2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nf_tables.h>
17 #include <net/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_conntrack.h>
19 #include <net/netfilter/nf_conntrack_acct.h>
20 #include <net/netfilter/nf_conntrack_tuple.h>
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <net/netfilter/nf_conntrack_ecache.h>
23 #include <net/netfilter/nf_conntrack_labels.h>
26 enum nft_ct_keys key
:8;
27 enum ip_conntrack_dir dir
:8;
29 enum nft_registers dreg
:8;
30 enum nft_registers sreg
:8;
34 static u64
nft_ct_get_eval_counter(const struct nf_conn_counter
*c
,
36 enum ip_conntrack_dir d
)
38 if (d
< IP_CT_DIR_MAX
)
39 return k
== NFT_CT_BYTES
? atomic64_read(&c
[d
].bytes
) :
40 atomic64_read(&c
[d
].packets
);
42 return nft_ct_get_eval_counter(c
, k
, IP_CT_DIR_ORIGINAL
) +
43 nft_ct_get_eval_counter(c
, k
, IP_CT_DIR_REPLY
);
46 static void nft_ct_get_eval(const struct nft_expr
*expr
,
47 struct nft_regs
*regs
,
48 const struct nft_pktinfo
*pkt
)
50 const struct nft_ct
*priv
= nft_expr_priv(expr
);
51 u32
*dest
= ®s
->data
[priv
->dreg
];
52 enum ip_conntrack_info ctinfo
;
53 const struct nf_conn
*ct
;
54 const struct nf_conn_help
*help
;
55 const struct nf_conntrack_tuple
*tuple
;
56 const struct nf_conntrack_helper
*helper
;
60 ct
= nf_ct_get(pkt
->skb
, &ctinfo
);
65 state
= NF_CT_STATE_INVALID_BIT
;
66 else if (nf_ct_is_untracked(ct
))
67 state
= NF_CT_STATE_UNTRACKED_BIT
;
69 state
= NF_CT_STATE_BIT(ctinfo
);
80 case NFT_CT_DIRECTION
:
81 *dest
= CTINFO2DIR(ctinfo
);
86 #ifdef CONFIG_NF_CONNTRACK_MARK
91 #ifdef CONFIG_NF_CONNTRACK_SECMARK
96 case NFT_CT_EXPIRATION
:
97 diff
= (long)jiffies
- (long)ct
->timeout
.expires
;
100 *dest
= jiffies_to_msecs(diff
);
103 if (ct
->master
== NULL
)
105 help
= nfct_help(ct
->master
);
108 helper
= rcu_dereference(help
->helper
);
111 strncpy((char *)dest
, helper
->name
, NF_CT_HELPER_NAME_LEN
);
113 #ifdef CONFIG_NF_CONNTRACK_LABELS
114 case NFT_CT_LABELS
: {
115 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
119 memset(dest
, 0, NF_CT_LABELS_MAX_SIZE
);
123 size
= labels
->words
* sizeof(long);
124 memcpy(dest
, labels
->bits
, size
);
125 if (size
< NF_CT_LABELS_MAX_SIZE
)
126 memset(((char *) dest
) + size
, 0,
127 NF_CT_LABELS_MAX_SIZE
- size
);
131 case NFT_CT_BYTES
: /* fallthrough */
133 const struct nf_conn_acct
*acct
= nf_conn_acct_find(ct
);
137 count
= nft_ct_get_eval_counter(acct
->counter
,
138 priv
->key
, priv
->dir
);
139 memcpy(dest
, &count
, sizeof(count
));
146 tuple
= &ct
->tuplehash
[priv
->dir
].tuple
;
148 case NFT_CT_L3PROTOCOL
:
149 *dest
= nf_ct_l3num(ct
);
152 memcpy(dest
, tuple
->src
.u3
.all
,
153 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
156 memcpy(dest
, tuple
->dst
.u3
.all
,
157 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
159 case NFT_CT_PROTOCOL
:
160 *dest
= nf_ct_protonum(ct
);
162 case NFT_CT_PROTO_SRC
:
163 *dest
= (__force __u16
)tuple
->src
.u
.all
;
165 case NFT_CT_PROTO_DST
:
166 *dest
= (__force __u16
)tuple
->dst
.u
.all
;
173 regs
->verdict
.code
= NFT_BREAK
;
176 static void nft_ct_set_eval(const struct nft_expr
*expr
,
177 struct nft_regs
*regs
,
178 const struct nft_pktinfo
*pkt
)
180 const struct nft_ct
*priv
= nft_expr_priv(expr
);
181 struct sk_buff
