2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * Development of this code funded by Astaro AG (http://www.astaro.com/)
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nf_tables.h>
17 #include <net/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_conntrack.h>
19 #include <net/netfilter/nf_conntrack_tuple.h>
20 #include <net/netfilter/nf_conntrack_helper.h>
21 #include <net/netfilter/nf_conntrack_ecache.h>
22 #include <net/netfilter/nf_conntrack_labels.h>
25 enum nft_ct_keys key
:8;
26 enum ip_conntrack_dir dir
:8;
28 enum nft_registers dreg
:8;
29 enum nft_registers sreg
:8;
33 static void nft_ct_get_eval(const struct nft_expr
*expr
,
34 struct nft_data data
[NFT_REG_MAX
+ 1],
35 const struct nft_pktinfo
*pkt
)
37 const struct nft_ct
*priv
= nft_expr_priv(expr
);
38 struct nft_data
*dest
= &data
[priv
->dreg
];
39 enum ip_conntrack_info ctinfo
;
40 const struct nf_conn
*ct
;
41 const struct nf_conn_help
*help
;
42 const struct nf_conntrack_tuple
*tuple
;
43 const struct nf_conntrack_helper
*helper
;
47 ct
= nf_ct_get(pkt
->skb
, &ctinfo
);
52 state
= NF_CT_STATE_INVALID_BIT
;
53 else if (nf_ct_is_untracked(ct
))
54 state
= NF_CT_STATE_UNTRACKED_BIT
;
56 state
= NF_CT_STATE_BIT(ctinfo
);
57 dest
->data
[0] = state
;
67 case NFT_CT_DIRECTION
:
68 dest
->data
[0] = CTINFO2DIR(ctinfo
);
71 dest
->data
[0] = ct
->status
;
73 #ifdef CONFIG_NF_CONNTRACK_MARK
75 dest
->data
[0] = ct
->mark
;
78 #ifdef CONFIG_NF_CONNTRACK_SECMARK
80 dest
->data
[0] = ct
->secmark
;
83 case NFT_CT_EXPIRATION
:
84 diff
= (long)jiffies
- (long)ct
->timeout
.expires
;
87 dest
->data
[0] = jiffies_to_msecs(diff
);
90 if (ct
->master
== NULL
)
92 help
= nfct_help(ct
->master
);
95 helper
= rcu_dereference(help
->helper
);
98 if (strlen(helper
->name
) >= sizeof(dest
->data
))
100 strncpy((char *)dest
->data
, helper
->name
, sizeof(dest
->data
));
102 #ifdef CONFIG_NF_CONNTRACK_LABELS
103 case NFT_CT_LABELS
: {
104 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
108 memset(dest
->data
, 0, sizeof(dest
->data
));
112 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE
> sizeof(dest
->data
));
113 size
= labels
->words
* sizeof(long);
115 memcpy(dest
->data
, labels
->bits
, size
);
116 if (size
< sizeof(dest
->data
))
117 memset(((char *) dest
->data
) + size
, 0,
118 sizeof(dest
->data
) - size
);
126 tuple
= &ct
->tuplehash
[priv
->dir
].tuple
;
128 case NFT_CT_L3PROTOCOL
:
129 dest
->data
[0] = nf_ct_l3num(ct
);
132 memcpy(dest
->data
, tuple
->src
.u3
.all
,
133 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
136 memcpy(dest
->data
, tuple
->dst
.u3
.all
,
137 nf_ct_l3num(ct
) == NFPROTO_IPV4
? 4 : 16);
139 case NFT_CT_PROTOCOL
:
140 dest
->data
[0] = nf_ct_protonum(ct
