Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 *
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
7 */
8
9#include <linux/kernel.h>
10#include <linux/init.h>
11#include <linux/module.h>
12#include <linux/netlink.h>
13#include <linux/netfilter.h>
14#include <linux/netfilter/nf_tables.h>
15#include <net/netfilter/nf_tables_core.h>
16#include <net/netfilter/nf_conntrack.h>
17#include <net/netfilter/nf_conntrack_acct.h>
18#include <net/netfilter/nf_conntrack_tuple.h>
19#include <net/netfilter/nf_conntrack_helper.h>
20#include <net/netfilter/nf_conntrack_ecache.h>
21#include <net/netfilter/nf_conntrack_labels.h>
22#include <net/netfilter/nf_conntrack_timeout.h>
23#include <net/netfilter/nf_conntrack_l4proto.h>
24#include <net/netfilter/nf_conntrack_expect.h>
25#include <net/netfilter/nf_conntrack_seqadj.h>
26#include "nf_internals.h"
27
28struct nft_ct_helper_obj {
29 struct nf_conntrack_helper *helper4;
30 struct nf_conntrack_helper *helper6;
31 u8 l4proto;
32};
33
34#ifdef CONFIG_NF_CONNTRACK_ZONES
35static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
36static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
37static DEFINE_MUTEX(nft_ct_pcpu_mutex);
38#endif
39
40static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
41 enum nft_ct_keys k,
42 enum ip_conntrack_dir d)
43{
44 if (d < IP_CT_DIR_MAX)
45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
46 atomic64_read(&c[d].packets);
47
48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50}
51
52static void nft_ct_get_eval(const struct nft_expr *expr,
53 struct nft_regs *regs,
54 const struct nft_pktinfo *pkt)
55{
56 const struct nft_ct *priv = nft_expr_priv(expr);
57 u32 *dest = ®s->data[priv->dreg];
58 enum ip_conntrack_info ctinfo;
59 const struct nf_conn *ct;
60 const struct nf_conn_help *help;
61 const struct nf_conntrack_tuple *tuple;
62 const struct nf_conntrack_helper *helper;
63 unsigned int state;
64
65 ct = nf_ct_get(pkt->skb, &ctinfo);
66
67 switch (priv->key) {
68 case NFT_CT_STATE:
69 if (ct)
70 state = NF_CT_STATE_BIT(ctinfo);
71 else if (ctinfo == IP_CT_UNTRACKED)
72 state = NF_CT_STATE_UNTRACKED_BIT;
73 else
74 state = NF_CT_STATE_INVALID_BIT;
75 *dest = state;
76 return;
77 default:
78 break;
79 }
80
81 if (ct == NULL)
82 goto err;
83
84 switch (priv->key) {
85 case NFT_CT_DIRECTION:
86 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
87 return;
88 case NFT_CT_STATUS:
89 *dest = ct->status;
90 return;
91#ifdef CONFIG_NF_CONNTRACK_MARK
92 case NFT_CT_MARK:
93 *dest = READ_ONCE(ct->mark);
94 return;
95#endif
96#ifdef CONFIG_NF_CONNTRACK_SECMARK
97 case NFT_CT_SECMARK:
98 *dest = ct->secmark;
99 return;
100#endif
101 case NFT_CT_EXPIRATION:
102 *dest = jiffies_to_msecs(nf_ct_expires(ct));
103 return;
104 case NFT_CT_HELPER:
105 if (ct->master == NULL)
106 goto err;
107 help = nfct_help(ct->master);
108 if (help == NULL)
109 goto err;
110 helper = rcu_dereference(help->helper);
111 if (helper == NULL)
112 goto err;
113 strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
114 return;
115#ifdef CONFIG_NF_CONNTRACK_LABELS
116 case NFT_CT_LABELS: {
117 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
118
119 if (labels)
120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
121 else
122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
123 return;
124 }
125#endif
126 case NFT_CT_BYTES:
127 case NFT_CT_PKTS: {
128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
129 u64 count = 0;
130
131 if (acct)
132 count = nft_ct_get_eval_counter(acct->counter,
133 priv->key, priv->dir);
134 memcpy(dest, &count, sizeof(count));
135 return;
136 }
137 case NFT_CT_AVGPKT: {
138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140
141 if (acct) {
142 pcnt = nft_ct_get_eval_counter(acct->counter,
143 NFT_CT_PKTS, priv->dir);
144 bcnt = nft_ct_get_eval_counter(acct->counter,
145 NFT_CT_BYTES, priv->dir);
146 if (pcnt != 0)
147 avgcnt = div64_u64(bcnt, pcnt);
148 }
149
150 memcpy(dest, &avgcnt, sizeof(avgcnt));
151 return;
152 }
153 case NFT_CT_L3PROTOCOL:
154 nft_reg_store8(dest, nf_ct_l3num(ct));
155 return;
156 case NFT_CT_PROTOCOL:
157 nft_reg_store8(dest, nf_ct_protonum(ct));
158 return;
159#ifdef CONFIG_NF_CONNTRACK_ZONES
160 case NFT_CT_ZONE: {
161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
162 u16 zoneid;
163
164 if (priv->dir < IP_CT_DIR_MAX)
165 zoneid = nf_ct_zone_id(zone, priv->dir);
166 else
167 zoneid = zone->id;
168
169 nft_reg_store16(dest, zoneid);
170 return;
171 }
172#endif
173 case NFT_CT_ID:
174 *dest = nf_ct_get_id(ct);
175 return;
