]> git.ipfire.org Git - thirdparty/linux.git/blame - net/netfilter/nft_ct.c
projects / thirdparty / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge remote-tracking branches 'asoc/topic/samsung', 'asoc/topic/sgtl5000', 'asoc...
[thirdparty/linux.git] / net / netfilter / nft_ct.c
CommitLineData
96518518 1/*
ef1f7df9 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
25443261 3 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
96518518
PM		 4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
10 */
11
12#include <linux/kernel.h>
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nf_tables.h>
18#include <net/netfilter/nf_tables.h>
19#include <net/netfilter/nf_conntrack.h>
48f66c90 20#include <net/netfilter/nf_conntrack_acct.h>
96518518
PM		 21#include <net/netfilter/nf_conntrack_tuple.h>
22#include <net/netfilter/nf_conntrack_helper.h>
c4ede3d3 23#include <net/netfilter/nf_conntrack_ecache.h>
d2bf2f34 24#include <net/netfilter/nf_conntrack_labels.h>
96518518
PM		 25
26struct nft_ct {
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
d46f2cd2 29 union {
c4ede3d3
KE		 30 enum nft_registers dreg:8;
31 enum nft_registers sreg:8;
32 };
96518518
PM		 33};
34
edee4f1e
FW		 35#ifdef CONFIG_NF_CONNTRACK_ZONES
36static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
37static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
38#endif
39
48f66c90
FW		 40static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
41 enum nft_ct_keys k,
42 enum ip_conntrack_dir d)
43{
44 if (d < IP_CT_DIR_MAX)
45 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
46 atomic64_read(&c[d].packets);
47
48 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
49 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
50}
51
c4ede3d3 52static void nft_ct_get_eval(const struct nft_expr *expr,
a55e22e9 53 struct nft_regs *regs,
c4ede3d3 54 const struct nft_pktinfo *pkt)
96518518
PM		 55{
56 const struct nft_ct *priv = nft_expr_priv(expr);
49499c3e 57 u32 *dest = &regs->data[priv->dreg];
96518518
PM		 58 enum ip_conntrack_info ctinfo;
59 const struct nf_conn *ct;
60 const struct nf_conn_help *help;
61 const struct nf_conntrack_tuple *tuple;
62 const struct nf_conntrack_helper *helper;
96518518
PM		 63 unsigned int state;
64
65 ct = nf_ct_get(pkt->skb, &ctinfo);
66
67 switch (priv->key) {
68 case NFT_CT_STATE:
69 if (ct == NULL)
70 state = NF_CT_STATE_INVALID_BIT;
71 else if (nf_ct_is_untracked(ct))
72 state = NF_CT_STATE_UNTRACKED_BIT;
73 else
74 state = NF_CT_STATE_BIT(ctinfo);
fad136ea 75 *dest = state;
96518518 76 return;
c1f86676
DM		 77 default:
78 break;
96518518
PM		 79 }
80
81 if (ct == NULL)
82 goto err;
83
84 switch (priv->key) {
85 case NFT_CT_DIRECTION:
10596608 86 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
96518518
PM		 87 return;
88 case NFT_CT_STATUS:
fad136ea 89 *dest = ct->status;
96518518
PM		 90 return;
91#ifdef CONFIG_NF_CONNTRACK_MARK
92 case NFT_CT_MARK:
fad136ea 93 *dest = ct->mark;
96518518
