[mirror_ubuntu-disco-kernel.git] / net / netfilter / xt_CT.c

/*
 * Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/gfp.h>
#include <linux/skbuff.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_CT.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_l4proto.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_timeout.h>
#include <net/netfilter/nf_conntrack_zones.h>

static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
{
	/* Previously seen (loopback)? Ignore. */
	if (skb->_nfct != 0)
		return XT_CONTINUE;

	if (ct) {
		atomic_inc(&ct->ct_general.use);
		nf_ct_set(skb, ct, IP_CT_NEW);
	} else {
		nf_ct_set(skb, ct, IP_CT_UNTRACKED);
	}

	return XT_CONTINUE;
}

static unsigned int xt_ct_target_v0(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	return xt_ct_target(skb, ct);
}

static unsigned int xt_ct_target_v1(struct sk_buff *skb,
				    const struct xt_action_param *par)
{
	const struct xt_ct_target_info_v1 *info = par->targinfo;
	struct nf_conn *ct = info->ct;

	return xt_ct_target(skb, ct);
}

static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
{
	if (par->family == NFPROTO_IPV4) {
		const struct ipt_entry *e = par->entryinfo;

		if (e->ip.invflags & IPT_INV_PROTO)
			return 0;
		return e->ip.proto;
	} else if (par->family == NFPROTO_IPV6) {
		const struct ip6t_entry *e = par->entryinfo;

		if (e->ipv6.invflags & IP6T_INV_PROTO)
			return 0;
		return e->ipv6.proto;
	} else
		return 0;
}

static int
xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
		 const struct xt_tgchk_param *par)
{
	struct nf_conntrack_helper *helper;
	struct nf_conn_help *help;
	u8 proto;

	proto = xt_ct_find_proto(par);
	if (!proto) {
		pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
		return -ENOENT;
	}

	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
						    proto);
	if (helper == NULL) {
		pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
		return -ENOENT;
	}

	help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
	if (help == NULL) {
		nf_conntrack_helper_put(helper);
		return -ENOMEM;
	}

	help->helper = helper;
	return 0;
}

#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
static void __xt_ct_tg_timeout_put(struct nf_ct_timeout *timeout)
{
	typeof(nf_ct_timeout_put_hook) timeout_put;

	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	if (timeout_put)
		timeout_put(timeout);
}
#endif

static int
xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par,
		  const char *timeout_name)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
	const struct nf_conntrack_l4proto *l4proto;
	struct nf_ct_timeout *timeout;
	struct nf_conn_timeout *timeout_ext;
	const char *errmsg = NULL;
	int ret = 0;
	u8 proto;

	rcu_read_lock();
	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
	if (timeout_find_get == NULL) {
		ret = -ENOENT;
		errmsg = "Timeout policy base is empty";
		goto out;
	}

	proto = xt_ct_find_proto(par);
	if (!proto) {
		ret = -EINVAL;
		errmsg = "You must specify a L4 protocol and not use inversions on it";
		goto out;
	}

	timeout = timeout_find_get(par->net, timeout_name);
	if (timeout == NULL) {
		ret = -ENOENT;
		pr_info_ratelimited("No such timeout policy \"%s\"\n",
				    timeout_name);
		goto out;
	}

	if (timeout->l3num != par->family) {
		ret = -EINVAL;
		pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
				    timeout_name, 3, timeout->l3num);
		goto err_put_timeout;
	}
	/* Make sure the timeout policy matches any existing protocol tracker,
	 * otherwise default to generic.
	 */
	l4proto = __nf_ct_l4proto_find(proto);
	if (timeout->l4proto->l4proto != l4proto->l4proto) {
		ret = -EINVAL;
		pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
				    timeout_name, 4, timeout->l4proto->l4proto);
		goto err_put_timeout;
	}
	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
	if (!timeout_ext) {
		ret = -ENOMEM;
		goto err_put_timeout;
	}

	rcu_read_unlock();
	return ret;

err_put_timeout:
	__xt_ct_tg_timeout_put(timeout);
out:
	rcu_read_unlock();
	if (errmsg)
		pr_info_ratelimited("%s\n", errmsg);
	return ret;
#else
	return -EOPNOTSUPP;
#endif
}

