuple->src.u3.all,
182 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
185 memcpy(dest, tuple->dst.u3.all,
186 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
188 case NFT_CT_PROTO_SRC:
189 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
191 case NFT_CT_PROTO_DST:
192 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
195 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
197 *dest = (__force __u32)tuple->src.u3.ip;
200 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
202 *dest = (__force __u32)tuple->dst.u3.ip;
205 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
207 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
210 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
212 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
219 regs->verdict.code = NFT_BREAK;
222 #ifdef CONFIG_NF_CONNTRACK_ZONES
223 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
224 struct nft_regs *regs,
225 const struct nft_pktinfo *pkt)
227 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
228 const struct nft_ct *priv = nft_expr_priv(expr);
229 struct sk_buff *skb = pkt->skb;
230 enum ip_conntrack_info ctinfo;
231 u16 value = nft_reg_load16(®s->data[priv->sreg]);
234 ct = nf_ct_get(skb, &ctinfo);
235 if (ct) /* already tracked */
241 case IP_CT_DIR_ORIGINAL:
242 zone.dir = NF_CT_ZONE_DIR_ORIG;
244 case IP_CT_DIR_REPLY:
245 zone.dir = NF_CT_ZONE_DIR_REPL;
251 ct = this_cpu_read(nft_ct_pcpu_template);
253 if (likely(refcount_read(&ct->ct_general.use) == 1)) {
254 refcount_inc(&ct->ct_general.use);
255 nf_ct_zone_add(ct, &zone);
257 /* previous skb got queued to userspace, allocate temporary
258 * one until percpu template can be reused.
260 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
262 regs->verdict.code = NF_DROP;
265 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
268 nf_ct_set(skb, ct, IP_CT_NEW);
272 static void nft_ct_set_eval(const struct nft_expr *expr,
273 struct nft_regs *regs,
274 const struct nft_pktinfo *pkt)
276 const struct nft_ct *priv = nft_expr_priv(expr);
277 struct sk_buff *skb = pkt->skb;
278 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
279 u32 value = regs->data[priv->sreg];
281 enum ip_conntrack_info ctinfo;
284 ct = nf_ct_get(skb, &ctinfo);
285 if (ct == NULL || nf_ct_is_template(ct))
289 #ifdef CONFIG_NF_CONNTRACK_MARK
291 if (READ_ONCE(ct->mark) != value) {
292 WRITE_ONCE(ct->mark, value);
293 nf_conntrack_event_cache(IPCT_MARK, ct);
297 #ifdef CONFIG_NF_CONNTRACK_SECMARK
299 if (ct->secmark != value) {
301 nf_conntrack_event_cache(IPCT_SECMARK, ct);
305 #ifdef CONFIG_NF_CONNTRACK_LABELS
307 nf_connlabels_replace(ct,
308 ®s->data[priv->sreg],
309 ®s->data[priv->sreg],
310 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
313 #ifdef CONFIG_NF_CONNTRACK_EVENTS
314 case NFT_CT_EVENTMASK: {
315 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
316 u32 ctmask = regs->data[priv->sreg];
319 if (e->ctmask != ctmask)
324 if (ctmask && !nf_ct_is_confirmed(ct))
325 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
334 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
335 [NFTA_CT_DREG] = { .type = NLA_U32 },
336 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
337 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
338 [NFTA_CT_SREG] = { .type = NLA_U32 },
341 #ifdef CONFIG_NF_CONNTRACK_ZONES
342 static void nft_ct_tmpl_put_pcpu(void)
347 for_each_possible_cpu(cpu) {
348 ct = per_cpu(nft_ct_pcpu_template, cpu);
352 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
356 static bool nft_ct_tmpl_alloc_pcpu(void)
358 struct nf_conntrack_zone zone = { .id = 0 };
362 if (nft_ct_pcpu_template_refcnt)
365 for_each_possible_cpu(cpu) {
366 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
368 nft_ct_tmpl_put_pcpu();
372 __set_bit(IPS_CONFIRMED_BIT, &tmp->status);
373 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
380 static int nft_ct_get_init(const struct nft_ctx *ctx,
381 const struct nft_expr *expr,
382 const struct nlattr * const tb[])
384 struct nft_ct *priv = nft_expr_priv(expr);
388 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
389 priv->dir = IP_CT_DIR_MAX;
391 case NFT_CT_DIRECTION:
392 if (tb[NFTA_CT_DIRECTION] != NULL)
398 #ifdef CONFIG_NF_CONNTRACK_MARK
401 #ifdef CONFIG_NF_CONNTRACK_SECMARK
404 case NFT_CT_EXPIRATION:
405 if (tb[NFTA_CT_DIRECTION] != NULL)
409 #ifdef CONFIG_NF_CONNTRACK_LABELS
411 if (tb[NFTA_CT_DIRECTION] != NULL)
413 len = NF_CT_LABELS_MAX_SIZE;
417 if (tb[NFTA_CT_DIRECTION] != NULL)
419 len = NF_CT_HELPER_NAME_LEN;
422 case NFT_CT_L3PROTOCOL:
423 case NFT_CT_PROTOCOL:
424 /* For compatibility, do not report error if NFTA_CT_DIRECTION
425 * attribute is specified.