PM		 94 return;
95#endif
96#ifdef CONFIG_NF_CONNTRACK_SECMARK
97 case NFT_CT_SECMARK:
fad136ea 98 *dest = ct->secmark;
96518518
PM		 99 return;
100#endif
101 case NFT_CT_EXPIRATION:
c8607e02 102 *dest = jiffies_to_msecs(nf_ct_expires(ct));
96518518
PM		 103 return;
104 case NFT_CT_HELPER:
105 if (ct->master == NULL)
106 goto err;
107 help = nfct_help(ct->master);
108 if (help == NULL)
109 goto err;
110 helper = rcu_dereference(help->helper);
111 if (helper == NULL)
112 goto err;
fad136ea 113 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
96518518 114 return;
d2bf2f34
FW		 115#ifdef CONFIG_NF_CONNTRACK_LABELS
116 case NFT_CT_LABELS: {
117 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
d2bf2f34 118
23014011
FW		 119 if (labels)
120 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
121 else
fad136ea 122 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
d2bf2f34
FW		 123 return;
124 }
efaea94a 125#endif
48f66c90
FW		 126 case NFT_CT_BYTES: /* fallthrough */
127 case NFT_CT_PKTS: {
128 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
129 u64 count = 0;
130
131 if (acct)
132 count = nft_ct_get_eval_counter(acct->counter,
133 priv->key, priv->dir);
134 memcpy(dest, &count, sizeof(count));
135 return;
136 }
949a3584
LZ		 137 case NFT_CT_AVGPKT: {
138 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
139 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
140
141 if (acct) {
142 pcnt = nft_ct_get_eval_counter(acct->counter,
143 NFT_CT_PKTS, priv->dir);
144 bcnt = nft_ct_get_eval_counter(acct->counter,
145 NFT_CT_BYTES, priv->dir);
146 if (pcnt != 0)
147 avgcnt = div64_u64(bcnt, pcnt);
148 }
149
150 memcpy(dest, &avgcnt, sizeof(avgcnt));
151 return;
152 }
d767ff2c 153 case NFT_CT_L3PROTOCOL:
10596608 154 nft_reg_store8(dest, nf_ct_l3num(ct));
d767ff2c
LZ		 155 return;
156 case NFT_CT_PROTOCOL:
10596608 157 nft_reg_store8(dest, nf_ct_protonum(ct));
d767ff2c 158 return;
ab23821f
FW		 159#ifdef CONFIG_NF_CONNTRACK_ZONES
160 case NFT_CT_ZONE: {
161 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
10596608 162 u16 zoneid;
ab23821f
FW		 163
164 if (priv->dir < IP_CT_DIR_MAX)
10596608 165 zoneid = nf_ct_zone_id(zone, priv->dir);
ab23821f 166 else
10596608 167 zoneid = zone->id;
ab23821f 168
10596608 169 nft_reg_store16(dest, zoneid);
ab23821f
FW		 170 return;
171 }
172#endif
c1f86676
DM		 173 default:
174 break;
96518518
PM		 175 }
176
177 tuple = &ct->tuplehash[priv->dir].tuple;
178 switch (priv->key) {
96518518 179 case NFT_CT_SRC:
fad136ea 180 memcpy(dest, tuple->src.u3.all,
96518518
PM		 181 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
182 return;
183 case NFT_CT_DST:
fad136ea 184 memcpy(dest, tuple->dst.u3.all,
96518518
PM		 185 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
186 return;
96518518 187 case NFT_CT_PROTO_SRC:
10596608 188 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
96518518
PM		 189 return;
190 case NFT_CT_PROTO_DST:
10596608 191 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
96518518 192 return;
c1f86676
DM		 193 default:
194 break;
96518518
PM		 195 }
196 return;
197err:
a55e22e9 198 regs->verdict.code = NFT_BREAK;
96518518
PM		 199}
200
edee4f1e
FW		 201#ifdef CONFIG_NF_CONNTRACK_ZONES
202static void nft_ct_set_zone_eval(const struct nft_expr *expr,
203 struct nft_regs *regs,
204 const struct nft_pktinfo *pkt)
205{
206 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
207 const struct nft_ct *priv = nft_expr_priv(expr);
208 struct sk_buff *skb = pkt->skb;
209 enum ip_conntrack_info ctinfo;
10596608 210 u16 value = nft_reg_load16(&regs->data[priv->sreg]);
edee4f1e
FW		 211 struct nf_conn *ct;
212
213 ct = nf_ct_get(skb, &ctinfo);
214 if (ct) /* already tracked */
215 return;
216
217 zone.id = value;
218
219 switch (priv->dir) {
220 case IP_CT_DIR_ORIGINAL:
221 zone.dir = NF_CT_ZONE_DIR_ORIG;
222 break;
223 case IP_CT_DIR_REPLY:
224 zone.dir = NF_CT_ZONE_DIR_REPL;
225 break;
226 default:
227 break;
228 }
229
230 ct = this_cpu_read(nft_ct_pcpu_template);
231
232 if (likely(atomic_read(&ct->ct_general.use) == 1)) {
233 nf_ct_zone_add(ct, &zone);
234 } else {
235 /* previous skb got queued to userspace */
236 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
237 if (!ct) {
238 regs->verdict.code = NF_DROP;
239 return;
240 }
241 }
242
243 atomic_inc(&ct->ct_general.use);
244 nf_ct_set(skb, ct, IP_CT_NEW);
245}
246#endif
247
c4ede3d3 248static void nft_ct_set_eval(const struct nft_expr *expr,
a55e22e9 249 struct nft_regs *regs,
c4ede3d3
KE		 250 const struct nft_pktinfo *pkt)
251{
252 const struct nft_ct *priv = nft_expr_priv(expr);
253 struct sk_buff *skb = pkt->skb;
847c8e29 254#ifdef CONFIG_NF_CONNTRACK_MARK
49499c3e 255 u32 value = regs->data[priv->sreg];
847c8e29 256#endif
c4ede3d3
KE		 257 enum ip_conntrack_info ctinfo;
258 struct nf_conn *ct;
259
260 ct = nf_ct_get(skb, &ctinfo);
261 if (ct == NULL)
262 return;
263
264 switch (priv->key) {
265#ifdef CONFIG_NF_CONNTRACK_MARK
266 case NFT_CT_MARK:
267 if (ct->mark != value) {
268 ct->mark = value;
269 nf_conntrack_event_cache(IPCT_MARK, ct);
270 }
271 break;
1ad8f48d
FW		 272#endif
273#ifdef CONFIG_NF_CONNTRACK_LABELS
274 case NFT_CT_LABELS:
275 nf_connlabels_replace(ct,
276 &regs->data[priv->sreg],
277 &regs->data[priv->sreg],
278 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
279 break;
c4ede3d3 280#endif
c1f86676
DM		 281 default:
282 break;
c4ede3d3
KE		 283 }
284}
285
96518518
PM		 286static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
287 [NFTA_CT_DREG] = { .type = NLA_U32 },
288 [NFTA_CT_KEY] = { .type = NLA_U32 },
289 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
c4ede3d3 290 [NFTA_CT_SREG] = { .type = NLA_U32 },
96518518
PM		 291};
292
ecb2421b 293static int nft_ct_netns_get(struct net *net, uint8_t family)
9638f33e
PM		 294{
295 int err;
296
297 if (family == NFPROTO_INET) {
ecb2421b 298 err = nf_ct_netns_get(net, NFPROTO_IPV4);
9638f33e
PM		 299 if (err < 0)