static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
{
	switch (info->flags & (XT_CT_ZONE_DIR_ORIG |
			       XT_CT_ZONE_DIR_REPL)) {
	case XT_CT_ZONE_DIR_ORIG:
		return NF_CT_ZONE_DIR_ORIG;
	case XT_CT_ZONE_DIR_REPL:
		return NF_CT_ZONE_DIR_REPL;
	default:
		return NF_CT_DEFAULT_ZONE_DIR;
	}
}

static int xt_ct_tg_check(const struct xt_tgchk_param *par,
			  struct xt_ct_target_info_v1 *info)
{
	struct nf_conntrack_zone zone;
	struct nf_conn_help *help;
	struct nf_conn *ct;
	int ret = -EOPNOTSUPP;

	if (info->flags & XT_CT_NOTRACK) {
		ct = NULL;
		goto out;
	}

#ifndef CONFIG_NF_CONNTRACK_ZONES
	if (info->zone || info->flags & (XT_CT_ZONE_DIR_ORIG |
					 XT_CT_ZONE_DIR_REPL |
					 XT_CT_ZONE_MARK))
		goto err1;
#endif

	ret = nf_ct_netns_get(par->net, par->family);
	if (ret < 0)
		goto err1;

	memset(&zone, 0, sizeof(zone));
	zone.id = info->zone;
	zone.dir = xt_ct_flags_to_dir(info);
	if (info->flags & XT_CT_ZONE_MARK)
		zone.flags |= NF_CT_FLAG_MARK;

	ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
	if (!ct) {
		ret = -ENOMEM;
		goto err2;
	}

	ret = 0;
	if ((info->ct_events || info->exp_events) &&
	    !nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
				  GFP_KERNEL)) {
		ret = -EINVAL;
		goto err3;
	}

	if (info->helper[0]) {
		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
			ret = -ENAMETOOLONG;
			goto err3;
		}

		ret = xt_ct_set_helper(ct, info->helper, par);
		if (ret < 0)
			goto err3;
	}

	if (info->timeout[0]) {
		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
			ret = -ENAMETOOLONG;
			goto err4;
		}

		ret = xt_ct_set_timeout(ct, par, info->timeout);
		if (ret < 0)
			goto err4;
	}
	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
	nf_conntrack_get(&ct->ct_general);
out:
	info->ct = ct;
	return 0;

err4:
	help = nfct_help(ct);
	if (help)
		nf_conntrack_helper_put(help->helper);
err3:
	nf_ct_tmpl_free(ct);
err2:
	nf_ct_netns_put(par->net, par->family);
err1:
	return ret;
}

static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct xt_ct_target_info_v1 info_v1 = {
		.flags 		= info->flags,
		.zone		= info->zone,
		.ct_events	= info->ct_events,
		.exp_events	= info->exp_events,
	};
	int ret;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	memcpy(info_v1.helper, info->helper, sizeof(info->helper));

	ret = xt_ct_tg_check(par, &info_v1);
	if (ret < 0)
		return ret;

	info->ct = info_v1.ct;

	return ret;
}

static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;

	if (info->flags & ~XT_CT_NOTRACK)
		return -EINVAL;

	return xt_ct_tg_check(par, par->targinfo);
}

static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
{
	struct xt_ct_target_info_v1 *info = par->targinfo;

	if (info->flags & ~XT_CT_MASK)
		return -EINVAL;

	return xt_ct_tg_check(par, par->targinfo);
}

static void xt_ct_destroy_timeout(struct nf_conn *ct)
{
#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	struct nf_conn_timeout *timeout_ext;
	typeof(nf_ct_timeout_put_hook) timeout_put;

	rcu_read_lock();
	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);

	if (timeout_put) {
		timeout_ext = nf_ct_timeout_find(ct);
		if (timeout_ext) {
			timeout_put(timeout_ext->timeout);
			RCU_INIT_POINTER(timeout_ext->timeout, NULL);
		}
	}
	rcu_read_unlock();
#endif
}

