net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/netlink.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nf_tables.h>
  17 #include <net/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_conntrack.h>
  19 #include <net/netfilter/nf_conntrack_acct.h>
  20 #include <net/netfilter/nf_conntrack_tuple.h>
  21 #include <net/netfilter/nf_conntrack_helper.h>
  22 #include <net/netfilter/nf_conntrack_ecache.h>
  23 #include <net/netfilter/nf_conntrack_labels.h>
  24
  25 struct nft_ct {
  26         enum nft_ct_keys        key:8;
  27         enum ip_conntrack_dir   dir:8;
  28         union {
  29                 enum nft_registers      dreg:8;
  30                 enum nft_registers      sreg:8;
  31         };
  32 };
  33
  34 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  35                                    enum nft_ct_keys k,
  36                                    enum ip_conntrack_dir d)
  37 {
  38         if (d < IP_CT_DIR_MAX)
  39                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  40                                            atomic64_read(&c[d].packets);
  41
  42         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  43                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  44 }
  45
  46 static void nft_ct_get_eval(const struct nft_expr *expr,
  47                             struct nft_regs *regs,
  48                             const struct nft_pktinfo *pkt)
  49 {
  50         const struct nft_ct *priv = nft_expr_priv(expr);
  51         u32 *dest = &regs->data[priv->dreg];
  52         enum ip_conntrack_info ctinfo;
  53         const struct nf_conn *ct;
  54         const struct nf_conn_help *help;
  55         const struct nf_conntrack_tuple *tuple;
  56         const struct nf_conntrack_helper *helper;
  57         long diff;
  58         unsigned int state;
  59
  60         ct = nf_ct_get(pkt->skb, &ctinfo);
  61
  62         switch (priv->key) {
  63         case NFT_CT_STATE:
  64                 if (ct == NULL)
  65                         state = NF_CT_STATE_INVALID_BIT;
  66                 else if (nf_ct_is_untracked(ct))
  67                         state = NF_CT_STATE_UNTRACKED_BIT;
  68                 else
  69                         state = NF_CT_STATE_BIT(ctinfo);
  70                 *dest = state;
  71                 return;
  72         default:
  73                 break;
  74         }
  75
  76         if (ct == NULL)
  77                 goto err;
  78
  79         switch (priv->key) {
  80         case NFT_CT_DIRECTION:
  81                 *dest = CTINFO2DIR(ctinfo);
  82                 return;
  83         case NFT_CT_STATUS:
  84                 *dest = ct->status;
  85                 return;
  86 #ifdef CONFIG_NF_CONNTRACK_MARK
  87         case NFT_CT_MARK:
  88                 *dest = ct->mark;
  89                 return;
  90 #endif
  91 #ifdef CONFIG_NF_CONNTRACK_SECMARK
  92         case NFT_CT_SECMARK:
  93                 *dest = ct->secmark;
  94                 return;
  95 #endif
  96         case NFT_CT_EXPIRATION:
  97                 diff = (long)jiffies - (long)ct->timeout.expires;
  98                 if (diff < 0)
  99                         diff = 0;
 100                 *dest = jiffies_to_msecs(diff);
 101                 return;
 102         case NFT_CT_HELPER:
 103                 if (ct->master == NULL)
 104                         goto err;
 105                 help = nfct_help(ct->master);
 106                 if (help == NULL)
 107                         goto err;
 108                 helper = rcu_dereference(help->helper);
 109                 if (helper == NULL)
 110                         goto err;
 111                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 112                 return;
 113 #ifdef CONFIG_NF_CONNTRACK_LABELS
 114         case NFT_CT_LABELS: {
 115                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 116                 unsigned int size;
 117
 118                 if (!labels) {
 119                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 120                         return;
 121                 }
 122
 123                 size = labels->words * sizeof(long);
 124                 memcpy(dest, labels->bits, size);
 125                 if (size < NF_CT_LABELS_MAX_SIZE)
 126                         memset(((char *) dest) + size, 0,
