[mirror_ubuntu-bionic-kernel.git] / net / netfilter / nft_ct.c

/*
 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_acct.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_labels.h>

struct nft_ct {
	enum nft_ct_keys	key:8;
	enum ip_conntrack_dir	dir:8;
	union {
		enum nft_registers	dreg:8;
		enum nft_registers	sreg:8;
	};
};

static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
				   enum nft_ct_keys k,
				   enum ip_conntrack_dir d)
{
	if (d < IP_CT_DIR_MAX)
		return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
					   atomic64_read(&c[d].packets);

	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
	       nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
}

static void nft_ct_get_eval(const struct nft_expr *expr,
			    struct nft_regs *regs,
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	u32 *dest = &regs->data[priv->dreg];
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	const struct nf_conn_help *help;
	const struct nf_conntrack_tuple *tuple;
	const struct nf_conntrack_helper *helper;
	unsigned int state;

	ct = nf_ct_get(pkt->skb, &ctinfo);

	switch (priv->key) {
	case NFT_CT_STATE:
		if (ct == NULL)
			state = NF_CT_STATE_INVALID_BIT;
		else if (nf_ct_is_untracked(ct))
			state = NF_CT_STATE_UNTRACKED_BIT;
		else
			state = NF_CT_STATE_BIT(ctinfo);
		*dest = state;
		return;
	default:
		break;
	}

	if (ct == NULL)
		goto err;

	switch (priv->key) {
	case NFT_CT_DIRECTION:
		*dest = CTINFO2DIR(ctinfo);
		return;
	case NFT_CT_STATUS:
		*dest = ct->status;
		return;
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		*dest = ct->mark;
		return;
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
		*dest = ct->secmark;
		return;
#endif
	case NFT_CT_EXPIRATION:
		*dest = jiffies_to_msecs(nf_ct_expires(ct));
		return;
	case NFT_CT_HELPER:
		if (ct->master == NULL)
			goto err;
		help = nfct_help(ct->master);
		if (help == NULL)
			goto err;
		helper = rcu_dereference(help->helper);
		if (helper == NULL)
			goto err;
		strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
		return;
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS: {
		struct nf_conn_labels *labels = nf_ct_labels_find(ct);

		if (labels)
			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
		else
			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
		return;
	}
#endif
	case NFT_CT_BYTES: /* fallthrough */
	case NFT_CT_PKTS: {
		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
		u64 count = 0;

		if (acct)
			count = nft_ct_get_eval_counter(acct->counter,
							priv->key, priv->dir);
		memcpy(dest, &count, sizeof(count));
		return;
	}
	case NFT_CT_L3PROTOCOL:
		*dest = nf_ct_l3num(ct);
		return;
	case NFT_CT_PROTOCOL:
		*dest = nf_ct_protonum(ct);
		return;
	default:
		break;
	}

	tuple = &ct->tuplehash[priv->dir].tuple;
	switch (priv->key) {
	case NFT_CT_SRC:
		memcpy(dest, tuple->src.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_DST:
		memcpy(dest, tuple->dst.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_PROTO_SRC:
		*dest = (__force __u16)tuple->src.u.all;
		return;
	case NFT_CT_PROTO_DST:
		*dest = (__force __u16)tuple->dst.u.all;
		return;
	default:
		break;
	}
	return;
err:
	regs->verdict.code = NFT_BREAK;
}

static void nft_ct_set_eval(const struct nft_expr *expr,
			    struct nft_regs *regs,
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	struct sk_buff *skb = pkt->skb;
#ifdef CONFIG_NF_CONNTRACK_MARK
	u32 value = regs->data[priv->sreg];
#endif
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;

	switch (priv->key) {
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		if (ct->mark != value) {
			ct->mark = value;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
#endif
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS:
		nf_connlabels_replace(ct,
				      &regs->data[priv->sreg],
				      &regs->data[priv->sreg],
				      NF_CT_LABELS_MAX_SIZE / sizeof(u32));
		break;
#endif
	default:
		break;
	}
}