static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
			     struct xt_ct_target_info_v1 *info)
{
	struct nf_conn *ct = info->ct;
	struct nf_conn_help *help;

	if (ct) {
		help = nfct_help(ct);
		if (help)
			nf_conntrack_helper_put(help->helper);

		nf_ct_netns_put(par->net, par->family);

		xt_ct_destroy_timeout(ct);
		nf_ct_put(info->ct);
	}
}

static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
{
	struct xt_ct_target_info *info = par->targinfo;
	struct xt_ct_target_info_v1 info_v1 = {
		.flags 		= info->flags,
		.zone		= info->zone,
		.ct_events	= info->ct_events,
		.exp_events	= info->exp_events,
		.ct		= info->ct,
	};
	memcpy(info_v1.helper, info->helper, sizeof(info->helper));

	xt_ct_tg_destroy(par, &info_v1);
}

static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
{
	xt_ct_tg_destroy(par, par->targinfo);
}

static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.targetsize	= sizeof(struct xt_ct_target_info),
		.usersize	= offsetof(struct xt_ct_target_info, ct),
		.checkentry	= xt_ct_tg_check_v0,
		.destroy	= xt_ct_tg_destroy_v0,
		.target		= xt_ct_target_v0,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.revision	= 1,
		.targetsize	= sizeof(struct xt_ct_target_info_v1),
		.usersize	= offsetof(struct xt_ct_target_info, ct),
		.checkentry	= xt_ct_tg_check_v1,
		.destroy	= xt_ct_tg_destroy_v1,
		.target		= xt_ct_target_v1,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CT",
		.family		= NFPROTO_UNSPEC,
		.revision	= 2,
		.targetsize	= sizeof(struct xt_ct_target_info_v1),
		.usersize	= offsetof(struct xt_ct_target_info, ct),
		.checkentry	= xt_ct_tg_check_v2,
		.destroy	= xt_ct_tg_destroy_v1,
		.target		= xt_ct_target_v1,
		.table		= "raw",
		.me		= THIS_MODULE,
	},
};

static unsigned int
notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
	/* Previously seen (loopback)? Ignore. */
	if (skb->_nfct != 0)
		return XT_CONTINUE;

	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);

	return XT_CONTINUE;
}

static int notrack_chk(const struct xt_tgchk_param *par)
{
	if (!par->net->xt.notrack_deprecated_warning) {
		pr_info("netfilter: NOTRACK target is deprecated, "
			"use CT instead or upgrade iptables\n");
		par->net->xt.notrack_deprecated_warning = true;
	}
	return 0;
}

static struct xt_target notrack_tg_reg __read_mostly = {
	.name		= "NOTRACK",
	.revision	= 0,
	.family		= NFPROTO_UNSPEC,
	.checkentry	= notrack_chk,
	.target		= notrack_tg,
	.table		= "raw",
	.me		= THIS_MODULE,
};

static int __init xt_ct_tg_init(void)
{
	int ret;

	ret = xt_register_target(&notrack_tg_reg);
	if (ret < 0)
		return ret;

	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	if (ret < 0) {
		xt_unregister_target(&notrack_tg_reg);
		return ret;
	}
	return 0;
}

static void __exit xt_ct_tg_exit(void)
{
	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	xt_unregister_target(&notrack_tg_reg);
}

