• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5  *
6  * Development of this code funded by Astaro AG (http://www.astaro.com/)
7  */
8 
9 #include <linux/kernel.h>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/netlink.h>
13 #include <linux/netfilter.h>
14 #include <linux/netfilter/nf_tables.h>
15 #include <net/netfilter/nf_tables.h>
16 #include <net/netfilter/nf_conntrack.h>
17 #include <net/netfilter/nf_conntrack_acct.h>
18 #include <net/netfilter/nf_conntrack_tuple.h>
19 #include <net/netfilter/nf_conntrack_helper.h>
20 #include <net/netfilter/nf_conntrack_ecache.h>
21 #include <net/netfilter/nf_conntrack_labels.h>
22 #include <net/netfilter/nf_conntrack_timeout.h>
23 #include <net/netfilter/nf_conntrack_l4proto.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 
26 struct nft_ct {
27 	enum nft_ct_keys	key:8;
28 	enum ip_conntrack_dir	dir:8;
29 	union {
30 		u8		dreg;
31 		u8		sreg;
32 	};
33 };
34 
35 struct nft_ct_helper_obj  {
36 	struct nf_conntrack_helper *helper4;
37 	struct nf_conntrack_helper *helper6;
38 	u8 l4proto;
39 };
40 
41 #ifdef CONFIG_NF_CONNTRACK_ZONES
42 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
43 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
44 static DEFINE_MUTEX(nft_ct_pcpu_mutex);
45 #endif
46 
nft_ct_get_eval_counter(const struct nf_conn_counter * c,enum nft_ct_keys k,enum ip_conntrack_dir d)47 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
48 				   enum nft_ct_keys k,
49 				   enum ip_conntrack_dir d)
50 {
51 	if (d < IP_CT_DIR_MAX)
52 		return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
53 					   atomic64_read(&c[d].packets);
54 
55 	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
56 	       nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
57 }
58 
nft_ct_get_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)59 static void nft_ct_get_eval(const struct nft_expr *expr,
60 			    struct nft_regs *regs,
61 			    const struct nft_pktinfo *pkt)
62 {
63 	const struct nft_ct *priv = nft_expr_priv(expr);
64 	u32 *dest = &regs->data[priv->dreg];
65 	enum ip_conntrack_info ctinfo;
66 	const struct nf_conn *ct;
67 	const struct nf_conn_help *help;
68 	const struct nf_conntrack_tuple *tuple;
69 	const struct nf_conntrack_helper *helper;
70 	unsigned int state;
71 
72 	ct = nf_ct_get(pkt->skb, &ctinfo);
73 
74 	switch (priv->key) {
75 	case NFT_CT_STATE:
76 		if (ct)
77 			state = NF_CT_STATE_BIT(ctinfo);
78 		else if (ctinfo == IP_CT_UNTRACKED)
79 			state = NF_CT_STATE_UNTRACKED_BIT;
80 		else
81 			state = NF_CT_STATE_INVALID_BIT;
82 		*dest = state;
83 		return;
84 	default:
85 		break;
86 	}
87 
88 	if (ct == NULL)
89 		goto err;
90 
91 	switch (priv->key) {
92 	case NFT_CT_DIRECTION:
93 		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
94 		return;
95 	case NFT_CT_STATUS:
96 		*dest = ct->status;
97 		return;
98 #ifdef CONFIG_NF_CONNTRACK_MARK
99 	case NFT_CT_MARK:
100 		*dest = READ_ONCE(ct->mark);
101 		return;
102 #endif
103 #ifdef CONFIG_NF_CONNTRACK_SECMARK
104 	case NFT_CT_SECMARK:
105 		*dest = ct->secmark;
106 		return;
107 #endif
108 	case NFT_CT_EXPIRATION:
109 		*dest = jiffies_to_msecs(nf_ct_expires(ct));
110 		return;
111 	case NFT_CT_HELPER:
112 		if (ct->master == NULL)
113 			goto err;
114 		help = nfct_help(ct->master);
115 		if (help == NULL)
116 			goto err;
117 		helper = rcu_dereference(help->helper);
118 		if (helper == NULL)
119 			goto err;
120 		strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
121 		return;
122 #ifdef CONFIG_NF_CONNTRACK_LABELS
123 	case NFT_CT_LABELS: {
124 		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
125 
126 		if (labels)
127 			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
128 		else
129 			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
130 		return;
131 	}
132 #endif
133 	case NFT_CT_BYTES:
134 	case NFT_CT_PKTS: {
135 		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
136 		u64 count = 0;
137 
138 		if (acct)
139 			count = nft_ct_get_eval_counter(acct->counter,
140 							priv->key, priv->dir);
141 		memcpy(dest, &count, sizeof(count));
142 		return;
143 	}
144 	case NFT_CT_AVGPKT: {
145 		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
146 		u64 avgcnt = 0, bcnt = 0, pcnt = 0;
147 
148 		if (acct) {
149 			pcnt = nft_ct_get_eval_counter(acct->counter,
150 						       NFT_CT_PKTS, priv->dir);
151 			bcnt = nft_ct_get_eval_counter(acct->counter,
152 						       NFT_CT_BYTES, priv->dir);
153 			if (pcnt != 0)
154 				avgcnt = div64_u64(bcnt, pcnt);
155 		}
156 
157 		memcpy(dest, &avgcnt, sizeof(avgcnt));
158 		return;
159 	}
160 	case NFT_CT_L3PROTOCOL:
161 		nft_reg_store8(dest, nf_ct_l3num(ct));
162 		return;
163 	case NFT_CT_PROTOCOL:
164 		nft_reg_store8(dest, nf_ct_protonum(ct));
165 		return;
