2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nf_tables.h>
17 #include <net/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_conntrack.h>
19 #include <net/netfilter/nf_conntrack_acct.h>
20 #include <net/netfilter/nf_conntrack_tuple.h>
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <net/netfilter/nf_conntrack_ecache.h>
23 #include <net/netfilter/nf_conntrack_labels.h>
26 enum nft_ct_keys key
:8;
27 enum ip_conntrack_dir dir
:8;
29 enum nft_registers dreg
:8;
30 enum nft_registers sreg
:8;
34 static u64
nft_ct_get_eval_counter(const struct nf_conn_counter
*c
,
36 enum ip_conntrack_dir d
)
38 if (d
< IP_CT_DIR_MAX
)
39 return k
== NFT_CT_BYTES
? atomic64_read(&c
[d
].bytes
) :
40 atomic64_read(&c
[d
].packets
);
42 return nft_ct_get_eval_counter(c
, k
, IP_CT_DIR_ORIGINAL
) +
43 nft_ct_get_eval_counter(c
, k
, IP_CT_DIR_REPLY
);
46 static void nft_ct_get_eval(const struct nft_expr
*expr
,
47 struct nft_regs
*regs
,
48 const struct nft_pktinfo
*pkt
)
50 const struct nft_ct
*priv
= nft_expr_priv(expr
);
51 u32
*dest
= ®s
->data
[priv
->dreg
];
52 enum ip_conntrack_info ctinfo
;
53 const struct nf_conn
*ct
;
54 const struct nf_conn_help
*help
;
55 const struct nf_conntrack_tuple
*tuple
;
56 const struct nf_conntrack_helper
*helper
;
59 ct
= nf_ct_get(pkt
->skb
, &ctinfo
);
64 state
= NF_CT_STATE_INVALID_BIT
;
65 else if (nf_ct_is_untracked(ct
))
66 state
= NF_CT_STATE_UNTRACKED_BIT
;
68 state
= NF_CT_STATE_BIT(ctinfo
);
79 case NFT_CT_DIRECTION
:
80 *dest
= CTINFO2DIR(ctinfo
);
85 #ifdef CONFIG_NF_CONNTRACK_MARK
90 #ifdef CONFIG_NF_CONNTRACK_SECMARK
95 case NFT_CT_EXPIRATION
:
96 *dest
= jiffies_to_msecs(nf_ct_expires(ct
));
99 if (ct
->master
== NULL
)
101 help
= nfct_help(ct
->master
);
104 helper
= rcu_dereference(help
->helper
);
107 strncpy((char *)dest
, helper
->name
, NF_CT_HELPER_NAME_LEN
);
109 #ifdef CONFIG_NF_CONNTRACK_LABELS
110 case NFT_CT_LABELS
: {
111 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
115 memset(dest
, 0, NF_CT_LABELS_MAX_SIZE
);
119 size
= labels
->words
* sizeof(long);
120 memcpy(dest
, labels
->bits
, size
);
121 if (size
< NF_CT_LABELS_MAX_SIZE
)
122 memset(((char *) dest
) + size
, 0,
123 NF_CT_LABELS_MAX_SIZE
- size
);
127 case NFT_CT_BYTES
: /* fallthrough */
129 const struct nf_conn_acct
*acct
= nf_conn_acct_find(ct
);
133 count
= nft_ct_get_eval_counter(acct
->counter
,
134 priv
->key
, priv
->dir
);
135 memcpy(dest
, &count
, sizeof(count
));
142 tuple
= &ct
->tuplehash
[priv
->dir
].tuple
;
144 case NFT_CT_L3PROTOCOL
:
145 *dest
= nf_ct_l3num(ct
);
148 memcpy(dest
, tuple
->src
.u3
.all
,
149 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
152 memcpy(dest
, tuple
->dst
.u3
.all
,
153 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
155 case NFT_CT_PROTOCOL
:
156 *dest
= nf_ct_protonum(ct
);
158 case NFT_CT_PROTO_SRC
:
159 *dest
= (__force __u16
)tuple
->src
.u
.all
;
161 case NFT_CT_PROTO_DST
:
162 *dest
= (__force __u16
)tuple
->dst
.u
.all
;
169 regs
->verdict
.code
= NFT_BREAK
;
172 static void nft_ct_set_eval(const struct nft_expr
*expr
,
173 struct nft_regs
*regs
,
174 const struct nft_pktinfo
*pkt
)
176 const struct nft_ct
*priv
= nft_expr_priv(expr
);
177 struct sk_buff
*skb
= pkt
->skb
;