176 default:
177 break;
178 }
179
180 tuple = &ct->tuplehash[priv->dir].tuple;
181 switch (priv->key) {
182 case NFT_CT_SRC:
183 memcpy(dest, tuple->src.u3.all,
184 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
185 return;
186 case NFT_CT_DST:
187 memcpy(dest, tuple->dst.u3.all,
188 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
189 return;
190 case NFT_CT_PROTO_SRC:
191 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
192 return;
193 case NFT_CT_PROTO_DST:
194 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
195 return;
196 case NFT_CT_SRC_IP:
197 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
198 goto err;
199 *dest = (__force __u32)tuple->src.u3.ip;
200 return;
201 case NFT_CT_DST_IP:
202 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
203 goto err;
204 *dest = (__force __u32)tuple->dst.u3.ip;
205 return;
206 case NFT_CT_SRC_IP6:
207 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
208 goto err;
209 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
210 return;
211 case NFT_CT_DST_IP6:
212 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
213 goto err;
214 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
215 return;
216 default:
217 break;
218 }
219 return;
220err:
221 regs->verdict.code = NFT_BREAK;
222}
223
224#ifdef CONFIG_NF_CONNTRACK_ZONES
225static void nft_ct_set_zone_eval(const struct nft_expr *expr,
226 struct nft_regs *regs,
227 const struct nft_pktinfo *pkt)
228{
229 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
230 const struct nft_ct *priv = nft_expr_priv(expr);
231 struct sk_buff *skb = pkt->skb;
232 enum ip_conntrack_info ctinfo;
233 u16 value = nft_reg_load16(®s->data[priv->sreg]);
234 struct nf_conn *ct;
235 int oldcnt;
236
237 ct = nf_ct_get(skb, &ctinfo);
238 if (ct) /* already tracked */
239 return;
240
241 zone.id = value;
242
243 switch (priv->dir) {
244 case IP_CT_DIR_ORIGINAL:
245 zone.dir = NF_CT_ZONE_DIR_ORIG;
246 break;
247 case IP_CT_DIR_REPLY:
248 zone.dir = NF_CT_ZONE_DIR_REPL;
249 break;
250 default:
251 break;
252 }
253
254 ct = this_cpu_read(nft_ct_pcpu_template);
255
256 __refcount_inc(&ct->ct_general.use, &oldcnt);
257 if (likely(oldcnt == 1)) {
258 nf_ct_zone_add(ct, &zone);
259 } else {
260 refcount_dec(&ct->ct_general.use);
261 /* previous skb got queued to userspace, allocate temporary
262 * one until percpu template can be reused.
263 */
264 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
265 if (!ct) {
266 regs->verdict.code = NF_DROP;
267 return;
268 }
269 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
270 }
271
272 nf_ct_set(skb, ct, IP_CT_NEW);
273}
274#endif
275
276static void nft_ct_set_eval(const struct nft_expr *expr,
277 struct nft_regs *regs,
278 const struct nft_pktinfo *pkt)
279{
280 const struct nft_ct *priv = nft_expr_priv(expr);
281 struct sk_buff *skb = pkt->skb;
282#if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
283 u32 value = regs->data[priv->sreg];
284#endif
285 enum ip_conntrack_info ctinfo;
286 struct nf_conn *ct;
287
288 ct = nf_ct_get(skb, &ctinfo);
289 if (ct == NULL || nf_ct_is_template(ct))
290 return;
291
292 switch (priv->key) {
293#ifdef CONFIG_NF_CONNTRACK_MARK
294 case NFT_CT_MARK:
295 if (READ_ONCE(ct->mark) != value) {
296 WRITE_ONCE(ct->mark, value);
297 nf_conntrack_event_cache(IPCT_MARK, ct);
298 }
299 break;
300#endif
301#ifdef CONFIG_NF_CONNTRACK_SECMARK
302 case NFT_CT_SECMARK:
303 if (ct->secmark != value) {
304 ct->secmark = value;
305 nf_conntrack_event_cache(IPCT_SECMARK, ct);
306 }
307 break;
308#endif
309#ifdef CONFIG_NF_CONNTRACK_LABELS
310 case NFT_CT_LABELS:
311 nf_connlabels_replace(ct,
312 ®s->data[priv->sreg],
313 ®s->data[priv->sreg],
314 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
315 break;
316#endif
317#ifdef CONFIG_NF_CONNTRACK_EVENTS
318 case NFT_CT_EVENTMASK: {
319 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
320 u32 ctmask = regs->data[priv->sreg];
321
322 if (e) {
323 if (e->ctmask != ctmask)
324 e->ctmask = ctmask;
325 break;
326 }
327
328 if (ctmask && !nf_ct_is_confirmed(ct))
329 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
330 break;
331 }
332#endif
333 default:
334 break;
335 }
336}
337
338static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
339 [NFTA_CT_DREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
340 [NFTA_CT_KEY] = NLA_POLICY_MAX(NLA_BE32, 255),
341 [NFTA_CT_DIRECTION] = NLA_POLICY_MAX(NLA_U8, IP_CT_DIR_REPLY),
342 [NFTA_CT_SREG] = NLA_POLICY_MAX(NLA_BE32, NFT_REG32_MAX),
343};
344
345#ifdef CONFIG_NF_CONNTRACK_ZONES
