1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
35 struct nft_ct_helper_obj {
36 struct nf_conntrack_helper *helper4;
37 struct nf_conntrack_helper *helper6;
41 #ifdef CONFIG_NF_CONNTRACK_ZONES
42 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
43 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
44 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
47 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
49 enum ip_conntrack_dir d)
51 if (d < IP_CT_DIR_MAX)
52 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
53 atomic64_read(&c[d].packets);
55 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
56 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
59 static void nft_ct_get_eval(const struct nft_expr *expr,
60 struct nft_regs *regs,
61 const struct nft_pktinfo *pkt)
63 const struct nft_ct *priv = nft_expr_priv(expr);
64 u32 *dest = ®s->data[priv->dreg];
65 enum ip_conntrack_info ctinfo;
66 const struct nf_conn *ct;
67 const struct nf_conn_help *help;
68 const struct nf_conntrack_tuple *tuple;
69 const struct nf_conntrack_helper *helper;
72 ct = nf_ct_get(pkt->skb, &ctinfo);
77 state = NF_CT_STATE_BIT(ctinfo);
78 else if (ctinfo == IP_CT_UNTRACKED)
79 state = NF_CT_STATE_UNTRACKED_BIT;
81 state = NF_CT_STATE_INVALID_BIT;
92 case NFT_CT_DIRECTION:
93 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
98 #ifdef CONFIG_NF_CONNTRACK_MARK
103 #ifdef CONFIG_NF_CONNTRACK_SECMARK
108 case NFT_CT_EXPIRATION:
109 *dest = jiffies_to_msecs(nf_ct_expires(ct));
112 if (ct->master == NULL)
114 help = nfct_help(ct->master);
117 helper = rcu_dereference(help->helper);
120 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
122 #ifdef CONFIG_NF_CONNTRACK_LABELS
123 case NFT_CT_LABELS: {
124 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
127 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
129 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
135 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 count = nft_ct_get_eval_counter(acct->counter,
140 priv->key, priv->dir);
141 memcpy(dest, &count, sizeof(count));
144 case NFT_CT_AVGPKT: {
145 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
146 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
149 pcnt = nft_ct_get_eval_counter(acct->counter,
150 NFT_CT_PKTS, priv->dir);
151 bcnt = nft_ct_get_eval_counter(acct->counter,
152 NFT_CT_BYTES, priv->dir);
154 avgcnt = div64_u64(bcnt, pcnt);
157 memcpy(dest, &avgcnt, sizeof(avgcnt));
160 case NFT_CT_L3PROTOCOL:
161 nft_reg_store8(dest, nf_ct_l3num(ct));
163 case NFT_CT_PROTOCOL:
164 nft_reg_store8(dest, nf_ct_protonum(ct));
166 #ifdef CONFIG_NF_CONNTRACK_ZONES
168 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
171 if (priv->dir < IP_CT_DIR_MAX)
172 zoneid = nf_ct_zone_id(zone, priv->dir);
176 nft_reg_store16(dest, zoneid);
181 *dest = nf_ct_get_id(ct);
187 tuple = &ct->tuplehash[priv->dir].tuple;
190 memcpy(dest, tuple->src.u3.all,
191 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
194 memcpy(dest, tuple->dst.u3.all,
195 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
197 case NFT_CT_PROTO_SRC:
198 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
200 case NFT_CT_PROTO_DST:
201 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
204 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
206 *dest = tuple->src.u3.ip;
209 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
211 *dest = tuple->dst.u3.ip;
214 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
216 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
219 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
221 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
