2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_conntrack.h>
20 #include <net/netfilter/nf_conntrack_acct.h>
21 #include <net/netfilter/nf_conntrack_tuple.h>
22 #include <net/netfilter/nf_conntrack_helper.h>
23 #include <net/netfilter/nf_conntrack_ecache.h>
24 #include <net/netfilter/nf_conntrack_labels.h>
27 enum nft_ct_keys key
:8;
28 enum ip_conntrack_dir dir
:8;
30 enum nft_registers dreg
:8;
31 enum nft_registers sreg
:8;
35 static u64
nft_ct_get_eval_counter(const struct nf_conn_counter
*c
,
37 enum ip_conntrack_dir d
)
39 if (d
< IP_CT_DIR_MAX
)
40 return k
== NFT_CT_BYTES
? atomic64_read(&c
[d
].bytes
) :
41 atomic64_read(&c
[d
].packets
);
43 return nft_ct_get_eval_counter(c
, k
, IP_CT_DIR_ORIGINAL
) +
44 nft_ct_get_eval_counter(c
, k
, IP_CT_DIR_REPLY
);
47 static void nft_ct_get_eval(const struct nft_expr
*expr
,
48 struct nft_regs
*regs
,
49 const struct nft_pktinfo
*pkt
)
51 const struct nft_ct
*priv
= nft_expr_priv(expr
);
52 u32
*dest
= ®s
->data
[priv
->dreg
];
53 enum ip_conntrack_info ctinfo
;
54 const struct nf_conn
*ct
;
55 const struct nf_conn_help
*help
;
56 const struct nf_conntrack_tuple
*tuple
;
57 const struct nf_conntrack_helper
*helper
;
60 ct
= nf_ct_get(pkt
->skb
, &ctinfo
);
65 state
= NF_CT_STATE_INVALID_BIT
;
66 else if (nf_ct_is_untracked(ct
))
67 state
= NF_CT_STATE_UNTRACKED_BIT
;
69 state
= NF_CT_STATE_BIT(ctinfo
);
80 case NFT_CT_DIRECTION
:
81 *dest
= CTINFO2DIR(ctinfo
);
86 #ifdef CONFIG_NF_CONNTRACK_MARK
91 #ifdef CONFIG_NF_CONNTRACK_SECMARK
96 case NFT_CT_EXPIRATION
:
97 *dest
= jiffies_to_msecs(nf_ct_expires(ct
));
100 if (ct
->master
== NULL
)
102 help
= nfct_help(ct
->master
);
105 helper
= rcu_dereference(help
->helper
);
108 strncpy((char *)dest
, helper
->name
, NF_CT_HELPER_NAME_LEN
);
110 #ifdef CONFIG_NF_CONNTRACK_LABELS
111 case NFT_CT_LABELS
: {
112 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
115 memcpy(dest
, labels
->bits
, NF_CT_LABELS_MAX_SIZE
);
117 memset(dest
, 0, NF_CT_LABELS_MAX_SIZE
);
121 case NFT_CT_BYTES
: /* fallthrough */
123 const struct nf_conn_acct
*acct
= nf_conn_acct_find(ct
);
127 count
= nft_ct_get_eval_counter(acct
->counter
,
128 priv
->key
, priv
->dir
);
129 memcpy(dest
, &count
, sizeof(count
));
132 case NFT_CT_AVGPKT
: {
133 const struct nf_conn_acct
*acct
= nf_conn_acct_find(ct
);
134 u64 avgcnt
= 0, bcnt
= 0, pcnt
= 0;
137 pcnt
= nft_ct_get_eval_counter(acct
->counter
,
138 NFT_CT_PKTS
, priv
->dir
);
139 bcnt
= nft_ct_get_eval_counter(acct
->counter
,
140 NFT_CT_BYTES
, priv
->dir
);
142 avgcnt
= div64_u64(bcnt
, pcnt
);
145 memcpy(dest
, &avgcnt
, sizeof(avgcnt
));
148 case NFT_CT_L3PROTOCOL
:
149 *dest
= nf_ct_l3num(ct
);
151 case NFT_CT_PROTOCOL
:
152 *dest
= nf_ct_protonum(ct
);
154 #ifdef CONFIG_NF_CONNTRACK_ZONES
156 const struct nf_conntrack_zone
*zone
= nf_ct_zone(ct
);