166 #ifdef CONFIG_NF_CONNTRACK_ZONES
167 	case NFT_CT_ZONE: {
168 		const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
169 		u16 zoneid;
170 
171 		if (priv->dir < IP_CT_DIR_MAX)
172 			zoneid = nf_ct_zone_id(zone, priv->dir);
173 		else
174 			zoneid = zone->id;
175 
176 		nft_reg_store16(dest, zoneid);
177 		return;
178 	}
179 #endif
180 	case NFT_CT_ID:
181 		*dest = nf_ct_get_id(ct);
182 		return;
183 	default:
184 		break;
185 	}
186 
187 	tuple = &ct->tuplehash[priv->dir].tuple;
188 	switch (priv->key) {
189 	case NFT_CT_SRC:
190 		memcpy(dest, tuple->src.u3.all,
191 		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
192 		return;
193 	case NFT_CT_DST:
194 		memcpy(dest, tuple->dst.u3.all,
195 		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
196 		return;
197 	case NFT_CT_PROTO_SRC:
198 		nft_reg_store16(dest, (__force u16)tuple->src.u.all);
199 		return;
200 	case NFT_CT_PROTO_DST:
201 		nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
202 		return;
203 	case NFT_CT_SRC_IP:
204 		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
205 			goto err;
206 		*dest = tuple->src.u3.ip;
207 		return;
208 	case NFT_CT_DST_IP:
209 		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
210 			goto err;
211 		*dest = tuple->dst.u3.ip;
212 		return;
213 	case NFT_CT_SRC_IP6:
214 		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
215 			goto err;
216 		memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
217 		return;
218 	case NFT_CT_DST_IP6:
219 		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
220 			goto err;
221 		memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
222 		return;
223 	default:
224 		break;
225 	}
226 	return;
227 err:
228 	regs->verdict.code = NFT_BREAK;
229 }
230 
231 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_set_zone_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)232 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
233 				 struct nft_regs *regs,
234 				 const struct nft_pktinfo *pkt)
235 {
236 	struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
237 	const struct nft_ct *priv = nft_expr_priv(expr);
238 	struct sk_buff *skb = pkt->skb;
239 	enum ip_conntrack_info ctinfo;
240 	u16 value = nft_reg_load16(&regs->data[priv->sreg]);
241 	struct nf_conn *ct;
242 
243 	ct = nf_ct_get(skb, &ctinfo);
244 	if (ct) /* already tracked */
245 		return;
246 
247 	zone.id = value;
248 
249 	switch (priv->dir) {
250 	case IP_CT_DIR_ORIGINAL:
251 		zone.dir = NF_CT_ZONE_DIR_ORIG;
252 		break;
253 	case IP_CT_DIR_REPLY:
254 		zone.dir = NF_CT_ZONE_DIR_REPL;
255 		break;
256 	default:
257 		break;
258 	}
259 
260 	ct = this_cpu_read(nft_ct_pcpu_template);
261 
262 	if (likely(atomic_read(&ct->ct_general.use) == 1)) {
263 		nf_ct_zone_add(ct, &zone);
264 	} else {
265 		/* previous skb got queued to userspace */
266 		ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
267 		if (!ct) {
268 			regs->verdict.code = NF_DROP;
269 			return;
270 		}
271 	}
272 
273 	atomic_inc(&ct->ct_general.use);
274 	nf_ct_set(skb, ct, IP_CT_NEW);
275 }
276 #endif
277 
nft_ct_set_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)278 static void nft_ct_set_eval(const struct nft_expr *expr,
279 			    struct nft_regs *regs,
280 			    const struct nft_pktinfo *pkt)
281 {
282 	const struct nft_ct *priv = nft_expr_priv(expr);
283 	struct sk_buff *skb = pkt->skb;
284 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
285 	u32 value = regs->data[priv->sreg];
286 #endif
287 	enum ip_conntrack_info ctinfo;
288 	struct nf_conn *ct;
289 
290 	ct = nf_ct_get(skb, &ctinfo);
291 	if (ct == NULL || nf_ct_is_template(ct))
292 		return;
293 
294 	switch (priv->key) {
295 #ifdef CONFIG_NF_CONNTRACK_MARK
296 	case NFT_CT_MARK:
297 		if (READ_ONCE(ct->mark) != value) {
298 			WRITE_ONCE(ct->mark, value);
299 			nf_conntrack_event_cache(IPCT_MARK, ct);
300 		}
301 		break;
302 #endif
303 #ifdef CONFIG_NF_CONNTRACK_SECMARK
304 	case NFT_CT_SECMARK:
305 		if (ct->secmark != value) {
306 			ct->secmark = value;
307 			nf_conntrack_event_cache(IPCT_SECMARK, ct);
308 		}
309 		break;
310 #endif
311 #ifdef CONFIG_NF_CONNTRACK_LABELS
312 	case NFT_CT_LABELS:
313 		nf_connlabels_replace(ct,
314 				      &regs->data[priv->sreg],
315 				      &regs->data[priv->sreg],
316 				      NF_CT_LABELS_MAX_SIZE / sizeof(u32));
317 		break;
318 #endif
319 #ifdef CONFIG_NF_CONNTRACK_EVENTS
320 	case NFT_CT_EVENTMASK: {
321 		struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
322 		u32 ctmask = regs->data[priv->sreg];
323 
324 		if (e) {
325 			if (e->ctmask != ctmask)
326 				e->ctmask = ctmask;
327 			break;
328 		}
329 
330 		if (ctmask && !nf_ct_is_confirmed(ct))
331 			nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
332 		break;
333 	}
334 #endif
335 	default:
336 		break;
337 	}
