net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/netlink.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nf_tables.h>
  17 #include <net/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_conntrack.h>
  19 #include <net/netfilter/nf_conntrack_tuple.h>
  20 #include <net/netfilter/nf_conntrack_helper.h>
  21 #include <net/netfilter/nf_conntrack_ecache.h>
  22 #include <net/netfilter/nf_conntrack_labels.h>
  23
  24 struct nft_ct {
  25         enum nft_ct_keys        key:8;
  26         enum ip_conntrack_dir   dir:8;
  27         union {
  28                 enum nft_registers      dreg:8;
  29                 enum nft_registers      sreg:8;
  30         };
  31 };
  32
  33 static void nft_ct_get_eval(const struct nft_expr *expr,
  34                             struct nft_data data[NFT_REG_MAX + 1],
  35                             const struct nft_pktinfo *pkt)
  36 {
  37         const struct nft_ct *priv = nft_expr_priv(expr);
  38         struct nft_data *dest = &data[priv->dreg];
  39         enum ip_conntrack_info ctinfo;
  40         const struct nf_conn *ct;
  41         const struct nf_conn_help *help;
  42         const struct nf_conntrack_tuple *tuple;
  43         const struct nf_conntrack_helper *helper;
  44         long diff;
  45         unsigned int state;
  46
  47         ct = nf_ct_get(pkt->skb, &ctinfo);
  48
  49         switch (priv->key) {
  50         case NFT_CT_STATE:
  51                 if (ct == NULL)
  52                         state = NF_CT_STATE_INVALID_BIT;
  53                 else if (nf_ct_is_untracked(ct))
  54                         state = NF_CT_STATE_UNTRACKED_BIT;
  55                 else
  56                         state = NF_CT_STATE_BIT(ctinfo);
  57                 dest->data[0] = state;
  58                 return;
  59         default:
  60                 break;
  61         }
  62
  63         if (ct == NULL)
  64                 goto err;
  65
  66         switch (priv->key) {
  67         case NFT_CT_DIRECTION:
  68                 dest->data[0] = CTINFO2DIR(ctinfo);
  69                 return;
  70         case NFT_CT_STATUS:
  71                 dest->data[0] = ct->status;
  72                 return;
  73 #ifdef CONFIG_NF_CONNTRACK_MARK
  74         case NFT_CT_MARK:
  75                 dest->data[0] = ct->mark;
  76                 return;
  77 #endif
  78 #ifdef CONFIG_NF_CONNTRACK_SECMARK
  79         case NFT_CT_SECMARK:
  80                 dest->data[0] = ct->secmark;
  81                 return;
  82 #endif
  83         case NFT_CT_EXPIRATION:
  84                 diff = (long)jiffies - (long)ct->timeout.expires;
  85                 if (diff < 0)
  86                         diff = 0;
  87                 dest->data[0] = jiffies_to_msecs(diff);
  88                 return;
  89         case NFT_CT_HELPER:
  90                 if (ct->master == NULL)
  91                         goto err;
  92                 help = nfct_help(ct->master);
  93                 if (help == NULL)
  94                         goto err;
  95                 helper = rcu_dereference(help->helper);
  96                 if (helper == NULL)
  97                         goto err;
  98                 strncpy((char *)dest->data, helper->name, sizeof(dest->data));
  99                 return;
 100 #ifdef CONFIG_NF_CONNTRACK_LABELS
 101         case NFT_CT_LABELS: {
 102                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 103                 unsigned int size;
 104
 105                 if (!labels) {
 106                         memset(dest->data, 0, sizeof(dest->data));
 107                         return;
 108                 }
 109
 110                 size = labels->words * sizeof(long);
 111                 memcpy(dest->data, labels->bits, size);
 112                 if (size < sizeof(dest->data))
 113                         memset(((char *) dest->data) + size, 0,
 114                                sizeof(dest->data) - size);
 115                 return;
 116         }
 117 #endif
 118         default:
 119                 break;
 120         }
 121
 122         tuple = &ct->tuplehash[priv->dir].tuple;
 123         switch (priv->key) {
 124         case NFT_CT_L3PROTOCOL:
 125                 dest->data[0] = nf_ct_l3num(ct);
 126                 return;
 127         case NFT_CT_SRC:
 128                 memcpy(dest->data, tuple->src.u3.all,
 129                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 130                 return;
 131         case NFT_CT_DST:
 132                 memcpy(dest->data, tuple->dst.u3.all,
 133                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 134                 return;
 135         case NFT_CT_PROTOCOL:
 136                 dest->data[0] = nf_ct_protonum(ct);
 137                 return;
 138         case NFT_CT_PROTO_SRC:
 139                 dest->data[0] = (__force __u16)tuple->src.u.all;
 140                 return;
 141         case NFT_CT_PROTO_DST:
 142                 dest->data[0] = (__force __u16)tuple->dst.u.all;
 143                 return;
 144         default:
 145                 break;
 146         }
 147         return;
 148 err:
 149         data[NFT_REG_VERDICT].verdict = NFT_BREAK;
 150 }
 151
 152 static void nft_ct_set_eval(const struct nft_expr *expr,
 153                             struct nft_data data[NFT_REG_MAX + 1],
