[mirror_ubuntu-zesty-kernel.git] / net / netfilter / nft_ct.c

/*
 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>

struct nft_ct {
	enum nft_ct_keys	key:8;
	enum ip_conntrack_dir	dir:8;
	union{
		enum nft_registers	dreg:8;
		enum nft_registers	sreg:8;
	};
	uint8_t			family;
};

static void nft_ct_get_eval(const struct nft_expr *expr,
			    struct nft_data data[NFT_REG_MAX + 1],
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	struct nft_data *dest = &data[priv->dreg];
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	const struct nf_conn_help *help;
	const struct nf_conntrack_tuple *tuple;
	const struct nf_conntrack_helper *helper;
	long diff;
	unsigned int state;

	ct = nf_ct_get(pkt->skb, &ctinfo);

	switch (priv->key) {
	case NFT_CT_STATE:
		if (ct == NULL)
			state = NF_CT_STATE_INVALID_BIT;
		else if (nf_ct_is_untracked(ct))
			state = NF_CT_STATE_UNTRACKED_BIT;
		else
			state = NF_CT_STATE_BIT(ctinfo);
		dest->data[0] = state;
		return;
	}

	if (ct == NULL)
		goto err;

	switch (priv->key) {
	case NFT_CT_DIRECTION:
		dest->data[0] = CTINFO2DIR(ctinfo);
		return;
	case NFT_CT_STATUS:
		dest->data[0] = ct->status;
		return;
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		dest->data[0] = ct->mark;
		return;
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
		dest->data[0] = ct->secmark;
		return;
#endif
	case NFT_CT_EXPIRATION:
		diff = (long)jiffies - (long)ct->timeout.expires;
		if (diff < 0)
			diff = 0;
		dest->data[0] = jiffies_to_msecs(diff);
		return;
	case NFT_CT_HELPER:
		if (ct->master == NULL)
			goto err;
		help = nfct_help(ct->master);
		if (help == NULL)
			goto err;
		helper = rcu_dereference(help->helper);
		if (helper == NULL)
			goto err;
		if (strlen(helper->name) >= sizeof(dest->data))
			goto err;
		strncpy((char *)dest->data, helper->name, sizeof(dest->data));
		return;
	}

	tuple = &ct->tuplehash[priv->dir].tuple;
	switch (priv->key) {
	case NFT_CT_L3PROTOCOL:
		dest->data[0] = nf_ct_l3num(ct);
		return;
	case NFT_CT_SRC:
		memcpy(dest->data, tuple->src.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_DST:
		memcpy(dest->data, tuple->dst.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_PROTOCOL:
		dest->data[0] = nf_ct_protonum(ct);
		return;
	case NFT_CT_PROTO_SRC:
		dest->data[0] = (__force __u16)tuple->src.u.all;
		return;
	case NFT_CT_PROTO_DST:
		dest->data[0] = (__force __u16)tuple->dst.u.all;
		return;
	}
	return;
err:
	data[NFT_REG_VERDICT].verdict = NFT_BREAK;
}

static void nft_ct_set_eval(const struct nft_expr *expr,
			    struct nft_data data[NFT_REG_MAX + 1],
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	struct sk_buff *skb = pkt->skb;
#ifdef CONFIG_NF_CONNTRACK_MARK
	u32 value = data[priv->sreg].data[0];
#endif
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;

	switch (priv->key) {
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		if (ct->mark != value) {
			ct->mark = value;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
#endif
	}
}

static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	[NFTA_CT_DREG]		= { .type = NLA_U32 },
	[NFTA_CT_KEY]		= { .type = NLA_U32 },
	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
	[NFTA_CT_SREG]		= { .type = NLA_U32 },
};

static int nft_ct_l3proto_try_module_get(uint8_t family)
{
	int err;

