[deliverable/linux.git] / net / netfilter / nft_ct.c

/*
 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_labels.h>

struct nft_ct {
	enum nft_ct_keys	key:8;
	enum ip_conntrack_dir	dir:8;
	union{
		enum nft_registers	dreg:8;
		enum nft_registers	sreg:8;
	};
	uint8_t			family;
};

static void nft_ct_get_eval(const struct nft_expr *expr,
			    struct nft_data data[NFT_REG_MAX + 1],
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	struct nft_data *dest = &data[priv->dreg];
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	const struct nf_conn_help *help;
	const struct nf_conntrack_tuple *tuple;
	const struct nf_conntrack_helper *helper;
	long diff;
	unsigned int state;

	ct = nf_ct_get(pkt->skb, &ctinfo);

	switch (priv->key) {
	case NFT_CT_STATE:
		if (ct == NULL)
			state = NF_CT_STATE_INVALID_BIT;
		else if (nf_ct_is_untracked(ct))
			state = NF_CT_STATE_UNTRACKED_BIT;
		else
			state = NF_CT_STATE_BIT(ctinfo);
		dest->data[0] = state;
		return;
	}

	if (ct == NULL)
		goto err;

	switch (priv->key) {
	case NFT_CT_DIRECTION:
		dest->data[0] = CTINFO2DIR(ctinfo);
		return;
	case NFT_CT_STATUS:
		dest->data[0] = ct->status;
		return;
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		dest->data[0] = ct->mark;
		return;
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
		dest->data[0] = ct->secmark;
		return;
#endif
	case NFT_CT_EXPIRATION:
		diff = (long)jiffies - (long)ct->timeout.expires;
		if (diff < 0)
			diff = 0;
		dest->data[0] = jiffies_to_msecs(diff);
		return;
	case NFT_CT_HELPER:
		if (ct->master == NULL)
			goto err;
		help = nfct_help(ct->master);
		if (help == NULL)
			goto err;
		helper = rcu_dereference(help->helper);
		if (helper == NULL)
			goto err;
		if (strlen(helper->name) >= sizeof(dest->data))
			goto err;
		strncpy((char *)dest->data, helper->name, sizeof(dest->data));
		return;
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS: {
		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
		unsigned int size;

		if (!labels) {
			memset(dest->data, 0, sizeof(dest->data));
			return;
		}

		BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > sizeof(dest->data));
		size = labels->words * sizeof(long);

		memcpy(dest->data, labels->bits, size);
		if (size < sizeof(dest->data))
			memset(((char *) dest->data) + size, 0,
			       sizeof(dest->data) - size);
		return;
	}
#endif
	}

	tuple = &ct->tuplehash[priv->dir].tuple;
	switch (priv->key) {
	case NFT_CT_L3PROTOCOL:
		dest->data[0] = nf_ct_l3num(ct);
		return;
	case NFT_CT_SRC:
		memcpy(dest->data, tuple->src.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_DST:
		memcpy(dest->data, tuple->dst.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_PROTOCOL:
		dest->data[0] = nf_ct_protonum(ct);
		return;
	case NFT_CT_PROTO_SRC:
		dest->data[0] = (__force __u16)tuple->src.u.all;
		return;
	case NFT_CT_PROTO_DST:
		dest->data[0] = (__force __u16)tuple->dst.u.all;
		return;
	}
	return;
err:
	data[NFT_REG_VERDICT].verdict = NFT_BREAK;
}

static void nft_ct_set_eval(const struct nft_expr *expr,
			    struct nft_data data[NFT_REG_MAX + 1],
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	struct sk_buff *skb = pkt->skb;
#ifdef CONFIG_NF_CONNTRACK_MARK
	u32 value = data[priv->sreg].data[0];
#endif
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;

	switch (priv->key) {
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		if (ct->mark != value) {
			ct->mark = value;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
#endif
	}
}

static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	[NFTA_CT_DREG]		= { .type = NLA_U32 },
	[NFTA_CT_KEY]		= { .type = NLA_U32 },
	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
	[NFTA_CT_SREG]		= { .type = NLA_U32 },
};