static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	[NFTA_CT_DREG]		= { .type = NLA_U32 },
	[NFTA_CT_KEY]		= { .type = NLA_U32 },
	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
	[NFTA_CT_SREG]		= { .type = NLA_U32 },
};

static int nft_ct_l3proto_try_module_get(uint8_t family)
{
	int err;

	if (family == NFPROTO_INET) {
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
		if (err < 0)
			goto err1;
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
		if (err < 0)
			goto err2;
	} else {
		err = nf_ct_l3proto_try_module_get(family);
		if (err < 0)
			goto err1;
	}
	return 0;

err2:
	nf_ct_l3proto_module_put(NFPROTO_IPV4);
err1:
	return err;
}

static void nft_ct_l3proto_module_put(uint8_t family)
{
	if (family == NFPROTO_INET) {
		nf_ct_l3proto_module_put(NFPROTO_IPV4);
		nf_ct_l3proto_module_put(NFPROTO_IPV6);
	} else
		nf_ct_l3proto_module_put(family);
}

static int nft_ct_get_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);
	unsigned int len;
	int err;

	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	switch (priv->key) {
	case NFT_CT_DIRECTION:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = sizeof(u8);
		break;
	case NFT_CT_STATE:
	case NFT_CT_STATUS:
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
#endif
	case NFT_CT_EXPIRATION:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = sizeof(u32);
		break;
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = NF_CT_LABELS_MAX_SIZE;
		break;
#endif
	case NFT_CT_HELPER:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = NF_CT_HELPER_NAME_LEN;
		break;

	case NFT_CT_L3PROTOCOL:
	case NFT_CT_PROTOCOL:
		/* For compatibility, do not report error if NFTA_CT_DIRECTION
		 * attribute is specified.
		 */
		len = sizeof(u8);
		break;
	case NFT_CT_SRC:
	case NFT_CT_DST:
		if (tb[NFTA_CT_DIRECTION] == NULL)
			return -EINVAL;

		switch (ctx->afi->family) {
		case NFPROTO_IPV4:
			len = FIELD_SIZEOF(struct nf_conntrack_tuple,
					   src.u3.ip);
			break;
		case NFPROTO_IPV6:
		case NFPROTO_INET:
			len = FIELD_SIZEOF(struct nf_conntrack_tuple,
					   src.u3.ip6);
			break;
		default:
			return -EAFNOSUPPORT;
		}
		break;
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (tb[NFTA_CT_DIRECTION] == NULL)
			return -EINVAL;
		len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
		break;
	case NFT_CT_BYTES:
	case NFT_CT_PKTS:
		/* no direction? return sum of original + reply */
		if (tb[NFTA_CT_DIRECTION] == NULL)
			priv->dir = IP_CT_DIR_MAX;
		len = sizeof(u64);
		break;
	default:
		return -EOPNOTSUPP;
	}

	if (tb[NFTA_CT_DIRECTION] != NULL) {
		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
		switch (priv->dir) {
		case IP_CT_DIR_ORIGINAL:
		case IP_CT_DIR_REPLY:
			break;
		default:
			return -EINVAL;
		}
	}

	priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
	err = nft_validate_register_store(ctx, priv->dreg, NULL,
					  NFT_DATA_VALUE, len);
	if (err < 0)
		return err;

	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	if (err < 0)
		return err;

	if (priv->key == NFT_CT_BYTES || priv->key == NFT_CT_PKTS)
		nf_ct_set_acct(ctx->net, true);

	return 0;
}

static int nft_ct_set_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);
	bool label_got = false;
	unsigned int len;
	int err;

	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	switch (priv->key) {
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		if (tb[NFTA_CT_DIRECTION])
			return -EINVAL;
		len = FIELD_SIZEOF(struct nf_conn, mark);
		break;
#endif
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS:
		if (tb[NFTA_CT_DIRECTION])
			return -EINVAL;
		len = NF_CT_LABELS_MAX_SIZE;
		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
		if (err)
			return err;
		label_got = true;
		break;
#endif
	default:
		return -EOPNOTSUPP;
	}

	priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
	err = nft_validate_register_load(priv->sreg, len);
	if (err < 0)
		goto err1;