 127                                NF_CT_LABELS_MAX_SIZE - size);
 128                 return;
 129         }
 130         case NFT_CT_BYTES: /* fallthrough */
 131         case NFT_CT_PKTS: {
 132                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 133                 u64 count = 0;
 134
 135                 if (acct)
 136                         count = nft_ct_get_eval_counter(acct->counter,
 137                                                         priv->key, priv->dir);
 138                 memcpy(dest, &count, sizeof(count));
 139                 return;
 140         }
 141 #endif
 142         default:
 143                 break;
 144         }
 145
 146         tuple = &ct->tuplehash[priv->dir].tuple;
 147         switch (priv->key) {
 148         case NFT_CT_L3PROTOCOL:
 149                 *dest = nf_ct_l3num(ct);
 150                 return;
 151         case NFT_CT_SRC:
 152                 memcpy(dest, tuple->src.u3.all,
 153                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 154                 return;
 155         case NFT_CT_DST:
 156                 memcpy(dest, tuple->dst.u3.all,
 157                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 158                 return;
 159         case NFT_CT_PROTOCOL:
 160                 *dest = nf_ct_protonum(ct);
 161                 return;
 162         case NFT_CT_PROTO_SRC:
 163                 *dest = (__force __u16)tuple->src.u.all;
 164                 return;
 165         case NFT_CT_PROTO_DST:
 166                 *dest = (__force __u16)tuple->dst.u.all;
 167                 return;
 168         default:
 169                 break;
 170         }
 171         return;
 172 err:
 173         regs->verdict.code = NFT_BREAK;
 174 }
 175
 176 static void nft_ct_set_eval(const struct nft_expr *expr,
 177                             struct nft_regs *regs,
 178                             const struct nft_pktinfo *pkt)
 179 {
 180         const struct nft_ct *priv = nft_expr_priv(expr);
 181         struct sk_buff *skb = pkt->skb;
 182 #ifdef CONFIG_NF_CONNTRACK_MARK
 183         u32 value = regs->data[priv->sreg];
 184 #endif
 185         enum ip_conntrack_info ctinfo;
 186         struct nf_conn *ct;
 187
 188         ct = nf_ct_get(skb, &ctinfo);
 189         if (ct == NULL)
 190                 return;
 191
 192         switch (priv->key) {
 193 #ifdef CONFIG_NF_CONNTRACK_MARK
 194         case NFT_CT_MARK:
 195                 if (ct->mark != value) {
 196                         ct->mark = value;
 197                         nf_conntrack_event_cache(IPCT_MARK, ct);
 198                 }
 199                 break;
 200 #endif
 201         default:
 202                 break;
 203         }
 204 }
 205
 206 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 207         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 208         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 209         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 210         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 211 };
 212
 213 static int nft_ct_l3proto_try_module_get(uint8_t family)
 214 {
 215         int err;
 216
 217         if (family == NFPROTO_INET) {
 218                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
 219                 if (err < 0)
 220                         goto err1;
 221                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
 222                 if (err < 0)
 223                         goto err2;
 224         } else {
 225                 err = nf_ct_l3proto_try_module_get(family);
 226                 if (err < 0)
 227                         goto err1;
 228         }
 229         return 0;
 230
 231 err2:
 232         nf_ct_l3proto_module_put(NFPROTO_IPV4);
 233 err1:
 234         return err;
 235 }
 236
 237 static void nft_ct_l3proto_module_put(uint8_t family)
 238 {
 239         if (family == NFPROTO_INET) {
 240                 nf_ct_l3proto_module_put(NFPROTO_IPV4);
 241                 nf_ct_l3proto_module_put(NFPROTO_IPV6);
 242         } else
 243                 nf_ct_l3proto_module_put(family);
 244 }
 245
 246 static int nft_ct_get_init(const struct nft_ctx *ctx,
 247                            const struct nft_expr *expr,
 248                            const struct nlattr * const tb[])
 249 {
 250         struct nft_ct *priv = nft_expr_priv(expr);