static int nft_ct_l3proto_try_module_get(uint8_t family)
{
	int err;

	if (family == NFPROTO_INET) {
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
		if (err < 0)
			goto err1;
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
		if (err < 0)
			goto err2;
	} else {
		err = nf_ct_l3proto_try_module_get(family);
		if (err < 0)
			goto err1;
	}
	return 0;

err2:
	nf_ct_l3proto_module_put(NFPROTO_IPV4);
err1:
	return err;
}

static void nft_ct_l3proto_module_put(uint8_t family)
{
	if (family == NFPROTO_INET) {
		nf_ct_l3proto_module_put(NFPROTO_IPV4);
		nf_ct_l3proto_module_put(NFPROTO_IPV6);
	} else
		nf_ct_l3proto_module_put(family);
}

static int nft_ct_init_validate_get(const struct nft_expr *expr,
				    const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);

	if (tb[NFTA_CT_DIRECTION] != NULL) {
		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
		switch (priv->dir) {
		case IP_CT_DIR_ORIGINAL:
		case IP_CT_DIR_REPLY:
			break;
		default:
			return -EINVAL;
		}
	}

	switch (priv->key) {
	case NFT_CT_STATE:
	case NFT_CT_DIRECTION:
	case NFT_CT_STATUS:
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
#endif
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS:
#endif
	case NFT_CT_EXPIRATION:
	case NFT_CT_HELPER:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		break;
	case NFT_CT_L3PROTOCOL:
	case NFT_CT_PROTOCOL:
	case NFT_CT_SRC:
	case NFT_CT_DST:
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (tb[NFTA_CT_DIRECTION] == NULL)
			return -EINVAL;
		break;
	default:
		return -EOPNOTSUPP;
	}

	return 0;
}

static int nft_ct_init_validate_set(uint32_t key)
{
	switch (key) {
	case NFT_CT_MARK:
		break;
	default:
		return -EOPNOTSUPP;
	}

	return 0;
}

static int nft_ct_init(const struct nft_ctx *ctx,
		       const struct nft_expr *expr,
		       const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);
	int err;

	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));

	if (tb[NFTA_CT_DREG]) {
		err = nft_ct_init_validate_get(expr, tb);
		if (err < 0)
			return err;

		priv->dreg = ntohl(nla_get_be32(tb[NFTA_CT_DREG]));
		err = nft_validate_output_register(priv->dreg);
		if (err < 0)
			return err;

		err = nft_validate_data_load(ctx, priv->dreg, NULL,
					     NFT_DATA_VALUE);
		if (err < 0)
			return err;
	} else {
		err = nft_ct_init_validate_set(priv->key);
		if (err < 0)
			return err;

		priv->sreg = ntohl(nla_get_be32(tb[NFTA_CT_SREG]));
		err = nft_validate_input_register(priv->sreg);
		if (err < 0)
			return err;
	}

	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	if (err < 0)
		return err;

	priv->family = ctx->afi->family;

	return 0;
}

static void nft_ct_destroy(const struct nft_ctx *ctx,
			   const struct nft_expr *expr)
{
	struct nft_ct *priv = nft_expr_priv(expr);

	nft_ct_l3proto_module_put(priv->family);
}

static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nla_put_be32(skb, NFTA_CT_DREG, htonl(priv->dreg)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;

	switch (priv->key) {
	case NFT_CT_PROTOCOL:
	case NFT_CT_SRC:
	case NFT_CT_DST:
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
			goto nla_put_failure;
	default:
		break;
	}

	return 0;

nla_put_failure:
	return -1;
}

static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nla_put_be32(skb, NFTA_CT_SREG, htonl(priv->sreg)))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_ct_type;
static const struct nft_expr_ops nft_ct_get_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_get_eval,
	.init		= nft_ct_init,
	.destroy	= nft_ct_destroy,
	.dump		= nft_ct_get_dump,
};

static const struct nft_expr_ops nft_ct_set_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_set_eval,
	.init		= nft_ct_init,
	.destroy	= nft_ct_destroy,
	.dump		= nft_ct_set_dump,
};

static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx *ctx,
		    const struct nlattr * const tb[])
{
	if (tb[NFTA_CT_KEY] == NULL)
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG])
		return &nft_ct_get_ops;