	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	if (err < 0)
		goto err1;

	return 0;

err1:
	if (label_got)
		nf_connlabels_put(ctx->net);
	return err;
}

static void nft_ct_get_destroy(const struct nft_ctx *ctx,
			       const struct nft_expr *expr)
{
	nft_ct_l3proto_module_put(ctx->afi->family);
}

static void nft_ct_set_destroy(const struct nft_ctx *ctx,
			       const struct nft_expr *expr)
{
	struct nft_ct *priv = nft_expr_priv(expr);

	switch (priv->key) {
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS:
		nf_connlabels_put(ctx->net);
		break;
#endif
	default:
		break;
	}

	nft_ct_l3proto_module_put(ctx->afi->family);
}

static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;

	switch (priv->key) {
	case NFT_CT_SRC:
	case NFT_CT_DST:
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
			goto nla_put_failure;
		break;
	case NFT_CT_BYTES:
	case NFT_CT_PKTS:
		if (priv->dir < IP_CT_DIR_MAX &&
		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
			goto nla_put_failure;
		break;
	default:
		break;
	}

	return 0;

nla_put_failure:
	return -1;
}

static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_ct_type;
static const struct nft_expr_ops nft_ct_get_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_get_eval,
	.init		= nft_ct_get_init,
	.destroy	= nft_ct_get_destroy,
	.dump		= nft_ct_get_dump,
};

static const struct nft_expr_ops nft_ct_set_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_set_eval,
	.init		= nft_ct_set_init,
	.destroy	= nft_ct_set_destroy,
	.dump		= nft_ct_set_dump,
};

static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx *ctx,
		    const struct nlattr * const tb[])
{
	if (tb[NFTA_CT_KEY] == NULL)
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG])
		return &nft_ct_get_ops;

	if (tb[NFTA_CT_SREG])
		return &nft_ct_set_ops;

	return ERR_PTR(-EINVAL);
}

static struct nft_expr_type nft_ct_type __read_mostly = {
	.name		= "ct",
	.select_ops	= &nft_ct_select_ops,
	.policy		= nft_ct_policy,
	.maxattr	= NFTA_CT_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_ct_module_init(void)
{
	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);

	return nft_register_expr(&nft_ct_type);
}

static void __exit nft_ct_module_exit(void)
{
	nft_unregister_expr(&nft_ct_type);
}