431 if (tb[NFTA_CT_DIRECTION] == NULL)
434 switch (ctx->family) {
436 len = sizeof_field(struct nf_conntrack_tuple,
441 len = sizeof_field(struct nf_conntrack_tuple,
445 return -EAFNOSUPPORT;
450 if (tb[NFTA_CT_DIRECTION] == NULL)
453 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
457 if (tb[NFTA_CT_DIRECTION] == NULL)
460 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
462 case NFT_CT_PROTO_SRC:
463 case NFT_CT_PROTO_DST:
464 if (tb[NFTA_CT_DIRECTION] == NULL)
466 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
473 #ifdef CONFIG_NF_CONNTRACK_ZONES
485 if (tb[NFTA_CT_DIRECTION] != NULL) {
486 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
488 case IP_CT_DIR_ORIGINAL:
489 case IP_CT_DIR_REPLY:
497 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
498 NFT_DATA_VALUE, len);
502 err = nf_ct_netns_get(ctx->net, ctx->family);
506 if (priv->key == NFT_CT_BYTES ||
507 priv->key == NFT_CT_PKTS ||
508 priv->key == NFT_CT_AVGPKT)
509 nf_ct_set_acct(ctx->net, true);
514 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
517 #ifdef CONFIG_NF_CONNTRACK_LABELS
519 nf_connlabels_put(ctx->net);
522 #ifdef CONFIG_NF_CONNTRACK_ZONES
524 mutex_lock(&nft_ct_pcpu_mutex);
525 if (--nft_ct_pcpu_template_refcnt == 0)
526 nft_ct_tmpl_put_pcpu();
527 mutex_unlock(&nft_ct_pcpu_mutex);
535 static int nft_ct_set_init(const struct nft_ctx *ctx,
536 const struct nft_expr *expr,
537 const struct nlattr * const tb[])
539 struct nft_ct *priv = nft_expr_priv(expr);
543 priv->dir = IP_CT_DIR_MAX;
544 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
546 #ifdef CONFIG_NF_CONNTRACK_MARK
548 if (tb[NFTA_CT_DIRECTION])
550 len = sizeof_field(struct nf_conn, mark);
553 #ifdef CONFIG_NF_CONNTRACK_LABELS
555 if (tb[NFTA_CT_DIRECTION])
557 len = NF_CT_LABELS_MAX_SIZE;
558 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
563 #ifdef CONFIG_NF_CONNTRACK_ZONES
565 mutex_lock(&nft_ct_pcpu_mutex);
566 if (!nft_ct_tmpl_alloc_pcpu()) {
567 mutex_unlock(&nft_ct_pcpu_mutex);
570 nft_ct_pcpu_template_refcnt++;
571 mutex_unlock(&nft_ct_pcpu_mutex);
575 #ifdef CONFIG_NF_CONNTRACK_EVENTS
576 case NFT_CT_EVENTMASK:
577 if (tb[NFTA_CT_DIRECTION])
582 #ifdef CONFIG_NF_CONNTRACK_SECMARK
584 if (tb[NFTA_CT_DIRECTION])
593 if (tb[NFTA_CT_DIRECTION]) {
594 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
596 case IP_CT_DIR_ORIGINAL:
597 case IP_CT_DIR_REPLY:
606 err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
610 err = nf_ct_netns_get(ctx->net, ctx->family);
617 __nft_ct_set_destroy(ctx, priv);
621 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
622 const struct nft_expr *expr)
624 nf_ct_netns_put(ctx->net, ctx->family);
627 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
628 const struct nft_expr *expr)
630 struct nft_ct *priv = nft_expr_priv(expr);
632 __nft_ct_set_destroy(ctx, priv);
633 nf_ct_netns_put(ctx->net, ctx->family);
636 static int nft_ct_get_dump(struct sk_buff *skb,
637 const struct nft_expr *expr, bool reset)
639 const struct nft_ct *priv = nft_expr_priv(expr);
641 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
642 goto nla_put_failure;
643 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
644 goto nla_put_failure;
653 case NFT_CT_PROTO_SRC:
654 case NFT_CT_PROTO_DST:
655 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
656 goto nla_put_failure;
662 if (priv->dir < IP_CT_DIR_MAX &&
663 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
664 goto nla_put_failure;
676 static bool nft_ct_get_reduce(struct nft_regs_track *track,
677 const struct nft_expr *expr)
679 const struct nft_ct *priv = nft_expr_priv(expr);
680 const struct nft_ct *ct;
682 if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
683 nft_reg_track_update(track, expr, priv->dreg, priv->len);
687 ct = nft_expr_priv(track->regs[priv->dreg].selector);
688 if (priv->key != ct->key) {
689 nft_reg_track_update(track, expr, priv->dreg, priv->len);
693 if (!track->regs[priv->dreg].bitwise)
696 return nft_expr_reduce_bitwise(track, expr);
699 static int nft_ct_set_dump(struct sk_buff *skb,
700 const struct nft_expr *expr, bool reset)