338 }
339 
340 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
341 	[NFTA_CT_DREG]		= { .type = NLA_U32 },
342 	[NFTA_CT_KEY]		= { .type = NLA_U32 },
343 	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
344 	[NFTA_CT_SREG]		= { .type = NLA_U32 },
345 };
346 
347 #ifdef CONFIG_NF_CONNTRACK_ZONES
nft_ct_tmpl_put_pcpu(void)348 static void nft_ct_tmpl_put_pcpu(void)
349 {
350 	struct nf_conn *ct;
351 	int cpu;
352 
353 	for_each_possible_cpu(cpu) {
354 		ct = per_cpu(nft_ct_pcpu_template, cpu);
355 		if (!ct)
356 			break;
357 		nf_ct_put(ct);
358 		per_cpu(nft_ct_pcpu_template, cpu) = NULL;
359 	}
360 }
361 
nft_ct_tmpl_alloc_pcpu(void)362 static bool nft_ct_tmpl_alloc_pcpu(void)
363 {
364 	struct nf_conntrack_zone zone = { .id = 0 };
365 	struct nf_conn *tmp;
366 	int cpu;
367 
368 	if (nft_ct_pcpu_template_refcnt)
369 		return true;
370 
371 	for_each_possible_cpu(cpu) {
372 		tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
373 		if (!tmp) {
374 			nft_ct_tmpl_put_pcpu();
375 			return false;
376 		}
377 
378 		atomic_set(&tmp->ct_general.use, 1);
379 		per_cpu(nft_ct_pcpu_template, cpu) = tmp;
380 	}
381 
382 	return true;
383 }
384 #endif
385 
nft_ct_get_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])386 static int nft_ct_get_init(const struct nft_ctx *ctx,
387 			   const struct nft_expr *expr,
388 			   const struct nlattr * const tb[])
389 {
390 	struct nft_ct *priv = nft_expr_priv(expr);
391 	unsigned int len;
392 	int err;
393 
394 	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
395 	priv->dir = IP_CT_DIR_MAX;
396 	switch (priv->key) {
397 	case NFT_CT_DIRECTION:
398 		if (tb[NFTA_CT_DIRECTION] != NULL)
399 			return -EINVAL;
400 		len = sizeof(u8);
401 		break;
402 	case NFT_CT_STATE:
403 	case NFT_CT_STATUS:
404 #ifdef CONFIG_NF_CONNTRACK_MARK
405 	case NFT_CT_MARK:
406 #endif
407 #ifdef CONFIG_NF_CONNTRACK_SECMARK
408 	case NFT_CT_SECMARK:
409 #endif
410 	case NFT_CT_EXPIRATION:
411 		if (tb[NFTA_CT_DIRECTION] != NULL)
412 			return -EINVAL;
413 		len = sizeof(u32);
414 		break;
415 #ifdef CONFIG_NF_CONNTRACK_LABELS
416 	case NFT_CT_LABELS:
417 		if (tb[NFTA_CT_DIRECTION] != NULL)
418 			return -EINVAL;
419 		len = NF_CT_LABELS_MAX_SIZE;
420 		break;
421 #endif
422 	case NFT_CT_HELPER:
423 		if (tb[NFTA_CT_DIRECTION] != NULL)
424 			return -EINVAL;
425 		len = NF_CT_HELPER_NAME_LEN;
426 		break;
427 
428 	case NFT_CT_L3PROTOCOL:
429 	case NFT_CT_PROTOCOL:
430 		/* For compatibility, do not report error if NFTA_CT_DIRECTION
431 		 * attribute is specified.
432 		 */
433 		len = sizeof(u8);
434 		break;
435 	case NFT_CT_SRC:
436 	case NFT_CT_DST:
437 		if (tb[NFTA_CT_DIRECTION] == NULL)
438 			return -EINVAL;
439 
440 		switch (ctx->family) {
441 		case NFPROTO_IPV4:
442 			len = sizeof_field(struct nf_conntrack_tuple,
443 					   src.u3.ip);
444 			break;
445 		case NFPROTO_IPV6:
446 		case NFPROTO_INET:
447 			len = sizeof_field(struct nf_conntrack_tuple,
448 					   src.u3.ip6);
449 			break;
450 		default:
451 			return -EAFNOSUPPORT;
452 		}
453 		break;
454 	case NFT_CT_SRC_IP:
455 	case NFT_CT_DST_IP:
456 		if (tb[NFTA_CT_DIRECTION] == NULL)
457 			return -EINVAL;
458 
459 		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
460 		break;
461 	case NFT_CT_SRC_IP6:
462 	case NFT_CT_DST_IP6:
463 		if (tb[NFTA_CT_DIRECTION] == NULL)
464 			return -EINVAL;
465 
466 		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
467 		break;
468 	case NFT_CT_PROTO_SRC:
469 	case NFT_CT_PROTO_DST:
470 		if (tb[NFTA_CT_DIRECTION] == NULL)
471 			return -EINVAL;
472 		len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
473 		break;
474 	case NFT_CT_BYTES:
475 	case NFT_CT_PKTS:
476 	case NFT_CT_AVGPKT:
477 		len = sizeof(u64);
478 		break;
479 #ifdef CONFIG_NF_CONNTRACK_ZONES
480 	case NFT_CT_ZONE:
481 		len = sizeof(u16);
482 		break;
483 #endif
484 	case NFT_CT_ID:
485 		if (tb[NFTA_CT_DIRECTION])
486 			return -EINVAL;
487 
488 		len = sizeof(u32);
489 		break;
490 	default:
491 		return -EOPNOTSUPP;
492 	}
493 
494 	if (tb[NFTA_CT_DIRECTION] != NULL) {
495 		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
496 		switch (priv->dir) {
497 		case IP_CT_DIR_ORIGINAL:
498 		case IP_CT_DIR_REPLY:
499 			break;
500 		default:
501 			return -EINVAL;
502 		}
503 	}
504 
505 	err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
506 				       NFT_DATA_VALUE, len);
507 	if (err < 0)
508 		return err;
509 
510 	err = nf_ct_netns_get(ctx->net, ctx->family);
511 	if (err < 0)
512 		return err;
513 
514 	if (priv->key == NFT_CT_BYTES ||
515 	    priv->key == NFT_CT_PKTS  ||
516 	    priv->key == NFT_CT_AVGPKT)
517 		nf_ct_set_acct(ctx->net, true);
518 
519 	return 0;
520 }
521 
__nft_ct_set_destroy(const struct nft_ctx * ctx,struct nft_ct * priv)522 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
523 {