module_init(xt_ct_tg_init);
module_exit(xt_ct_tg_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Xtables: connection tracking target");
MODULE_ALIAS("ipt_CT");
MODULE_ALIAS("ip6t_CT");
MODULE_ALIAS("ipt_NOTRACK");
MODULE_ALIAS("ip6t_NOTRACK");
Commit	Line	Data
84f3bb9a PM	1	/*
	2	* Copyright (c) 2010 Patrick McHardy <kaber@trash.net>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*/
a7fed762	8	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
84f3bb9a	9	#include <linux/module.h>
5a0e3ad6	10	#include <linux/gfp.h>
84f3bb9a	11	#include <linux/skbuff.h>
84f3bb9a PM	12	#include <linux/netfilter_ipv4/ip_tables.h>
	13	#include <linux/netfilter_ipv6/ip6_tables.h>
	14	#include <linux/netfilter/x_tables.h>
	15	#include <linux/netfilter/xt_CT.h>
	16	#include <net/netfilter/nf_conntrack.h>
eeb4cb95	17	#include <net/netfilter/nf_conntrack_l4proto.h>
84f3bb9a PM	18	#include <net/netfilter/nf_conntrack_helper.h>
84f3bb9a PM	19	#include <net/netfilter/nf_conntrack_ecache.h>
24de58f4	20	#include <net/netfilter/nf_conntrack_timeout.h>
5d0aa2cc	21	#include <net/netfilter/nf_conntrack_zones.h>
84f3bb9a	22
d52ed437	23	static inline int xt_ct_target(struct sk_buff skb, struct nf_conn ct)
84f3bb9a	24	{
84f3bb9a	25	/* Previously seen (loopback)? Ignore. */
a9e419dc	26	if (skb->_nfct != 0)
84f3bb9a PM	27	return XT_CONTINUE;
84f3bb9a PM	28
cc41c84b FW	29	if (ct) {
	30	atomic_inc(&ct->ct_general.use);
	31	nf_ct_set(skb, ct, IP_CT_NEW);
	32	} else {
	33	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
	34	}
84f3bb9a PM	35
	36	return XT_CONTINUE;
	37	}
	38
d52ed437	39	static unsigned int xt_ct_target_v0(struct sk_buff *skb,
24de58f4 PNA	40	const struct xt_action_param *par)
24de58f4 PNA	41	{
d52ed437	42	const struct xt_ct_target_info *info = par->targinfo;
24de58f4 PNA	43	struct nf_conn *ct = info->ct;
24de58f4 PNA	44
d52ed437 PNA	45	return xt_ct_target(skb, ct);
d52ed437 PNA	46	}
24de58f4	47
d52ed437 PNA	48	static unsigned int xt_ct_target_v1(struct sk_buff *skb,
	49	const struct xt_action_param *par)
	50	{
	51	const struct xt_ct_target_info_v1 *info = par->targinfo;
	52	struct nf_conn *ct = info->ct;
24de58f4	53
d52ed437	54	return xt_ct_target(skb, ct);
24de58f4 PNA	55	}
24de58f4 PNA	56
84f3bb9a PM	57	static u8 xt_ct_find_proto(const struct xt_tgchk_param *par)
84f3bb9a PM	58	{
076f7839	59	if (par->family == NFPROTO_IPV4) {
84f3bb9a PM	60	const struct ipt_entry *e = par->entryinfo;
	61
	62	if (e->ip.invflags & IPT_INV_PROTO)
	63	return 0;
	64	return e->ip.proto;
076f7839	65	} else if (par->family == NFPROTO_IPV6) {
84f3bb9a PM	66	const struct ip6t_entry *e = par->entryinfo;
	67
	68	if (e->ipv6.invflags & IP6T_INV_PROTO)
	69	return 0;
	70	return e->ipv6.proto;
	71	} else
	72	return 0;
	73	}
	74
236df005 PNA	75	static int
	76	xt_ct_set_helper(struct nf_conn ct, const char helper_name,
	77	const struct xt_tgchk_param *par)
	78	{
	79	struct nf_conntrack_helper *helper;
	80	struct nf_conn_help *help;
	81	u8 proto;
	82
	83	proto = xt_ct_find_proto(par);
	84	if (!proto) {
11f7aee2	85	pr_info_ratelimited("You must specify a L4 protocol and not use inversions on it\n");