module_init(nft_ct_module_init);
module_exit(nft_ct_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_EXPR("ct");
Commit	Line	Data
96518518	1	/*
ef1f7df9	2	* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
96518518 PM	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/init.h>
	13	#include <linux/module.h>
	14	#include <linux/netlink.h>
	15	#include <linux/netfilter.h>
	16	#include <linux/netfilter/nf_tables.h>
	17	#include <net/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_conntrack.h>
48f66c90	19	#include <net/netfilter/nf_conntrack_acct.h>
96518518 PM	20	#include <net/netfilter/nf_conntrack_tuple.h>
96518518 PM	21	#include <net/netfilter/nf_conntrack_helper.h>
c4ede3d3	22	#include <net/netfilter/nf_conntrack_ecache.h>
d2bf2f34	23	#include <net/netfilter/nf_conntrack_labels.h>
96518518 PM	24
	25	struct nft_ct {
	26	enum nft_ct_keys key:8;
	27	enum ip_conntrack_dir dir:8;
d46f2cd2	28	union {
c4ede3d3 KE	29	enum nft_registers dreg:8;
	30	enum nft_registers sreg:8;
	31	};
96518518 PM	32	};
96518518 PM	33
48f66c90 FW	34	static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
	35	enum nft_ct_keys k,
	36	enum ip_conntrack_dir d)
	37	{
	38	if (d < IP_CT_DIR_MAX)
	39	return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
	40	atomic64_read(&c[d].packets);
	41
	42	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
	43	nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
	44	}
	45
c4ede3d3	46	static void nft_ct_get_eval(const struct nft_expr *expr,
a55e22e9	47	struct nft_regs *regs,
c4ede3d3	48	const struct nft_pktinfo *pkt)
96518518 PM	49	{
96518518 PM	50	const struct nft_ct *priv = nft_expr_priv(expr);
49499c3e	51	u32 *dest = &regs->data[priv->dreg];
96518518 PM	52	enum ip_conntrack_info ctinfo;
	53	const struct nf_conn *ct;
	54	const struct nf_conn_help *help;
	55	const struct nf_conntrack_tuple *tuple;
	56	const struct nf_conntrack_helper *helper;
96518518 PM	57	unsigned int state;
	58
	59	ct = nf_ct_get(pkt->skb, &ctinfo);
	60
	61	switch (priv->key) {
	62	case NFT_CT_STATE:
	63	if (ct == NULL)
	64	state = NF_CT_STATE_INVALID_BIT;
	65	else if (nf_ct_is_untracked(ct))
	66	state = NF_CT_STATE_UNTRACKED_BIT;
	67	else
	68	state = NF_CT_STATE_BIT(ctinfo);
fad136ea	69	*dest = state;
96518518	70	return;
c1f86676 DM	71	default:
c1f86676 DM	72	break;
96518518 PM	73	}
	74
	75	if (ct == NULL)
	76	goto err;
	77
	78	switch (priv->key) {
	79	case NFT_CT_DIRECTION:
fad136ea	80	*dest = CTINFO2DIR(ctinfo);
96518518 PM	81	return;
96518518 PM	82	case NFT_CT_STATUS:
fad136ea	83	*dest = ct->status;
96518518 PM	84	return;
	85	#ifdef CONFIG_NF_CONNTRACK_MARK
	86	case NFT_CT_MARK:
fad136ea	87	*dest = ct->mark;
96518518 PM	88	return;
	89	#endif
	90	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	91	case NFT_CT_SECMARK:
fad136ea	92	*dest = ct->secmark;
96518518 PM	93	return;
	94	#endif
	95	case NFT_CT_EXPIRATION:
c8607e02	96	*dest = jiffies_to_msecs(nf_ct_expires(ct));
96518518 PM	97	return;
	98	case NFT_CT_HELPER:
	99	if (ct->master == NULL)
	100	goto err;
	101	help = nfct_help(ct->master);
	102	if (help == NULL)
	103	goto err;
	104	helper = rcu_dereference(help->helper);
	105	if (helper == NULL)
	106	goto err;