	if (tb[NFTA_CT_SREG])
		return &nft_ct_set_ops;

	return ERR_PTR(-EINVAL);
}

static struct nft_expr_type nft_ct_type __read_mostly = {
	.name		= "ct",
	.select_ops	= &nft_ct_select_ops,
	.policy		= nft_ct_policy,
	.maxattr	= NFTA_CT_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_ct_module_init(void)
{
	return nft_register_expr(&nft_ct_type);
}

static void __exit nft_ct_module_exit(void)
{
	nft_unregister_expr(&nft_ct_type);
}

module_init(nft_ct_module_init);
module_exit(nft_ct_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_EXPR("ct");
Commit	Line	Data
96518518	1	/*
ef1f7df9	2	* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
96518518 PM	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/init.h>
	13	#include <linux/module.h>
	14	#include <linux/netlink.h>
	15	#include <linux/netfilter.h>
	16	#include <linux/netfilter/nf_tables.h>
	17	#include <net/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_conntrack.h>
	19	#include <net/netfilter/nf_conntrack_tuple.h>
	20	#include <net/netfilter/nf_conntrack_helper.h>
c4ede3d3	21	#include <net/netfilter/nf_conntrack_ecache.h>
d2bf2f34	22	#include <net/netfilter/nf_conntrack_labels.h>
96518518 PM	23
	24	struct nft_ct {
	25	enum nft_ct_keys key:8;
	26	enum ip_conntrack_dir dir:8;
c4ede3d3 KE	27	union{
	28	enum nft_registers dreg:8;
	29	enum nft_registers sreg:8;
	30	};
96518518 PM	31	uint8_t family;
	32	};
	33
c4ede3d3 KE	34	static void nft_ct_get_eval(const struct nft_expr *expr,
	35	struct nft_data data[NFT_REG_MAX + 1],
	36	const struct nft_pktinfo *pkt)
96518518 PM	37	{
	38	const struct nft_ct *priv = nft_expr_priv(expr);
	39	struct nft_data *dest = &data[priv->dreg];
	40	enum ip_conntrack_info ctinfo;
	41	const struct nf_conn *ct;
	42	const struct nf_conn_help *help;
	43	const struct nf_conntrack_tuple *tuple;
	44	const struct nf_conntrack_helper *helper;
	45	long diff;
	46	unsigned int state;
	47
	48	ct = nf_ct_get(pkt->skb, &ctinfo);
	49
	50	switch (priv->key) {
	51	case NFT_CT_STATE:
	52	if (ct == NULL)
	53	state = NF_CT_STATE_INVALID_BIT;
	54	else if (nf_ct_is_untracked(ct))
	55	state = NF_CT_STATE_UNTRACKED_BIT;
	56	else
	57	state = NF_CT_STATE_BIT(ctinfo);
	58	dest->data[0] = state;
	59	return;
	60	}
	61
	62	if (ct == NULL)
	63	goto err;
	64
	65	switch (priv->key) {
	66	case NFT_CT_DIRECTION:
	67	dest->data[0] = CTINFO2DIR(ctinfo);
	68	return;
	69	case NFT_CT_STATUS:
	70	dest->data[0] = ct->status;
	71	return;
	72	#ifdef CONFIG_NF_CONNTRACK_MARK
	73	case NFT_CT_MARK:
	74	dest->data[0] = ct->mark;
	75	return;
	76	#endif
	77	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	78	case NFT_CT_SECMARK:
	79	dest->data[0] = ct->secmark;
	80	return;
	81	#endif
	82	case NFT_CT_EXPIRATION:
	83	diff = (long)jiffies - (long)ct->timeout.expires;
	84	if (diff < 0)
	85	diff = 0;
	86	dest->data[0] = jiffies_to_msecs(diff);
	87	return;
	88	case NFT_CT_HELPER:
	89	if (ct->master == NULL)
	90	goto err;
	91	help = nfct_help(ct->master);
	92	if (help == NULL)
	93	goto err;
	94	helper = rcu_dereference(help->helper);
	95	if (helper == NULL)
	96	goto err;
	97	if (strlen(helper->name) >= sizeof(dest->data))