228 regs->verdict.code = NFT_BREAK;
231 #ifdef CONFIG_NF_CONNTRACK_ZONES
232 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
233 struct nft_regs *regs,
234 const struct nft_pktinfo *pkt)
236 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
237 const struct nft_ct *priv = nft_expr_priv(expr);
238 struct sk_buff *skb = pkt->skb;
239 enum ip_conntrack_info ctinfo;
240 u16 value = nft_reg_load16(®s->data[priv->sreg]);
243 ct = nf_ct_get(skb, &ctinfo);
244 if (ct) /* already tracked */
250 case IP_CT_DIR_ORIGINAL:
251 zone.dir = NF_CT_ZONE_DIR_ORIG;
253 case IP_CT_DIR_REPLY:
254 zone.dir = NF_CT_ZONE_DIR_REPL;
260 ct = this_cpu_read(nft_ct_pcpu_template);
262 if (likely(refcount_read(&ct->ct_general.use) == 1)) {
263 nf_ct_zone_add(ct, &zone);
265 /* previous skb got queued to userspace */
266 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
268 regs->verdict.code = NF_DROP;
273 nf_ct_set(skb, ct, IP_CT_NEW);
277 static void nft_ct_set_eval(const struct nft_expr *expr,
278 struct nft_regs *regs,
279 const struct nft_pktinfo *pkt)
281 const struct nft_ct *priv = nft_expr_priv(expr);
282 struct sk_buff *skb = pkt->skb;
283 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
284 u32 value = regs->data[priv->sreg];
286 enum ip_conntrack_info ctinfo;
289 ct = nf_ct_get(skb, &ctinfo);
290 if (ct == NULL || nf_ct_is_template(ct))
294 #ifdef CONFIG_NF_CONNTRACK_MARK
296 if (ct->mark != value) {
298 nf_conntrack_event_cache(IPCT_MARK, ct);
302 #ifdef CONFIG_NF_CONNTRACK_SECMARK
304 if (ct->secmark != value) {
306 nf_conntrack_event_cache(IPCT_SECMARK, ct);
310 #ifdef CONFIG_NF_CONNTRACK_LABELS
312 nf_connlabels_replace(ct,
313 ®s->data[priv->sreg],
314 ®s->data[priv->sreg],
315 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
318 #ifdef CONFIG_NF_CONNTRACK_EVENTS
319 case NFT_CT_EVENTMASK: {
320 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
321 u32 ctmask = regs->data[priv->sreg];
324 if (e->ctmask != ctmask)
329 if (ctmask && !nf_ct_is_confirmed(ct))
330 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
339 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
340 [NFTA_CT_DREG] = { .type = NLA_U32 },
341 [NFTA_CT_KEY] = { .type = NLA_U32 },
342 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
343 [NFTA_CT_SREG] = { .type = NLA_U32 },
346 #ifdef CONFIG_NF_CONNTRACK_ZONES
347 static void nft_ct_tmpl_put_pcpu(void)
352 for_each_possible_cpu(cpu) {
353 ct = per_cpu(nft_ct_pcpu_template, cpu);
357 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
361 static bool nft_ct_tmpl_alloc_pcpu(void)
363 struct nf_conntrack_zone zone = { .id = 0 };
367 if (nft_ct_pcpu_template_refcnt)
370 for_each_possible_cpu(cpu) {
371 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
373 nft_ct_tmpl_put_pcpu();
377 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
384 static int nft_ct_get_init(const struct nft_ctx *ctx,
385 const struct nft_expr *expr,
386 const struct nlattr * const tb[])
388 struct nft_ct *priv = nft_expr_priv(expr);
392 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
393 priv->dir = IP_CT_DIR_MAX;
395 case NFT_CT_DIRECTION:
396 if (tb[NFTA_CT_DIRECTION] != NULL)
402 #ifdef CONFIG_NF_CONNTRACK_MARK
405 #ifdef CONFIG_NF_CONNTRACK_SECMARK
408 case NFT_CT_EXPIRATION:
409 if (tb[NFTA_CT_DIRECTION] != NULL)
413 #ifdef CONFIG_NF_CONNTRACK_LABELS
415 if (tb[NFTA_CT_DIRECTION] != NULL)
417 len = NF_CT_LABELS_MAX_SIZE;
421 if (tb[NFTA_CT_DIRECTION] != NULL)
423 len = NF_CT_HELPER_NAME_LEN;
426 case NFT_CT_L3PROTOCOL:
427 case NFT_CT_PROTOCOL:
428 /* For compatibility, do not report error if NFTA_CT_DIRECTION
429 * attribute is specified.