158 if (priv
->dir
< IP_CT_DIR_MAX
)
159 *dest
= nf_ct_zone_id(zone
, priv
->dir
);
170 tuple
= &ct
->tuplehash
[priv
->dir
].tuple
;
173 memcpy(dest
, tuple
->src
.u3
.all
,
174 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
177 memcpy(dest
, tuple
->dst
.u3
.all
,
178 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
180 case NFT_CT_PROTO_SRC
:
181 *dest
= (__force __u16
)tuple
->src
.u
.all
;
183 case NFT_CT_PROTO_DST
:
184 *dest
= (__force __u16
)tuple
->dst
.u
.all
;
191 regs
->verdict
.code
= NFT_BREAK
;
194 static void nft_ct_set_eval(const struct nft_expr
*expr
,
195 struct nft_regs
*regs
,
196 const struct nft_pktinfo
*pkt
)
198 const struct nft_ct
*priv
= nft_expr_priv(expr
);
199 struct sk_buff
*skb
= pkt
->skb
;
200 #ifdef CONFIG_NF_CONNTRACK_MARK
201 u32 value
= regs
->data
[priv
->sreg
];
203 enum ip_conntrack_info ctinfo
;
206 ct
= nf_ct_get(skb
, &ctinfo
);
211 #ifdef CONFIG_NF_CONNTRACK_MARK
213 if (ct
->mark
!= value
) {
215 nf_conntrack_event_cache(IPCT_MARK
, ct
);
219 #ifdef CONFIG_NF_CONNTRACK_LABELS
221 nf_connlabels_replace(ct
,
222 ®s
->data
[priv
->sreg
],
223 ®s
->data
[priv
->sreg
],
224 NF_CT_LABELS_MAX_SIZE
/ sizeof(u32
));
232 static const struct nla_policy nft_ct_policy
[NFTA_CT_MAX
+ 1] = {
233 [NFTA_CT_DREG
] = { .type
= NLA_U32
},
234 [NFTA_CT_KEY
] = { .type
= NLA_U32
},
235 [NFTA_CT_DIRECTION
] = { .type
= NLA_U8
},
236 [NFTA_CT_SREG
] = { .type
= NLA_U32
},
239 static int nft_ct_netns_get(struct net
*net
, uint8_t family
)
243 if (family
== NFPROTO_INET
) {
244 err
= nf_ct_netns_get(net
, NFPROTO_IPV4
);
247 err
= nf_ct_netns_get(net
, NFPROTO_IPV6
);
251 err
= nf_ct_netns_get(net
, family
);
258 nf_ct_netns_put(net
, NFPROTO_IPV4
);
263 static void nft_ct_netns_put(struct net
*net
, uint8_t family
)
265 if (family
== NFPROTO_INET
) {
266 nf_ct_netns_put(net
, NFPROTO_IPV4
);
267 nf_ct_netns_put(net
, NFPROTO_IPV6
);
269 nf_ct_netns_put(net
, family
);
272 static int nft_ct_get_init(const struct nft_ctx
*ctx
,
273 const struct nft_expr
*expr
,
274 const struct nlattr
* const tb
[])
276 struct nft_ct
*priv
= nft_expr_priv(expr
);
280 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
281 priv
->dir
= IP_CT_DIR_MAX
;
283 case NFT_CT_DIRECTION
:
284 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
290 #ifdef CONFIG_NF_CONNTRACK_MARK
293 #ifdef CONFIG_NF_CONNTRACK_SECMARK
296 case NFT_CT_EXPIRATION
:
297 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
301 #ifdef CONFIG_NF_CONNTRACK_LABELS
303 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
305 len
= NF_CT_LABELS_MAX_SIZE
;
309 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
311 len
= NF_CT_HELPER_NAME_LEN
;
314 case NFT_CT_L3PROTOCOL
:
315 case NFT_CT_PROTOCOL
:
316 /* For compatibility, do not report error if NFTA_CT_DIRECTION
317 * attribute is specified.