	if (family == NFPROTO_INET) {
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
		if (err < 0)
			goto err1;
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
		if (err < 0)
			goto err2;
	} else {
		err = nf_ct_l3proto_try_module_get(family);
		if (err < 0)
			goto err1;
	}
	return 0;

err2:
	nf_ct_l3proto_module_put(NFPROTO_IPV4);
err1:
	return err;
}

static void nft_ct_l3proto_module_put(uint8_t family)
{
	if (family == NFPROTO_INET) {
		nf_ct_l3proto_module_put(NFPROTO_IPV4);
		nf_ct_l3proto_module_put(NFPROTO_IPV6);
	} else
		nf_ct_l3proto_module_put(family);
}

static int nft_ct_init_validate_get(const struct nft_expr *expr,
				    const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);

	if (tb[NFTA_CT_DIRECTION] != NULL) {
		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
		switch (priv->dir) {
		case IP_CT_DIR_ORIGINAL:
		case IP_CT_DIR_REPLY:
			break;
		default:
			return -EINVAL;
		}
	}

	switch (priv->key) {
	case NFT_CT_STATE:
	case NFT_CT_DIRECTION:
	case NFT_CT_STATUS:
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
#endif
	case NFT_CT_EXPIRATION:
	case NFT_CT_HELPER:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		break;
	case NFT_CT_L3PROTOCOL:
	case NFT_CT_PROTOCOL:
	case NFT_CT_SRC:
	case NFT_CT_DST:
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (tb[NFTA_CT_DIRECTION] == NULL)
			return -EINVAL;
		break;
	default:
		return -EOPNOTSUPP;
	}

	return 0;
}

static int nft_ct_init_validate_set(uint32_t key)
{
	switch (key) {
	case NFT_CT_MARK:
		break;
	default:
		return -EOPNOTSUPP;
	}

	return 0;
}

static int nft_ct_init(const struct nft_ctx *ctx,
		       const struct nft_expr *expr,
		       const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);
	int err;

	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));

	if (tb[NFTA_CT_DREG]) {
		err = nft_ct_init_validate_get(expr, tb);
		if (err < 0)
			return err;

		priv->dreg = ntohl(nla_get_be32(tb[NFTA_CT_DREG]));
		err = nft_validate_output_register(priv->dreg);
		if (err < 0)
			return err;

		err = nft_validate_data_load(ctx, priv->dreg, NULL,
					     NFT_DATA_VALUE);
		if (err < 0)
			return err;
	} else {
		err = nft_ct_init_validate_set(priv->key);
		if (err < 0)
			return err;

		priv->sreg = ntohl(nla_get_be32(tb[NFTA_CT_SREG]));
		err = nft_validate_input_register(priv->sreg);
		if (err < 0)
			return err;
	}

	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	if (err < 0)
		return err;

	priv->family = ctx->afi->family;

	return 0;
}

static void nft_ct_destroy(const struct nft_expr *expr)
{
	struct nft_ct *priv = nft_expr_priv(expr);

	nft_ct_l3proto_module_put(priv->family);
}

static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nla_put_be32(skb, NFTA_CT_DREG, htonl(priv->dreg)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;

	switch (priv->key) {
	case NFT_CT_PROTOCOL:
	case NFT_CT_SRC:
	case NFT_CT_DST:
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
			goto nla_put_failure;
	default:
		break;
	}

	return 0;

nla_put_failure:
	return -1;
}

static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nla_put_be32(skb, NFTA_CT_SREG, htonl(priv->sreg)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_ct_type;
static const struct nft_expr_ops nft_ct_get_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_get_eval,
	.init		= nft_ct_init,
	.destroy	= nft_ct_destroy,
	.dump		= nft_ct_get_dump,
};

static const struct nft_expr_ops nft_ct_set_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_set_eval,
	.init		= nft_ct_init,
	.destroy	= nft_ct_destroy,
	.dump		= nft_ct_set_dump,
};