524 	switch (priv->key) {
525 #ifdef CONFIG_NF_CONNTRACK_LABELS
526 	case NFT_CT_LABELS:
527 		nf_connlabels_put(ctx->net);
528 		break;
529 #endif
530 #ifdef CONFIG_NF_CONNTRACK_ZONES
531 	case NFT_CT_ZONE:
532 		mutex_lock(&nft_ct_pcpu_mutex);
533 		if (--nft_ct_pcpu_template_refcnt == 0)
534 			nft_ct_tmpl_put_pcpu();
535 		mutex_unlock(&nft_ct_pcpu_mutex);
536 		break;
537 #endif
538 	default:
539 		break;
540 	}
541 }
542 
nft_ct_set_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])543 static int nft_ct_set_init(const struct nft_ctx *ctx,
544 			   const struct nft_expr *expr,
545 			   const struct nlattr * const tb[])
546 {
547 	struct nft_ct *priv = nft_expr_priv(expr);
548 	unsigned int len;
549 	int err;
550 
551 	priv->dir = IP_CT_DIR_MAX;
552 	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
553 	switch (priv->key) {
554 #ifdef CONFIG_NF_CONNTRACK_MARK
555 	case NFT_CT_MARK:
556 		if (tb[NFTA_CT_DIRECTION])
557 			return -EINVAL;
558 		len = sizeof_field(struct nf_conn, mark);
559 		break;
560 #endif
561 #ifdef CONFIG_NF_CONNTRACK_LABELS
562 	case NFT_CT_LABELS:
563 		if (tb[NFTA_CT_DIRECTION])
564 			return -EINVAL;
565 		len = NF_CT_LABELS_MAX_SIZE;
566 		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
567 		if (err)
568 			return err;
569 		break;
570 #endif
571 #ifdef CONFIG_NF_CONNTRACK_ZONES
572 	case NFT_CT_ZONE:
573 		mutex_lock(&nft_ct_pcpu_mutex);
574 		if (!nft_ct_tmpl_alloc_pcpu()) {
575 			mutex_unlock(&nft_ct_pcpu_mutex);
576 			return -ENOMEM;
577 		}
578 		nft_ct_pcpu_template_refcnt++;
579 		mutex_unlock(&nft_ct_pcpu_mutex);
580 		len = sizeof(u16);
581 		break;
582 #endif
583 #ifdef CONFIG_NF_CONNTRACK_EVENTS
584 	case NFT_CT_EVENTMASK:
585 		if (tb[NFTA_CT_DIRECTION])
586 			return -EINVAL;
587 		len = sizeof(u32);
588 		break;
589 #endif
590 #ifdef CONFIG_NF_CONNTRACK_SECMARK
591 	case NFT_CT_SECMARK:
592 		if (tb[NFTA_CT_DIRECTION])
593 			return -EINVAL;
594 		len = sizeof(u32);
595 		break;
596 #endif
597 	default:
598 		return -EOPNOTSUPP;
599 	}
600 
601 	if (tb[NFTA_CT_DIRECTION]) {
602 		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
603 		switch (priv->dir) {
604 		case IP_CT_DIR_ORIGINAL:
605 		case IP_CT_DIR_REPLY:
606 			break;
607 		default:
608 			err = -EINVAL;
609 			goto err1;
610 		}
611 	}
612 
613 	err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len);
614 	if (err < 0)
615 		goto err1;
616 
617 	err = nf_ct_netns_get(ctx->net, ctx->family);
618 	if (err < 0)
619 		goto err1;
620 
621 	return 0;
622 
623 err1:
624 	__nft_ct_set_destroy(ctx, priv);
625 	return err;
626 }
627 
nft_ct_get_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)628 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
629 			       const struct nft_expr *expr)
630 {
631 	nf_ct_netns_put(ctx->net, ctx->family);
632 }
633 
nft_ct_set_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)634 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
635 			       const struct nft_expr *expr)
636 {
637 	struct nft_ct *priv = nft_expr_priv(expr);
638 
639 	__nft_ct_set_destroy(ctx, priv);
640 	nf_ct_netns_put(ctx->net, ctx->family);
641 }
642 
nft_ct_get_dump(struct sk_buff * skb,const struct nft_expr * expr)643 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
644 {
645 	const struct nft_ct *priv = nft_expr_priv(expr);
646 
647 	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
648 		goto nla_put_failure;
649 	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
650 		goto nla_put_failure;
651 
652 	switch (priv->key) {
653 	case NFT_CT_SRC:
654 	case NFT_CT_DST:
655 	case NFT_CT_SRC_IP:
656 	case NFT_CT_DST_IP:
657 	case NFT_CT_SRC_IP6:
658 	case NFT_CT_DST_IP6:
659 	case NFT_CT_PROTO_SRC:
660 	case NFT_CT_PROTO_DST:
661 		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
662 			goto nla_put_failure;
663 		break;
664 	case NFT_CT_BYTES:
665 	case NFT_CT_PKTS:
666 	case NFT_CT_AVGPKT:
667 	case NFT_CT_ZONE:
668 		if (priv->dir < IP_CT_DIR_MAX &&
669 		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
670 			goto nla_put_failure;
671 		break;
672 	default:
673 		break;
674 	}
675 
676 	return 0;
677 
678 nla_put_failure:
679 	return -1;
680 }
681 
nft_ct_set_dump(struct sk_buff * skb,const struct nft_expr * expr)682 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
683 {
684 	const struct nft_ct *priv = nft_expr_priv(expr);
685 
686 	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
687 		goto nla_put_failure;
688 	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
689 		goto nla_put_failure;
690 
691 	switch (priv->key) {
692 	case NFT_CT_ZONE:
693 		if (priv->dir < IP_CT_DIR_MAX &&
694 		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
695 			goto nla_put_failure;
696 		break;