*skb
= pkt
->skb
;
182 #ifdef CONFIG_NF_CONNTRACK_MARK
183 u32 value
= regs
->data
[priv
->sreg
];
185 enum ip_conntrack_info ctinfo
;
188 ct
= nf_ct_get(skb
, &ctinfo
);
193 #ifdef CONFIG_NF_CONNTRACK_MARK
195 if (ct
->mark
!= value
) {
197 nf_conntrack_event_cache(IPCT_MARK
, ct
);
201 #ifdef CONFIG_NF_CONNTRACK_LABELS
203 nf_connlabels_replace(ct
,
204 ®s
->data
[priv
->sreg
],
205 ®s
->data
[priv
->sreg
],
206 NF_CT_LABELS_MAX_SIZE
/ sizeof(u32
));
214 static const struct nla_policy nft_ct_policy
[NFTA_CT_MAX
+ 1] = {
215 [NFTA_CT_DREG
] = { .type
= NLA_U32
},
216 [NFTA_CT_KEY
] = { .type
= NLA_U32
},
217 [NFTA_CT_DIRECTION
] = { .type
= NLA_U8
},
218 [NFTA_CT_SREG
] = { .type
= NLA_U32
},
221 static int nft_ct_l3proto_try_module_get(uint8_t family
)
225 if (family
== NFPROTO_INET
) {
226 err
= nf_ct_l3proto_try_module_get(NFPROTO_IPV4
);
229 err
= nf_ct_l3proto_try_module_get(NFPROTO_IPV6
);
233 err
= nf_ct_l3proto_try_module_get(family
);
240 nf_ct_l3proto_module_put(NFPROTO_IPV4
);
245 static void nft_ct_l3proto_module_put(uint8_t family
)
247 if (family
== NFPROTO_INET
) {
248 nf_ct_l3proto_module_put(NFPROTO_IPV4
);
249 nf_ct_l3proto_module_put(NFPROTO_IPV6
);
251 nf_ct_l3proto_module_put(family
);
254 static int nft_ct_get_init(const struct nft_ctx
*ctx
,
255 const struct nft_expr
*expr
,
256 const struct nlattr
* const tb
[])
258 struct nft_ct
*priv
= nft_expr_priv(expr
);
262 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
264 case NFT_CT_DIRECTION
:
265 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
271 #ifdef CONFIG_NF_CONNTRACK_MARK
274 #ifdef CONFIG_NF_CONNTRACK_SECMARK
277 case NFT_CT_EXPIRATION
:
278 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
282 #ifdef CONFIG_NF_CONNTRACK_LABELS
284 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
286 len
= NF_CT_LABELS_MAX_SIZE
;
290 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
292 len
= NF_CT_HELPER_NAME_LEN
;
295 case NFT_CT_L3PROTOCOL
:
296 case NFT_CT_PROTOCOL
:
297 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
303 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
306 switch (ctx
->afi
->family
) {
308 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
,
313 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
,
317 return -EAFNOSUPPORT
;
320 case NFT_CT_PROTO_SRC
:
321 case NFT_CT_PROTO_DST
:
322 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
324 len
= FIELD_SIZEOF(struct nf_conntrack_tuple
, src
.u
.all
);
328 /* no direction? return sum of original + reply */
329 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
330 priv
->dir
= IP_CT_DIR_MAX
;
337 if (tb
[NFTA_CT_DIRECTION
] != NULL
) {
338 priv
->dir
= nla_get_u8(tb
[NFTA_CT_DIRECTION
]);
340 case IP_CT_DIR_ORIGINAL
:
341 case IP_CT_DIR_REPLY
:
348 priv
->dreg
= nft_parse_register(tb
[NFTA_CT_DREG
]);
349 err
= nft_validate_register_store(ctx
, priv
->dreg
, NULL
,
350 NFT_DATA_VALUE
, len
);
354 err
= nft_ct_l3proto_try_module_get(ctx
->afi
->family
);
361 static int nft_ct_set_init(const struct nft_ctx
*ctx
,
362 const struct nft_expr
*expr
,
363 const struct nlattr
* const tb
[])
365 struct nft_ct
*priv
= nft_expr_priv(expr
);
369 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