236df005 PNA	86	return -ENOENT;
	87	}
	88
	89	helper = nf_conntrack_helper_try_module_get(helper_name, par->family,
	90	proto);
	91	if (helper == NULL) {
11f7aee2	92	pr_info_ratelimited("No such helper \"%s\"\n", helper_name);
236df005 PNA	93	return -ENOENT;
	94	}
	95
440534d3	96	help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
236df005	97	if (help == NULL) {
d91fc59c	98	nf_conntrack_helper_put(helper);
236df005 PNA	99	return -ENOMEM;
	100	}
	101
	102	help->helper = helper;
	103	return 0;
	104	}
	105
ee14186f	106	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
6c1fd7dc	107	static void __xt_ct_tg_timeout_put(struct nf_ct_timeout *timeout)
ee14186f PNA	108	{
	109	typeof(nf_ct_timeout_put_hook) timeout_put;
	110
	111	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	112	if (timeout_put)
	113	timeout_put(timeout);
	114	}
	115	#endif
	116
236df005 PNA	117	static int
	118	xt_ct_set_timeout(struct nf_conn ct, const struct xt_tgchk_param par,
	119	const char *timeout_name)
	120	{
	121	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	122	typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
b3480fe0	123	const struct nf_conntrack_l4proto *l4proto;
6c1fd7dc	124	struct nf_ct_timeout *timeout;
236df005	125	struct nf_conn_timeout *timeout_ext;
11f7aee2	126	const char *errmsg = NULL;
236df005	127	int ret = 0;
0153d5a8	128	u8 proto;
236df005 PNA	129
	130	rcu_read_lock();
	131	timeout_find_get = rcu_dereference(nf_ct_timeout_find_get_hook);
	132	if (timeout_find_get == NULL) {
	133	ret = -ENOENT;
11f7aee2	134	errmsg = "Timeout policy base is empty";
236df005 PNA	135	goto out;
	136	}
	137
0153d5a8 PNA	138	proto = xt_ct_find_proto(par);
0153d5a8 PNA	139	if (!proto) {
236df005	140	ret = -EINVAL;
11f7aee2	141	errmsg = "You must specify a L4 protocol and not use inversions on it";
236df005 PNA	142	goto out;
	143	}
	144
19576c94	145	timeout = timeout_find_get(par->net, timeout_name);
236df005 PNA	146	if (timeout == NULL) {
236df005 PNA	147	ret = -ENOENT;
11f7aee2 FW	148	pr_info_ratelimited("No such timeout policy \"%s\"\n",
11f7aee2 FW	149	timeout_name);
236df005 PNA	150	goto out;
	151	}
	152
	153	if (timeout->l3num != par->family) {
	154	ret = -EINVAL;
11f7aee2 FW	155	pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
11f7aee2 FW	156	timeout_name, 3, timeout->l3num);
236df005 PNA	157	goto err_put_timeout;
	158	}
	159	/* Make sure the timeout policy matches any existing protocol tracker,
	160	* otherwise default to generic.
	161	*/
dd2934a9	162	l4proto = __nf_ct_l4proto_find(proto);
236df005 PNA	163	if (timeout->l4proto->l4proto != l4proto->l4proto) {
236df005 PNA	164	ret = -EINVAL;
11f7aee2 FW	165	pr_info_ratelimited("Timeout policy `%s' can only be used by L%d protocol number %d\n",
11f7aee2 FW	166	timeout_name, 4, timeout->l4proto->l4proto);
236df005 PNA	167	goto err_put_timeout;
	168	}
	169	timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC);
470acf55	170	if (!timeout_ext) {
236df005	171	ret = -ENOMEM;
470acf55 GF	172	goto err_put_timeout;
470acf55 GF	173	}
236df005	174
403d89ad PNA	175	rcu_read_unlock();