702 const struct nft_ct *priv = nft_expr_priv(expr);
704 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
705 goto nla_put_failure;
706 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
707 goto nla_put_failure;
711 if (priv->dir < IP_CT_DIR_MAX &&
712 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
713 goto nla_put_failure;
725 static struct nft_expr_type nft_ct_type;
726 static const struct nft_expr_ops nft_ct_get_ops = {
727 .type = &nft_ct_type,
728 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
729 .eval = nft_ct_get_eval,
730 .init = nft_ct_get_init,
731 .destroy = nft_ct_get_destroy,
732 .dump = nft_ct_get_dump,
733 .reduce = nft_ct_get_reduce,
736 static bool nft_ct_set_reduce(struct nft_regs_track *track,
737 const struct nft_expr *expr)
741 for (i = 0; i < NFT_REG32_NUM; i++) {
742 if (!track->regs[i].selector)
745 if (track->regs[i].selector->ops != &nft_ct_get_ops)
748 __nft_reg_track_cancel(track, i);
754 #ifdef CONFIG_RETPOLINE
755 static const struct nft_expr_ops nft_ct_get_fast_ops = {
756 .type = &nft_ct_type,
757 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
758 .eval = nft_ct_get_fast_eval,
759 .init = nft_ct_get_init,
760 .destroy = nft_ct_get_destroy,
761 .dump = nft_ct_get_dump,
762 .reduce = nft_ct_set_reduce,
766 static const struct nft_expr_ops nft_ct_set_ops = {
767 .type = &nft_ct_type,
768 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
769 .eval = nft_ct_set_eval,
770 .init = nft_ct_set_init,
771 .destroy = nft_ct_set_destroy,
772 .dump = nft_ct_set_dump,
773 .reduce = nft_ct_set_reduce,
776 #ifdef CONFIG_NF_CONNTRACK_ZONES
777 static const struct nft_expr_ops nft_ct_set_zone_ops = {
778 .type = &nft_ct_type,
779 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
780 .eval = nft_ct_set_zone_eval,
781 .init = nft_ct_set_init,
782 .destroy = nft_ct_set_destroy,
783 .dump = nft_ct_set_dump,
784 .reduce = nft_ct_set_reduce,
788 static const struct nft_expr_ops *
789 nft_ct_select_ops(const struct nft_ctx *ctx,
790 const struct nlattr * const tb[])
792 if (tb[NFTA_CT_KEY] == NULL)
793 return ERR_PTR(-EINVAL);
795 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
796 return ERR_PTR(-EINVAL);
798 if (tb[NFTA_CT_DREG]) {
799 #ifdef CONFIG_RETPOLINE
800 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
804 case NFT_CT_DIRECTION:
808 return &nft_ct_get_fast_ops;
811 return &nft_ct_get_ops;
814 if (tb[NFTA_CT_SREG]) {
815 #ifdef CONFIG_NF_CONNTRACK_ZONES
816 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
817 return &nft_ct_set_zone_ops;
819 return &nft_ct_set_ops;
822 return ERR_PTR(-EINVAL);
825 static struct nft_expr_type nft_ct_type __read_mostly = {
827 .select_ops = nft_ct_select_ops,
828 .policy = nft_ct_policy,
829 .maxattr = NFTA_CT_MAX,
830 .owner = THIS_MODULE,
833 static void nft_notrack_eval(const struct nft_expr *expr,
834 struct nft_regs *regs,
835 const struct nft_pktinfo *pkt)
837 struct sk_buff *skb = pkt->skb;
838 enum ip_conntrack_info ctinfo;
841 ct = nf_ct_get(pkt->skb, &ctinfo);
842 /* Previously seen (loopback or untracked)? Ignore. */
843 if (ct || ctinfo == IP_CT_UNTRACKED)
846 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
849 static struct nft_expr_type nft_notrack_type;
850 static const struct nft_expr_ops nft_notrack_ops = {
851 .type = &nft_notrack_type,
852 .size = NFT_EXPR_SIZE(0),
853 .eval = nft_notrack_eval,
854 .reduce = NFT_REDUCE_READONLY,
857 static struct nft_expr_type nft_notrack_type __read_mostly = {
859 .ops = &nft_notrack_ops,
860 .owner = THIS_MODULE,
863 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
865 nft_ct_timeout_parse_policy(void *timeouts,
866 const struct nf_conntrack_l4proto *l4proto,
867 struct net *net, const struct nlattr *attr)
872 tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
878 ret = nla_parse_nested_deprecated(tb,
879 l4proto->ctnl_timeout.nlattr_max,
881 l4proto->ctnl_timeout.nla_policy,
886 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
893 struct nft_ct_timeout_obj {
894 struct nf_ct_timeout *timeout;
898 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
899 struct nft_regs *regs,
