net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/netlink.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nf_tables.h>
  17 #include <net/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_conntrack.h>
  19 #include <net/netfilter/nf_conntrack_tuple.h>
  20 #include <net/netfilter/nf_conntrack_helper.h>
  21 #include <net/netfilter/nf_conntrack_ecache.h>
  22 #include <net/netfilter/nf_conntrack_labels.h>
  23
  24 struct nft_ct {
  25         enum nft_ct_keys        key:8;
  26         enum ip_conntrack_dir   dir:8;
  27         union{
  28                 enum nft_registers      dreg:8;
  29                 enum nft_registers      sreg:8;
  30         };
  31         uint8_t                 family;
  32 };
  33
  34 static void nft_ct_get_eval(const struct nft_expr *expr,
  35                             struct nft_data data[NFT_REG_MAX + 1],
  36                             const struct nft_pktinfo *pkt)
  37 {
  38         const struct nft_ct *priv = nft_expr_priv(expr);
  39         struct nft_data *dest = &data[priv->dreg];
  40         enum ip_conntrack_info ctinfo;
  41         const struct nf_conn *ct;
  42         const struct nf_conn_help *help;
  43         const struct nf_conntrack_tuple *tuple;
  44         const struct nf_conntrack_helper *helper;
  45         long diff;
  46         unsigned int state;
  47
  48         ct = nf_ct_get(pkt->skb, &ctinfo);
  49
  50         switch (priv->key) {
  51         case NFT_CT_STATE:
  52                 if (ct == NULL)
  53                         state = NF_CT_STATE_INVALID_BIT;
  54                 else if (nf_ct_is_untracked(ct))
  55                         state = NF_CT_STATE_UNTRACKED_BIT;
  56                 else
  57                         state = NF_CT_STATE_BIT(ctinfo);
  58                 dest->data[0] = state;
  59                 return;
  60         }
  61
  62         if (ct == NULL)
  63                 goto err;
  64
  65         switch (priv->key) {
  66         case NFT_CT_DIRECTION:
  67                 dest->data[0] = CTINFO2DIR(ctinfo);
  68                 return;
  69         case NFT_CT_STATUS:
  70                 dest->data[0] = ct->status;
  71                 return;
  72 #ifdef CONFIG_NF_CONNTRACK_MARK
  73         case NFT_CT_MARK:
  74                 dest->data[0] = ct->mark;
  75                 return;
  76 #endif
  77 #ifdef CONFIG_NF_CONNTRACK_SECMARK
  78         case NFT_CT_SECMARK:
  79                 dest->data[0] = ct->secmark;
  80                 return;
  81 #endif
  82         case NFT_CT_EXPIRATION:
  83                 diff = (long)jiffies - (long)ct->timeout.expires;
  84                 if (diff < 0)
  85                         diff = 0;
  86                 dest->data[0] = jiffies_to_msecs(diff);
  87                 return;
  88         case NFT_CT_HELPER:
  89                 if (ct->master == NULL)
  90                         goto err;
  91                 help = nfct_help(ct->master);
  92                 if (help == NULL)
  93                         goto err;
  94                 helper = rcu_dereference(help->helper);
  95                 if (helper == NULL)
  96                         goto err;
  97                 if (strlen(helper->name) >= sizeof(dest->data))
  98                         goto err;
  99                 strncpy((char *)dest->data, helper->name, sizeof(dest->data));
 100                 return;
 101 #ifdef CONFIG_NF_CONNTRACK_LABELS
 102         case NFT_CT_LABELS: {
 103                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 104                 unsigned int size;
 105
 106                 if (!labels) {
 107                         memset(dest->data, 0, sizeof(dest->data));
 108                         return;
 109                 }
 110
 111                 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > sizeof(dest->data));
 112                 size = labels->words * sizeof(long);
 113
 114                 memcpy(dest->data, labels->bits, size);
 115                 if (size < sizeof(dest->data))
 116                         memset(((char *) dest->data) + size, 0,
 117                                sizeof(dest->data) - size);
 118                 return;
 119         }
 120 #endif
 121         }
 122
 123         tuple = &ct->tuplehash[priv->dir].tuple;
 124         switch (priv->key) {
 125         case NFT_CT_L3PROTOCOL:
 126                 dest->data[0] = nf_ct_l3num(ct);
 127                 return;
 128         case NFT_CT_SRC:
 129                 memcpy(dest->data, tuple->src.u3.all,
 130                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 131                 return;
 132         case NFT_CT_DST:
 133                 memcpy(dest->data, tuple->dst.u3.all,
 134                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 135                 return;
 136         case NFT_CT_PROTOCOL:
 137                 dest->data[0] = nf_ct_protonum(ct);