300 goto err1;
ecb2421b 301 err = nf_ct_netns_get(net, NFPROTO_IPV6);
9638f33e
PM		 302 if (err < 0)
303 goto err2;
304 } else {
ecb2421b 305 err = nf_ct_netns_get(net, family);
9638f33e
PM		 306 if (err < 0)
307 goto err1;
308 }
309 return 0;
310
311err2:
ecb2421b 312 nf_ct_netns_put(net, NFPROTO_IPV4);
9638f33e
PM		 313err1:
314 return err;
315}
316
ecb2421b 317static void nft_ct_netns_put(struct net *net, uint8_t family)
9638f33e
PM		 318{
319 if (family == NFPROTO_INET) {
ecb2421b
FW		 320 nf_ct_netns_put(net, NFPROTO_IPV4);
321 nf_ct_netns_put(net, NFPROTO_IPV6);
9638f33e 322 } else
ecb2421b 323 nf_ct_netns_put(net, family);
9638f33e
PM		 324}
325
edee4f1e
FW		 326#ifdef CONFIG_NF_CONNTRACK_ZONES
327static void nft_ct_tmpl_put_pcpu(void)
328{
329 struct nf_conn *ct;
330 int cpu;
331
332 for_each_possible_cpu(cpu) {
333 ct = per_cpu(nft_ct_pcpu_template, cpu);
334 if (!ct)
335 break;
336 nf_ct_put(ct);
337 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
338 }
339}
340
341static bool nft_ct_tmpl_alloc_pcpu(void)
342{
343 struct nf_conntrack_zone zone = { .id = 0 };
344 struct nf_conn *tmp;
345 int cpu;
346
347 if (nft_ct_pcpu_template_refcnt)
348 return true;
349
350 for_each_possible_cpu(cpu) {
351 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
352 if (!tmp) {
353 nft_ct_tmpl_put_pcpu();
354 return false;
355 }
356
357 atomic_set(&tmp->ct_general.use, 1);
358 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
359 }
360
361 return true;
362}
363#endif
364
fe92ca45
PM		 365static int nft_ct_get_init(const struct nft_ctx *ctx,
366 const struct nft_expr *expr,
367 const struct nlattr * const tb[])
96518518
PM		 368{
369 struct nft_ct *priv = nft_expr_priv(expr);
45d9bcda 370 unsigned int len;
fe92ca45 371 int err;
96518518 372
fe92ca45 373 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
ab23821f 374 priv->dir = IP_CT_DIR_MAX;
96518518 375 switch (priv->key) {
96518518 376 case NFT_CT_DIRECTION:
45d9bcda
PM		 377 if (tb[NFTA_CT_DIRECTION] != NULL)
378 return -EINVAL;
379 len = sizeof(u8);
380 break;
381 case NFT_CT_STATE:
96518518
PM		 382 case NFT_CT_STATUS:
383#ifdef CONFIG_NF_CONNTRACK_MARK
384 case NFT_CT_MARK:
385#endif
386#ifdef CONFIG_NF_CONNTRACK_SECMARK
387 case NFT_CT_SECMARK:
d2bf2f34 388#endif
45d9bcda
PM		 389 case NFT_CT_EXPIRATION:
390 if (tb[NFTA_CT_DIRECTION] != NULL)
391 return -EINVAL;
392 len = sizeof(u32);
393 break;
d2bf2f34
FW		 394#ifdef CONFIG_NF_CONNTRACK_LABELS
395 case NFT_CT_LABELS:
45d9bcda
PM		 396 if (tb[NFTA_CT_DIRECTION] != NULL)
397 return -EINVAL;
398 len = NF_CT_LABELS_MAX_SIZE;
399 break;
96518518 400#endif
96518518
PM		 401 case NFT_CT_HELPER:
402 if (tb[NFTA_CT_DIRECTION] != NULL)
403 return -EINVAL;
45d9bcda 404 len = NF_CT_HELPER_NAME_LEN;
96518518 405 break;
45d9bcda 406
51292c07 407 case NFT_CT_L3PROTOCOL:
96518518 408 case NFT_CT_PROTOCOL:
d767ff2c
LZ		 409 /* For compatibility, do not report error if NFTA_CT_DIRECTION
410 * attribute is specified.