	98	goto err;
	99	strncpy((char *)dest->data, helper->name, sizeof(dest->data));
	100	return;
d2bf2f34 FW	101	#ifdef CONFIG_NF_CONNTRACK_LABELS
	102	case NFT_CT_LABELS: {
	103	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
	104	unsigned int size;
	105
	106	if (!labels) {
	107	memset(dest->data, 0, sizeof(dest->data));
	108	return;
	109	}
	110
	111	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > sizeof(dest->data));
	112	size = labels->words * sizeof(long);
	113
	114	memcpy(dest->data, labels->bits, size);
	115	if (size < sizeof(dest->data))
	116	memset(((char *) dest->data) + size, 0,
	117	sizeof(dest->data) - size);
	118	return;
	119	}
	120	#endif
96518518 PM	121	}
	122
	123	tuple = &ct->tuplehash[priv->dir].tuple;
	124	switch (priv->key) {
	125	case NFT_CT_L3PROTOCOL:
	126	dest->data[0] = nf_ct_l3num(ct);
	127	return;
	128	case NFT_CT_SRC:
	129	memcpy(dest->data, tuple->src.u3.all,
	130	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
	131	return;
	132	case NFT_CT_DST:
	133	memcpy(dest->data, tuple->dst.u3.all,
	134	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
	135	return;
	136	case NFT_CT_PROTOCOL:
	137	dest->data[0] = nf_ct_protonum(ct);
	138	return;
	139	case NFT_CT_PROTO_SRC:
	140	dest->data[0] = (__force __u16)tuple->src.u.all;
	141	return;
	142	case NFT_CT_PROTO_DST:
	143	dest->data[0] = (__force __u16)tuple->dst.u.all;
	144	return;
	145	}
	146	return;
	147	err:
	148	data[NFT_REG_VERDICT].verdict = NFT_BREAK;
	149	}
	150
c4ede3d3 KE	151	static void nft_ct_set_eval(const struct nft_expr *expr,
	152	struct nft_data data[NFT_REG_MAX + 1],
	153	const struct nft_pktinfo *pkt)
	154	{
	155	const struct nft_ct *priv = nft_expr_priv(expr);
	156	struct sk_buff *skb = pkt->skb;
847c8e29	157	#ifdef CONFIG_NF_CONNTRACK_MARK
c4ede3d3	158	u32 value = data[priv->sreg].data[0];
847c8e29	159	#endif
c4ede3d3 KE	160	enum ip_conntrack_info ctinfo;
	161	struct nf_conn *ct;
	162
	163	ct = nf_ct_get(skb, &ctinfo);
	164	if (ct == NULL)
	165	return;
	166
	167	switch (priv->key) {
	168	#ifdef CONFIG_NF_CONNTRACK_MARK
	169	case NFT_CT_MARK:
	170	if (ct->mark != value) {
	171	ct->mark = value;
	172	nf_conntrack_event_cache(IPCT_MARK, ct);
	173	}
	174	break;
	175	#endif
	176	}
	177	}
	178
96518518 PM	179	static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	180	[NFTA_CT_DREG] = { .type = NLA_U32 },
	181	[NFTA_CT_KEY] = { .type = NLA_U32 },
	182	[NFTA_CT_DIRECTION] = { .type = NLA_U8 },
c4ede3d3	183	[NFTA_CT_SREG] = { .type = NLA_U32 },
96518518 PM	184	};
96518518 PM	185
9638f33e PM	186	static int nft_ct_l3proto_try_module_get(uint8_t family)
	187	{
	188	int err;
	189
	190	if (family == NFPROTO_INET) {
	191	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
	192	if (err < 0)
	193	goto err1;
	194	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
	195	if (err < 0)
	196	goto err2;
	197	} else {
	198	err = nf_ct_l3proto_try_module_get(family);
	199	if (err < 0)
	200	goto err1;
	201	}
	202	return 0;
	203
	204	err2:
	205	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	206	err1:
	207	return err;
	208	}
	209