435 if (tb[NFTA_CT_DIRECTION] == NULL)
438 switch (ctx->family) {
440 len = sizeof_field(struct nf_conntrack_tuple,
445 len = sizeof_field(struct nf_conntrack_tuple,
449 return -EAFNOSUPPORT;
454 if (tb[NFTA_CT_DIRECTION] == NULL)
457 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
461 if (tb[NFTA_CT_DIRECTION] == NULL)
464 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
466 case NFT_CT_PROTO_SRC:
467 case NFT_CT_PROTO_DST:
468 if (tb[NFTA_CT_DIRECTION] == NULL)
470 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
477 #ifdef CONFIG_NF_CONNTRACK_ZONES
489 if (tb[NFTA_CT_DIRECTION] != NULL) {
490 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
492 case IP_CT_DIR_ORIGINAL:
493 case IP_CT_DIR_REPLY:
500 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
501 NFT_DATA_VALUE, len);
505 err = nf_ct_netns_get(ctx->net, ctx->family);
509 if (priv->key == NFT_CT_BYTES ||
510 priv->key == NFT_CT_PKTS ||
511 priv->key == NFT_CT_AVGPKT)
512 nf_ct_set_acct(ctx->net, true);
517 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
520 #ifdef CONFIG_NF_CONNTRACK_LABELS
522 nf_connlabels_put(ctx->net);
525 #ifdef CONFIG_NF_CONNTRACK_ZONES
527 mutex_lock(&nft_ct_pcpu_mutex);
528 if (--nft_ct_pcpu_template_refcnt == 0)
529 nft_ct_tmpl_put_pcpu();
530 mutex_unlock(&nft_ct_pcpu_mutex);
538 static int nft_ct_set_init(const struct nft_ctx *ctx,
539 const struct nft_expr *expr,
540 const struct nlattr * const tb[])
542 struct nft_ct *priv = nft_expr_priv(expr);
546 priv->dir = IP_CT_DIR_MAX;
547 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
549 #ifdef CONFIG_NF_CONNTRACK_MARK
551 if (tb[NFTA_CT_DIRECTION])
553 len = sizeof_field(struct nf_conn, mark);
556 #ifdef CONFIG_NF_CONNTRACK_LABELS
558 if (tb[NFTA_CT_DIRECTION])
560 len = NF_CT_LABELS_MAX_SIZE;
561 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
566 #ifdef CONFIG_NF_CONNTRACK_ZONES
568 mutex_lock(&nft_ct_pcpu_mutex);
569 if (!nft_ct_tmpl_alloc_pcpu()) {
570 mutex_unlock(&nft_ct_pcpu_mutex);
573 nft_ct_pcpu_template_refcnt++;
574 mutex_unlock(&nft_ct_pcpu_mutex);
578 #ifdef CONFIG_NF_CONNTRACK_EVENTS
579 case NFT_CT_EVENTMASK:
580 if (tb[NFTA_CT_DIRECTION])
585 #ifdef CONFIG_NF_CONNTRACK_SECMARK
587 if (tb[NFTA_CT_DIRECTION])
596 if (tb[NFTA_CT_DIRECTION]) {
597 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
599 case IP_CT_DIR_ORIGINAL:
600 case IP_CT_DIR_REPLY:
608 err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
612 err = nf_ct_netns_get(ctx->net, ctx->family);
619 __nft_ct_set_destroy(ctx, priv);
623 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
624 const struct nft_expr *expr)
626 nf_ct_netns_put(ctx->net, ctx->family);
629 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
630 const struct nft_expr *expr)
632 struct nft_ct *priv = nft_expr_priv(expr);
634 __nft_ct_set_destroy(ctx, priv);
635 nf_ct_netns_put(ctx->net, ctx->family);
638 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
640 const struct nft_ct *priv = nft_expr_priv(expr);
642 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
643 goto nla_put_failure;
644 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
645 goto nla_put_failure;
654 case NFT_CT_PROTO_SRC:
655 case NFT_CT_PROTO_DST:
656 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
657 goto nla_put_failure;
663 if (priv->dir < IP_CT_DIR_MAX &&
664 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
665 goto nla_put_failure;
677 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
679 const struct nft_ct *priv = nft_expr_priv(expr);
681 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
682 goto nla_put_failure;
683 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