346static void nft_ct_tmpl_put_pcpu(void)
347{
348 struct nf_conn *ct;
349 int cpu;
350
351 for_each_possible_cpu(cpu) {
352 ct = per_cpu(nft_ct_pcpu_template, cpu);
353 if (!ct)
354 break;
355 nf_ct_put(ct);
356 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
357 }
358}
359
360static bool nft_ct_tmpl_alloc_pcpu(void)
361{
362 struct nf_conntrack_zone zone = { .id = 0 };
363 struct nf_conn *tmp;
364 int cpu;
365
366 if (nft_ct_pcpu_template_refcnt)
367 return true;
368
369 for_each_possible_cpu(cpu) {
370 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
371 if (!tmp) {
372 nft_ct_tmpl_put_pcpu();
373 return false;
374 }
375
376 __set_bit(IPS_CONFIRMED_BIT, &tmp->status);
377 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
378 }
379
380 return true;
381}
382#endif
383
384static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
385{
386#ifdef CONFIG_NF_CONNTRACK_LABELS
387 if (priv->key == NFT_CT_LABELS)
388 nf_connlabels_put(ctx->net);
389#endif
390}
391
392static int nft_ct_get_init(const struct nft_ctx *ctx,
393 const struct nft_expr *expr,
394 const struct nlattr * const tb[])
395{
396 struct nft_ct *priv = nft_expr_priv(expr);
397 unsigned int len;
398 int err;
399
400 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
401 priv->dir = IP_CT_DIR_MAX;
402 switch (priv->key) {
403 case NFT_CT_DIRECTION:
404 if (tb[NFTA_CT_DIRECTION] != NULL)
405 return -EINVAL;
406 len = sizeof(u8);
407 break;
408 case NFT_CT_STATE:
409 case NFT_CT_STATUS:
410#ifdef CONFIG_NF_CONNTRACK_MARK
411 case NFT_CT_MARK:
412#endif
413#ifdef CONFIG_NF_CONNTRACK_SECMARK
414 case NFT_CT_SECMARK:
415#endif
416 case NFT_CT_EXPIRATION:
417 if (tb[NFTA_CT_DIRECTION] != NULL)
418 return -EINVAL;
419 len = sizeof(u32);
420 break;
421#ifdef CONFIG_NF_CONNTRACK_LABELS
422 case NFT_CT_LABELS:
423 if (tb[NFTA_CT_DIRECTION] != NULL)
424 return -EINVAL;
425 len = NF_CT_LABELS_MAX_SIZE;
426
427 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
428 if (err)
429 return err;
430 break;
431#endif
432 case NFT_CT_HELPER:
433 if (tb[NFTA_CT_DIRECTION] != NULL)
434 return -EINVAL;
435 len = NF_CT_HELPER_NAME_LEN;
436 break;
437
438 case NFT_CT_L3PROTOCOL:
439 case NFT_CT_PROTOCOL:
440 /* For compatibility, do not report error if NFTA_CT_DIRECTION
441 * attribute is specified.
442 */
443 len = sizeof(u8);
444 break;
445 case NFT_CT_SRC:
446 case NFT_CT_DST:
447 if (tb[NFTA_CT_DIRECTION] == NULL)
448 return -EINVAL;
449
450 switch (ctx->family) {
451 case NFPROTO_IPV4:
452 len = sizeof_field(struct nf_conntrack_tuple,
453 src.u3.ip);
454 break;
455 case NFPROTO_IPV6:
456 case NFPROTO_INET:
457 len = sizeof_field(struct nf_conntrack_tuple,
458 src.u3.ip6);
459 break;
460 default:
461 return -EAFNOSUPPORT;
462 }
463 break;
464 case NFT_CT_SRC_IP:
465 case NFT_CT_DST_IP:
466 if (tb[NFTA_CT_DIRECTION] == NULL)
467 return -EINVAL;
468
469 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
470 break;
471 case NFT_CT_SRC_IP6:
472 case NFT_CT_DST_IP6:
473 if (tb[NFTA_CT_DIRECTION] == NULL)
474 return -EINVAL;
475
476 len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
477 break;
478 case NFT_CT_PROTO_SRC:
479 case NFT_CT_PROTO_DST:
480 if (tb[NFTA_CT_DIRECTION] == NULL)
481 return -EINVAL;
482 len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
483 break;
484 case NFT_CT_BYTES:
485 case NFT_CT_PKTS:
486 case NFT_CT_AVGPKT:
487 len = sizeof(u64);
488 break;
489#ifdef CONFIG_NF_CONNTRACK_ZONES
490 case NFT_CT_ZONE:
491 len = sizeof(u16);
492 break;
493#endif
494 case NFT_CT_ID:
495 if (tb[NFTA_CT_DIRECTION])
496 return -EINVAL;
497
498 len = sizeof(u32);
499 break;
500 default:
501 return -EOPNOTSUPP;
502 }
503
504 if (tb[NFTA_CT_DIRECTION] != NULL) {
505 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
506 switch (priv->dir) {
507 case IP_CT_DIR_ORIGINAL:
508 case IP_CT_DIR_REPLY:
509 break;
510 default:
511 err = -EINVAL;
512 goto err;
513 }
514 }
515
516 priv->len = len;
517 err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
518 NFT_DATA_VALUE, len);
519 if (err < 0)
520 goto err;
521
522 err = nf_ct_netns_get(ctx->net, ctx->family);
523 if (err < 0)
524 goto err;
525
526 if (priv->key == NFT_CT_BYTES ||
527 priv->key == NFT_CT_PKTS ||
528 priv->key == NFT_CT_AVGPKT)
529 nf_ct_set_acct(ctx->net, true);
530
531 return 0;
532err:
533 __nft_ct_get_destroy(ctx, priv);
534 return err;
535}
536
537static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
538{
539 switch (priv->key) {
540#ifdef CONFIG_NF_CONNTRACK_LABELS
541 case NFT_CT_LABELS:
542 nf_connlabels_put(ctx->net);
543 break;
544#endif
545#ifdef CONFIG_NF_CONNTRACK_ZONES
546 case NFT_CT_ZONE:
547 nf_queue_nf_hook_drop(ctx->net);
548 mutex_lock(&nft_ct_pcpu_mutex);
549 if (--nft_ct_pcpu_template_refcnt == 0)
550 nft_ct_tmpl_put_pcpu();
551 mutex_unlock(&nft_ct_pcpu_mutex);
552 break;
553#endif
554 default:
555 break;
556 }
557}
558
559static int nft_ct_set_init(const struct nft_ctx *ctx,
560 const struct nft_expr *expr,
561 const struct nlattr * const tb[])
562{
563 struct nft_ct *priv = nft_expr_priv(expr);
564 unsigned int len;
565 int err;
566
567 priv->dir = IP_CT_DIR_MAX;
568 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
569 switch (priv->key) {
570#ifdef CONFIG_NF_CONNTRACK_MARK
571 case NFT_CT_MARK:
572 if (tb[NFTA_CT_DIRECTION])
573 return -EINVAL;
574 len = sizeof_field(struct nf_conn, mark);
575 break;
576#endif
577#ifdef CONFIG_NF_CONNTRACK_LABELS
578 case NFT_CT_LABELS:
579 if (tb[NFTA_CT_DIRECTION])
580 return -EINVAL;
581 len = NF_CT_LABELS_MAX_SIZE;
582 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
583 if (err)
584 return err;
585 break;
586#endif
587#ifdef CONFIG_NF_CONNTRACK_ZONES
588 case NFT_CT_ZONE:
589 mutex_lock(&nft_ct_pcpu_mutex);
590 if (!nft_ct_tmpl_alloc_pcpu()) {
591 mutex_unlock(&nft_ct_pcpu_mutex);
592 return -ENOMEM;
593 }
594 nft_ct_pcpu_template_refcnt++;
595 mutex_unlock(&nft_ct_pcpu_mutex);
596 len = sizeof(u16);
597 break;
598#endif
599#ifdef CONFIG_NF_CONNTRACK_EVENTS
600 case NFT_CT_EVENTMASK:
601 if (tb[NFTA_CT_DIRECTION])
602 return -EINVAL;
603 len = sizeof(u32);
604 break;
605#endif
606#ifdef CONFIG_NF_CONNTRACK_SECMARK
607 case NFT_CT_SECMARK:
608 if (tb[NFTA_CT_DIRECTION])
609 return -EINVAL;
610 len = sizeof(u32);
611 break;
612#endif
613 default:
614 return -EOPNOTSUPP;
615 }
616
617 if (tb[NFTA_CT_DIRECTION]) {
618 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
619 switch (priv->dir) {
620 case IP_CT_DIR_ORIGINAL:
621 case IP_CT_DIR_REPLY:
622 break;
623 default:
624 err = -EINVAL;
625 goto err1;
626 }
627 }
628
629 priv->len = len;
630 err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len);
631 if (err < 0)
632 goto err1;
633
634 err = nf_ct_netns_get(ctx->net, ctx->family);
635 if (err < 0)
636 goto err1;
637
638 return 0;
639
640err1:
641 __nft_ct_set_destroy(ctx, priv);
642 return err;
643}
644
645static void nft_ct_get_destroy(const struct nft_ctx *ctx,
646 const struct nft_expr *expr)
647{
648 struct nft_ct *priv = nft_expr_priv(expr);
649
650 __nft_ct_get_destroy(ctx, priv);
651 nf_ct_netns_put(ctx->net, ctx->family);
652}
653
654static void nft_ct_set_destroy(const struct nft_ctx *ctx,
655 const struct nft_expr *expr)
656{
657 struct nft_ct *priv = nft_expr_priv(expr);
658
659 __nft_ct_set_destroy(ctx, priv);
660 nf_ct_netns_put(ctx->net, ctx->family);
661}
662
663static int nft_ct_get_dump(struct sk_buff *skb,
664 const struct nft_expr *expr, bool reset)
665{
666 const struct nft_ct *priv = nft_expr_priv(expr);
667
668 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
669 goto nla_put_failure;
670 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
671 goto nla_put_failure;
672
673 switch (priv->key) {
674 case NFT_CT_SRC:
675 case NFT_CT_DST:
676 case NFT_CT_SRC_IP:
677 case NFT_CT_DST_IP:
678 case NFT_CT_SRC_IP6:
679 case NFT_CT_DST_IP6:
680 case NFT_CT_PROTO_SRC:
681 case NFT_CT_PROTO_DST:
682 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
683 goto nla_put_failure;
684 break;
685 case NFT_CT_BYTES:
686 case NFT_CT_PKTS:
687 case NFT_CT_AVGPKT:
688 case NFT_CT_ZONE:
689 if (priv->dir < IP_CT_DIR_MAX &&
690 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
691 goto nla_put_failure;
692 break;
693 default:
694 break;
695 }
696
697 return 0;
698
699nla_put_failure:
700 return -1;
701}
702
703static int nft_ct_set_dump(struct sk_buff *skb,
704 const struct nft_expr *expr, bool reset)
705{
706 const struct nft_ct *priv = nft_expr_priv(expr);
707
708 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
709 goto nla_put_failure;
710 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
711 goto nla_put_failure;
712
713 switch (priv->key) {
714 case NFT_CT_ZONE:
715 if (priv->dir < IP_CT_DIR_MAX &&
716 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
717 goto nla_put_failure;
718 break;
719 default:
720 break;
721 }
722
723 return 0;
724
725nla_put_failure:
726 return -1;
727}
728
729static struct nft_expr_type nft_ct_type;
730static const struct nft_expr_ops nft_ct_get_ops = {
731 .type = &nft_ct_type,
732 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