323 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
326 switch (ctx
->afi
->family
) {
328 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
,
333 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
,
337 return -EAFNOSUPPORT
;
340 case NFT_CT_PROTO_SRC
:
341 case NFT_CT_PROTO_DST
:
342 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
344 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
, src
.u
.all
);
351 #ifdef CONFIG_NF_CONNTRACK_ZONES
360 if (tb
[NFTA_CT_DIRECTION
] != NULL
) {
361 priv
->dir
= nla_get_u8(tb
[NFTA_CT_DIRECTION
]);
363 case IP_CT_DIR_ORIGINAL
:
364 case IP_CT_DIR_REPLY
:
371 priv
->dreg
= nft_parse_register(tb
[NFTA_CT_DREG
]);
372 err
= nft_validate_register_store(ctx
, priv
->dreg
, NULL
,
373 NFT_DATA_VALUE
, len
);
377 err
= nft_ct_netns_get(ctx
->net
, ctx
->afi
->family
);
381 if (priv
->key
== NFT_CT_BYTES
||
382 priv
->key
== NFT_CT_PKTS
||
383 priv
->key
== NFT_CT_AVGPKT
)
384 nf_ct_set_acct(ctx
->net
, true);
389 static void __nft_ct_set_destroy(const struct nft_ctx
*ctx
, struct nft_ct
*priv
)
392 #ifdef CONFIG_NF_CONNTRACK_LABELS
394 nf_connlabels_put(ctx
->net
);
402 static int nft_ct_set_init(const struct nft_ctx
*ctx
,
403 const struct nft_expr
*expr
,
404 const struct nlattr
* const tb
[])
406 struct nft_ct
*priv
= nft_expr_priv(expr
);
410 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
412 #ifdef CONFIG_NF_CONNTRACK_MARK
414 if (tb
[NFTA_CT_DIRECTION
])
416 len
= FIELD_SIZEOF(struct nf_conn
, mark
);
419 #ifdef CONFIG_NF_CONNTRACK_LABELS
421 if (tb
[NFTA_CT_DIRECTION
])
423 len
= NF_CT_LABELS_MAX_SIZE
;
424 err
= nf_connlabels_get(ctx
->net
, (len
* BITS_PER_BYTE
) - 1);
433 priv
->sreg
= nft_parse_register(tb
[NFTA_CT_SREG
]);
434 err
= nft_validate_register_load(priv
->sreg
, len
);
438 err
= nft_ct_netns_get(ctx
->net
, ctx
->afi
->family
);
445 __nft_ct_set_destroy(ctx
, priv
);
449 static void nft_ct_get_destroy(const struct nft_ctx
*ctx
,
450 const struct nft_expr
*expr
)
452 nf_ct_netns_put(ctx
->net
, ctx
->afi
->family
);
455 static void nft_ct_set_destroy(const struct nft_ctx
*ctx
,
456 const struct nft_expr
*expr
)
458 struct nft_ct
*priv
= nft_expr_priv(expr
);
460 __nft_ct_set_destroy(ctx
, priv
);
461 nft_ct_netns_put(ctx
->net
, ctx
->afi
->family
);
464 static int nft_ct_get_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
466 const struct nft_ct
*priv
= nft_expr_priv(expr
);
468 if (nft_dump_register(skb
, NFTA_CT_DREG
, priv
->dreg
))
469 goto nla_put_failure
;
470 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
471 goto nla_put_failure
;
476 case NFT_CT_PROTO_SRC
:
477 case NFT_CT_PROTO_DST
:
478 if (nla_put_u8(skb
, NFTA_CT_DIRECTION
, priv
->dir
))
479 goto nla_put_failure
;
485 if (priv
->dir
< IP_CT_DIR_MAX
&&
486 nla_put_u8(skb
, NFTA_CT_DIRECTION
, priv
->dir
))
487 goto nla_put_failure
;