 154                             const struct nft_pktinfo *pkt)
 155 {
 156         const struct nft_ct *priv = nft_expr_priv(expr);
 157         struct sk_buff *skb = pkt->skb;
 158 #ifdef CONFIG_NF_CONNTRACK_MARK
 159         u32 value = data[priv->sreg].data[0];
 160 #endif
 161         enum ip_conntrack_info ctinfo;
 162         struct nf_conn *ct;
 163
 164         ct = nf_ct_get(skb, &ctinfo);
 165         if (ct == NULL)
 166                 return;
 167
 168         switch (priv->key) {
 169 #ifdef CONFIG_NF_CONNTRACK_MARK
 170         case NFT_CT_MARK:
 171                 if (ct->mark != value) {
 172                         ct->mark = value;
 173                         nf_conntrack_event_cache(IPCT_MARK, ct);
 174                 }
 175                 break;
 176 #endif
 177         default:
 178                 break;
 179         }
 180 }
 181
 182 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 183         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 184         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 185         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 186         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 187 };
 188
 189 static int nft_ct_l3proto_try_module_get(uint8_t family)
 190 {
 191         int err;
 192
 193         if (family == NFPROTO_INET) {
 194                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
 195                 if (err < 0)
 196                         goto err1;
 197                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
 198                 if (err < 0)
 199                         goto err2;
 200         } else {
 201                 err = nf_ct_l3proto_try_module_get(family);
 202                 if (err < 0)
 203                         goto err1;
 204         }
 205         return 0;
 206
 207 err2:
 208         nf_ct_l3proto_module_put(NFPROTO_IPV4);
 209 err1:
 210         return err;
 211 }
 212
 213 static void nft_ct_l3proto_module_put(uint8_t family)
 214 {
 215         if (family == NFPROTO_INET) {
 216                 nf_ct_l3proto_module_put(NFPROTO_IPV4);
 217                 nf_ct_l3proto_module_put(NFPROTO_IPV6);
 218         } else
 219                 nf_ct_l3proto_module_put(family);
 220 }
 221
 222 static int nft_ct_get_init(const struct nft_ctx *ctx,
 223                            const struct nft_expr *expr,
 224                            const struct nlattr * const tb[])
 225 {
 226         struct nft_ct *priv = nft_expr_priv(expr);
 227         unsigned int len;
 228         int err;
 229
 230         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 231         switch (priv->key) {
 232         case NFT_CT_DIRECTION:
 233                 if (tb[NFTA_CT_DIRECTION] != NULL)
 234                         return -EINVAL;
 235                 len = sizeof(u8);
 236                 break;
 237         case NFT_CT_STATE:
 238         case NFT_CT_STATUS:
 239 #ifdef CONFIG_NF_CONNTRACK_MARK
 240         case NFT_CT_MARK:
 241 #endif
 242 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 243         case NFT_CT_SECMARK:
 244 #endif
 245         case NFT_CT_EXPIRATION:
 246                 if (tb[NFTA_CT_DIRECTION] != NULL)
 247                         return -EINVAL;
 248                 len = sizeof(u32);
 249                 break;
 250 #ifdef CONFIG_NF_CONNTRACK_LABELS
 251         case NFT_CT_LABELS:
 252                 if (tb[NFTA_CT_DIRECTION] != NULL)
 253                         return -EINVAL;
 254                 len = NF_CT_LABELS_MAX_SIZE;
 255                 break;
 256 #endif
 257         case NFT_CT_HELPER:
 258                 if (tb[NFTA_CT_DIRECTION] != NULL)
 259                         return -EINVAL;
 260                 len = NF_CT_HELPER_NAME_LEN;
 261                 break;
 262
 263         case NFT_CT_L3PROTOCOL:
 264         case NFT_CT_PROTOCOL:
 265                 if (tb[NFTA_CT_DIRECTION] == NULL)
 266                         return -EINVAL;
 267                 len = sizeof(u8);
 268                 break;
 269         case NFT_CT_SRC:
 270         case NFT_CT_DST:
 271                 if (tb[NFTA_CT_DIRECTION] == NULL)
 272                         return -EINVAL;
 273
 274                 switch (ctx->afi->family) {
 275                 case NFPROTO_IPV4:
 276                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 277                                            src.u3.ip);
 278                         break;
 279                 case NFPROTO_IPV6:
 280                 case NFPROTO_INET:
 281                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 282                                            src.u3.ip6);
 283                         break;
 284                 default:
 285                         return -EAFNOSUPPORT;
 286                 }
 287                 break;
 288         case NFT_CT_PROTO_SRC:
 289         case NFT_CT_PROTO_DST:
 290                 if (tb[NFTA_CT_DIRECTION] == NULL)
 291                         return -EINVAL;
 292                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
 293                 break;
 294         default:
 295                 return -EOPNOTSUPP;
 296         }
 297
 298         if (tb[NFTA_CT_DIRECTION] != NULL) {