684 goto nla_put_failure;
688 if (priv->dir < IP_CT_DIR_MAX &&
689 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
690 goto nla_put_failure;
702 static struct nft_expr_type nft_ct_type;
703 static const struct nft_expr_ops nft_ct_get_ops = {
704 .type = &nft_ct_type,
705 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
706 .eval = nft_ct_get_eval,
707 .init = nft_ct_get_init,
708 .destroy = nft_ct_get_destroy,
709 .dump = nft_ct_get_dump,
712 static const struct nft_expr_ops nft_ct_set_ops = {
713 .type = &nft_ct_type,
714 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
715 .eval = nft_ct_set_eval,
716 .init = nft_ct_set_init,
717 .destroy = nft_ct_set_destroy,
718 .dump = nft_ct_set_dump,
721 #ifdef CONFIG_NF_CONNTRACK_ZONES
722 static const struct nft_expr_ops nft_ct_set_zone_ops = {
723 .type = &nft_ct_type,
724 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
725 .eval = nft_ct_set_zone_eval,
726 .init = nft_ct_set_init,
727 .destroy = nft_ct_set_destroy,
728 .dump = nft_ct_set_dump,
732 static const struct nft_expr_ops *
733 nft_ct_select_ops(const struct nft_ctx *ctx,
734 const struct nlattr * const tb[])
736 if (tb[NFTA_CT_KEY] == NULL)
737 return ERR_PTR(-EINVAL);
739 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
740 return ERR_PTR(-EINVAL);
742 if (tb[NFTA_CT_DREG])
743 return &nft_ct_get_ops;
745 if (tb[NFTA_CT_SREG]) {
746 #ifdef CONFIG_NF_CONNTRACK_ZONES
747 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
748 return &nft_ct_set_zone_ops;
750 return &nft_ct_set_ops;
753 return ERR_PTR(-EINVAL);
756 static struct nft_expr_type nft_ct_type __read_mostly = {
758 .select_ops = nft_ct_select_ops,
759 .policy = nft_ct_policy,
760 .maxattr = NFTA_CT_MAX,
761 .owner = THIS_MODULE,
764 static void nft_notrack_eval(const struct nft_expr *expr,
765 struct nft_regs *regs,
766 const struct nft_pktinfo *pkt)
768 struct sk_buff *skb = pkt->skb;
769 enum ip_conntrack_info ctinfo;
772 ct = nf_ct_get(pkt->skb, &ctinfo);
773 /* Previously seen (loopback or untracked)? Ignore. */
774 if (ct || ctinfo == IP_CT_UNTRACKED)
777 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
780 static struct nft_expr_type nft_notrack_type;
781 static const struct nft_expr_ops nft_notrack_ops = {
782 .type = &nft_notrack_type,
783 .size = NFT_EXPR_SIZE(0),
784 .eval = nft_notrack_eval,
787 static struct nft_expr_type nft_notrack_type __read_mostly = {
789 .ops = &nft_notrack_ops,
790 .owner = THIS_MODULE,
793 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
795 nft_ct_timeout_parse_policy(void *timeouts,
796 const struct nf_conntrack_l4proto *l4proto,
797 struct net *net, const struct nlattr *attr)
802 tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
808 ret = nla_parse_nested_deprecated(tb,
809 l4proto->ctnl_timeout.nlattr_max,
811 l4proto->ctnl_timeout.nla_policy,
816 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
823 struct nft_ct_timeout_obj {
824 struct nf_ct_timeout *timeout;
828 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
829 struct nft_regs *regs,
830 const struct nft_pktinfo *pkt)
832 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
833 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
834 struct nf_conn_timeout *timeout;
835 const unsigned int *values;
837 if (priv->l4proto != pkt->tprot)
840 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
843 timeout = nf_ct_timeout_find(ct);
845 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
847 regs->verdict.code = NF_DROP;
852 rcu_assign_pointer(timeout->timeout, priv->timeout);
854 /* adjust the timeout as per 'new' state. ct is unconfirmed,
855 * so the current timestamp must not be added.