697 	default:
698 		break;
699 	}
700 
701 	return 0;
702 
703 nla_put_failure:
704 	return -1;
705 }
706 
707 static struct nft_expr_type nft_ct_type;
708 static const struct nft_expr_ops nft_ct_get_ops = {
709 	.type		= &nft_ct_type,
710 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
711 	.eval		= nft_ct_get_eval,
712 	.init		= nft_ct_get_init,
713 	.destroy	= nft_ct_get_destroy,
714 	.dump		= nft_ct_get_dump,
715 };
716 
717 static const struct nft_expr_ops nft_ct_set_ops = {
718 	.type		= &nft_ct_type,
719 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
720 	.eval		= nft_ct_set_eval,
721 	.init		= nft_ct_set_init,
722 	.destroy	= nft_ct_set_destroy,
723 	.dump		= nft_ct_set_dump,
724 };
725 
726 #ifdef CONFIG_NF_CONNTRACK_ZONES
727 static const struct nft_expr_ops nft_ct_set_zone_ops = {
728 	.type		= &nft_ct_type,
729 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
730 	.eval		= nft_ct_set_zone_eval,
731 	.init		= nft_ct_set_init,
732 	.destroy	= nft_ct_set_destroy,
733 	.dump		= nft_ct_set_dump,
734 };
735 #endif
736 
737 static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx * ctx,const struct nlattr * const tb[])738 nft_ct_select_ops(const struct nft_ctx *ctx,
739 		    const struct nlattr * const tb[])
740 {
741 	if (tb[NFTA_CT_KEY] == NULL)
742 		return ERR_PTR(-EINVAL);
743 
744 	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
745 		return ERR_PTR(-EINVAL);
746 
747 	if (tb[NFTA_CT_DREG])
748 		return &nft_ct_get_ops;
749 
750 	if (tb[NFTA_CT_SREG]) {
751 #ifdef CONFIG_NF_CONNTRACK_ZONES
752 		if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
753 			return &nft_ct_set_zone_ops;
754 #endif
755 		return &nft_ct_set_ops;
756 	}
757 
758 	return ERR_PTR(-EINVAL);
759 }
760 
761 static struct nft_expr_type nft_ct_type __read_mostly = {
762 	.name		= "ct",
763 	.select_ops	= nft_ct_select_ops,
764 	.policy		= nft_ct_policy,
765 	.maxattr	= NFTA_CT_MAX,
766 	.owner		= THIS_MODULE,
767 };
768 
nft_notrack_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)769 static void nft_notrack_eval(const struct nft_expr *expr,
770 			     struct nft_regs *regs,
771 			     const struct nft_pktinfo *pkt)
772 {
773 	struct sk_buff *skb = pkt->skb;
774 	enum ip_conntrack_info ctinfo;
775 	struct nf_conn *ct;
776 
777 	ct = nf_ct_get(pkt->skb, &ctinfo);
778 	/* Previously seen (loopback or untracked)?  Ignore. */
779 	if (ct || ctinfo == IP_CT_UNTRACKED)
780 		return;
781 
782 	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
783 }
784 
785 static struct nft_expr_type nft_notrack_type;
786 static const struct nft_expr_ops nft_notrack_ops = {
787 	.type		= &nft_notrack_type,
788 	.size		= NFT_EXPR_SIZE(0),
789 	.eval		= nft_notrack_eval,
790 };
791 
792 static struct nft_expr_type nft_notrack_type __read_mostly = {
793 	.name		= "notrack",
794 	.ops		= &nft_notrack_ops,
795 	.owner		= THIS_MODULE,
796 };
797 
798 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
799 static int
nft_ct_timeout_parse_policy(void * timeouts,const struct nf_conntrack_l4proto * l4proto,struct net * net,const struct nlattr * attr)800 nft_ct_timeout_parse_policy(void *timeouts,
801 			    const struct nf_conntrack_l4proto *l4proto,
802 			    struct net *net, const struct nlattr *attr)
803 {
804 	struct nlattr **tb;
805 	int ret = 0;
806 
807 	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
808 		     GFP_KERNEL);
809 
810 	if (!tb)
811 		return -ENOMEM;
812 
813 	ret = nla_parse_nested_deprecated(tb,
814 					  l4proto->ctnl_timeout.nlattr_max,
815 					  attr,
816 					  l4proto->ctnl_timeout.nla_policy,
817 					  NULL);
818 	if (ret < 0)
819 		goto err;
820 
821 	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
822 
823 err:
824 	kfree(tb);
825 	return ret;
826 }
827 
828 struct nft_ct_timeout_obj {
829 	struct nf_ct_timeout    *timeout;
830 	u8			l4proto;
831 };
832 
nft_ct_timeout_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)833 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
834 				    struct nft_regs *regs,
835 				    const struct nft_pktinfo *pkt)
836 {
837 	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
838 	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
839 	struct nf_conn_timeout *timeout;
840 	const unsigned int *values;
841 
842 	if (priv->l4proto != pkt->tprot)
843 		return;
844 
845 	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
846 		return;
847 
848 	timeout = nf_ct_timeout_find(ct);
849 	if (!timeout) {
850 		timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
851 		if (!timeout) {
852 			regs->verdict.code = NF_DROP;
853 			return;
854 		}
855 	}
856 
857 	rcu_assign_pointer(timeout->timeout, priv->timeout);
858 
859 	/* adjust the timeout as per 'new' state. ct is unconfirmed,
860 	 * so the current timestamp must not be added.