733 .eval = nft_ct_get_eval,
734 .init = nft_ct_get_init,
735 .destroy = nft_ct_get_destroy,
736 .dump = nft_ct_get_dump,
737};
738
739#ifdef CONFIG_MITIGATION_RETPOLINE
740static const struct nft_expr_ops nft_ct_get_fast_ops = {
741 .type = &nft_ct_type,
742 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
743 .eval = nft_ct_get_fast_eval,
744 .init = nft_ct_get_init,
745 .destroy = nft_ct_get_destroy,
746 .dump = nft_ct_get_dump,
747};
748#endif
749
750static const struct nft_expr_ops nft_ct_set_ops = {
751 .type = &nft_ct_type,
752 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
753 .eval = nft_ct_set_eval,
754 .init = nft_ct_set_init,
755 .destroy = nft_ct_set_destroy,
756 .dump = nft_ct_set_dump,
757};
758
759#ifdef CONFIG_NF_CONNTRACK_ZONES
760static const struct nft_expr_ops nft_ct_set_zone_ops = {
761 .type = &nft_ct_type,
762 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
763 .eval = nft_ct_set_zone_eval,
764 .init = nft_ct_set_init,
765 .destroy = nft_ct_set_destroy,
766 .dump = nft_ct_set_dump,
767};
768#endif
769
770static const struct nft_expr_ops *
771nft_ct_select_ops(const struct nft_ctx *ctx,
772 const struct nlattr * const tb[])
773{
774 if (tb[NFTA_CT_KEY] == NULL)
775 return ERR_PTR(-EINVAL);
776
777 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
778 return ERR_PTR(-EINVAL);
779
780 if (tb[NFTA_CT_DREG]) {
781#ifdef CONFIG_MITIGATION_RETPOLINE
782 u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
783
784 switch (k) {
785 case NFT_CT_STATE:
786 case NFT_CT_DIRECTION:
787 case NFT_CT_STATUS:
788 case NFT_CT_MARK:
789 case NFT_CT_SECMARK:
790 return &nft_ct_get_fast_ops;
791 }
792#endif
793 return &nft_ct_get_ops;
794 }
795
796 if (tb[NFTA_CT_SREG]) {
797#ifdef CONFIG_NF_CONNTRACK_ZONES
798 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
799 return &nft_ct_set_zone_ops;
800#endif
801 return &nft_ct_set_ops;
802 }
803
804 return ERR_PTR(-EINVAL);
805}
806
807static struct nft_expr_type nft_ct_type __read_mostly = {
808 .name = "ct",
809 .select_ops = nft_ct_select_ops,
810 .policy = nft_ct_policy,
811 .maxattr = NFTA_CT_MAX,
812 .owner = THIS_MODULE,
813};
814
815static void nft_notrack_eval(const struct nft_expr *expr,
816 struct nft_regs *regs,
817 const struct nft_pktinfo *pkt)
818{
819 struct sk_buff *skb = pkt->skb;
820 enum ip_conntrack_info ctinfo;
821 struct nf_conn *ct;
822
823 ct = nf_ct_get(pkt->skb, &ctinfo);
824 /* Previously seen (loopback or untracked)? Ignore. */
825 if (ct || ctinfo == IP_CT_UNTRACKED)
826 return;
827
828 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
829}
830
831static struct nft_expr_type nft_notrack_type;
832static const struct nft_expr_ops nft_notrack_ops = {
833 .type = &nft_notrack_type,
834 .size = NFT_EXPR_SIZE(0),
835 .eval = nft_notrack_eval,
836};
837
838static struct nft_expr_type nft_notrack_type __read_mostly = {
839 .name = "notrack",
840 .ops = &nft_notrack_ops,
841 .owner = THIS_MODULE,
842};
843
844#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
845static int
846nft_ct_timeout_parse_policy(void *timeouts,
847 const struct nf_conntrack_l4proto *l4proto,
848 struct net *net, const struct nlattr *attr)
849{
850 struct nlattr **tb;
851 int ret = 0;
852
853 tb = kzalloc_objs(*tb, l4proto->ctnl_timeout.nlattr_max + 1);
854
855 if (!tb)
856 return -ENOMEM;
857
858 ret = nla_parse_nested_deprecated(tb,
859 l4proto->ctnl_timeout.nlattr_max,
860 attr,
861 l4proto->ctnl_timeout.nla_policy,
862 NULL);
863 if (ret < 0)
864 goto err;
865
866 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
867
868err:
869 kfree(tb);
870 return ret;
871}
872
873struct nft_ct_timeout_obj {
874 struct nf_ct_timeout *timeout;
875 u8 l4proto;
876};
877
878static void nft_ct_timeout_obj_eval(struct nft_object *obj,
879 struct nft_regs *regs,
880 const struct nft_pktinfo *pkt)
881{
882 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
883 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
884 struct nf_conn_timeout *timeout;
885 const unsigned int *values;
886
887 if (priv->l4proto != pkt->tprot)
888 return;
889
890 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
891 return;
892
893 timeout = nf_ct_timeout_find(ct);
894 if (!timeout) {
895 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
896 if (!timeout) {
897 regs->verdict.code = NF_DROP;
898 return;
899 }
900 }
901
902 rcu_assign_pointer(timeout->timeout, priv->timeout);
903
904 /* adjust the timeout as per 'new' state. ct is unconfirmed,
905 * so the current timestamp must not be added.