	176	return ret;
	177
236df005 PNA	178	err_put_timeout:
	179	__xt_ct_tg_timeout_put(timeout);
	180	out:
	181	rcu_read_unlock();
11f7aee2 FW	182	if (errmsg)
11f7aee2 FW	183	pr_info_ratelimited("%s\n", errmsg);
236df005 PNA	184	return ret;
	185	#else
	186	return -EOPNOTSUPP;
	187	#endif
	188	}
	189
deedb590 DB	190	static u16 xt_ct_flags_to_dir(const struct xt_ct_target_info_v1 *info)
	191	{
	192	switch (info->flags & (XT_CT_ZONE_DIR_ORIG \|
	193	XT_CT_ZONE_DIR_REPL)) {
	194	case XT_CT_ZONE_DIR_ORIG:
	195	return NF_CT_ZONE_DIR_ORIG;
	196	case XT_CT_ZONE_DIR_REPL:
	197	return NF_CT_ZONE_DIR_REPL;
	198	default:
	199	return NF_CT_DEFAULT_ZONE_DIR;
	200	}
	201	}
	202
d52ed437 PNA	203	static int xt_ct_tg_check(const struct xt_tgchk_param *par,
d52ed437 PNA	204	struct xt_ct_target_info_v1 *info)
24de58f4	205	{
308ac914	206	struct nf_conntrack_zone zone;
470acf55	207	struct nf_conn_help *help;
24de58f4	208	struct nf_conn *ct;
4610476d	209	int ret = -EOPNOTSUPP;
236df005	210
24de58f4	211	if (info->flags & XT_CT_NOTRACK) {
27e7190e	212	ct = NULL;
24de58f4 PNA	213	goto out;
	214	}
	215
	216	#ifndef CONFIG_NF_CONNTRACK_ZONES
deedb590	217	if (info->zone \|\| info->flags & (XT_CT_ZONE_DIR_ORIG \|
5e8018fc DB	218	XT_CT_ZONE_DIR_REPL \|
5e8018fc DB	219	XT_CT_ZONE_MARK))
24de58f4 PNA	220	goto err1;
	221	#endif
	222
ecb2421b	223	ret = nf_ct_netns_get(par->net, par->family);
24de58f4 PNA	224	if (ret < 0)
	225	goto err1;
	226
308ac914 DB	227	memset(&zone, 0, sizeof(zone));
308ac914 DB	228	zone.id = info->zone;
deedb590	229	zone.dir = xt_ct_flags_to_dir(info);
5e8018fc DB	230	if (info->flags & XT_CT_ZONE_MARK)
5e8018fc DB	231	zone.flags \|= NF_CT_FLAG_MARK;
308ac914 DB	232
308ac914 DB	233	ct = nf_ct_tmpl_alloc(par->net, &zone, GFP_KERNEL);
1a727c63 DC	234	if (!ct) {
1a727c63 DC	235	ret = -ENOMEM;
24de58f4	236	goto err2;
1a727c63	237	}
24de58f4 PNA	238
	239	ret = 0;
	240	if ((info->ct_events \|\| info->exp_events) &&
	241	!nf_ct_ecache_ext_add(ct, info->ct_events, info->exp_events,
14abfa16 EL	242	GFP_KERNEL)) {
14abfa16 EL	243	ret = -EINVAL;
24de58f4	244	goto err3;
14abfa16	245	}
24de58f4 PNA	246
24de58f4 PNA	247	if (info->helper[0]) {
8f4d19aa GF	248	if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
	249	ret = -ENAMETOOLONG;
	250	goto err3;
	251	}
	252
236df005 PNA	253	ret = xt_ct_set_helper(ct, info->helper, par);
236df005 PNA	254	if (ret < 0)
1afc5679	255	goto err3;
24de58f4 PNA	256	}
24de58f4 PNA	257
6cf51852	258	if (info->timeout[0]) {
8f4d19aa GF	259	if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
	260	ret = -ENAMETOOLONG;
	261	goto err4;
	262	}
	263
236df005 PNA	264	ret = xt_ct_set_timeout(ct, par, info->timeout);
236df005 PNA	265	if (ret < 0)
470acf55	266	goto err4;
24de58f4	267	}
0838aa7f PNA	268	__set_bit(IPS_CONFIRMED_BIT, &ct->status);
0838aa7f PNA	269	nf_conntrack_get(&ct->ct_general);
24de58f4 PNA	270	out:
	271	info->ct = ct;
	272	return 0;
	273
470acf55 GF	274	err4:
	275	help = nfct_help(ct);
	276	if (help)
d91fc59c	277	nf_conntrack_helper_put(help->helper);
24de58f4	278	err3:
9cf94eab	279	nf_ct_tmpl_free(ct);
24de58f4	280	err2:
ecb2421b	281	nf_ct_netns_put(par->net, par->family);
24de58f4 PNA	282	err1:
	283	return ret;
	284	}
	285
d52ed437	286	static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
84f3bb9a PM	287	{
84f3bb9a PM	288	struct xt_ct_target_info *info = par->targinfo;
d52ed437 PNA	289	struct xt_ct_target_info_v1 info_v1 = {
	290	.flags = info->flags,
	291	.zone = info->zone,
	292	.ct_events = info->ct_events,
	293	.exp_events = info->exp_events,
	294	};
	295	int ret;
84f3bb9a	296
5474f57f PNA	297	if (info->flags & ~XT_CT_NOTRACK)
	298	return -EINVAL;
	299
d52ed437	300	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
84f3bb9a	301
d52ed437 PNA	302	ret = xt_ct_tg_check(par, &info_v1);
	303	if (ret < 0)
	304	return ret;
	305
	306	info->ct = info_v1.ct;
	307
	308	return ret;
	309	}
	310
	311	static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
	312	{
5474f57f PNA	313	struct xt_ct_target_info_v1 *info = par->targinfo;
	314
	315	if (info->flags & ~XT_CT_NOTRACK)
	316	return -EINVAL;
	317
	318	return xt_ct_tg_check(par, par->targinfo);
	319	}
	320
	321	static int xt_ct_tg_check_v2(const struct xt_tgchk_param *par)
	322	{
	323	struct xt_ct_target_info_v1 *info = par->targinfo;
	324
	325	if (info->flags & ~XT_CT_MASK)
	326	return -EINVAL;
	327
d52ed437	328	return xt_ct_tg_check(par, par->targinfo);
84f3bb9a PM	329	}
84f3bb9a PM	330
236df005	331	static void xt_ct_destroy_timeout(struct nf_conn *ct)
24de58f4	332	{
24de58f4 PNA	333	#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
	334	struct nf_conn_timeout *timeout_ext;
	335	typeof(nf_ct_timeout_put_hook) timeout_put;
236df005 PNA	336
	337	rcu_read_lock();
	338	timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
	339
	340	if (timeout_put) {
	341	timeout_ext = nf_ct_timeout_find(ct);
ae2d708e	342	if (timeout_ext) {
236df005	343	timeout_put(timeout_ext->timeout);
ae2d708e PNA	344	RCU_INIT_POINTER(timeout_ext->timeout, NULL);
ae2d708e PNA	345	}
236df005 PNA	346	}
236df005 PNA	347	rcu_read_unlock();
24de58f4	348	#endif
236df005 PNA	349	}
236df005 PNA	350
d52ed437 PNA	351	static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
d52ed437 PNA	352	struct xt_ct_target_info_v1 *info)
236df005	353	{
236df005 PNA	354	struct nf_conn *ct = info->ct;
	355	struct nf_conn_help *help;
	356
cc41c84b	357	if (ct) {
24de58f4 PNA	358	help = nfct_help(ct);
24de58f4 PNA	359	if (help)
d91fc59c	360	nf_conntrack_helper_put(help->helper);
24de58f4	361
ecb2421b	362	nf_ct_netns_put(par->net, par->family);
24de58f4	363
236df005	364	xt_ct_destroy_timeout(ct);
27e7190e	365	nf_ct_put(info->ct);
24de58f4	366	}
d52ed437 PNA	367	}
	368
	369	static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
	370	{
	371	struct xt_ct_target_info *info = par->targinfo;
	372	struct xt_ct_target_info_v1 info_v1 = {
	373	.flags = info->flags,
	374	.zone = info->zone,
	375	.ct_events = info->ct_events,
	376	.exp_events = info->exp_events,
	377	.ct = info->ct,
	378	};
	379	memcpy(info_v1.helper, info->helper, sizeof(info->helper));
	380
	381	xt_ct_tg_destroy(par, &info_v1);
	382	}
	383
	384	static void xt_ct_tg_destroy_v1(const struct xt_tgdtor_param *par)