static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx *ctx,
		    const struct nlattr * const tb[])
{
	if (tb[NFTA_CT_KEY] == NULL)
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG])
		return &nft_ct_get_ops;

	if (tb[NFTA_CT_SREG])
		return &nft_ct_set_ops;

	return ERR_PTR(-EINVAL);
}

static struct nft_expr_type nft_ct_type __read_mostly = {
	.name		= "ct",
	.select_ops	= &nft_ct_select_ops,
	.policy		= nft_ct_policy,
	.maxattr	= NFTA_CT_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_ct_module_init(void)
{
	return nft_register_expr(&nft_ct_type);
}

static void __exit nft_ct_module_exit(void)
{
	nft_unregister_expr(&nft_ct_type);
}

module_init(nft_ct_module_init);
module_exit(nft_ct_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_EXPR("ct");
Commit	Line	Data
96518518	1	/*
ef1f7df9	2	* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
96518518 PM	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/init.h>
	13	#include <linux/module.h>
	14	#include <linux/netlink.h>
	15	#include <linux/netfilter.h>
	16	#include <linux/netfilter/nf_tables.h>
	17	#include <net/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_conntrack.h>
	19	#include <net/netfilter/nf_conntrack_tuple.h>
	20	#include <net/netfilter/nf_conntrack_helper.h>
c4ede3d3	21	#include <net/netfilter/nf_conntrack_ecache.h>
96518518 PM	22
	23	struct nft_ct {
	24	enum nft_ct_keys key:8;
	25	enum ip_conntrack_dir dir:8;
c4ede3d3 KE	26	union{
	27	enum nft_registers dreg:8;
	28	enum nft_registers sreg:8;
	29	};
96518518 PM	30	uint8_t family;
	31	};
	32
c4ede3d3 KE	33	static void nft_ct_get_eval(const struct nft_expr *expr,
	34	struct nft_data data[NFT_REG_MAX + 1],
	35	const struct nft_pktinfo *pkt)
96518518 PM	36	{
	37	const struct nft_ct *priv = nft_expr_priv(expr);
	38	struct nft_data *dest = &data[priv->dreg];
	39	enum ip_conntrack_info ctinfo;
	40	const struct nf_conn *ct;
	41	const struct nf_conn_help *help;
	42	const struct nf_conntrack_tuple *tuple;
	43	const struct nf_conntrack_helper *helper;
	44	long diff;
	45	unsigned int state;
	46
	47	ct = nf_ct_get(pkt->skb, &ctinfo);
	48
	49	switch (priv->key) {
	50	case NFT_CT_STATE:
	51	if (ct == NULL)
	52	state = NF_CT_STATE_INVALID_BIT;
	53	else if (nf_ct_is_untracked(ct))
	54	state = NF_CT_STATE_UNTRACKED_BIT;
	55	else
	56	state = NF_CT_STATE_BIT(ctinfo);
	57	dest->data[0] = state;
	58	return;
	59	}
	60
	61	if (ct == NULL)
	62	goto err;
	63
	64	switch (priv->key) {
	65	case NFT_CT_DIRECTION:
	66	dest->data[0] = CTINFO2DIR(ctinfo);
	67	return;
	68	case NFT_CT_STATUS:
	69	dest->data[0] = ct->status;
	70	return;
	71	#ifdef CONFIG_NF_CONNTRACK_MARK
	72	case NFT_CT_MARK:
	73	dest->data[0] = ct->mark;
	74	return;
	75	#endif
	76	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	77	case NFT_CT_SECMARK:
	78	dest->data[0] = ct->secmark;
	79	return;
	80	#endif
	81	case NFT_CT_EXPIRATION:
	82	diff = (long)jiffies - (long)ct->timeout.expires;
	83	if (diff < 0)