906 */
907 values = nf_ct_timeout_data(timeout);
908 if (values)
909 nf_ct_refresh(ct, values[0]);
910}
911
912static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
913 const struct nlattr * const tb[],
914 struct nft_object *obj)
915{
916 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
917 const struct nf_conntrack_l4proto *l4proto;
918 struct nf_ct_timeout *timeout;
919 int l3num = ctx->family;
920 __u8 l4num;
921 int ret;
922
923 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
924 !tb[NFTA_CT_TIMEOUT_DATA])
925 return -EINVAL;
926
927 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
928 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
929
930 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
931 priv->l4proto = l4num;
932
933 l4proto = nf_ct_l4proto_find(l4num);
934
935 if (l4proto->l4proto != l4num) {
936 ret = -EOPNOTSUPP;
937 goto err_proto_put;
938 }
939
940 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
941 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
942 if (timeout == NULL) {
943 ret = -ENOMEM;
944 goto err_proto_put;
945 }
946
947 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
948 tb[NFTA_CT_TIMEOUT_DATA]);
949 if (ret < 0)
950 goto err_free_timeout;
951
952 timeout->l3num = l3num;
953 timeout->l4proto = l4proto;
954
955 ret = nf_ct_netns_get(ctx->net, ctx->family);
956 if (ret < 0)
957 goto err_free_timeout;
958
959 priv->timeout = timeout;
960 return 0;
961
962err_free_timeout:
963 kfree(timeout);
964err_proto_put:
965 return ret;
966}
967
968static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
969 struct nft_object *obj)
970{
971 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
972 struct nf_ct_timeout *timeout = priv->timeout;
973
974 nf_queue_nf_hook_drop(ctx->net);
975 nf_ct_untimeout(ctx->net, timeout);
976 nf_ct_netns_put(ctx->net, ctx->family);
977 kfree_rcu(priv->timeout, rcu);
978}
979
980static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
981 struct nft_object *obj, bool reset)
982{
983 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
984 const struct nf_ct_timeout *timeout = priv->timeout;
985 struct nlattr *nest_params;
986 int ret;
987
988 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
989 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
990 return -1;
991
992 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
993 if (!nest_params)
994 return -1;
995
996 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
997 if (ret < 0)
998 return -1;
999 nla_nest_end(skb, nest_params);
1000 return 0;
1001}
1002
1003static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1004 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1005 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1006 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
1007};
1008
1009static struct nft_object_type nft_ct_timeout_obj_type;
1010
1011static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1012 .type = &nft_ct_timeout_obj_type,
1013 .size = sizeof(struct nft_ct_timeout_obj),
1014 .eval = nft_ct_timeout_obj_eval,
1015 .init = nft_ct_timeout_obj_init,
1016 .destroy = nft_ct_timeout_obj_destroy,
1017 .dump = nft_ct_timeout_obj_dump,
1018};
1019
1020static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1021 .type = NFT_OBJECT_CT_TIMEOUT,
1022 .ops = &nft_ct_timeout_obj_ops,
1023 .maxattr = NFTA_CT_TIMEOUT_MAX,
1024 .policy = nft_ct_timeout_policy,
1025 .owner = THIS_MODULE,
1026};
1027#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1028
1029static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1030 const struct nlattr * const tb[],
1031 struct nft_object *obj)
1032{
1033 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1034 struct nf_conntrack_helper *help4, *help6;
1035 char name[NF_CT_HELPER_NAME_LEN];
1036 int family = ctx->family;
1037 int err;
1038
1039 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1040 return -EINVAL;
1041
1042 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1043 if (!priv->l4proto)
1044 return -ENOENT;
1045
1046 nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1047
1048 if (tb[NFTA_CT_HELPER_L3PROTO])
1049 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1050
1051 help4 = NULL;
1052 help6 = NULL;
1053
1054 switch (family) {
1055 case NFPROTO_IPV4:
1056 if (ctx->family == NFPROTO_IPV6)
1057 return -EINVAL;
1058
1059 help4 = nf_conntrack_helper_try_module_get(name, family,
1060 priv->l4proto);
1061 break;
1062 case NFPROTO_IPV6:
1063 if (ctx->family == NFPROTO_IPV4)
1064 return -EINVAL;
1065
1066 help6 = nf_conntrack_helper_try_module_get(name, family,
1067 priv->l4proto);
1068 break;
1069 case NFPROTO_NETDEV:
1070 case NFPROTO_BRIDGE:
1071 case NFPROTO_INET:
1072 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1073 priv->l4proto);
1074 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1075 priv->l4proto);
1076 break;
1077 default:
1078 return -EAFNOSUPPORT;
1079 }
1080
1081 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1082 if (!help4 && !help6)