178 #ifdef CONFIG_NF_CONNTRACK_MARK
179 u32 value
= regs
->data
[priv
->sreg
];
181 enum ip_conntrack_info ctinfo
;
184 ct
= nf_ct_get(skb
, &ctinfo
);
189 #ifdef CONFIG_NF_CONNTRACK_MARK
191 if (ct
->mark
!= value
) {
193 nf_conntrack_event_cache(IPCT_MARK
, ct
);
197 #ifdef CONFIG_NF_CONNTRACK_LABELS
199 nf_connlabels_replace(ct
,
200 ®s
->data
[priv
->sreg
],
201 ®s
->data
[priv
->sreg
],
202 NF_CT_LABELS_MAX_SIZE
/ sizeof(u32
));
210 static const struct nla_policy nft_ct_policy
[NFTA_CT_MAX
+ 1] = {
211 [NFTA_CT_DREG
] = { .type
= NLA_U32
},
212 [NFTA_CT_KEY
] = { .type
= NLA_U32
},
213 [NFTA_CT_DIRECTION
] = { .type
= NLA_U8
},
214 [NFTA_CT_SREG
] = { .type
= NLA_U32
},
217 static int nft_ct_l3proto_try_module_get(uint8_t family
)
221 if (family
== NFPROTO_INET
) {
222 err
= nf_ct_l3proto_try_module_get(NFPROTO_IPV4
);
225 err
= nf_ct_l3proto_try_module_get(NFPROTO_IPV6
);
229 err
= nf_ct_l3proto_try_module_get(family
);
236 nf_ct_l3proto_module_put(NFPROTO_IPV4
);
241 static void nft_ct_l3proto_module_put(uint8_t family
)
243 if (family
== NFPROTO_INET
) {
244 nf_ct_l3proto_module_put(NFPROTO_IPV4
);
245 nf_ct_l3proto_module_put(NFPROTO_IPV6
);
247 nf_ct_l3proto_module_put(family
);
250 static int nft_ct_get_init(const struct nft_ctx
*ctx
,
251 const struct nft_expr
*expr
,
252 const struct nlattr
* const tb
[])
254 struct nft_ct
*priv
= nft_expr_priv(expr
);
258 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
260 case NFT_CT_DIRECTION
:
261 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
267 #ifdef CONFIG_NF_CONNTRACK_MARK
270 #ifdef CONFIG_NF_CONNTRACK_SECMARK
273 case NFT_CT_EXPIRATION
:
274 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
278 #ifdef CONFIG_NF_CONNTRACK_LABELS
280 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
282 len
= NF_CT_LABELS_MAX_SIZE
;
286 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
288 len
= NF_CT_HELPER_NAME_LEN
;
291 case NFT_CT_L3PROTOCOL
:
292 case NFT_CT_PROTOCOL
:
293 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
299 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
302 switch (ctx
->afi
->family
) {
304 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
,
309 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
,
313 return -EAFNOSUPPORT
;
316 case NFT_CT_PROTO_SRC
:
317 case NFT_CT_PROTO_DST
:
318 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
320 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
, src
.u
.all
);
324 /* no direction? return sum of original + reply */
325 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
326 priv
->dir
= IP_CT_DIR_MAX
;
333 if (tb
[NFTA_CT_DIRECTION
] != NULL
) {
334 priv
->dir
= nla_get_u8(tb
[NFTA_CT_DIRECTION
]);
336 case IP_CT_DIR_ORIGINAL
:
337 case IP_CT_DIR_REPLY
:
344 priv
->dreg
= nft_parse_register(tb
[NFTA_CT_DREG
]);
345 err
= nft_validate_register_store(ctx
, priv
->dreg
, NULL
,
346 NFT_DATA_VALUE
, len
);
350 err
= nft_ct_l3proto_try_module_get(ctx
->afi
->family
);
357 static int nft_ct_set_init(const struct nft_ctx
*ctx
,
358 const struct nft_expr
*expr
,
359 const struct nlattr
* const tb
[])
361 struct nft_ct
*priv
= nft_expr_priv(expr
);
365 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
367 #ifdef CONFIG_NF_CONNTRACK_MARK