);
142 case NFT_CT_PROTO_SRC
:
143 dest
->data
[0] = (__force __u16
)tuple
->src
.u
.all
;
145 case NFT_CT_PROTO_DST
:
146 dest
->data
[0] = (__force __u16
)tuple
->dst
.u
.all
;
153 data
[NFT_REG_VERDICT
].verdict
= NFT_BREAK
;
156 static void nft_ct_set_eval(const struct nft_expr
*expr
,
157 struct nft_data data
[NFT_REG_MAX
+ 1],
158 const struct nft_pktinfo
*pkt
)
160 const struct nft_ct
*priv
= nft_expr_priv(expr
);
161 struct sk_buff
*skb
= pkt
->skb
;
162 #ifdef CONFIG_NF_CONNTRACK_MARK
163 u32 value
= data
[priv
->sreg
].data
[0];
165 enum ip_conntrack_info ctinfo
;
168 ct
= nf_ct_get(skb
, &ctinfo
);
173 #ifdef CONFIG_NF_CONNTRACK_MARK
175 if (ct
->mark
!= value
) {
177 nf_conntrack_event_cache(IPCT_MARK
, ct
);
186 static const struct nla_policy nft_ct_policy
[NFTA_CT_MAX
+ 1] = {
187 [NFTA_CT_DREG
] = { .type
= NLA_U32
},
188 [NFTA_CT_KEY
] = { .type
= NLA_U32
},
189 [NFTA_CT_DIRECTION
] = { .type
= NLA_U8
},
190 [NFTA_CT_SREG
] = { .type
= NLA_U32
},
193 static int nft_ct_l3proto_try_module_get(uint8_t family
)
197 if (family
== NFPROTO_INET
) {
198 err
= nf_ct_l3proto_try_module_get(NFPROTO_IPV4
);
201 err
= nf_ct_l3proto_try_module_get(NFPROTO_IPV6
);
205 err
= nf_ct_l3proto_try_module_get(family
);
212 nf_ct_l3proto_module_put(NFPROTO_IPV4
);
217 static void nft_ct_l3proto_module_put(uint8_t family
)
219 if (family
== NFPROTO_INET
) {
220 nf_ct_l3proto_module_put(NFPROTO_IPV4
);
221 nf_ct_l3proto_module_put(NFPROTO_IPV6
);
223 nf_ct_l3proto_module_put(family
);
226 static int nft_ct_get_init(const struct nft_ctx
*ctx
,
227 const struct nft_expr
*expr
,
228 const struct nlattr
* const tb
[])
230 struct nft_ct
*priv
= nft_expr_priv(expr
);
233 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
236 case NFT_CT_DIRECTION
:
238 #ifdef CONFIG_NF_CONNTRACK_MARK
241 #ifdef CONFIG_NF_CONNTRACK_SECMARK
244 #ifdef CONFIG_NF_CONNTRACK_LABELS
247 case NFT_CT_EXPIRATION
:
249 if (tb
[NFTA_CT_DIRECTION
] != NULL
)
252 case NFT_CT_L3PROTOCOL
:
253 case NFT_CT_PROTOCOL
:
256 case NFT_CT_PROTO_SRC
:
257 case NFT_CT_PROTO_DST
:
258 if (tb
[NFTA_CT_DIRECTION
] == NULL
)
265 if (tb
[NFTA_CT_DIRECTION
] != NULL
) {
266 priv
->dir
= nla_get_u8(tb
[NFTA_CT_DIRECTION
]);
268 case IP_CT_DIR_ORIGINAL
:
269 case IP_CT_DIR_REPLY
:
276 priv
->dreg
= ntohl(nla_get_be32(tb
[NFTA_CT_DREG
]));
277 err
= nft_validate_output_register(priv
->dreg
);
281 err
= nft_validate_data_load(ctx
, priv
->dreg
, NULL
, NFT_DATA_VALUE
);
285 err
= nft_ct_l3proto_try_module_get(ctx
->afi
->family
);
292 static int nft_ct_set_init(const struct nft_ctx
*ctx
,
293 const struct nft_expr
*expr
,
294 const struct nlattr
* const tb
[])
296 struct nft_ct
*priv
= nft_expr_priv(expr
);
299 priv
->key
= ntohl(nla_get_be32(tb