900 const struct nft_pktinfo *pkt)
902 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
903 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
904 struct nf_conn_timeout *timeout;
905 const unsigned int *values;
907 if (priv->l4proto != pkt->tprot)
910 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
913 timeout = nf_ct_timeout_find(ct);
915 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
917 regs->verdict.code = NF_DROP;
922 rcu_assign_pointer(timeout->timeout, priv->timeout);
924 /* adjust the timeout as per 'new' state. ct is unconfirmed,
925 * so the current timestamp must not be added.
927 values = nf_ct_timeout_data(timeout);
929 nf_ct_refresh(ct, pkt->skb, values[0]);
932 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
933 const struct nlattr * const tb[],
934 struct nft_object *obj)
936 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
937 const struct nf_conntrack_l4proto *l4proto;
938 struct nf_ct_timeout *timeout;
939 int l3num = ctx->family;
943 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
944 !tb[NFTA_CT_TIMEOUT_DATA])
947 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
948 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
950 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
951 priv->l4proto = l4num;
953 l4proto = nf_ct_l4proto_find(l4num);
955 if (l4proto->l4proto != l4num) {
960 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
961 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
962 if (timeout == NULL) {
967 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
968 tb[NFTA_CT_TIMEOUT_DATA]);
970 goto err_free_timeout;
972 timeout->l3num = l3num;
973 timeout->l4proto = l4proto;
975 ret = nf_ct_netns_get(ctx->net, ctx->family);
977 goto err_free_timeout;
979 priv->timeout = timeout;
988 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
989 struct nft_object *obj)
991 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
992 struct nf_ct_timeout *timeout = priv->timeout;
994 nf_ct_untimeout(ctx->net, timeout);
995 nf_ct_netns_put(ctx->net, ctx->family);
996 kfree(priv->timeout);
999 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
1000 struct nft_object *obj, bool reset)
1002 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
1003 const struct nf_ct_timeout *timeout = priv->timeout;
1004 struct nlattr *nest_params;
1007 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
1008 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
1011 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
1015 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
1018 nla_nest_end(skb, nest_params);
1022 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1023 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1024 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1025 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
1028 static struct nft_object_type nft_ct_timeout_obj_type;
1030 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1031 .type = &nft_ct_timeout_obj_type,
1032 .size = sizeof(struct nft_ct_timeout_obj),
1033 .eval = nft_ct_timeout_obj_eval,
1034 .init = nft_ct_timeout_obj_init,
1035 .destroy = nft_ct_timeout_obj_destroy,
1036 .dump = nft_ct_timeout_obj_dump,
1039 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1040 .type = NFT_OBJECT_CT_TIMEOUT,
1041 .ops = &nft_ct_timeout_obj_ops,
1042 .maxattr = NFTA_CT_TIMEOUT_MAX,
1043 .policy = nft_ct_timeout_policy,
1044 .owner = THIS_MODULE,
1046 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1048 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1049 const struct nlattr * const tb[],
1050 struct nft_object *obj)
1052 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1053 struct nf_conntrack_helper *help4, *help6;
1054 char name[NF_CT_HELPER_NAME_LEN];
1055 int family = ctx->family;
1058 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1061 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1065 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1067 if (tb[NFTA_CT_HELPER_L3PROTO])
1068 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1075 if (ctx->family == NFPROTO_IPV6)