fad136ea	107	strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
96518518	108	return;
d2bf2f34 FW	109	#ifdef CONFIG_NF_CONNTRACK_LABELS
	110	case NFT_CT_LABELS: {
	111	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
d2bf2f34	112
23014011 FW	113	if (labels)
	114	memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
	115	else
fad136ea	116	memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
d2bf2f34 FW	117	return;
d2bf2f34 FW	118	}
efaea94a	119	#endif
48f66c90 FW	120	case NFT_CT_BYTES: /* fallthrough */
	121	case NFT_CT_PKTS: {
	122	const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
	123	u64 count = 0;
	124
	125	if (acct)
	126	count = nft_ct_get_eval_counter(acct->counter,
	127	priv->key, priv->dir);
	128	memcpy(dest, &count, sizeof(count));
	129	return;
	130	}
d767ff2c LZ	131	case NFT_CT_L3PROTOCOL:
	132	*dest = nf_ct_l3num(ct);
	133	return;
	134	case NFT_CT_PROTOCOL:
	135	*dest = nf_ct_protonum(ct);
	136	return;
c1f86676 DM	137	default:
c1f86676 DM	138	break;
96518518 PM	139	}
	140
	141	tuple = &ct->tuplehash[priv->dir].tuple;
	142	switch (priv->key) {
96518518	143	case NFT_CT_SRC:
fad136ea	144	memcpy(dest, tuple->src.u3.all,
96518518 PM	145	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
	146	return;
	147	case NFT_CT_DST:
fad136ea	148	memcpy(dest, tuple->dst.u3.all,
96518518 PM	149	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
96518518 PM	150	return;
96518518	151	case NFT_CT_PROTO_SRC:
fad136ea	152	*dest = (__force __u16)tuple->src.u.all;
96518518 PM	153	return;
96518518 PM	154	case NFT_CT_PROTO_DST:
fad136ea	155	*dest = (__force __u16)tuple->dst.u.all;
96518518	156	return;
c1f86676 DM	157	default:
c1f86676 DM	158	break;
96518518 PM	159	}
	160	return;
	161	err:
a55e22e9	162	regs->verdict.code = NFT_BREAK;
96518518 PM	163	}
96518518 PM	164
c4ede3d3	165	static void nft_ct_set_eval(const struct nft_expr *expr,
a55e22e9	166	struct nft_regs *regs,
c4ede3d3 KE	167	const struct nft_pktinfo *pkt)
	168	{
	169	const struct nft_ct *priv = nft_expr_priv(expr);
	170	struct sk_buff *skb = pkt->skb;
847c8e29	171	#ifdef CONFIG_NF_CONNTRACK_MARK
49499c3e	172	u32 value = regs->data[priv->sreg];
847c8e29	173	#endif
c4ede3d3 KE	174	enum ip_conntrack_info ctinfo;
	175	struct nf_conn *ct;
	176
	177	ct = nf_ct_get(skb, &ctinfo);
	178	if (ct == NULL)
	179	return;
	180
	181	switch (priv->key) {
	182	#ifdef CONFIG_NF_CONNTRACK_MARK
	183	case NFT_CT_MARK:
	184	if (ct->mark != value) {
	185	ct->mark = value;
	186	nf_conntrack_event_cache(IPCT_MARK, ct);
	187	}
	188	break;
1ad8f48d FW	189	#endif
	190	#ifdef CONFIG_NF_CONNTRACK_LABELS
	191	case NFT_CT_LABELS:
	192	nf_connlabels_replace(ct,
	193	&regs->data[priv->sreg],
	194	&regs->data[priv->sreg],
	195	NF_CT_LABELS_MAX_SIZE / sizeof(u32));
	196	break;
c4ede3d3	197	#endif
c1f86676 DM	198	default:
c1f86676 DM	199	break;
c4ede3d3 KE	200	}
	201	}
	202
96518518 PM	203	static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	204	[NFTA_CT_DREG] = { .type = NLA_U32 },
	205	[NFTA_CT_KEY] = { .type = NLA_U32 },
	206	[NFTA_CT_DIRECTION] = { .type = NLA_U8 },
c4ede3d3	207	[NFTA_CT_SREG] = { .type = NLA_U32 },
96518518 PM	208	};
96518518 PM	209
9638f33e PM	210	static int nft_ct_l3proto_try_module_get(uint8_t family)