499 static int nft_ct_set_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
501 const struct nft_ct
*priv
= nft_expr_priv(expr
);
503 if (nft_dump_register(skb
, NFTA_CT_SREG
, priv
->sreg
))
504 goto nla_put_failure
;
505 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
506 goto nla_put_failure
;
513 static struct nft_expr_type nft_ct_type
;
514 static const struct nft_expr_ops nft_ct_get_ops
= {
515 .type
= &nft_ct_type
,
516 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
517 .eval
= nft_ct_get_eval
,
518 .init
= nft_ct_get_init
,
519 .destroy
= nft_ct_get_destroy
,
520 .dump
= nft_ct_get_dump
,
523 static const struct nft_expr_ops nft_ct_set_ops
= {
524 .type
= &nft_ct_type
,
525 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
526 .eval
= nft_ct_set_eval
,
527 .init
= nft_ct_set_init
,
528 .destroy
= nft_ct_set_destroy
,
529 .dump
= nft_ct_set_dump
,
532 static const struct nft_expr_ops
*
533 nft_ct_select_ops(const struct nft_ctx
*ctx
,
534 const struct nlattr
* const tb
[])
536 if (tb
[NFTA_CT_KEY
] == NULL
)
537 return ERR_PTR(-EINVAL
);
539 if (tb
[NFTA_CT_DREG
] && tb
[NFTA_CT_SREG
])
540 return ERR_PTR(-EINVAL
);
542 if (tb
[NFTA_CT_DREG
])
543 return &nft_ct_get_ops
;
545 if (tb
[NFTA_CT_SREG
])
546 return &nft_ct_set_ops
;
548 return ERR_PTR(-EINVAL
);
551 static struct nft_expr_type nft_ct_type __read_mostly
= {
553 .select_ops
= &nft_ct_select_ops
,
554 .policy
= nft_ct_policy
,
555 .maxattr
= NFTA_CT_MAX
,
556 .owner
= THIS_MODULE
,
559 static void nft_notrack_eval(const struct nft_expr
*expr
,
560 struct nft_regs
*regs
,
561 const struct nft_pktinfo
*pkt
)
563 struct sk_buff
*skb
= pkt
->skb
;
564 enum ip_conntrack_info ctinfo
;
567 ct
= nf_ct_get(pkt
->skb
, &ctinfo
);
568 /* Previously seen (loopback or untracked)? Ignore. */
572 ct
= nf_ct_untracked_get();
573 atomic_inc(&ct
->ct_general
.use
);
574 nf_ct_set(skb
, ct
, IP_CT_NEW
);
577 static struct nft_expr_type nft_notrack_type
;
578 static const struct nft_expr_ops nft_notrack_ops
= {
579 .type
= &nft_notrack_type
,
580 .size
= NFT_EXPR_SIZE(0),
581 .eval
= nft_notrack_eval
,
584 static struct nft_expr_type nft_notrack_type __read_mostly
= {
586 .ops
= &nft_notrack_ops
,
587 .owner
= THIS_MODULE
,
590 static int __init
nft_ct_module_init(void)
594 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE
> NFT_REG_SIZE
);
596 err
= nft_register_expr(&nft_ct_type
);
600 err
= nft_register_expr(&nft_notrack_type
);
606 nft_unregister_expr(&nft_ct_type
);
610 static void __exit
nft_ct_module_exit(void)
612 nft_unregister_expr(&nft_notrack_type
);
613 nft_unregister_expr(&nft_ct_type
);
616 module_init(nft_ct_module_init
);
617 module_exit(nft_ct_module_exit
);
619 MODULE_LICENSE("GPL");
620 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
621 MODULE_ALIAS_NFT_EXPR("ct");
622 MODULE_ALIAS_NFT_EXPR("notrack");