 138                 return;
 139         case NFT_CT_PROTO_SRC:
 140                 dest->data[0] = (__force __u16)tuple->src.u.all;
 141                 return;
 142         case NFT_CT_PROTO_DST:
 143                 dest->data[0] = (__force __u16)tuple->dst.u.all;
 144                 return;
 145         }
 146         return;
 147 err:
 148         data[NFT_REG_VERDICT].verdict = NFT_BREAK;
 149 }
 150
 151 static void nft_ct_set_eval(const struct nft_expr *expr,
 152                             struct nft_data data[NFT_REG_MAX + 1],
 153                             const struct nft_pktinfo *pkt)
 154 {
 155         const struct nft_ct *priv = nft_expr_priv(expr);
 156         struct sk_buff *skb = pkt->skb;
 157 #ifdef CONFIG_NF_CONNTRACK_MARK
 158         u32 value = data[priv->sreg].data[0];
 159 #endif
 160         enum ip_conntrack_info ctinfo;
 161         struct nf_conn *ct;
 162
 163         ct = nf_ct_get(skb, &ctinfo);
 164         if (ct == NULL)
 165                 return;
 166
 167         switch (priv->key) {
 168 #ifdef CONFIG_NF_CONNTRACK_MARK
 169         case NFT_CT_MARK:
 170                 if (ct->mark != value) {
 171                         ct->mark = value;
 172                         nf_conntrack_event_cache(IPCT_MARK, ct);
 173                 }
 174                 break;
 175 #endif
 176         }
 177 }
 178
 179 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 180         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 181         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 182         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 183         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 184 };
 185
 186 static int nft_ct_l3proto_try_module_get(uint8_t family)
 187 {
 188         int err;
 189
 190         if (family == NFPROTO_INET) {
 191                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
 192                 if (err < 0)
 193                         goto err1;
 194                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
 195                 if (err < 0)
 196                         goto err2;
 197         } else {
 198                 err = nf_ct_l3proto_try_module_get(family);
 199                 if (err < 0)
 200                         goto err1;
 201         }
 202         return 0;
 203
 204 err2:
 205         nf_ct_l3proto_module_put(NFPROTO_IPV4);
 206 err1:
 207         return err;
 208 }
 209
 210 static void nft_ct_l3proto_module_put(uint8_t family)
 211 {
 212         if (family == NFPROTO_INET) {
 213                 nf_ct_l3proto_module_put(NFPROTO_IPV4);
 214                 nf_ct_l3proto_module_put(NFPROTO_IPV6);
 215         } else
 216                 nf_ct_l3proto_module_put(family);
 217 }
 218
 219 static int nft_ct_init_validate_get(const struct nft_expr *expr,
 220                                     const struct nlattr * const tb[])
 221 {
 222         struct nft_ct *priv = nft_expr_priv(expr);
 223
 224         if (tb[NFTA_CT_DIRECTION] != NULL) {
 225                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 226                 switch (priv->dir) {
 227                 case IP_CT_DIR_ORIGINAL:
 228                 case IP_CT_DIR_REPLY:
 229                         break;
 230                 default:
 231                         return -EINVAL;
 232                 }
 233         }
 234
 235         switch (priv->key) {
 236         case NFT_CT_STATE:
 237         case NFT_CT_DIRECTION:
 238         case NFT_CT_STATUS:
 239 #ifdef CONFIG_NF_CONNTRACK_MARK
 240         case NFT_CT_MARK:
 241 #endif
 242 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 243         case NFT_CT_SECMARK:
 244 #endif
 245 #ifdef CONFIG_NF_CONNTRACK_LABELS
 246         case NFT_CT_LABELS:
 247 #endif
 248         case NFT_CT_EXPIRATION:
 249         case NFT_CT_HELPER:
 250                 if (tb[NFTA_CT_DIRECTION] != NULL)
 251                         return -EINVAL;
 252                 break;
 253         case NFT_CT_L3PROTOCOL:
 254         case NFT_CT_PROTOCOL:
 255         case NFT_CT_SRC:
 256         case NFT_CT_DST:
 257         case NFT_CT_PROTO_SRC:
 258         case NFT_CT_PROTO_DST:
 259                 if (tb[NFTA_CT_DIRECTION] == NULL)
 260                         return -EINVAL;
 261                 break;
 262         default:
 263                 return -EOPNOTSUPP;
 264         }
 265
 266         return 0;
 267 }
 268
 269 static int nft_ct_init_validate_set(uint32_t key)
 270 {
 271         switch (key) {
 272         case NFT_CT_MARK:
 273                 break;
 274         default:
 275                 return -EOPNOTSUPP;
 276         }
 277
 278         return 0;
 279 }
 280
 281 static int nft_ct_init(const struct nft_ctx *ctx,
 282                        const struct nft_expr *expr,
 283                        const struct nlattr * const tb[])
 284 {
 285         struct nft_ct *priv = nft_expr_priv(expr);