411 */
45d9bcda
PM		 412 len = sizeof(u8);
413 break;
96518518
PM		 414 case NFT_CT_SRC:
415 case NFT_CT_DST:
45d9bcda
PM		 416 if (tb[NFTA_CT_DIRECTION] == NULL)
417 return -EINVAL;
418
419 switch (ctx->afi->family) {
420 case NFPROTO_IPV4:
421 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
422 src.u3.ip);
423 break;
424 case NFPROTO_IPV6:
425 case NFPROTO_INET:
426 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
427 src.u3.ip6);
428 break;
429 default:
430 return -EAFNOSUPPORT;
431 }
432 break;
96518518
PM		 433 case NFT_CT_PROTO_SRC:
434 case NFT_CT_PROTO_DST:
435 if (tb[NFTA_CT_DIRECTION] == NULL)
436 return -EINVAL;
45d9bcda 437 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
96518518 438 break;
48f66c90
FW		 439 case NFT_CT_BYTES:
440 case NFT_CT_PKTS:
949a3584 441 case NFT_CT_AVGPKT:
48f66c90
FW		 442 len = sizeof(u64);
443 break;
ab23821f
FW		 444#ifdef CONFIG_NF_CONNTRACK_ZONES
445 case NFT_CT_ZONE:
446 len = sizeof(u16);
447 break;
448#endif
96518518
PM		 449 default:
450 return -EOPNOTSUPP;
451 }
452
fe92ca45
PM		 453 if (tb[NFTA_CT_DIRECTION] != NULL) {
454 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
455 switch (priv->dir) {
456 case IP_CT_DIR_ORIGINAL:
457 case IP_CT_DIR_REPLY:
458 break;
459 default:
460 return -EINVAL;
461 }
462 }
463
b1c96ed3 464 priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
1ec10212
PM		 465 err = nft_validate_register_store(ctx, priv->dreg, NULL,
466 NFT_DATA_VALUE, len);
fe92ca45
PM		 467 if (err < 0)
468 return err;
469
ecb2421b 470 err = nft_ct_netns_get(ctx->net, ctx->afi->family);
fe92ca45
PM		 471 if (err < 0)
472 return err;
473
949a3584
LZ		 474 if (priv->key == NFT_CT_BYTES ||
475 priv->key == NFT_CT_PKTS ||
476 priv->key == NFT_CT_AVGPKT)
3f8b61b7
LZ		 477 nf_ct_set_acct(ctx->net, true);
478
c4ede3d3
KE		 479 return 0;
480}
481
5c178d81
FW		 482static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
483{
484 switch (priv->key) {
485#ifdef CONFIG_NF_CONNTRACK_LABELS
486 case NFT_CT_LABELS:
487 nf_connlabels_put(ctx->net);
488 break;
edee4f1e
FW		 489#endif
490#ifdef CONFIG_NF_CONNTRACK_ZONES
491 case NFT_CT_ZONE:
492 if (--nft_ct_pcpu_template_refcnt == 0)
493 nft_ct_tmpl_put_pcpu();
5c178d81
FW		 494#endif
495 default:
496 break;
497 }
498}
499
fe92ca45
PM		 500static int nft_ct_set_init(const struct nft_ctx *ctx,
501 const struct nft_expr *expr,
502 const struct nlattr * const tb[])
c4ede3d3 503{
fe92ca45 504 struct nft_ct *priv = nft_expr_priv(expr);
d07db988 505 unsigned int len;
fe92ca45
PM		 506 int err;
507
edee4f1e 508 priv->dir = IP_CT_DIR_MAX;
fe92ca45
PM		 509 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
510 switch (priv->key) {
e88e514e 511#ifdef CONFIG_NF_CONNTRACK_MARK
c4ede3d3 512 case NFT_CT_MARK:
7bfdde70
LZ		 513 if (tb[NFTA_CT_DIRECTION])
514 return -EINVAL;
d07db988 515 len = FIELD_SIZEOF(struct nf_conn, mark);
c4ede3d3 516 break;
1ad8f48d
FW		 517#endif
518#ifdef CONFIG_NF_CONNTRACK_LABELS
519 case NFT_CT_LABELS:
520 if (tb[NFTA_CT_DIRECTION])
521 return -EINVAL;
522 len = NF_CT_LABELS_MAX_SIZE;
523 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
524 if (err)
525 return err;
526 break;
edee4f1e
FW		 527#endif
528#ifdef CONFIG_NF_CONNTRACK_ZONES
529 case NFT_CT_ZONE:
530 if (!nft_ct_tmpl_alloc_pcpu())
531 return -ENOMEM;
532 nft_ct_pcpu_template_refcnt++;
427345d6 533 len = sizeof(u16);