	84	diff = 0;
	85	dest->data[0] = jiffies_to_msecs(diff);
	86	return;
	87	case NFT_CT_HELPER:
	88	if (ct->master == NULL)
	89	goto err;
	90	help = nfct_help(ct->master);
	91	if (help == NULL)
	92	goto err;
	93	helper = rcu_dereference(help->helper);
	94	if (helper == NULL)
	95	goto err;
	96	if (strlen(helper->name) >= sizeof(dest->data))
	97	goto err;
	98	strncpy((char *)dest->data, helper->name, sizeof(dest->data));
	99	return;
100	}
101
102	tuple = &ct->tuplehash[priv->dir].tuple;
103	switch (priv->key) {
104	case NFT_CT_L3PROTOCOL:
105	dest->data[0] = nf_ct_l3num(ct);
106	return;
107	case NFT_CT_SRC:
108	memcpy(dest->data, tuple->src.u3.all,
109	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
110	return;
111	case NFT_CT_DST:
112	memcpy(dest->data, tuple->dst.u3.all,
113	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
114	return;
115	case NFT_CT_PROTOCOL:
116	dest->data[0] = nf_ct_protonum(ct);
117	return;
118	case NFT_CT_PROTO_SRC:
119	dest->data[0] = (__force __u16)tuple->src.u.all;
120	return;
121	case NFT_CT_PROTO_DST:
122	dest->data[0] = (__force __u16)tuple->dst.u.all;
123	return;
124	}
125	return;
126	err:
127	data[NFT_REG_VERDICT].verdict = NFT_BREAK;
128	}
129
c4ede3d3 KE	130	static void nft_ct_set_eval(const struct nft_expr *expr,
	131	struct nft_data data[NFT_REG_MAX + 1],
	132	const struct nft_pktinfo *pkt)
	133	{
	134	const struct nft_ct *priv = nft_expr_priv(expr);
	135	struct sk_buff *skb = pkt->skb;
847c8e29	136	#ifdef CONFIG_NF_CONNTRACK_MARK
c4ede3d3	137	u32 value = data[priv->sreg].data[0];
847c8e29	138	#endif
c4ede3d3 KE	139	enum ip_conntrack_info ctinfo;
	140	struct nf_conn *ct;
	141
	142	ct = nf_ct_get(skb, &ctinfo);
	143	if (ct == NULL)
	144	return;
	145
	146	switch (priv->key) {
	147	#ifdef CONFIG_NF_CONNTRACK_MARK
	148	case NFT_CT_MARK:
	149	if (ct->mark != value) {
	150	ct->mark = value;
	151	nf_conntrack_event_cache(IPCT_MARK, ct);
	152	}
	153	break;
	154	#endif
	155	}
	156	}
	157
96518518 PM	158	static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	159	[NFTA_CT_DREG] = { .type = NLA_U32 },
	160	[NFTA_CT_KEY] = { .type = NLA_U32 },
	161	[NFTA_CT_DIRECTION] = { .type = NLA_U8 },
c4ede3d3	162	[NFTA_CT_SREG] = { .type = NLA_U32 },
96518518 PM	163	};
96518518 PM	164
9638f33e PM	165	static int nft_ct_l3proto_try_module_get(uint8_t family)
	166	{
	167	int err;
	168
	169	if (family == NFPROTO_INET) {
	170	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
	171	if (err < 0)
	172	goto err1;
	173	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
	174	if (err < 0)
	175	goto err2;
	176	} else {
	177	err = nf_ct_l3proto_try_module_get(family);
	178	if (err < 0)
	179	goto err1;
	180	}
	181	return 0;
	182
	183	err2:
	184	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	185	err1:
	186	return err;
	187	}
	188
	189	static void nft_ct_l3proto_module_put(uint8_t family)
	190	{
	191	if (family == NFPROTO_INET) {
	192	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	193	nf_ct_l3proto_module_put(NFPROTO_IPV6);