371 #ifdef CONFIG_NF_CONNTRACK_MARK
373 len
= FIELD_SIZEOF(struct nf_conn
, mark
);
376 #ifdef CONFIG_NF_CONNTRACK_LABELS
378 if (tb
[NFTA_CT_DIRECTION
])
380 len
= NF_CT_LABELS_MAX_SIZE
;
381 err
= nf_connlabels_get(ctx
->net
, (len
* BITS_PER_BYTE
) - 1);
390 priv
->sreg
= nft_parse_register(tb
[NFTA_CT_SREG
]);
391 err
= nft_validate_register_load(priv
->sreg
, len
);
395 err
= nft_ct_l3proto_try_module_get(ctx
->afi
->family
);
402 static void nft_ct_destroy(const struct nft_ctx
*ctx
,
403 const struct nft_expr
*expr
)
405 struct nft_ct
*priv
= nft_expr_priv(expr
);
408 #ifdef CONFIG_NF_CONNTRACK_LABELS
410 nf_connlabels_put(ctx
->net
);
417 nft_ct_l3proto_module_put(ctx
->afi
->family
);
420 static int nft_ct_get_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
422 const struct nft_ct
*priv
= nft_expr_priv(expr
);
424 if (nft_dump_register(skb
, NFTA_CT_DREG
, priv
->dreg
))
425 goto nla_put_failure
;
426 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
427 goto nla_put_failure
;
430 case NFT_CT_L3PROTOCOL
:
431 case NFT_CT_PROTOCOL
:
434 case NFT_CT_PROTO_SRC
:
435 case NFT_CT_PROTO_DST
:
436 if (nla_put_u8(skb
, NFTA_CT_DIRECTION
, priv
->dir
))
437 goto nla_put_failure
;
441 if (priv
->dir
< IP_CT_DIR_MAX
&&
442 nla_put_u8(skb
, NFTA_CT_DIRECTION
, priv
->dir
))
443 goto nla_put_failure
;
455 static int nft_ct_set_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
457 const struct nft_ct
*priv
= nft_expr_priv(expr
);
459 if (nft_dump_register(skb
, NFTA_CT_SREG
, priv
->sreg
))
460 goto nla_put_failure
;
461 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
462 goto nla_put_failure
;
469 static struct nft_expr_type nft_ct_type
;
470 static const struct nft_expr_ops nft_ct_get_ops
= {
471 .type
= &nft_ct_type
,
472 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
473 .eval
= nft_ct_get_eval
,
474 .init
= nft_ct_get_init
,
475 .destroy
= nft_ct_destroy
,
476 .dump
= nft_ct_get_dump
,
479 static const struct nft_expr_ops nft_ct_set_ops
= {
480 .type
= &nft_ct_type
,
481 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
482 .eval
= nft_ct_set_eval
,
483 .init
= nft_ct_set_init
,
484 .destroy
= nft_ct_destroy
,
485 .dump
= nft_ct_set_dump
,
488 static const struct nft_expr_ops
*
489 nft_ct_select_ops(const struct nft_ctx
*ctx
,
490 const struct nlattr
* const tb
[])
492 if (tb
[NFTA_CT_KEY
] == NULL
)
493 return ERR_PTR(-EINVAL
);
495 if (tb
[NFTA_CT_DREG
] && tb
[NFTA_CT_SREG
])
496 return ERR_PTR(-EINVAL
);
498 if (tb
[NFTA_CT_DREG
])
499 return &nft_ct_get_ops
;
501 if (tb
[NFTA_CT_SREG
])
502 return &nft_ct_set_ops
;
504 return ERR_PTR(-EINVAL
);
507 static struct nft_expr_type nft_ct_type __read_mostly
= {
509 .select_ops
= &nft_ct_select_ops
,
510 .policy
= nft_ct_policy
,
511 .maxattr
= NFTA_CT_MAX
,
512 .owner
= THIS_MODULE
,
515 static int __init
nft_ct_module_init(void)
517 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE
> NFT_REG_SIZE
);
519 return nft_register_expr(&nft_ct_type
);
522 static void __exit
nft_ct_module_exit(void)
524 nft_unregister_expr(&nft_ct_type
);
527 module_init(nft_ct_module_init
);
528 module_exit(nft_ct_module_exit
);
530 MODULE_LICENSE("GPL");
531 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
532 MODULE_ALIAS_NFT_EXPR("ct");