 299                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 300                 switch (priv->dir) {
 301                 case IP_CT_DIR_ORIGINAL:
 302                 case IP_CT_DIR_REPLY:
 303                         break;
 304                 default:
 305                         return -EINVAL;
 306                 }
 307         }
 308
 309         priv->dreg = ntohl(nla_get_be32(tb[NFTA_CT_DREG]));
 310         err = nft_validate_output_register(priv->dreg);
 311         if (err < 0)
 312                 return err;
 313
 314         err = nft_validate_data_load(ctx, priv->dreg, NULL,
 315                                      NFT_DATA_VALUE, len);
 316         if (err < 0)
 317                 return err;
 318
 319         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 320         if (err < 0)
 321                 return err;
 322
 323         return 0;
 324 }
 325
 326 static int nft_ct_set_init(const struct nft_ctx *ctx,
 327                            const struct nft_expr *expr,
 328                            const struct nlattr * const tb[])
 329 {
 330         struct nft_ct *priv = nft_expr_priv(expr);
 331         int err;
 332
 333         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 334         switch (priv->key) {
 335 #ifdef CONFIG_NF_CONNTRACK_MARK
 336         case NFT_CT_MARK:
 337                 break;
 338 #endif
 339         default:
 340                 return -EOPNOTSUPP;
 341         }
 342
 343         priv->sreg = ntohl(nla_get_be32(tb[NFTA_CT_SREG]));
 344         err = nft_validate_input_register(priv->sreg);
 345         if (err < 0)
 346                 return err;
 347
 348         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 349         if (err < 0)
 350                 return err;
 351
 352         return 0;
 353 }
 354
 355 static void nft_ct_destroy(const struct nft_ctx *ctx,
 356                            const struct nft_expr *expr)
 357 {
 358         nft_ct_l3proto_module_put(ctx->afi->family);
 359 }
 360
 361 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 362 {
 363         const struct nft_ct *priv = nft_expr_priv(expr);
 364
 365         if (nla_put_be32(skb, NFTA_CT_DREG, htonl(priv->dreg)))
 366                 goto nla_put_failure;
 367         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 368                 goto nla_put_failure;
 369
 370         switch (priv->key) {
 371         case NFT_CT_PROTOCOL:
 372         case NFT_CT_SRC:
 373         case NFT_CT_DST:
 374         case NFT_CT_PROTO_SRC:
 375         case NFT_CT_PROTO_DST:
 376                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 377                         goto nla_put_failure;
 378         default:
 379                 break;
 380         }
 381
 382         return 0;
 383
 384 nla_put_failure:
 385         return -1;
 386 }
 387
 388 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 389 {
 390         const struct nft_ct *priv = nft_expr_priv(expr);
 391
 392         if (nla_put_be32(skb, NFTA_CT_SREG, htonl(priv->sreg)))
 393                 goto nla_put_failure;
 394         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 395                 goto nla_put_failure;
 396         return 0;
 397
 398 nla_put_failure:
 399         return -1;
 400 }
 401
 402 static struct nft_expr_type nft_ct_type;
 403 static const struct nft_expr_ops nft_ct_get_ops = {
 404         .type           = &nft_ct_type,
 405         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 406         .eval           = nft_ct_get_eval,
 407         .init           = nft_ct_get_init,
 408         .destroy        = nft_ct_destroy,
 409         .dump           = nft_ct_get_dump,
 410 };
 411
 412 static const struct nft_expr_ops nft_ct_set_ops = {
 413         .type           = &nft_ct_type,
 414         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 415         .eval           = nft_ct_set_eval,
 416         .init           = nft_ct_set_init,
 417         .destroy        = nft_ct_destroy,
 418         .dump           = nft_ct_set_dump,
 419 };
 420
 421 static const struct nft_expr_ops *
 422 nft_ct_select_ops(const struct nft_ctx *ctx,
 423                     const struct nlattr * const tb[])
 424 {
 425         if (tb[NFTA_CT_KEY] == NULL)
 426                 return ERR_PTR(-EINVAL);
 427
 428         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 429                 return ERR_PTR(-EINVAL);
 430
 431         if (tb[NFTA_CT_DREG])
 432                 return &nft_ct_get_ops;
 433
 434         if (tb[NFTA_CT_SREG])
 435                 return &nft_ct_set_ops;
 436
 437         return ERR_PTR(-EINVAL);
 438 }
 439
 440 static struct nft_expr_type nft_ct_type __read_mostly = {
 441         .name           = "ct",
 442         .select_ops     = &nft_ct_select_ops,
 443         .policy         = nft_ct_policy,
 444         .maxattr        = NFTA_CT_MAX,
 445         .owner          = THIS_MODULE,
 446 };
 447
 448 static int __init nft_ct_module_init(void)
 449 {
 450         return nft_register_expr(&nft_ct_type);
 451 }
 452
 453 static void __exit nft_ct_module_exit(void)
 454 {
 455         nft_unregister_expr(&nft_ct_type);
 456 }
 457
 458 module_init(nft_ct_module_init);
 459 module_exit(nft_ct_module_exit);
 460
 461 MODULE_LICENSE("GPL");
 462 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 463 MODULE_ALIAS_NFT_EXPR("ct");