861 	 */
862 	values = nf_ct_timeout_data(timeout);
863 	if (values)
864 		nf_ct_refresh(ct, pkt->skb, values[0]);
865 }
866 
nft_ct_timeout_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)867 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
868 				   const struct nlattr * const tb[],
869 				   struct nft_object *obj)
870 {
871 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
872 	const struct nf_conntrack_l4proto *l4proto;
873 	struct nf_ct_timeout *timeout;
874 	int l3num = ctx->family;
875 	__u8 l4num;
876 	int ret;
877 
878 	if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
879 	    !tb[NFTA_CT_TIMEOUT_DATA])
880 		return -EINVAL;
881 
882 	if (tb[NFTA_CT_TIMEOUT_L3PROTO])
883 		l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
884 
885 	l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
886 	priv->l4proto = l4num;
887 
888 	l4proto = nf_ct_l4proto_find(l4num);
889 
890 	if (l4proto->l4proto != l4num) {
891 		ret = -EOPNOTSUPP;
892 		goto err_proto_put;
893 	}
894 
895 	timeout = kzalloc(sizeof(struct nf_ct_timeout) +
896 			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
897 	if (timeout == NULL) {
898 		ret = -ENOMEM;
899 		goto err_proto_put;
900 	}
901 
902 	ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
903 					  tb[NFTA_CT_TIMEOUT_DATA]);
904 	if (ret < 0)
905 		goto err_free_timeout;
906 
907 	timeout->l3num = l3num;
908 	timeout->l4proto = l4proto;
909 
910 	ret = nf_ct_netns_get(ctx->net, ctx->family);
911 	if (ret < 0)
912 		goto err_free_timeout;
913 
914 	priv->timeout = timeout;
915 	return 0;
916 
917 err_free_timeout:
918 	kfree(timeout);
919 err_proto_put:
920 	return ret;
921 }
922 
nft_ct_timeout_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)923 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
924 				       struct nft_object *obj)
925 {
926 	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
927 	struct nf_ct_timeout *timeout = priv->timeout;
928 
929 	nf_ct_untimeout(ctx->net, timeout);
930 	nf_ct_netns_put(ctx->net, ctx->family);
931 	kfree(priv->timeout);
932 }
933 
nft_ct_timeout_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)934 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
935 				   struct nft_object *obj, bool reset)
936 {
937 	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
938 	const struct nf_ct_timeout *timeout = priv->timeout;
939 	struct nlattr *nest_params;
940 	int ret;
941 
942 	if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
943 	    nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
944 		return -1;
945 
946 	nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
947 	if (!nest_params)
948 		return -1;
949 
950 	ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
951 	if (ret < 0)
952 		return -1;
953 	nla_nest_end(skb, nest_params);
954 	return 0;
955 }
956 
957 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
958 	[NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
959 	[NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
960 	[NFTA_CT_TIMEOUT_DATA]	  = {.type = NLA_NESTED },
961 };
962 
963 static struct nft_object_type nft_ct_timeout_obj_type;
964 
965 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
966 	.type		= &nft_ct_timeout_obj_type,
967 	.size		= sizeof(struct nft_ct_timeout_obj),
968 	.eval		= nft_ct_timeout_obj_eval,
969 	.init		= nft_ct_timeout_obj_init,
970 	.destroy	= nft_ct_timeout_obj_destroy,
971 	.dump		= nft_ct_timeout_obj_dump,
972 };
973 
974 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
975 	.type		= NFT_OBJECT_CT_TIMEOUT,
976 	.ops		= &nft_ct_timeout_obj_ops,
977 	.maxattr	= NFTA_CT_TIMEOUT_MAX,
978 	.policy		= nft_ct_timeout_policy,
979 	.owner		= THIS_MODULE,
980 };
981 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
982 
nft_ct_helper_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)983 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
984 				  const struct nlattr * const tb[],
985 				  struct nft_object *obj)
986 {
987 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
988 	struct nf_conntrack_helper *help4, *help6;
989 	char name[NF_CT_HELPER_NAME_LEN];
990 	int family = ctx->family;
991 	int err;
992 
993 	if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
994 		return -EINVAL;
995 
996 	priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
997 	if (!priv->l4proto)
998 		return -ENOENT;
999 
1000 	nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1001 
1002 	if (tb[NFTA_CT_HELPER_L3PROTO])
1003 		family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1004 
1005 	help4 = NULL;
1006 	help6 = NULL;
1007 
1008 	switch (family) {
1009 	case NFPROTO_IPV4:
1010 		if (ctx->family == NFPROTO_IPV6)
1011 			return -EINVAL;
1012 
1013 		help4 = nf_conntrack_helper_try_module_get(name, family,
1014 							   priv->l4proto);
1015 		break;
1016 	case NFPROTO_IPV6:
1017 		if (ctx->family == NFPROTO_IPV4)
1018 			return -EINVAL;
1019 
1020 		help6 = nf_conntrack_helper_try_module_get(name, family,
1021 							   priv->l4proto);
1022 		break;
1023 	case NFPROTO_NETDEV:
1024 	case NFPROTO_BRIDGE:
1025 	case NFPROTO_INET:
1026 		help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1027 							   priv->l4proto);
1028 		help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1029 							   priv->l4proto);
1030 		break;
1031 	default:
1032 		return -EAFNOSUPPORT;
1033 	}
1034 
1035 	/* && is intentional; only error if INET found neither ipv4 or ipv6 */