	194	} else
	195	nf_ct_l3proto_module_put(family);
	196	}
	197
c4ede3d3 KE	198	static int nft_ct_init_validate_get(const struct nft_expr *expr,
c4ede3d3 KE	199	const struct nlattr * const tb[])
96518518 PM	200	{
96518518 PM	201	struct nft_ct *priv = nft_expr_priv(expr);
96518518	202
96518518 PM	203	if (tb[NFTA_CT_DIRECTION] != NULL) {
	204	priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
	205	switch (priv->dir) {
	206	case IP_CT_DIR_ORIGINAL:
	207	case IP_CT_DIR_REPLY:
	208	break;
	209	default:
	210	return -EINVAL;
	211	}
	212	}
	213
	214	switch (priv->key) {
	215	case NFT_CT_STATE:
	216	case NFT_CT_DIRECTION:
	217	case NFT_CT_STATUS:
	218	#ifdef CONFIG_NF_CONNTRACK_MARK
	219	case NFT_CT_MARK:
	220	#endif
	221	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	222	case NFT_CT_SECMARK:
	223	#endif
	224	case NFT_CT_EXPIRATION:
	225	case NFT_CT_HELPER:
	226	if (tb[NFTA_CT_DIRECTION] != NULL)
	227	return -EINVAL;
	228	break;
51292c07	229	case NFT_CT_L3PROTOCOL:
96518518 PM	230	case NFT_CT_PROTOCOL:
	231	case NFT_CT_SRC:
	232	case NFT_CT_DST:
	233	case NFT_CT_PROTO_SRC:
	234	case NFT_CT_PROTO_DST:
	235	if (tb[NFTA_CT_DIRECTION] == NULL)
	236	return -EINVAL;
	237	break;
	238	default:
	239	return -EOPNOTSUPP;
	240	}
	241
c4ede3d3 KE	242	return 0;
	243	}
	244
	245	static int nft_ct_init_validate_set(uint32_t key)
	246	{
	247	switch (key) {
	248	case NFT_CT_MARK:
	249	break;
	250	default:
	251	return -EOPNOTSUPP;
	252	}
	253
	254	return 0;
	255	}
	256
	257	static int nft_ct_init(const struct nft_ctx *ctx,
	258	const struct nft_expr *expr,
	259	const struct nlattr * const tb[])
	260	{
	261	struct nft_ct *priv = nft_expr_priv(expr);
	262	int err;
	263
	264	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	265
	266	if (tb[NFTA_CT_DREG]) {
	267	err = nft_ct_init_validate_get(expr, tb);
	268	if (err < 0)
	269	return err;
	270
	271	priv->dreg = ntohl(nla_get_be32(tb[NFTA_CT_DREG]));
	272	err = nft_validate_output_register(priv->dreg);
	273	if (err < 0)
	274	return err;
	275
	276	err = nft_validate_data_load(ctx, priv->dreg, NULL,
	277	NFT_DATA_VALUE);
	278	if (err < 0)
	279	return err;
	280	} else {
	281	err = nft_ct_init_validate_set(priv->key);
	282	if (err < 0)
	283	return err;
	284
	285	priv->sreg = ntohl(nla_get_be32(tb[NFTA_CT_SREG]));
	286	err = nft_validate_input_register(priv->sreg);
	287	if (err < 0)
	288	return err;
	289	}
	290
9638f33e	291	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
96518518 PM	292	if (err < 0)
96518518 PM	293	return err;
96518518	294
c4ede3d3	295	priv->family = ctx->afi->family;
96518518	296
96518518	297	return 0;
96518518 PM	298	}
	299
	300	static void nft_ct_destroy(const struct nft_expr *expr)
	301	{
	302	struct nft_ct *priv = nft_expr_priv(expr);
	303
9638f33e	304	nft_ct_l3proto_module_put(priv->family);
96518518 PM	305	}
96518518 PM	306
c4ede3d3	307	static int nft_ct_get_dump(struct sk_buff skb, const struct nft_expr expr)