[NFTA_CT_KEY
]));
301 #ifdef CONFIG_NF_CONNTRACK_MARK
309 priv
->sreg
= ntohl(nla_get_be32(tb
[NFTA_CT_SREG
]));
310 err
= nft_validate_input_register(priv
->sreg
);
314 err
= nft_ct_l3proto_try_module_get(ctx
->afi
->family
);
321 static void nft_ct_destroy(const struct nft_ctx
*ctx
,
322 const struct nft_expr
*expr
)
324 nft_ct_l3proto_module_put(ctx
->afi
->family
);
327 static int nft_ct_get_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
329 const struct nft_ct
*priv
= nft_expr_priv(expr
);
331 if (nla_put_be32(skb
, NFTA_CT_DREG
, htonl(priv
->dreg
)))
332 goto nla_put_failure
;
333 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
334 goto nla_put_failure
;
337 case NFT_CT_PROTOCOL
:
340 case NFT_CT_PROTO_SRC
:
341 case NFT_CT_PROTO_DST
:
342 if (nla_put_u8(skb
, NFTA_CT_DIRECTION
, priv
->dir
))
343 goto nla_put_failure
;
354 static int nft_ct_set_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
356 const struct nft_ct
*priv
= nft_expr_priv(expr
);
358 if (nla_put_be32(skb
, NFTA_CT_SREG
, htonl(priv
->sreg
)))
359 goto nla_put_failure
;
360 if (nla_put_be32(skb
, NFTA_CT_KEY
, htonl(priv
->key
)))
361 goto nla_put_failure
;
368 static struct nft_expr_type nft_ct_type
;
369 static const struct nft_expr_ops nft_ct_get_ops
= {
370 .type
= &nft_ct_type
,
371 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
372 .eval
= nft_ct_get_eval
,
373 .init
= nft_ct_get_init
,
374 .destroy
= nft_ct_destroy
,
375 .dump
= nft_ct_get_dump
,
378 static const struct nft_expr_ops nft_ct_set_ops
= {
379 .type
= &nft_ct_type
,
380 .size
= NFT_EXPR_SIZE(sizeof(struct nft_ct
)),
381 .eval
= nft_ct_set_eval
,
382 .init
= nft_ct_set_init
,
383 .destroy
= nft_ct_destroy
,
384 .dump
= nft_ct_set_dump
,
387 static const struct nft_expr_ops
*
388 nft_ct_select_ops(const struct nft_ctx
*ctx
,
389 const struct nlattr
* const tb
[])
391 if (tb
[NFTA_CT_KEY
] == NULL
)
392 return ERR_PTR(-EINVAL
);
394 if (tb
[NFTA_CT_DREG
] && tb
[NFTA_CT_SREG
])
395 return ERR_PTR(-EINVAL
);
397 if (tb
[NFTA_CT_DREG
])
398 return &nft_ct_get_ops
;
400 if (tb
[NFTA_CT_SREG
])
401 return &nft_ct_set_ops
;
403 return ERR_PTR(-EINVAL
);
406 static struct nft_expr_type nft_ct_type __read_mostly
= {
408 .select_ops
= &nft_ct_select_ops
,
409 .policy
= nft_ct_policy
,
410 .maxattr
= NFTA_CT_MAX
,
411 .owner
= THIS_MODULE
,
414 static int __init
nft_ct_module_init(void)
416 return nft_register_expr(&nft_ct_type
);
419 static void __exit
nft_ct_module_exit(void)
421 nft_unregister_expr(&nft_ct_type
);
424 module_init(nft_ct_module_init
);
425 module_exit(nft_ct_module_exit
);
427 MODULE_LICENSE("GPL");
428 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
429 MODULE_ALIAS_NFT_EXPR("ct");