1036 	if (!help4 && !help6)
1037 		return -ENOENT;
1038 
1039 	priv->helper4 = help4;
1040 	priv->helper6 = help6;
1041 
1042 	err = nf_ct_netns_get(ctx->net, ctx->family);
1043 	if (err < 0)
1044 		goto err_put_helper;
1045 
1046 	return 0;
1047 
1048 err_put_helper:
1049 	if (priv->helper4)
1050 		nf_conntrack_helper_put(priv->helper4);
1051 	if (priv->helper6)
1052 		nf_conntrack_helper_put(priv->helper6);
1053 	return err;
1054 }
1055 
nft_ct_helper_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1056 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1057 				      struct nft_object *obj)
1058 {
1059 	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1060 
1061 	if (priv->helper4)
1062 		nf_conntrack_helper_put(priv->helper4);
1063 	if (priv->helper6)
1064 		nf_conntrack_helper_put(priv->helper6);
1065 
1066 	nf_ct_netns_put(ctx->net, ctx->family);
1067 }
1068 
nft_ct_helper_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1069 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1070 				   struct nft_regs *regs,
1071 				   const struct nft_pktinfo *pkt)
1072 {
1073 	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1074 	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1075 	struct nf_conntrack_helper *to_assign = NULL;
1076 	struct nf_conn_help *help;
1077 
1078 	if (!ct ||
1079 	    nf_ct_is_confirmed(ct) ||
1080 	    nf_ct_is_template(ct) ||
1081 	    priv->l4proto != nf_ct_protonum(ct))
1082 		return;
1083 
1084 	switch (nf_ct_l3num(ct)) {
1085 	case NFPROTO_IPV4:
1086 		to_assign = priv->helper4;
1087 		break;
1088 	case NFPROTO_IPV6:
1089 		to_assign = priv->helper6;
1090 		break;
1091 	default:
1092 		WARN_ON_ONCE(1);
1093 		return;
1094 	}
1095 
1096 	if (!to_assign)
1097 		return;
1098 
1099 	if (test_bit(IPS_HELPER_BIT, &ct->status))
1100 		return;
1101 
1102 	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1103 	if (help) {
1104 		rcu_assign_pointer(help->helper, to_assign);
1105 		set_bit(IPS_HELPER_BIT, &ct->status);
1106 	}
1107 }
1108 
nft_ct_helper_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1109 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1110 				  struct nft_object *obj, bool reset)
1111 {
1112 	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1113 	const struct nf_conntrack_helper *helper;
1114 	u16 family;
1115 
1116 	if (priv->helper4 && priv->helper6) {
1117 		family = NFPROTO_INET;
1118 		helper = priv->helper4;
1119 	} else if (priv->helper6) {
1120 		family = NFPROTO_IPV6;
1121 		helper = priv->helper6;
1122 	} else {
1123 		family = NFPROTO_IPV4;
1124 		helper = priv->helper4;
1125 	}
1126 
1127 	if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1128 		return -1;
1129 
1130 	if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1131 		return -1;
1132 
1133 	if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1134 		return -1;
1135 
1136 	return 0;
1137 }
1138 
1139 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1140 	[NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1141 				  .len = NF_CT_HELPER_NAME_LEN - 1 },
1142 	[NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1143 	[NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1144 };
1145 
1146 static struct nft_object_type nft_ct_helper_obj_type;
1147 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1148 	.type		= &nft_ct_helper_obj_type,
1149 	.size		= sizeof(struct nft_ct_helper_obj),
1150 	.eval		= nft_ct_helper_obj_eval,
1151 	.init		= nft_ct_helper_obj_init,
1152 	.destroy	= nft_ct_helper_obj_destroy,
1153 	.dump		= nft_ct_helper_obj_dump,
1154 };
1155 
1156 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1157 	.type		= NFT_OBJECT_CT_HELPER,
1158 	.ops		= &nft_ct_helper_obj_ops,
1159 	.maxattr	= NFTA_CT_HELPER_MAX,
1160 	.policy		= nft_ct_helper_policy,
1161 	.owner		= THIS_MODULE,
1162 };
1163 
1164 struct nft_ct_expect_obj {
1165 	u16		l3num;
1166 	__be16		dport;
1167 	u8		l4proto;
1168 	u8		size;
1169 	u32		timeout;
1170 };
1171 
nft_ct_expect_obj_init(const struct nft_ctx * ctx,const struct nlattr * const tb[],struct nft_object * obj)1172 static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1173 				  const struct nlattr * const tb[],
1174 				  struct nft_object *obj)
1175 {
1176 	struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1177 
1178 	if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1179 	    !tb[NFTA_CT_EXPECT_DPORT] ||
1180 	    !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1181 	    !tb[NFTA_CT_EXPECT_SIZE])
1182 		return -EINVAL;
1183 
1184 	priv->l3num = ctx->family;
1185 	if (tb[NFTA_CT_EXPECT_L3PROTO])
1186 		priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1187 
1188 	switch (priv->l3num) {
1189 	case NFPROTO_IPV4:
1190 	case NFPROTO_IPV6:
1191 		if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1192 			break;
1193 
1194 		return -EINVAL;
1195 	case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1196 	default:
1197 		return -EAFNOSUPPORT;
1198 	}
1199 
1200 	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1201 	switch (priv->l4proto) {
1202 	case IPPROTO_TCP:
1203 	case IPPROTO_UDP:
1204 	case IPPROTO_UDPLITE:
1205 	case IPPROTO_DCCP:
1206 	case IPPROTO_SCTP:
1207 		break;
1208 	default:
1209 		return -EOPNOTSUPP;
1210 	}
1211 
1212 	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1213 	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1214 	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1215 