edee4f1e 534 break;
e88e514e 535#endif
c4ede3d3
KE		 536 default:
537 return -EOPNOTSUPP;
538 }
539
edee4f1e
FW		 540 if (tb[NFTA_CT_DIRECTION]) {
541 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
542 switch (priv->dir) {
543 case IP_CT_DIR_ORIGINAL:
544 case IP_CT_DIR_REPLY:
545 break;
546 default:
4494dbc6
LZ		 547 err = -EINVAL;
548 goto err1;
edee4f1e
FW		 549 }
550 }
551
b1c96ed3 552 priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
d07db988 553 err = nft_validate_register_load(priv->sreg, len);
fe92ca45 554 if (err < 0)
590025a2 555 goto err1;
c4ede3d3 556
ecb2421b 557 err = nft_ct_netns_get(ctx->net, ctx->afi->family);
96518518 558 if (err < 0)
590025a2 559 goto err1;
96518518 560
96518518 561 return 0;
590025a2
LZ		 562
563err1:
5c178d81 564 __nft_ct_set_destroy(ctx, priv);
590025a2
LZ		 565 return err;
566}
567
568static void nft_ct_get_destroy(const struct nft_ctx *ctx,
569 const struct nft_expr *expr)
570{
ecb2421b 571 nf_ct_netns_put(ctx->net, ctx->afi->family);
96518518
PM		 572}
573
590025a2
LZ		 574static void nft_ct_set_destroy(const struct nft_ctx *ctx,
575 const struct nft_expr *expr)
96518518 576{
1ad8f48d
FW		 577 struct nft_ct *priv = nft_expr_priv(expr);
578
5c178d81 579 __nft_ct_set_destroy(ctx, priv);
ecb2421b 580 nft_ct_netns_put(ctx->net, ctx->afi->family);
96518518
PM		 581}
582
c4ede3d3 583static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
96518518
PM		 584{
585 const struct nft_ct *priv = nft_expr_priv(expr);
586
b1c96ed3 587 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
96518518
PM		 588 goto nla_put_failure;
589 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
590 goto nla_put_failure;
2a53bfb3
AB		 591
592 switch (priv->key) {
2a53bfb3
AB		 593 case NFT_CT_SRC:
594 case NFT_CT_DST:
595 case NFT_CT_PROTO_SRC:
596 case NFT_CT_PROTO_DST:
597 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
598 goto nla_put_failure;
48f66c90
FW		 599 break;
600 case NFT_CT_BYTES:
601 case NFT_CT_PKTS:
949a3584 602 case NFT_CT_AVGPKT:
ab23821f 603 case NFT_CT_ZONE:
48f66c90
FW		 604 if (priv->dir < IP_CT_DIR_MAX &&
605 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
606 goto nla_put_failure;
607 break;
2a53bfb3
AB		 608 default:
609 break;
610 }
611
96518518
PM		 612 return 0;
613
614nla_put_failure:
615 return -1;
616}
617
c4ede3d3
KE		 618static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
619{
620 const struct nft_ct *priv = nft_expr_priv(expr);
621
b1c96ed3 622 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
c4ede3d3
KE		 623 goto nla_put_failure;
624 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
625 goto nla_put_failure;
edee4f1e
FW		 626
627 switch (priv->key) {
628 case NFT_CT_ZONE:
629 if (priv->dir < IP_CT_DIR_MAX &&
630 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
631 goto nla_put_failure;
632 break;
633 default:
634 break;
635 }
636
c4ede3d3
KE		 637 return 0;
638
639nla_put_failure:
640 return -1;
641}
642
ef1f7df9 643static struct nft_expr_type nft_ct_type;
c4ede3d3 644static const struct nft_expr_ops nft_ct_get_ops = {
ef1f7df9 645 .type = &nft_ct_type,
96518518 646 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
c4ede3d3 647 .eval = nft_ct_get_eval,
fe92ca45 648 .init = nft_ct_get_init,
590025a2 649 .destroy = nft_ct_get_destroy,
c4ede3d3 650 .dump = nft_ct_get_dump,
ef1f7df9