1083 return -ENOENT;
1084
1085 priv->helper4 = help4;
1086 priv->helper6 = help6;
1087
1088 err = nf_ct_netns_get(ctx->net, ctx->family);
1089 if (err < 0)
1090 goto err_put_helper;
1091
1092 return 0;
1093
1094err_put_helper:
1095 if (priv->helper4)
1096 nf_conntrack_helper_put(priv->helper4);
1097 if (priv->helper6)
1098 nf_conntrack_helper_put(priv->helper6);
1099 return err;
1100}
1101
1102static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1103 struct nft_object *obj)
1104{
1105 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1106
1107 nf_queue_nf_hook_drop(ctx->net);
1108 if (priv->helper4)
1109 nf_conntrack_helper_put(priv->helper4);
1110 if (priv->helper6)
1111 nf_conntrack_helper_put(priv->helper6);
1112
1113 nf_ct_netns_put(ctx->net, ctx->family);
1114}
1115
1116static void nft_ct_helper_obj_eval(struct nft_object *obj,
1117 struct nft_regs *regs,
1118 const struct nft_pktinfo *pkt)
1119{
1120 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1121 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1122 struct nf_conntrack_helper *to_assign = NULL;
1123 struct nf_conn_help *help;
1124
1125 if (!ct ||
1126 nf_ct_is_confirmed(ct) ||
1127 nf_ct_is_template(ct) ||
1128 priv->l4proto != nf_ct_protonum(ct))
1129 return;
1130
1131 switch (nf_ct_l3num(ct)) {
1132 case NFPROTO_IPV4:
1133 to_assign = priv->helper4;
1134 break;
1135 case NFPROTO_IPV6:
1136 to_assign = priv->helper6;
1137 break;
1138 default:
1139 WARN_ON_ONCE(1);
1140 return;
1141 }
1142
1143 if (!to_assign)
1144 return;
1145
1146 if (test_bit(IPS_HELPER_BIT, &ct->status))
1147 return;
1148
1149 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1150 if (help) {
1151 rcu_assign_pointer(help->helper, to_assign);
1152 set_bit(IPS_HELPER_BIT, &ct->status);
1153
1154 if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
1155 if (!nfct_seqadj_ext_add(ct))
1156 regs->verdict.code = NF_DROP;
1157 }
1158}
1159
1160static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1161 struct nft_object *obj, bool reset)
1162{
1163 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1164 const struct nf_conntrack_helper *helper;
1165 u16 family;
1166
1167 if (priv->helper4 && priv->helper6) {
1168 family = NFPROTO_INET;
1169 helper = priv->helper4;
1170 } else if (priv->helper6) {
1171 family = NFPROTO_IPV6;
1172 helper = priv->helper6;
1173 } else {
1174 family = NFPROTO_IPV4;
1175 helper = priv->helper4;
1176 }
1177
1178 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1179 return -1;
1180
1181 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1182 return -1;
1183
1184 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1185 return -1;
1186
1187 return 0;
1188}
1189
1190static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1191 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1192 .len = NF_CT_HELPER_NAME_LEN - 1 },
1193 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1194 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1195};
1196
1197static struct nft_object_type nft_ct_helper_obj_type;
1198static const struct nft_object_ops nft_ct_helper_obj_ops = {
1199 .type = &nft_ct_helper_obj_type,
1200 .size = sizeof(struct nft_ct_helper_obj),
1201 .eval = nft_ct_helper_obj_eval,
1202 .init = nft_ct_helper_obj_init,
1203 .destroy = nft_ct_helper_obj_destroy,
1204 .dump = nft_ct_helper_obj_dump,
1205};
1206
1207static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1208 .type = NFT_OBJECT_CT_HELPER,
1209 .ops = &nft_ct_helper_obj_ops,
1210 .maxattr = NFTA_CT_HELPER_MAX,
1211 .policy = nft_ct_helper_policy,
1212 .owner = THIS_MODULE,
1213};
1214
1215struct nft_ct_expect_obj {
1216 u16 l3num;
1217 __be16 dport;
1218 u8 l4proto;
1219 u8 size;
1220 u32 timeout;
1221};
1222
1223static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1224 const struct nlattr * const tb[],
1225 struct nft_object *obj)
1226{
1227 struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1228
1229 if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1230 !tb[NFTA_CT_EXPECT_DPORT] ||
1231 !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1232 !tb[NFTA_CT_EXPECT_SIZE])
1233 return -EINVAL;
1234
1235 priv->l3num = ctx->family;
1236 if (tb[NFTA_CT_EXPECT_L3PROTO])
1237 priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1238
1239 switch (priv->l3num) {
1240 case NFPROTO_IPV4:
1241 case NFPROTO_IPV6:
1242 if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1243 break;
1244
1245 return -EINVAL;
1246 case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1247 default:
1248 return -EAFNOSUPPORT;
1249 }
1250
1251 priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1252 switch (priv->l4proto) {
1253 case IPPROTO_TCP:
1254 case IPPROTO_UDP:
1255 case IPPROTO_DCCP:
1256 case IPPROTO_SCTP:
1257 break;
1258 default:
1259 return -EOPNOTSUPP;
1260 }
1261
1262 priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1263 priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1264 priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1265