	211	{
	212	int err;
	213
	214	if (family == NFPROTO_INET) {
	215	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
	216	if (err < 0)
	217	goto err1;
	218	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
	219	if (err < 0)
	220	goto err2;
	221	} else {
	222	err = nf_ct_l3proto_try_module_get(family);
	223	if (err < 0)
	224	goto err1;
	225	}
	226	return 0;
	227
	228	err2:
	229	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	230	err1:
	231	return err;
	232	}
	233
	234	static void nft_ct_l3proto_module_put(uint8_t family)
	235	{
	236	if (family == NFPROTO_INET) {
	237	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	238	nf_ct_l3proto_module_put(NFPROTO_IPV6);
	239	} else
	240	nf_ct_l3proto_module_put(family);
	241	}
	242
fe92ca45 PM	243	static int nft_ct_get_init(const struct nft_ctx *ctx,
	244	const struct nft_expr *expr,
	245	const struct nlattr * const tb[])
96518518 PM	246	{
96518518 PM	247	struct nft_ct *priv = nft_expr_priv(expr);
45d9bcda	248	unsigned int len;
fe92ca45	249	int err;
96518518	250
fe92ca45	251	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
96518518	252	switch (priv->key) {
96518518	253	case NFT_CT_DIRECTION:
45d9bcda PM	254	if (tb[NFTA_CT_DIRECTION] != NULL)
	255	return -EINVAL;
	256	len = sizeof(u8);
	257	break;
	258	case NFT_CT_STATE:
96518518 PM	259	case NFT_CT_STATUS:
	260	#ifdef CONFIG_NF_CONNTRACK_MARK
	261	case NFT_CT_MARK:
	262	#endif
	263	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	264	case NFT_CT_SECMARK:
d2bf2f34	265	#endif
45d9bcda PM	266	case NFT_CT_EXPIRATION:
	267	if (tb[NFTA_CT_DIRECTION] != NULL)
	268	return -EINVAL;
	269	len = sizeof(u32);
	270	break;
d2bf2f34 FW	271	#ifdef CONFIG_NF_CONNTRACK_LABELS
d2bf2f34 FW	272	case NFT_CT_LABELS:
45d9bcda PM	273	if (tb[NFTA_CT_DIRECTION] != NULL)
	274	return -EINVAL;
	275	len = NF_CT_LABELS_MAX_SIZE;
	276	break;
96518518	277	#endif
96518518 PM	278	case NFT_CT_HELPER:
	279	if (tb[NFTA_CT_DIRECTION] != NULL)
	280	return -EINVAL;
45d9bcda	281	len = NF_CT_HELPER_NAME_LEN;
96518518	282	break;
45d9bcda	283
51292c07	284	case NFT_CT_L3PROTOCOL:
96518518	285	case NFT_CT_PROTOCOL:
d767ff2c LZ	286	/* For compatibility, do not report error if NFTA_CT_DIRECTION
	287	* attribute is specified.
	288	*/
45d9bcda PM	289	len = sizeof(u8);
45d9bcda PM	290	break;
96518518 PM	291	case NFT_CT_SRC:
96518518 PM	292	case NFT_CT_DST:
45d9bcda PM	293	if (tb[NFTA_CT_DIRECTION] == NULL)
	294	return -EINVAL;
	295
	296	switch (ctx->afi->family) {
	297	case NFPROTO_IPV4:
	298	len = FIELD_SIZEOF(struct nf_conntrack_tuple,
	299	src.u3.ip);
	300	break;
	301	case NFPROTO_IPV6:
	302	case NFPROTO_INET:
	303	len = FIELD_SIZEOF(struct nf_conntrack_tuple,
	304	src.u3.ip6);
	305	break;
	306	default:
	307	return -EAFNOSUPPORT;
	308	}
	309	break;
96518518 PM	310	case NFT_CT_PROTO_SRC:
	311	case NFT_CT_PROTO_DST:
	312	if (tb[NFTA_CT_DIRECTION] == NULL)
	313	return -EINVAL;
45d9bcda	314	len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
96518518	315	break;
48f66c90 FW	316	case NFT_CT_BYTES:
	317	case NFT_CT_PKTS:
	318	/* no direction? return sum of original + reply */
	319	if (tb[NFTA_CT_DIRECTION] == NULL)
	320	priv->dir = IP_CT_DIR_MAX;