 286         int err;
 287
 288         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 289
 290         if (tb[NFTA_CT_DREG]) {
 291                 err = nft_ct_init_validate_get(expr, tb);
 292                 if (err < 0)
 293                         return err;
 294
 295                 priv->dreg = ntohl(nla_get_be32(tb[NFTA_CT_DREG]));
 296                 err = nft_validate_output_register(priv->dreg);
 297                 if (err < 0)
 298                         return err;
 299
 300                 err = nft_validate_data_load(ctx, priv->dreg, NULL,
 301                                              NFT_DATA_VALUE);
 302                 if (err < 0)
 303                         return err;
 304         } else {
 305                 err = nft_ct_init_validate_set(priv->key);
 306                 if (err < 0)
 307                         return err;
 308
 309                 priv->sreg = ntohl(nla_get_be32(tb[NFTA_CT_SREG]));
 310                 err = nft_validate_input_register(priv->sreg);
 311                 if (err < 0)
 312                         return err;
 313         }
 314
 315         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 316         if (err < 0)
 317                 return err;
 318
 319         priv->family = ctx->afi->family;
 320
 321         return 0;
 322 }
 323
 324 static void nft_ct_destroy(const struct nft_expr *expr)
 325 {
 326         struct nft_ct *priv = nft_expr_priv(expr);
 327
 328         nft_ct_l3proto_module_put(priv->family);
 329 }
 330
 331 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 332 {
 333         const struct nft_ct *priv = nft_expr_priv(expr);
 334
 335         if (nla_put_be32(skb, NFTA_CT_DREG, htonl(priv->dreg)))
 336                 goto nla_put_failure;
 337         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 338                 goto nla_put_failure;
 339
 340         switch (priv->key) {
 341         case NFT_CT_PROTOCOL:
 342         case NFT_CT_SRC:
 343         case NFT_CT_DST:
 344         case NFT_CT_PROTO_SRC:
 345         case NFT_CT_PROTO_DST:
 346                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 347                         goto nla_put_failure;
 348         default:
 349                 break;
 350         }
 351
 352         return 0;
 353
 354 nla_put_failure:
 355         return -1;
 356 }
 357
 358 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 359 {
 360         const struct nft_ct *priv = nft_expr_priv(expr);
 361
 362         if (nla_put_be32(skb, NFTA_CT_SREG, htonl(priv->sreg)))
 363                 goto nla_put_failure;
 364         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 365                 goto nla_put_failure;
 366         return 0;
 367
 368 nla_put_failure:
 369         return -1;
 370 }
 371
 372 static struct nft_expr_type nft_ct_type;
 373 static const struct nft_expr_ops nft_ct_get_ops = {
 374         .type           = &nft_ct_type,
 375         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 376         .eval           = nft_ct_get_eval,
 377         .init           = nft_ct_init,
 378         .destroy        = nft_ct_destroy,
 379         .dump           = nft_ct_get_dump,
 380 };
 381
 382 static const struct nft_expr_ops nft_ct_set_ops = {
 383         .type           = &nft_ct_type,
 384         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 385         .eval           = nft_ct_set_eval,
 386         .init           = nft_ct_init,
 387         .destroy        = nft_ct_destroy,
 388         .dump           = nft_ct_set_dump,
 389 };
 390
 391 static const struct nft_expr_ops *
 392 nft_ct_select_ops(const struct nft_ctx *ctx,
 393                     const struct nlattr * const tb[])
 394 {
 395         if (tb[NFTA_CT_KEY] == NULL)
 396                 return ERR_PTR(-EINVAL);
 397
 398         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 399                 return ERR_PTR(-EINVAL);
 400
 401         if (tb[NFTA_CT_DREG])
 402                 return &nft_ct_get_ops;
 403
 404         if (tb[NFTA_CT_SREG])
 405                 return &nft_ct_set_ops;
 406
 407         return ERR_PTR(-EINVAL);
 408 }
 409
 410 static struct nft_expr_type nft_ct_type __read_mostly = {
 411         .name           = "ct",
 412         .select_ops     = &nft_ct_select_ops,
 413         .policy         = nft_ct_policy,
 414         .maxattr        = NFTA_CT_MAX,
 415         .owner          = THIS_MODULE,
 416 };
 417
 418 static int __init nft_ct_module_init(void)
 419 {
 420         return nft_register_expr(&nft_ct_type);
 421 }
 422
 423 static void __exit nft_ct_module_exit(void)
 424 {
 425         nft_unregister_expr(&nft_ct_type);
 426 }
 427
 428 module_init(nft_ct_module_init);
 429 module_exit(nft_ct_module_exit);
 430
 431 MODULE_LICENSE("GPL");
 432 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 433 MODULE_ALIAS_NFT_EXPR("ct");