1266 return nf_ct_netns_get(ctx->net, ctx->family);
1267}
1268
1269static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1270 struct nft_object *obj)
1271{
1272 nf_ct_netns_put(ctx->net, ctx->family);
1273}
1274
1275static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1276 struct nft_object *obj, bool reset)
1277{
1278 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1279
1280 if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1281 nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1282 nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1283 nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1284 nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1285 return -1;
1286
1287 return 0;
1288}
1289
1290static void nft_ct_expect_obj_eval(struct nft_object *obj,
1291 struct nft_regs *regs,
1292 const struct nft_pktinfo *pkt)
1293{
1294 const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1295 struct nf_conntrack_expect *exp;
1296 enum ip_conntrack_info ctinfo;
1297 struct nf_conn_help *help;
1298 enum ip_conntrack_dir dir;
1299 u16 l3num = priv->l3num;
1300 struct nf_conn *ct;
1301
1302 ct = nf_ct_get(pkt->skb, &ctinfo);
1303 if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1304 regs->verdict.code = NFT_BREAK;
1305 return;
1306 }
1307 dir = CTINFO2DIR(ctinfo);
1308
1309 help = nfct_help(ct);
1310 if (!help)
1311 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1312 if (!help) {
1313 regs->verdict.code = NF_DROP;
1314 return;
1315 }
1316
1317 if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1318 regs->verdict.code = NFT_BREAK;
1319 return;
1320 }
1321 if (l3num == NFPROTO_INET)
1322 l3num = nf_ct_l3num(ct);
1323
1324 exp = nf_ct_expect_alloc(ct);
1325 if (exp == NULL) {
1326 regs->verdict.code = NF_DROP;
1327 return;
1328 }
1329 nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1330 &ct->tuplehash[!dir].tuple.src.u3,
1331 &ct->tuplehash[!dir].tuple.dst.u3,
1332 priv->l4proto, NULL, &priv->dport);
1333 exp->timeout.expires = jiffies + priv->timeout * HZ;
1334
1335 if (nf_ct_expect_related(exp, 0) != 0)
1336 regs->verdict.code = NF_DROP;
1337}
1338
1339static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1340 [NFTA_CT_EXPECT_L3PROTO] = { .type = NLA_U16 },
1341 [NFTA_CT_EXPECT_L4PROTO] = { .type = NLA_U8 },
1342 [NFTA_CT_EXPECT_DPORT] = { .type = NLA_U16 },
1343 [NFTA_CT_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1344 [NFTA_CT_EXPECT_SIZE] = { .type = NLA_U8 },
1345};
1346
1347static struct nft_object_type nft_ct_expect_obj_type;
1348
1349static const struct nft_object_ops nft_ct_expect_obj_ops = {
1350 .type = &nft_ct_expect_obj_type,
1351 .size = sizeof(struct nft_ct_expect_obj),
1352 .eval = nft_ct_expect_obj_eval,
1353 .init = nft_ct_expect_obj_init,
1354 .destroy = nft_ct_expect_obj_destroy,
1355 .dump = nft_ct_expect_obj_dump,
1356};
1357
1358static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1359 .type = NFT_OBJECT_CT_EXPECT,
1360 .ops = &nft_ct_expect_obj_ops,
1361 .maxattr = NFTA_CT_EXPECT_MAX,
1362 .policy = nft_ct_expect_policy,
1363 .owner = THIS_MODULE,
1364};
1365
1366static int __init nft_ct_module_init(void)
1367{
1368 int err;
1369
1370 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1371
1372 err = nft_register_expr(&nft_ct_type);
1373 if (err < 0)
1374 return err;
1375
1376 err = nft_register_expr(&nft_notrack_type);
1377 if (err < 0)
1378 goto err1;
1379
1380 err = nft_register_obj(&nft_ct_helper_obj_type);
1381 if (err < 0)
1382 goto err2;
1383
1384 err = nft_register_obj(&nft_ct_expect_obj_type);
1385 if (err < 0)
1386 goto err3;
1387#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1388 err = nft_register_obj(&nft_ct_timeout_obj_type);
1389 if (err < 0)
1390 goto err4;
1391#endif
1392 return 0;
1393
1394#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1395err4:
1396 nft_unregister_obj(&nft_ct_expect_obj_type);
1397#endif
1398err3:
1399 nft_unregister_obj(&nft_ct_helper_obj_type);
1400err2:
1401 nft_unregister_expr(&nft_notrack_type);
1402err1:
1403 nft_unregister_expr(&nft_ct_type);
1404 return err;
1405}
1406
1407static void __exit nft_ct_module_exit(void)
1408{
1409#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1410 nft_unregister_obj(&nft_ct_timeout_obj_type);
1411#endif
1412 nft_unregister_obj(&nft_ct_expect_obj_type);
1413 nft_unregister_obj(&nft_ct_helper_obj_type);
1414 nft_unregister_expr(&nft_notrack_type);
1415 nft_unregister_expr(&nft_ct_type);
1416}
1417
1418module_init(nft_ct_module_init);
1419module_exit(nft_ct_module_exit);
1420
1421MODULE_LICENSE("GPL");
1422MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1423MODULE_ALIAS_NFT_EXPR("ct");
1424MODULE_ALIAS_NFT_EXPR("notrack");
1425MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1426MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1427MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1428MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");