 251         unsigned int len;
 252         int err;
 253
 254         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 255         switch (priv->key) {
 256         case NFT_CT_DIRECTION:
 257                 if (tb[NFTA_CT_DIRECTION] != NULL)
 258                         return -EINVAL;
 259                 len = sizeof(u8);
 260                 break;
 261         case NFT_CT_STATE:
 262         case NFT_CT_STATUS:
 263 #ifdef CONFIG_NF_CONNTRACK_MARK
 264         case NFT_CT_MARK:
 265 #endif
 266 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 267         case NFT_CT_SECMARK:
 268 #endif
 269         case NFT_CT_EXPIRATION:
 270                 if (tb[NFTA_CT_DIRECTION] != NULL)
 271                         return -EINVAL;
 272                 len = sizeof(u32);
 273                 break;
 274 #ifdef CONFIG_NF_CONNTRACK_LABELS
 275         case NFT_CT_LABELS:
 276                 if (tb[NFTA_CT_DIRECTION] != NULL)
 277                         return -EINVAL;
 278                 len = NF_CT_LABELS_MAX_SIZE;
 279                 break;
 280 #endif
 281         case NFT_CT_HELPER:
 282                 if (tb[NFTA_CT_DIRECTION] != NULL)
 283                         return -EINVAL;
 284                 len = NF_CT_HELPER_NAME_LEN;
 285                 break;
 286
 287         case NFT_CT_L3PROTOCOL:
 288         case NFT_CT_PROTOCOL:
 289                 if (tb[NFTA_CT_DIRECTION] == NULL)
 290                         return -EINVAL;
 291                 len = sizeof(u8);
 292                 break;
 293         case NFT_CT_SRC:
 294         case NFT_CT_DST:
 295                 if (tb[NFTA_CT_DIRECTION] == NULL)
 296                         return -EINVAL;
 297
 298                 switch (ctx->afi->family) {
 299                 case NFPROTO_IPV4:
 300                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 301                                            src.u3.ip);
 302                         break;
 303                 case NFPROTO_IPV6:
 304                 case NFPROTO_INET:
 305                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 306                                            src.u3.ip6);
 307                         break;
 308                 default:
 309                         return -EAFNOSUPPORT;
 310                 }
 311                 break;
 312         case NFT_CT_PROTO_SRC:
 313         case NFT_CT_PROTO_DST:
 314                 if (tb[NFTA_CT_DIRECTION] == NULL)
 315                         return -EINVAL;
 316                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
 317                 break;
 318         case NFT_CT_BYTES:
 319         case NFT_CT_PKTS:
 320                 /* no direction? return sum of original + reply */
 321                 if (tb[NFTA_CT_DIRECTION] == NULL)
 322                         priv->dir = IP_CT_DIR_MAX;
 323                 len = sizeof(u64);
 324                 break;
 325         default:
 326                 return -EOPNOTSUPP;
 327         }
 328
 329         if (tb[NFTA_CT_DIRECTION] != NULL) {
 330                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 331                 switch (priv->dir) {
 332                 case IP_CT_DIR_ORIGINAL:
 333                 case IP_CT_DIR_REPLY:
 334                         break;
 335                 default:
 336                         return -EINVAL;
 337                 }
 338         }
 339
 340         priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
 341         err = nft_validate_register_store(ctx, priv->dreg, NULL,
 342                                           NFT_DATA_VALUE, len);
 343         if (err < 0)
 344                 return err;
 345
 346         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 347         if (err < 0)
 348                 return err;
 349
 350         return 0;
 351 }
 352
 353 static int nft_ct_set_init(const struct nft_ctx *ctx,
 354                            const struct nft_expr *expr,
 355                            const struct nlattr * const tb[])
 356 {
 357         struct nft_ct *priv = nft_expr_priv(expr);
 358         unsigned int len;
 359         int err;
 360
 361         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 362         switch (priv->key) {
 363 #ifdef CONFIG_NF_CONNTRACK_MARK
 364         case NFT_CT_MARK:
 365                 len = FIELD_SIZEOF(struct nf_conn, mark);