	210	static void nft_ct_l3proto_module_put(uint8_t family)
	211	{
	212	if (family == NFPROTO_INET) {
	213	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	214	nf_ct_l3proto_module_put(NFPROTO_IPV6);
	215	} else
	216	nf_ct_l3proto_module_put(family);
	217	}
	218
c4ede3d3 KE	219	static int nft_ct_init_validate_get(const struct nft_expr *expr,
c4ede3d3 KE	220	const struct nlattr * const tb[])
96518518 PM	221	{
96518518 PM	222	struct nft_ct *priv = nft_expr_priv(expr);
96518518	223
96518518 PM	224	if (tb[NFTA_CT_DIRECTION] != NULL) {
	225	priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
	226	switch (priv->dir) {
	227	case IP_CT_DIR_ORIGINAL:
	228	case IP_CT_DIR_REPLY:
	229	break;
	230	default:
	231	return -EINVAL;
	232	}
	233	}
	234
	235	switch (priv->key) {
	236	case NFT_CT_STATE:
	237	case NFT_CT_DIRECTION:
	238	case NFT_CT_STATUS:
	239	#ifdef CONFIG_NF_CONNTRACK_MARK
	240	case NFT_CT_MARK:
	241	#endif
	242	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	243	case NFT_CT_SECMARK:
d2bf2f34 FW	244	#endif
	245	#ifdef CONFIG_NF_CONNTRACK_LABELS
	246	case NFT_CT_LABELS:
96518518 PM	247	#endif
	248	case NFT_CT_EXPIRATION:
	249	case NFT_CT_HELPER:
	250	if (tb[NFTA_CT_DIRECTION] != NULL)
	251	return -EINVAL;
	252	break;
51292c07	253	case NFT_CT_L3PROTOCOL:
96518518 PM	254	case NFT_CT_PROTOCOL:
	255	case NFT_CT_SRC:
	256	case NFT_CT_DST:
	257	case NFT_CT_PROTO_SRC:
	258	case NFT_CT_PROTO_DST:
	259	if (tb[NFTA_CT_DIRECTION] == NULL)
	260	return -EINVAL;
	261	break;
	262	default:
	263	return -EOPNOTSUPP;
	264	}
	265
c4ede3d3 KE	266	return 0;
	267	}
	268
	269	static int nft_ct_init_validate_set(uint32_t key)
	270	{
	271	switch (key) {
	272	case NFT_CT_MARK:
	273	break;
	274	default:
	275	return -EOPNOTSUPP;
	276	}
	277
	278	return 0;
	279	}
	280
	281	static int nft_ct_init(const struct nft_ctx *ctx,
	282	const struct nft_expr *expr,
	283	const struct nlattr * const tb[])
	284	{
	285	struct nft_ct *priv = nft_expr_priv(expr);
	286	int err;
	287
	288	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	289
	290	if (tb[NFTA_CT_DREG]) {
	291	err = nft_ct_init_validate_get(expr, tb);
	292	if (err < 0)
	293	return err;
	294
	295	priv->dreg = ntohl(nla_get_be32(tb[NFTA_CT_DREG]));
	296	err = nft_validate_output_register(priv->dreg);
	297	if (err < 0)
	298	return err;
	299
	300	err = nft_validate_data_load(ctx, priv->dreg, NULL,
	301	NFT_DATA_VALUE);
	302	if (err < 0)
	303	return err;
	304	} else {
	305	err = nft_ct_init_validate_set(priv->key);
	306	if (err < 0)
	307	return err;
	308
	309	priv->sreg = ntohl(nla_get_be32(tb[NFTA_CT_SREG]));
	310	err = nft_validate_input_register(priv->sreg);
	311	if (err < 0)
	312	return err;
	313	}
	314
9638f33e	315	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
96518518 PM	316	if (err < 0)
96518518 PM	317	return err;
96518518	318
c4ede3d3	319	priv->family = ctx->afi->family;
96518518	320
96518518	321	return 0;
96518518 PM	322	}
96518518 PM	323
62472bce PM	324	static void nft_ct_destroy(const struct nft_ctx *ctx,
62472bce PM	325	const struct nft_expr *expr)
96518518 PM	326	{
	327	struct nft_ct *priv = nft_expr_priv(expr);
	328