96518518 PM	308	{
	309	const struct nft_ct *priv = nft_expr_priv(expr);
	310
	311	if (nla_put_be32(skb, NFTA_CT_DREG, htonl(priv->dreg)))
	312	goto nla_put_failure;
	313	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	314	goto nla_put_failure;
2a53bfb3 AB	315
	316	switch (priv->key) {
	317	case NFT_CT_PROTOCOL:
	318	case NFT_CT_SRC:
	319	case NFT_CT_DST:
	320	case NFT_CT_PROTO_SRC:
	321	case NFT_CT_PROTO_DST:
	322	if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
	323	goto nla_put_failure;
	324	default:
	325	break;
	326	}
	327
96518518 PM	328	return 0;
	329
	330	nla_put_failure:
	331	return -1;
	332	}
	333
c4ede3d3 KE	334	static int nft_ct_set_dump(struct sk_buff skb, const struct nft_expr expr)
	335	{
	336	const struct nft_ct *priv = nft_expr_priv(expr);
	337
	338	if (nla_put_be32(skb, NFTA_CT_SREG, htonl(priv->sreg)))
	339	goto nla_put_failure;
	340	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	341	goto nla_put_failure;
	342	return 0;
	343
	344	nla_put_failure:
	345	return -1;
	346	}
	347
ef1f7df9	348	static struct nft_expr_type nft_ct_type;
c4ede3d3	349	static const struct nft_expr_ops nft_ct_get_ops = {
ef1f7df9	350	.type = &nft_ct_type,
96518518	351	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
c4ede3d3	352	.eval = nft_ct_get_eval,
96518518 PM	353	.init = nft_ct_init,
96518518 PM	354	.destroy = nft_ct_destroy,
c4ede3d3	355	.dump = nft_ct_get_dump,
ef1f7df9 PM	356	};
ef1f7df9 PM	357
c4ede3d3 KE	358	static const struct nft_expr_ops nft_ct_set_ops = {
	359	.type = &nft_ct_type,
	360	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	361	.eval = nft_ct_set_eval,
	362	.init = nft_ct_init,
	363	.destroy = nft_ct_destroy,
	364	.dump = nft_ct_set_dump,
	365	};
	366
	367	static const struct nft_expr_ops *
	368	nft_ct_select_ops(const struct nft_ctx *ctx,
	369	const struct nlattr * const tb[])
	370	{
	371	if (tb[NFTA_CT_KEY] == NULL)
	372	return ERR_PTR(-EINVAL);
	373
	374	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
	375	return ERR_PTR(-EINVAL);
	376
	377	if (tb[NFTA_CT_DREG])
	378	return &nft_ct_get_ops;
	379
	380	if (tb[NFTA_CT_SREG])
	381	return &nft_ct_set_ops;
	382
	383	return ERR_PTR(-EINVAL);
	384	}
	385
ef1f7df9 PM	386	static struct nft_expr_type nft_ct_type __read_mostly = {
ef1f7df9 PM	387	.name = "ct",
c4ede3d3	388	.select_ops = &nft_ct_select_ops,
96518518 PM	389	.policy = nft_ct_policy,
96518518 PM	390	.maxattr = NFTA_CT_MAX,
ef1f7df9	391	.owner = THIS_MODULE,
96518518 PM	392	};
	393
	394	static int __init nft_ct_module_init(void)
	395	{
ef1f7df9	396	return nft_register_expr(&nft_ct_type);
96518518 PM	397	}
	398
	399	static void __exit nft_ct_module_exit(void)
	400	{
ef1f7df9	401	nft_unregister_expr(&nft_ct_type);
96518518 PM	402	}
	403
	404	module_init(nft_ct_module_init);
	405	module_exit(nft_ct_module_exit);
	406
	407	MODULE_LICENSE("GPL");
	408	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	409	MODULE_ALIAS_NFT_EXPR("ct");