1078 help4 = nf_conntrack_helper_try_module_get(name, family,
1082 if (ctx->family == NFPROTO_IPV4)
1085 help6 = nf_conntrack_helper_try_module_get(name, family,
1088 case NFPROTO_NETDEV:
1089 case NFPROTO_BRIDGE:
1091 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1093 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1097 return -EAFNOSUPPORT;
1100 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1101 if (!help4 && !help6)
1104 priv->helper4 = help4;
1105 priv->helper6 = help6;
1107 err = nf_ct_netns_get(ctx->net, ctx->family);
1109 goto err_put_helper;
1115 nf_conntrack_helper_put(priv->helper4);
1117 nf_conntrack_helper_put(priv->helper6);
1121 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1122 struct nft_object *obj)
1124 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1127 nf_conntrack_helper_put(priv->helper4);
1129 nf_conntrack_helper_put(priv->helper6);
1131 nf_ct_netns_put(ctx->net, ctx->family);
1134 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1135 struct nft_regs *regs,
1136 const struct nft_pktinfo *pkt)
1138 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1139 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1140 struct nf_conntrack_helper *to_assign = NULL;
1141 struct nf_conn_help *help;
1144 nf_ct_is_confirmed(ct) ||
1145 nf_ct_is_template(ct) ||
1146 priv->l4proto != nf_ct_protonum(ct))
1149 switch (nf_ct_l3num(ct)) {
1151 to_assign = priv->helper4;
1154 to_assign = priv->helper6;
1164 if (test_bit(IPS_HELPER_BIT, &ct->status))
1167 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1169 rcu_assign_pointer(help->helper, to_assign);
1170 set_bit(IPS_HELPER_BIT, &ct->status);
1174 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1175 struct nft_object *obj, bool reset)
1177 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1178 const struct nf_conntrack_helper *helper;
1181 if (priv->helper4 && priv->helper6) {
1182 family = NFPROTO_INET;
1183 helper = priv->helper4;
1184 } else if (priv->helper6) {
1185 family = NFPROTO_IPV6;
1186 helper = priv->helper6;
1188 family = NFPROTO_IPV4;
1189 helper = priv->helper4;
1192 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1195 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1198 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1204 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1205 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1206 .len = NF_CT_HELPER_NAME_LEN - 1 },
1207 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1208 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1211 static struct nft_object_type nft_ct_helper_obj_type;
1212 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1213 .type = &nft_ct_helper_obj_type,
1214 .size = sizeof(struct nft_ct_helper_obj),
1215 .eval = nft_ct_helper_obj_eval,
1216 .init = nft_ct_helper_obj_init,
1217 .destroy = nft_ct_helper_obj_destroy,
1218 .dump = nft_ct_helper_obj_dump,
1221 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1222 .type = NFT_OBJECT_CT_HELPER,
1223 .ops = &nft_ct_helper_obj_ops,
1224 .maxattr = NFTA_CT_HELPER_MAX,
1225 .policy = nft_ct_helper_policy,
1226 .owner = THIS_MODULE,
1229 struct nft_ct_expect_obj {
1237 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1238 const struct nlattr * const tb[],
1239 struct nft_object *obj)
1241 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1243 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1244 !tb[NFTA_CT_EXPECT_DPORT] ||
1245 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1246 !tb[NFTA_CT_EXPECT_SIZE])
1249 priv->l3num = ctx->family;
1250 if (tb[NFTA_CT_EXPECT_L3PROTO])
1251 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1253 switch (priv->l3num) {
1256 if (priv->l3num != ctx->family)
1266 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1267 switch (priv->l4proto) {
1270 case IPPROTO_UDPLITE:
1278 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1279 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1280 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1282 return nf_ct_netns_get(ctx->net, ctx->family);
1285 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1286 struct nft_object *obj)