	321	len = sizeof(u64);
	322	break;
96518518 PM	323	default:
	324	return -EOPNOTSUPP;
	325	}
	326
fe92ca45 PM	327	if (tb[NFTA_CT_DIRECTION] != NULL) {
	328	priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
	329	switch (priv->dir) {
	330	case IP_CT_DIR_ORIGINAL:
	331	case IP_CT_DIR_REPLY:
	332	break;
	333	default:
	334	return -EINVAL;
	335	}
	336	}
	337
b1c96ed3	338	priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
1ec10212 PM	339	err = nft_validate_register_store(ctx, priv->dreg, NULL,
1ec10212 PM	340	NFT_DATA_VALUE, len);
fe92ca45 PM	341	if (err < 0)
	342	return err;
	343
	344	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	345	if (err < 0)
	346	return err;
	347
3f8b61b7 LZ	348	if (priv->key == NFT_CT_BYTES \|\| priv->key == NFT_CT_PKTS)
	349	nf_ct_set_acct(ctx->net, true);
	350
c4ede3d3 KE	351	return 0;
	352	}
	353
fe92ca45 PM	354	static int nft_ct_set_init(const struct nft_ctx *ctx,
	355	const struct nft_expr *expr,
	356	const struct nlattr * const tb[])
c4ede3d3	357	{
fe92ca45	358	struct nft_ct *priv = nft_expr_priv(expr);
590025a2	359	bool label_got = false;
d07db988	360	unsigned int len;
fe92ca45 PM	361	int err;
	362
	363	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	364	switch (priv->key) {
e88e514e	365	#ifdef CONFIG_NF_CONNTRACK_MARK
c4ede3d3	366	case NFT_CT_MARK:
7bfdde70 LZ	367	if (tb[NFTA_CT_DIRECTION])
7bfdde70 LZ	368	return -EINVAL;
d07db988	369	len = FIELD_SIZEOF(struct nf_conn, mark);
c4ede3d3	370	break;
1ad8f48d FW	371	#endif
	372	#ifdef CONFIG_NF_CONNTRACK_LABELS
	373	case NFT_CT_LABELS:
	374	if (tb[NFTA_CT_DIRECTION])
	375	return -EINVAL;
	376	len = NF_CT_LABELS_MAX_SIZE;
	377	err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
	378	if (err)
	379	return err;
590025a2	380	label_got = true;
1ad8f48d	381	break;
e88e514e	382	#endif
c4ede3d3 KE	383	default:
	384	return -EOPNOTSUPP;
	385	}
	386
b1c96ed3	387	priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
d07db988	388	err = nft_validate_register_load(priv->sreg, len);
fe92ca45	389	if (err < 0)
590025a2	390	goto err1;
c4ede3d3	391
9638f33e	392	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
96518518	393	if (err < 0)
590025a2	394	goto err1;
96518518	395
96518518	396	return 0;
590025a2 LZ	397
	398	err1:
	399	if (label_got)
	400	nf_connlabels_put(ctx->net);
	401	return err;
	402	}
	403
	404	static void nft_ct_get_destroy(const struct nft_ctx *ctx,
	405	const struct nft_expr *expr)
	406	{
	407	nft_ct_l3proto_module_put(ctx->afi->family);
96518518 PM	408	}
96518518 PM	409
590025a2 LZ	410	static void nft_ct_set_destroy(const struct nft_ctx *ctx,
590025a2 LZ	411	const struct nft_expr *expr)
96518518	412	{
1ad8f48d FW	413	struct nft_ct *priv = nft_expr_priv(expr);
	414
	415	switch (priv->key) {
	416	#ifdef CONFIG_NF_CONNTRACK_LABELS
	417	case NFT_CT_LABELS:
	418	nf_connlabels_put(ctx->net);
	419	break;
	420	#endif
	421	default:
	422	break;
	423	}
	424
d46f2cd2	425	nft_ct_l3proto_module_put(ctx->afi->family);
96518518 PM	426	}
96518518 PM	427
c4ede3d3	428	static int nft_ct_get_dump(struct sk_buff skb, const struct nft_expr expr)
96518518 PM	429	{
	430	const struct nft_ct *priv = nft_expr_priv(expr);
	431
b1c96ed3	432	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