857 values = nf_ct_timeout_data(timeout);
859 nf_ct_refresh(ct, pkt->skb, values[0]);
862 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
863 const struct nlattr * const tb[],
864 struct nft_object *obj)
866 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
867 const struct nf_conntrack_l4proto *l4proto;
868 struct nf_ct_timeout *timeout;
869 int l3num = ctx->family;
873 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
874 !tb[NFTA_CT_TIMEOUT_DATA])
877 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
878 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
880 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
881 priv->l4proto = l4num;
883 l4proto = nf_ct_l4proto_find(l4num);
885 if (l4proto->l4proto != l4num) {
890 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
891 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
892 if (timeout == NULL) {
897 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
898 tb[NFTA_CT_TIMEOUT_DATA]);
900 goto err_free_timeout;
902 timeout->l3num = l3num;
903 timeout->l4proto = l4proto;
905 ret = nf_ct_netns_get(ctx->net, ctx->family);
907 goto err_free_timeout;
909 priv->timeout = timeout;
918 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
919 struct nft_object *obj)
921 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
922 struct nf_ct_timeout *timeout = priv->timeout;
924 nf_ct_untimeout(ctx->net, timeout);
925 nf_ct_netns_put(ctx->net, ctx->family);
926 kfree(priv->timeout);
929 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
930 struct nft_object *obj, bool reset)
932 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
933 const struct nf_ct_timeout *timeout = priv->timeout;
934 struct nlattr *nest_params;
937 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
938 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
941 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
945 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
948 nla_nest_end(skb, nest_params);
952 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
953 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
954 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
955 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
958 static struct nft_object_type nft_ct_timeout_obj_type;
960 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
961 .type = &nft_ct_timeout_obj_type,
962 .size = sizeof(struct nft_ct_timeout_obj),
963 .eval = nft_ct_timeout_obj_eval,
964 .init = nft_ct_timeout_obj_init,
965 .destroy = nft_ct_timeout_obj_destroy,
966 .dump = nft_ct_timeout_obj_dump,
969 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
970 .type = NFT_OBJECT_CT_TIMEOUT,
971 .ops = &nft_ct_timeout_obj_ops,
972 .maxattr = NFTA_CT_TIMEOUT_MAX,
973 .policy = nft_ct_timeout_policy,
974 .owner = THIS_MODULE,
976 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
978 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
979 const struct nlattr * const tb[],
980 struct nft_object *obj)
982 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
983 struct nf_conntrack_helper *help4, *help6;
984 char name[NF_CT_HELPER_NAME_LEN];
985 int family = ctx->family;
988 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
991 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
995 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
997 if (tb[NFTA_CT_HELPER_L3PROTO])
998 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1005 if (ctx->family == NFPROTO_IPV6)
1008 help4 = nf_conntrack_helper_try_module_get(name, family,
1012 if (ctx->family == NFPROTO_IPV4)
1015 help6 = nf_conntrack_helper_try_module_get(name, family,
1018 case NFPROTO_NETDEV:
1019 case NFPROTO_BRIDGE:
1021 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1023 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1027 return -EAFNOSUPPORT;
1030 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1031 if (!help4 && !help6)
1034 priv->helper4 = help4;
1035 priv->helper6 = help6;
1037 err = nf_ct_netns_get(ctx->net, ctx->family);
1039 goto err_put_helper;
1041 /* Avoid the bogus warning, helper will be assigned after CT init */
1042 nf_ct_set_auto_assign_helper_warned(ctx->net);
1048 nf_conntrack_helper_put(priv->helper4);
1050 nf_conntrack_helper_put(priv->helper6);
1054 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1055 struct nft_object *obj)
1057 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1060 nf_conntrack_helper_put(priv->helper4);
1062 nf_conntrack_helper_put(priv->helper6);
1064 nf_ct_netns_put(ctx->net, ctx->family);
1067 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1068 struct nft_regs *regs,
1069 const struct nft_pktinfo *pkt)
1071 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1072 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1073 struct nf_conntrack_helper *to_assign = NULL;
1074 struct nf_conn_help *help;
1077 nf_ct_is_confirmed(ct) ||
1078 nf_ct_is_template(ct) ||
1079 priv->l4proto != nf_ct_protonum(ct))
1082 switch (nf_ct_l3num(ct)) {
1084 to_assign = priv->helper4;
1087 to_assign = priv->helper6;
1097 if (test_bit(IPS_HELPER_BIT, &ct->status))
1100 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1102 rcu_assign_pointer(help->helper, to_assign);
1103 set_bit(IPS_HELPER_BIT, &ct->status);
1107 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1108 struct nft_object *obj, bool reset)
1110 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1111 const struct nf_conntrack_helper *helper;
1114 if (priv->helper4 && priv->helper6) {
1115 family = NFPROTO_INET;
1116 helper = priv->helper4;
1117 } else if (priv->helper6) {
1118 family = NFPROTO_IPV6;
1119 helper = priv->helper6;
1121 family = NFPROTO_IPV4;
1122 helper = priv->helper4;