	385	{
	386	xt_ct_tg_destroy(par, par->targinfo);
24de58f4 PNA	387	}
	388
	389	static struct xt_target xt_ct_tg_reg[] __read_mostly = {
	390	{
	391	.name = "CT",
	392	.family = NFPROTO_UNSPEC,
	393	.targetsize = sizeof(struct xt_ct_target_info),
ec231890	394	.usersize = offsetof(struct xt_ct_target_info, ct),
24de58f4 PNA	395	.checkentry = xt_ct_tg_check_v0,
	396	.destroy = xt_ct_tg_destroy_v0,
	397	.target = xt_ct_target_v0,
	398	.table = "raw",
	399	.me = THIS_MODULE,
	400	},
	401	{
	402	.name = "CT",
	403	.family = NFPROTO_UNSPEC,
	404	.revision = 1,
	405	.targetsize = sizeof(struct xt_ct_target_info_v1),
ec231890	406	.usersize = offsetof(struct xt_ct_target_info, ct),
24de58f4 PNA	407	.checkentry = xt_ct_tg_check_v1,
	408	.destroy = xt_ct_tg_destroy_v1,
	409	.target = xt_ct_target_v1,
	410	.table = "raw",
	411	.me = THIS_MODULE,
	412	},
5474f57f PNA	413	{
	414	.name = "CT",
	415	.family = NFPROTO_UNSPEC,
	416	.revision = 2,
	417	.targetsize = sizeof(struct xt_ct_target_info_v1),
ec231890	418	.usersize = offsetof(struct xt_ct_target_info, ct),
5474f57f PNA	419	.checkentry = xt_ct_tg_check_v2,
	420	.destroy = xt_ct_tg_destroy_v1,
	421	.target = xt_ct_target_v1,
	422	.table = "raw",
	423	.me = THIS_MODULE,
	424	},
84f3bb9a PM	425	};
84f3bb9a PM	426
10db9069 PNA	427	static unsigned int
	428	notrack_tg(struct sk_buff skb, const struct xt_action_param par)
	429	{
	430	/* Previously seen (loopback)? Ignore. */
a9e419dc	431	if (skb->_nfct != 0)
10db9069 PNA	432	return XT_CONTINUE;
10db9069 PNA	433
cc41c84b	434	nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
10db9069 PNA	435
	436	return XT_CONTINUE;
	437	}
	438
	439	static int notrack_chk(const struct xt_tgchk_param *par)
	440	{
	441	if (!par->net->xt.notrack_deprecated_warning) {
	442	pr_info("netfilter: NOTRACK target is deprecated, "
	443	"use CT instead or upgrade iptables\n");
	444	par->net->xt.notrack_deprecated_warning = true;
	445	}
	446	return 0;
	447	}
	448
	449	static struct xt_target notrack_tg_reg __read_mostly = {
	450	.name = "NOTRACK",
	451	.revision = 0,
	452	.family = NFPROTO_UNSPEC,
	453	.checkentry = notrack_chk,
	454	.target = notrack_tg,
	455	.table = "raw",
	456	.me = THIS_MODULE,
	457	};
	458
84f3bb9a PM	459	static int __init xt_ct_tg_init(void)
84f3bb9a PM	460	{
10db9069 PNA	461	int ret;
	462
	463	ret = xt_register_target(&notrack_tg_reg);
	464	if (ret < 0)
	465	return ret;
	466
	467	ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
	468	if (ret < 0) {
	469	xt_unregister_target(&notrack_tg_reg);
	470	return ret;
	471	}
	472	return 0;
84f3bb9a PM	473	}
	474
	475	static void __exit xt_ct_tg_exit(void)
	476	{
24de58f4	477	xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
10db9069	478	xt_unregister_target(&notrack_tg_reg);
84f3bb9a PM	479	}
	480
	481	module_init(xt_ct_tg_init);
	482	module_exit(xt_ct_tg_exit);
	483
	484	MODULE_LICENSE("GPL");
	485	MODULE_DESCRIPTION("Xtables: connection tracking target");
	486	MODULE_ALIAS("ipt_CT");
	487	MODULE_ALIAS("ip6t_CT");
10db9069 PNA	488	MODULE_ALIAS("ipt_NOTRACK");
10db9069 PNA	489	MODULE_ALIAS("ip6t_NOTRACK");