9638f33e	329	nft_ct_l3proto_module_put(priv->family);
96518518 PM	330	}
96518518 PM	331
c4ede3d3	332	static int nft_ct_get_dump(struct sk_buff skb, const struct nft_expr expr)
96518518 PM	333	{
	334	const struct nft_ct *priv = nft_expr_priv(expr);
	335
	336	if (nla_put_be32(skb, NFTA_CT_DREG, htonl(priv->dreg)))
	337	goto nla_put_failure;
	338	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	339	goto nla_put_failure;
2a53bfb3 AB	340
	341	switch (priv->key) {
	342	case NFT_CT_PROTOCOL:
	343	case NFT_CT_SRC:
	344	case NFT_CT_DST:
	345	case NFT_CT_PROTO_SRC:
	346	case NFT_CT_PROTO_DST:
	347	if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
	348	goto nla_put_failure;
	349	default:
	350	break;
	351	}
	352
96518518 PM	353	return 0;
	354
	355	nla_put_failure:
	356	return -1;
	357	}
	358
c4ede3d3 KE	359	static int nft_ct_set_dump(struct sk_buff skb, const struct nft_expr expr)
	360	{
	361	const struct nft_ct *priv = nft_expr_priv(expr);
	362
	363	if (nla_put_be32(skb, NFTA_CT_SREG, htonl(priv->sreg)))
	364	goto nla_put_failure;
	365	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	366	goto nla_put_failure;
	367	return 0;
	368
	369	nla_put_failure:
	370	return -1;
	371	}
	372
ef1f7df9	373	static struct nft_expr_type nft_ct_type;
c4ede3d3	374	static const struct nft_expr_ops nft_ct_get_ops = {
ef1f7df9	375	.type = &nft_ct_type,
96518518	376	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
c4ede3d3	377	.eval = nft_ct_get_eval,
96518518 PM	378	.init = nft_ct_init,
96518518 PM	379	.destroy = nft_ct_destroy,
c4ede3d3	380	.dump = nft_ct_get_dump,
ef1f7df9 PM	381	};
ef1f7df9 PM	382
c4ede3d3 KE	383	static const struct nft_expr_ops nft_ct_set_ops = {
	384	.type = &nft_ct_type,
	385	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	386	.eval = nft_ct_set_eval,
	387	.init = nft_ct_init,
	388	.destroy = nft_ct_destroy,
	389	.dump = nft_ct_set_dump,
	390	};
	391
	392	static const struct nft_expr_ops *
	393	nft_ct_select_ops(const struct nft_ctx *ctx,
	394	const struct nlattr * const tb[])
	395	{
	396	if (tb[NFTA_CT_KEY] == NULL)
	397	return ERR_PTR(-EINVAL);
	398
	399	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
	400	return ERR_PTR(-EINVAL);
	401
	402	if (tb[NFTA_CT_DREG])
	403	return &nft_ct_get_ops;
	404
	405	if (tb[NFTA_CT_SREG])
	406	return &nft_ct_set_ops;
	407
	408	return ERR_PTR(-EINVAL);
	409	}
	410
ef1f7df9 PM	411	static struct nft_expr_type nft_ct_type __read_mostly = {
ef1f7df9 PM	412	.name = "ct",
c4ede3d3	413	.select_ops = &nft_ct_select_ops,
96518518 PM	414	.policy = nft_ct_policy,
96518518 PM	415	.maxattr = NFTA_CT_MAX,
ef1f7df9	416	.owner = THIS_MODULE,
96518518 PM	417	};
	418
	419	static int __init nft_ct_module_init(void)
	420	{
ef1f7df9	421	return nft_register_expr(&nft_ct_type);
96518518 PM	422	}
	423
	424	static void __exit nft_ct_module_exit(void)
	425	{
ef1f7df9	426	nft_unregister_expr(&nft_ct_type);
96518518 PM	427	}
	428
	429	module_init(nft_ct_module_init);
	430	module_exit(nft_ct_module_exit);
	431
	432	MODULE_LICENSE("GPL");
	433	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	434	MODULE_ALIAS_NFT_EXPR("ct");