1216 	return nf_ct_netns_get(ctx->net, ctx->family);
1217 }
1218 
nft_ct_expect_obj_destroy(const struct nft_ctx * ctx,struct nft_object * obj)1219 static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1220 				       struct nft_object *obj)
1221 {
1222 	nf_ct_netns_put(ctx->net, ctx->family);
1223 }
1224 
nft_ct_expect_obj_dump(struct sk_buff * skb,struct nft_object * obj,bool reset)1225 static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1226 				  struct nft_object *obj, bool reset)
1227 {
1228 	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1229 
1230 	if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1231 	    nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1232 	    nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1233 	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1234 	    nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1235 		return -1;
1236 
1237 	return 0;
1238 }
1239 
nft_ct_expect_obj_eval(struct nft_object * obj,struct nft_regs * regs,const struct nft_pktinfo * pkt)1240 static void nft_ct_expect_obj_eval(struct nft_object *obj,
1241 				   struct nft_regs *regs,
1242 				   const struct nft_pktinfo *pkt)
1243 {
1244 	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1245 	struct nf_conntrack_expect *exp;
1246 	enum ip_conntrack_info ctinfo;
1247 	struct nf_conn_help *help;
1248 	enum ip_conntrack_dir dir;
1249 	u16 l3num = priv->l3num;
1250 	struct nf_conn *ct;
1251 
1252 	ct = nf_ct_get(pkt->skb, &ctinfo);
1253 	if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1254 		regs->verdict.code = NFT_BREAK;
1255 		return;
1256 	}
1257 	dir = CTINFO2DIR(ctinfo);
1258 
1259 	help = nfct_help(ct);
1260 	if (!help)
1261 		help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1262 	if (!help) {
1263 		regs->verdict.code = NF_DROP;
1264 		return;
1265 	}
1266 
1267 	if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1268 		regs->verdict.code = NFT_BREAK;
1269 		return;
1270 	}
1271 	if (l3num == NFPROTO_INET)
1272 		l3num = nf_ct_l3num(ct);
1273 
1274 	exp = nf_ct_expect_alloc(ct);
1275 	if (exp == NULL) {
1276 		regs->verdict.code = NF_DROP;
1277 		return;
1278 	}
1279 	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1280 		          &ct->tuplehash[!dir].tuple.src.u3,
1281 		          &ct->tuplehash[!dir].tuple.dst.u3,
1282 		          priv->l4proto, NULL, &priv->dport);
1283 	exp->timeout.expires = jiffies + priv->timeout * HZ;
1284 
1285 	if (nf_ct_expect_related(exp, 0) != 0)
1286 		regs->verdict.code = NF_DROP;
1287 }
1288 
1289 static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1290 	[NFTA_CT_EXPECT_L3PROTO]	= { .type = NLA_U16 },
1291 	[NFTA_CT_EXPECT_L4PROTO]	= { .type = NLA_U8 },
1292 	[NFTA_CT_EXPECT_DPORT]		= { .type = NLA_U16 },
1293 	[NFTA_CT_EXPECT_TIMEOUT]	= { .type = NLA_U32 },
1294 	[NFTA_CT_EXPECT_SIZE]		= { .type = NLA_U8 },
1295 };
1296 
1297 static struct nft_object_type nft_ct_expect_obj_type;
1298 
1299 static const struct nft_object_ops nft_ct_expect_obj_ops = {
1300 	.type		= &nft_ct_expect_obj_type,
1301 	.size		= sizeof(struct nft_ct_expect_obj),
1302 	.eval		= nft_ct_expect_obj_eval,
1303 	.init		= nft_ct_expect_obj_init,
1304 	.destroy	= nft_ct_expect_obj_destroy,
1305 	.dump		= nft_ct_expect_obj_dump,
1306 };
1307 
1308 static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1309 	.type		= NFT_OBJECT_CT_EXPECT,
1310 	.ops		= &nft_ct_expect_obj_ops,
1311 	.maxattr	= NFTA_CT_EXPECT_MAX,
1312 	.policy		= nft_ct_expect_policy,
1313 	.owner		= THIS_MODULE,
1314 };
1315 
nft_ct_module_init(void)1316 static int __init nft_ct_module_init(void)
1317 {
1318 	int err;
1319 
1320 	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1321 
1322 	err = nft_register_expr(&nft_ct_type);
1323 	if (err < 0)
1324 		return err;
1325 
1326 	err = nft_register_expr(&nft_notrack_type);
1327 	if (err < 0)
1328 		goto err1;
1329 
1330 	err = nft_register_obj(&nft_ct_helper_obj_type);
1331 	if (err < 0)
1332 		goto err2;
1333 
1334 	err = nft_register_obj(&nft_ct_expect_obj_type);
1335 	if (err < 0)
1336 		goto err3;
1337 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1338 	err = nft_register_obj(&nft_ct_timeout_obj_type);
1339 	if (err < 0)
1340 		goto err4;
1341 #endif
1342 	return 0;
1343 
1344 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1345 err4:
1346 	nft_unregister_obj(&nft_ct_expect_obj_type);
1347 #endif
1348 err3:
1349 	nft_unregister_obj(&nft_ct_helper_obj_type);
1350 err2:
1351 	nft_unregister_expr(&nft_notrack_type);
1352 err1:
1353 	nft_unregister_expr(&nft_ct_type);
1354 	return err;
1355 }
1356 
nft_ct_module_exit(void)1357 static void __exit nft_ct_module_exit(void)
1358 {
1359 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1360 	nft_unregister_obj(&nft_ct_timeout_obj_type);
1361 #endif
1362 	nft_unregister_obj(&nft_ct_expect_obj_type);
1363 	nft_unregister_obj(&nft_ct_helper_obj_type);
1364 	nft_unregister_expr(&nft_notrack_type);
1365 	nft_unregister_expr(&nft_ct_type);
1366 }
1367 
1368 module_init(nft_ct_module_init);
1369 module_exit(nft_ct_module_exit);
1370 
1371 MODULE_LICENSE("GPL");
1372 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1373 MODULE_ALIAS_NFT_EXPR("ct");
1374 MODULE_ALIAS_NFT_EXPR("notrack");
1375 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1376 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1377 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1378 MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");
1379