PM		 651};
652
c4ede3d3
KE		 653static const struct nft_expr_ops nft_ct_set_ops = {
654 .type = &nft_ct_type,
655 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
656 .eval = nft_ct_set_eval,
fe92ca45 657 .init = nft_ct_set_init,
590025a2 658 .destroy = nft_ct_set_destroy,
c4ede3d3
KE		 659 .dump = nft_ct_set_dump,
660};
661
edee4f1e
FW		 662#ifdef CONFIG_NF_CONNTRACK_ZONES
663static const struct nft_expr_ops nft_ct_set_zone_ops = {
664 .type = &nft_ct_type,
665 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
666 .eval = nft_ct_set_zone_eval,
667 .init = nft_ct_set_init,
668 .destroy = nft_ct_set_destroy,
669 .dump = nft_ct_set_dump,
670};
671#endif
672
c4ede3d3
KE		 673static const struct nft_expr_ops *
674nft_ct_select_ops(const struct nft_ctx *ctx,
675 const struct nlattr * const tb[])
676{
677 if (tb[NFTA_CT_KEY] == NULL)
678 return ERR_PTR(-EINVAL);
679
680 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
681 return ERR_PTR(-EINVAL);
682
683 if (tb[NFTA_CT_DREG])
684 return &nft_ct_get_ops;
685
edee4f1e
FW		 686 if (tb[NFTA_CT_SREG]) {
687#ifdef CONFIG_NF_CONNTRACK_ZONES
688 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
689 return &nft_ct_set_zone_ops;
690#endif
c4ede3d3 691 return &nft_ct_set_ops;
edee4f1e 692 }
c4ede3d3
KE		 693
694 return ERR_PTR(-EINVAL);
695}
696
ef1f7df9
PM		 697static struct nft_expr_type nft_ct_type __read_mostly = {
698 .name = "ct",
c4ede3d3 699 .select_ops = &nft_ct_select_ops,
96518518
PM		 700 .policy = nft_ct_policy,
701 .maxattr = NFTA_CT_MAX,
ef1f7df9 702 .owner = THIS_MODULE,
96518518
PM		 703};
704
25443261
PNA		 705static void nft_notrack_eval(const struct nft_expr *expr,
706 struct nft_regs *regs,
707 const struct nft_pktinfo *pkt)
708{
709 struct sk_buff *skb = pkt->skb;
710 enum ip_conntrack_info ctinfo;
711 struct nf_conn *ct;
712
713 ct = nf_ct_get(pkt->skb, &ctinfo);
714 /* Previously seen (loopback or untracked)? Ignore. */
715 if (ct)
716 return;
717
718 ct = nf_ct_untracked_get();
719 atomic_inc(&ct->ct_general.use);
c74454fa 720 nf_ct_set(skb, ct, IP_CT_NEW);
25443261
PNA		 721}
722
723static struct nft_expr_type nft_notrack_type;
724static const struct nft_expr_ops nft_notrack_ops = {
725 .type = &nft_notrack_type,
726 .size = NFT_EXPR_SIZE(0),
727 .eval = nft_notrack_eval,
728};
729
730static struct nft_expr_type nft_notrack_type __read_mostly = {
731 .name = "notrack",
732 .ops = &nft_notrack_ops,
733 .owner = THIS_MODULE,
734};
735
96518518
PM		 736static int __init nft_ct_module_init(void)
737{
25443261
PNA		 738 int err;
739
adff6c65
FW		 740 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
741
25443261
PNA		 742 err = nft_register_expr(&nft_ct_type);
743 if (err < 0)
744 return err;
745
746 err = nft_register_expr(&nft_notrack_type);
747 if (err < 0)
748 goto err1;
749
750 return 0;
751err1:
752 nft_unregister_expr(&nft_ct_type);
753 return err;
96518518
PM		 754}
755
756static void __exit nft_ct_module_exit(void)
757{
25443261 758 nft_unregister_expr(&nft_notrack_type);
ef1f7df9 759 nft_unregister_expr(&nft_ct_type);
96518518
PM		 760}
761
762module_init(nft_ct_module_init);
763module_exit(nft_ct_module_exit);
764
765MODULE_LICENSE("GPL");
766MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
767MODULE_ALIAS_NFT_EXPR("ct");
25443261 768MODULE_ALIAS_NFT_EXPR("notrack");
A mirror of Linus' kernel repository