96518518 PM	433	goto nla_put_failure;
	434	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	435	goto nla_put_failure;
2a53bfb3 AB	436
2a53bfb3 AB	437	switch (priv->key) {
2a53bfb3 AB	438	case NFT_CT_SRC:
	439	case NFT_CT_DST:
	440	case NFT_CT_PROTO_SRC:
	441	case NFT_CT_PROTO_DST:
	442	if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
	443	goto nla_put_failure;
48f66c90 FW	444	break;
	445	case NFT_CT_BYTES:
	446	case NFT_CT_PKTS:
	447	if (priv->dir < IP_CT_DIR_MAX &&
	448	nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
	449	goto nla_put_failure;
	450	break;
2a53bfb3 AB	451	default:
	452	break;
	453	}
	454
96518518 PM	455	return 0;
	456
	457	nla_put_failure:
	458	return -1;
	459	}
	460
c4ede3d3 KE	461	static int nft_ct_set_dump(struct sk_buff skb, const struct nft_expr expr)
	462	{
	463	const struct nft_ct *priv = nft_expr_priv(expr);
	464
b1c96ed3	465	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
c4ede3d3 KE	466	goto nla_put_failure;
	467	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	468	goto nla_put_failure;
	469	return 0;
	470
	471	nla_put_failure:
	472	return -1;
	473	}
	474
ef1f7df9	475	static struct nft_expr_type nft_ct_type;
c4ede3d3	476	static const struct nft_expr_ops nft_ct_get_ops = {
ef1f7df9	477	.type = &nft_ct_type,
96518518	478	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
c4ede3d3	479	.eval = nft_ct_get_eval,
fe92ca45	480	.init = nft_ct_get_init,
590025a2	481	.destroy = nft_ct_get_destroy,
c4ede3d3	482	.dump = nft_ct_get_dump,
ef1f7df9 PM	483	};
ef1f7df9 PM	484
c4ede3d3 KE	485	static const struct nft_expr_ops nft_ct_set_ops = {
	486	.type = &nft_ct_type,
	487	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	488	.eval = nft_ct_set_eval,
fe92ca45	489	.init = nft_ct_set_init,
590025a2	490	.destroy = nft_ct_set_destroy,
c4ede3d3 KE	491	.dump = nft_ct_set_dump,
	492	};
	493
	494	static const struct nft_expr_ops *
	495	nft_ct_select_ops(const struct nft_ctx *ctx,
	496	const struct nlattr * const tb[])
	497	{
	498	if (tb[NFTA_CT_KEY] == NULL)
	499	return ERR_PTR(-EINVAL);
	500
	501	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
	502	return ERR_PTR(-EINVAL);
	503
	504	if (tb[NFTA_CT_DREG])
	505	return &nft_ct_get_ops;
	506
	507	if (tb[NFTA_CT_SREG])
	508	return &nft_ct_set_ops;
	509
	510	return ERR_PTR(-EINVAL);
	511	}
	512
ef1f7df9 PM	513	static struct nft_expr_type nft_ct_type __read_mostly = {
ef1f7df9 PM	514	.name = "ct",
c4ede3d3	515	.select_ops = &nft_ct_select_ops,
96518518 PM	516	.policy = nft_ct_policy,
96518518 PM	517	.maxattr = NFTA_CT_MAX,
ef1f7df9	518	.owner = THIS_MODULE,
96518518 PM	519	};
	520
	521	static int __init nft_ct_module_init(void)
	522	{
adff6c65 FW	523	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
adff6c65 FW	524
ef1f7df9	525	return nft_register_expr(&nft_ct_type);
96518518 PM	526	}
	527
	528	static void __exit nft_ct_module_exit(void)
	529	{
ef1f7df9	530	nft_unregister_expr(&nft_ct_type);
96518518 PM	531	}
	532
	533	module_init(nft_ct_module_init);
	534	module_exit(nft_ct_module_exit);
	535
	536	MODULE_LICENSE("GPL");
	537	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	538	MODULE_ALIAS_NFT_EXPR("ct");