1288 nf_ct_netns_put(ctx->net, ctx->family);
1291 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1292 struct nft_object *obj, bool reset)
1294 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1296 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1297 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1298 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1299 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1300 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1306 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1307 struct nft_regs *regs,
1308 const struct nft_pktinfo *pkt)
1310 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1311 struct nf_conntrack_expect *exp;
1312 enum ip_conntrack_info ctinfo;
1313 struct nf_conn_help *help;
1314 enum ip_conntrack_dir dir;
1315 u16 l3num = priv->l3num;
1318 ct = nf_ct_get(pkt->skb, &ctinfo);
1319 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1320 regs->verdict.code = NFT_BREAK;
1323 dir = CTINFO2DIR(ctinfo);
1325 help = nfct_help(ct);
1327 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1329 regs->verdict.code = NF_DROP;
1333 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1334 regs->verdict.code = NFT_BREAK;
1337 if (l3num == NFPROTO_INET)
1338 l3num = nf_ct_l3num(ct);
1340 exp = nf_ct_expect_alloc(ct);
1342 regs->verdict.code = NF_DROP;
1345 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1346 &ct->tuplehash[!dir].tuple.src.u3,
1347 &ct->tuplehash[!dir].tuple.dst.u3,
1348 priv->l4proto, NULL, &priv->dport);
1349 exp->timeout.expires = jiffies + priv->timeout * HZ;
1351 if (nf_ct_expect_related(exp, 0) != 0)
1352 regs->verdict.code = NF_DROP;
1355 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1356 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1357 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1358 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1359 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1360 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1363 static struct nft_object_type nft_ct_expect_obj_type;
1365 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1366 .type = &nft_ct_expect_obj_type,
1367 .size = sizeof(struct nft_ct_expect_obj),
1368 .eval = nft_ct_expect_obj_eval,
1369 .init = nft_ct_expect_obj_init,
1370 .destroy = nft_ct_expect_obj_destroy,
1371 .dump = nft_ct_expect_obj_dump,
1374 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1375 .type = NFT_OBJECT_CT_EXPECT,
1376 .ops = &nft_ct_expect_obj_ops,
1377 .maxattr = NFTA_CT_EXPECT_MAX,
1378 .policy = nft_ct_expect_policy,
1379 .owner = THIS_MODULE,
1382 static int __init nft_ct_module_init(void)
1386 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1388 err = nft_register_expr(&nft_ct_type);
1392 err = nft_register_expr(&nft_notrack_type);
1396 err = nft_register_obj(&nft_ct_helper_obj_type);
1400 err = nft_register_obj(&nft_ct_expect_obj_type);
1403 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1404 err = nft_register_obj(&nft_ct_timeout_obj_type);
1410 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1412 nft_unregister_obj(&nft_ct_expect_obj_type);
1415 nft_unregister_obj(&nft_ct_helper_obj_type);
1417 nft_unregister_expr(&nft_notrack_type);
1419 nft_unregister_expr(&nft_ct_type);
1423 static void __exit nft_ct_module_exit(void)
1425 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1426 nft_unregister_obj(&nft_ct_timeout_obj_type);
1428 nft_unregister_obj(&nft_ct_expect_obj_type);
1429 nft_unregister_obj(&nft_ct_helper_obj_type);
1430 nft_unregister_expr(&nft_notrack_type);
1431 nft_unregister_expr(&nft_ct_type);
1434 module_init(nft_ct_module_init);
1435 module_exit(nft_ct_module_exit);
1437 MODULE_LICENSE("GPL");
1438 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1439 MODULE_ALIAS_NFT_EXPR("ct");
1440 MODULE_ALIAS_NFT_EXPR("notrack");
1441 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1442 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1443 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1444 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");