 366                 break;
 367 #endif
 368         default:
 369                 return -EOPNOTSUPP;
 370         }
 371
 372         priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
 373         err = nft_validate_register_load(priv->sreg, len);
 374         if (err < 0)
 375                 return err;
 376
 377         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 378         if (err < 0)
 379                 return err;
 380
 381         return 0;
 382 }
 383
 384 static void nft_ct_destroy(const struct nft_ctx *ctx,
 385                            const struct nft_expr *expr)
 386 {
 387         nft_ct_l3proto_module_put(ctx->afi->family);
 388 }
 389
 390 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 391 {
 392         const struct nft_ct *priv = nft_expr_priv(expr);
 393
 394         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 395                 goto nla_put_failure;
 396         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 397                 goto nla_put_failure;
 398
 399         switch (priv->key) {
 400         case NFT_CT_L3PROTOCOL:
 401         case NFT_CT_PROTOCOL:
 402         case NFT_CT_SRC:
 403         case NFT_CT_DST:
 404         case NFT_CT_PROTO_SRC:
 405         case NFT_CT_PROTO_DST:
 406                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 407                         goto nla_put_failure;
 408                 break;
 409         case NFT_CT_BYTES:
 410         case NFT_CT_PKTS:
 411                 if (priv->dir < IP_CT_DIR_MAX &&
 412                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 413                         goto nla_put_failure;
 414                 break;
 415         default:
 416                 break;
 417         }
 418
 419         return 0;
 420
 421 nla_put_failure:
 422         return -1;
 423 }
 424
 425 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 426 {
 427         const struct nft_ct *priv = nft_expr_priv(expr);
 428
 429         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 430                 goto nla_put_failure;
 431         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 432                 goto nla_put_failure;
 433         return 0;
 434
 435 nla_put_failure:
 436         return -1;
 437 }
 438
 439 static struct nft_expr_type nft_ct_type;
 440 static const struct nft_expr_ops nft_ct_get_ops = {
 441         .type           = &nft_ct_type,
 442         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 443         .eval           = nft_ct_get_eval,
 444         .init           = nft_ct_get_init,
 445         .destroy        = nft_ct_destroy,
 446         .dump           = nft_ct_get_dump,
 447 };
 448
 449 static const struct nft_expr_ops nft_ct_set_ops = {
 450         .type           = &nft_ct_type,
 451         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 452         .eval           = nft_ct_set_eval,
 453         .init           = nft_ct_set_init,
 454         .destroy        = nft_ct_destroy,
 455         .dump           = nft_ct_set_dump,
 456 };
 457
 458 static const struct nft_expr_ops *
 459 nft_ct_select_ops(const struct nft_ctx *ctx,
 460                     const struct nlattr * const tb[])
 461 {
 462         if (tb[NFTA_CT_KEY] == NULL)
 463                 return ERR_PTR(-EINVAL);
 464
 465         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 466                 return ERR_PTR(-EINVAL);
 467
 468         if (tb[NFTA_CT_DREG])
 469                 return &nft_ct_get_ops;
 470
 471         if (tb[NFTA_CT_SREG])
 472                 return &nft_ct_set_ops;
 473
 474         return ERR_PTR(-EINVAL);
 475 }
 476
 477 static struct nft_expr_type nft_ct_type __read_mostly = {
 478         .name           = "ct",
 479         .select_ops     = &nft_ct_select_ops,
 480         .policy         = nft_ct_policy,
 481         .maxattr        = NFTA_CT_MAX,
 482         .owner          = THIS_MODULE,
 483 };
 484
 485 static int __init nft_ct_module_init(void)
 486 {
 487         return nft_register_expr(&nft_ct_type);
 488 }
 489
 490 static void __exit nft_ct_module_exit(void)
 491 {
 492         nft_unregister_expr(&nft_ct_type);
 493 }
 494
 495 module_init(nft_ct_module_init);
 496 module_exit(nft_ct_module_exit);
 497
 498 MODULE_LICENSE("GPL");
 499 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 500 MODULE_ALIAS_NFT_EXPR("ct");