369 len
= FIELD_SIZEOF(struct nf_conn
, mark
);
372 #ifdef CONFIG_NF_CONNTRACK_LABELS
374 if (tb
[NFTA_CT_DIRECTION
])
376 len
= NF_CT_LABELS_MAX_SIZE
;
377 err
= nf_connlabels_get(ctx
->net
, (len
* BITS_PER_BYTE
) - 1);
386 priv
->sreg
= nft_parse_register(tb
[NFTA_CT_SREG
]);
387 err
= nft_validate_register_load(priv
->sreg
, len
);
391 err
= nft_ct_l3proto_try_module_get(ctx
->afi
->family
);
398 static void nft_ct_destroy(const struct nft_ctx
*ctx
,
399 const struct nft_expr
*expr
)
401 struct nft_ct
*priv
= nft_expr_priv(expr
);
404 #ifdef CONFIG_NF_CONNTRACK_LABELS
406 nf_connlabels_put(ctx
->net
);
413 nft_ct_l3proto_module_put(ctx
->afi
->family
);
416 static int nft_ct_get_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
418 const struct nft_ct
*priv
= nft_expr_priv(expr
);
420 if (nft_dump_register(skb
, NFTA_CT_DREG
, priv
->dreg
))
421 goto nla_put_failure
;
422 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
423 goto nla_put_failure
;
426 case NFT_CT_L3PROTOCOL
:
427 case NFT_CT_PROTOCOL
:
430 case NFT_CT_PROTO_SRC
:
431 case NFT_CT_PROTO_DST
:
432 if (nla_put_u8(skb
, NFTA_CT_DIRECTION
, priv
->dir
))
433 goto nla_put_failure
;
437 if (priv
->dir
< IP_CT_DIR_MAX
&&
438 nla_put_u8(skb
, NFTA_CT_DIRECTION
, priv
->dir
))
439 goto nla_put_failure
;
451 static int nft_ct_set_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
453 const struct nft_ct
*priv
= nft_expr_priv(expr
);
455 if (nft_dump_register(skb
, NFTA_CT_SREG
, priv
->sreg
))
456 goto nla_put_failure
;
457 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
458 goto nla_put_failure
;
465 static struct nft_expr_type nft_ct_type
;
466 static const struct nft_expr_ops nft_ct_get_ops
= {
467 .type
= &nft_ct_type
,
468 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
469 .eval
= nft_ct_get_eval
,
470 .init
= nft_ct_get_init
,
471 .destroy
= nft_ct_destroy
,
472 .dump
= nft_ct_get_dump
,
475 static const struct nft_expr_ops nft_ct_set_ops
= {
476 .type
= &nft_ct_type
,
477 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
478 .eval
= nft_ct_set_eval
,
479 .init
= nft_ct_set_init
,
480 .destroy
= nft_ct_destroy
,
481 .dump
= nft_ct_set_dump
,
484 static const struct nft_expr_ops
*
485 nft_ct_select_ops(const struct nft_ctx
*ctx
,
486 const struct nlattr
* const tb
[])
488 if (tb
[NFTA_CT_KEY
] == NULL
)
489 return ERR_PTR(-EINVAL
);
491 if (tb
[NFTA_CT_DREG
] && tb
[NFTA_CT_SREG
])
492 return ERR_PTR(-EINVAL
);
494 if (tb
[NFTA_CT_DREG
])
495 return &nft_ct_get_ops
;
497 if (tb
[NFTA_CT_SREG
])
498 return &nft_ct_set_ops
;
500 return ERR_PTR(-EINVAL
);
503 static struct nft_expr_type nft_ct_type __read_mostly
= {
505 .select_ops
= &nft_ct_select_ops
,
506 .policy
= nft_ct_policy
,
507 .maxattr
= NFTA_CT_MAX
,
508 .owner
= THIS_MODULE
,
511 static int __init
nft_ct_module_init(void)
513 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE
> NFT_REG_SIZE
);
515 return nft_register_expr(&nft_ct_type
);
518 static void __exit
nft_ct_module_exit(void)
520 nft_unregister_expr(&nft_ct_type
);
523 module_init(nft_ct_module_init
);
524 module_exit(nft_ct_module_exit
);
526 MODULE_LICENSE("GPL");
527 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
528 MODULE_ALIAS_NFT_EXPR("ct");