1125 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1128 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1131 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1137 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1138 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1139 .len = NF_CT_HELPER_NAME_LEN - 1 },
1140 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1141 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1144 static struct nft_object_type nft_ct_helper_obj_type;
1145 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1146 .type = &nft_ct_helper_obj_type,
1147 .size = sizeof(struct nft_ct_helper_obj),
1148 .eval = nft_ct_helper_obj_eval,
1149 .init = nft_ct_helper_obj_init,
1150 .destroy = nft_ct_helper_obj_destroy,
1151 .dump = nft_ct_helper_obj_dump,
1154 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1155 .type = NFT_OBJECT_CT_HELPER,
1156 .ops = &nft_ct_helper_obj_ops,
1157 .maxattr = NFTA_CT_HELPER_MAX,
1158 .policy = nft_ct_helper_policy,
1159 .owner = THIS_MODULE,
1162 struct nft_ct_expect_obj {
1170 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1171 const struct nlattr * const tb[],
1172 struct nft_object *obj)
1174 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1176 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1177 !tb[NFTA_CT_EXPECT_DPORT] ||
1178 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1179 !tb[NFTA_CT_EXPECT_SIZE])
1182 priv->l3num = ctx->family;
1183 if (tb[NFTA_CT_EXPECT_L3PROTO])
1184 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1186 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1187 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1188 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1189 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1191 return nf_ct_netns_get(ctx->net, ctx->family);
1194 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1195 struct nft_object *obj)
1197 nf_ct_netns_put(ctx->net, ctx->family);
1200 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1201 struct nft_object *obj, bool reset)
1203 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1205 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1206 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1207 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1208 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1209 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1215 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1216 struct nft_regs *regs,
1217 const struct nft_pktinfo *pkt)
1219 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1220 struct nf_conntrack_expect *exp;
1221 enum ip_conntrack_info ctinfo;
1222 struct nf_conn_help *help;
1223 enum ip_conntrack_dir dir;
1224 u16 l3num = priv->l3num;
1227 ct = nf_ct_get(pkt->skb, &ctinfo);
1228 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1229 regs->verdict.code = NFT_BREAK;
1232 dir = CTINFO2DIR(ctinfo);
1234 help = nfct_help(ct);
1236 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1238 regs->verdict.code = NF_DROP;
1242 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1243 regs->verdict.code = NFT_BREAK;
1246 if (l3num == NFPROTO_INET)
1247 l3num = nf_ct_l3num(ct);
1249 exp = nf_ct_expect_alloc(ct);
1251 regs->verdict.code = NF_DROP;
1254 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1255 &ct->tuplehash[!dir].tuple.src.u3,
1256 &ct->tuplehash[!dir].tuple.dst.u3,
1257 priv->l4proto, NULL, &priv->dport);
1258 exp->timeout.expires = jiffies + priv->timeout * HZ;
1260 if (nf_ct_expect_related(exp, 0) != 0)
1261 regs->verdict.code = NF_DROP;
1264 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1265 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1266 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1267 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1268 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1269 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1272 static struct nft_object_type nft_ct_expect_obj_type;
1274 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1275 .type = &nft_ct_expect_obj_type,
1276 .size = sizeof(struct nft_ct_expect_obj),
1277 .eval = nft_ct_expect_obj_eval,
1278 .init = nft_ct_expect_obj_init,
1279 .destroy = nft_ct_expect_obj_destroy,
1280 .dump = nft_ct_expect_obj_dump,
1283 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1284 .type = NFT_OBJECT_CT_EXPECT,
1285 .ops = &nft_ct_expect_obj_ops,
1286 .maxattr = NFTA_CT_EXPECT_MAX,
1287 .policy = nft_ct_expect_policy,
1288 .owner = THIS_MODULE,
1291 static int __init nft_ct_module_init(void)
1295 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1297 err = nft_register_expr(&nft_ct_type);
1301 err = nft_register_expr(&nft_notrack_type);
1305 err = nft_register_obj(&nft_ct_helper_obj_type);
1309 err = nft_register_obj(&nft_ct_expect_obj_type);
1312 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1313 err = nft_register_obj(&nft_ct_timeout_obj_type);
1319 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1321 nft_unregister_obj(&nft_ct_expect_obj_type);
1324 nft_unregister_obj(&nft_ct_helper_obj_type);
1326 nft_unregister_expr(&nft_notrack_type);
1328 nft_unregister_expr(&nft_ct_type);
1332 static void __exit nft_ct_module_exit(void)
1334 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1335 nft_unregister_obj(&nft_ct_timeout_obj_type);
1337 nft_unregister_obj(&nft_ct_expect_obj_type);
1338 nft_unregister_obj(&nft_ct_helper_obj_type);
1339 nft_unregister_expr(&nft_notrack_type);
1340 nft_unregister_expr(&nft_ct_type);
1343 module_init(nft_ct_module_init);
1344 module_exit(nft_ct_module_exit);
1346 MODULE_LICENSE("GPL");
1347 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1348 MODULE_ALIAS_NFT_EXPR("ct");
1349 MODULE_ALIAS_NFT_EXPR("notrack");
1350 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1351 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1352 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1353 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");