nft_ct.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   4 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   5 *
   6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
   7 */
   8
   9#include <linux/kernel.h>
  10#include <linux/init.h>
  11#include <linux/module.h>
  12#include <linux/netlink.h>
  13#include <linux/netfilter.h>
  14#include <linux/netfilter/nf_tables.h>
  15#include <net/netfilter/nf_tables_core.h>
  16#include <net/netfilter/nf_conntrack.h>
  17#include <net/netfilter/nf_conntrack_acct.h>
  18#include <net/netfilter/nf_conntrack_tuple.h>
  19#include <net/netfilter/nf_conntrack_helper.h>
  20#include <net/netfilter/nf_conntrack_ecache.h>
  21#include <net/netfilter/nf_conntrack_labels.h>
  22#include <net/netfilter/nf_conntrack_timeout.h>
  23#include <net/netfilter/nf_conntrack_l4proto.h>
  24#include <net/netfilter/nf_conntrack_expect.h>
  25#include <net/netfilter/nf_conntrack_seqadj.h>
  26#include "nf_internals.h"
  27
  28struct nft_ct_helper_obj  {
  29	struct nf_conntrack_helper *helper4;
  30	struct nf_conntrack_helper *helper6;
  31	u8 l4proto;
  32};
  33
  34#ifdef CONFIG_NF_CONNTRACK_ZONES
  35static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  36static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  37static DEFINE_MUTEX(nft_ct_pcpu_mutex);
  38#endif
  39
  40static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  41				   enum nft_ct_keys k,
  42				   enum ip_conntrack_dir d)
  43{
  44	if (d < IP_CT_DIR_MAX)
  45		return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  46					   atomic64_read(&c[d].packets);
  47
  48	return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  49	       nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  50}
  51
  52static void nft_ct_get_eval(const struct nft_expr *expr,
  53			    struct nft_regs *regs,
  54			    const struct nft_pktinfo *pkt)
  55{
  56	const struct nft_ct *priv = nft_expr_priv(expr);
  57	u32 *dest = &regs->data[priv->dreg];
  58	enum ip_conntrack_info ctinfo;
  59	const struct nf_conn *ct;
  60	const struct nf_conn_help *help;
  61	const struct nf_conntrack_tuple *tuple;
  62	const struct nf_conntrack_helper *helper;
  63	unsigned int state;
  64
  65	ct = nf_ct_get(pkt->skb, &ctinfo);
  66
  67	switch (priv->key) {
  68	case NFT_CT_STATE:
  69		if (ct)
  70			state = NF_CT_STATE_BIT(ctinfo);
  71		else if (ctinfo == IP_CT_UNTRACKED)
  72			state = NF_CT_STATE_UNTRACKED_BIT;
  73		else
  74			state = NF_CT_STATE_INVALID_BIT;
  75		*dest = state;
  76		return;
  77	default:
  78		break;
  79	}
  80
  81	if (ct == NULL)
  82		goto err;
  83
  84	switch (priv->key) {
  85	case NFT_CT_DIRECTION:
  86		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
  87		return;
  88	case NFT_CT_STATUS:
  89		*dest = ct->status;
  90		return;
  91#ifdef CONFIG_NF_CONNTRACK_MARK
  92	case NFT_CT_MARK:
  93		*dest = READ_ONCE(ct->mark);
  94		return;
  95#endif
  96#ifdef CONFIG_NF_CONNTRACK_SECMARK
  97	case NFT_CT_SECMARK:
  98		*dest = ct->secmark;
  99		return;
 100#endif
 101	case NFT_CT_EXPIRATION:
 102		*dest = jiffies_to_msecs(nf_ct_expires(ct));
 103		return;
 104	case NFT_CT_HELPER:
 105		if (ct->master == NULL)
 106			goto err;
 107		help = nfct_help(ct->master);
 108		if (help == NULL)
 109			goto err;
 110		helper = rcu_dereference(help->helper);
 111		if (helper == NULL)
 112			goto err;
 113		strscpy_pad((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 114		return;
 115#ifdef CONFIG_NF_CONNTRACK_LABELS
 116	case NFT_CT_LABELS: {
 117		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 118
 119		if (labels)
 120			memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 121		else
 122			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 123		return;
 124	}
 125#endif
 126	case NFT_CT_BYTES:
 127	case NFT_CT_PKTS: {
 128		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 129		u64 count = 0;
 130
 131		if (acct)
 132			count = nft_ct_get_eval_counter(acct->counter,
 133							priv->key, priv->dir);
 134		memcpy(dest, &count, sizeof(count));
 135		return;
 136	}
 137	case NFT_CT_AVGPKT: {
 138		const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 139		u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 140
 141		if (acct) {
 142			pcnt = nft_ct_get_eval_counter(acct->counter,
 143						       NFT_CT_PKTS, priv->dir);
 144			bcnt = nft_ct_get_eval_counter(acct->counter,
 145						       NFT_CT_BYTES, priv->dir);
 146			if (pcnt != 0)
 147				avgcnt = div64_u64(bcnt, pcnt);
 148		}
 149
 150		memcpy(dest, &avgcnt, sizeof(avgcnt));
 151		return;
 152	}
 153	case NFT_CT_L3PROTOCOL:
 154		nft_reg_store8(dest, nf_ct_l3num(ct));
 155		return;
 156	case NFT_CT_PROTOCOL:
 157		nft_reg_store8(dest, nf_ct_protonum(ct));
 158		return;
 159#ifdef CONFIG_NF_CONNTRACK_ZONES
 160	case NFT_CT_ZONE: {
 161		const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 162		u16 zoneid;
 163
 164		if (priv->dir < IP_CT_DIR_MAX)
 165			zoneid = nf_ct_zone_id(zone, priv->dir);
 166		else
 167			zoneid = zone->id;
 168
 169		nft_reg_store16(dest, zoneid);
 170		return;
 171	}
 172#endif
 173	case NFT_CT_ID:
 174		*dest = nf_ct_get_id(ct);
 175		return;
 176	default:
 177		break;
 178	}
 179
 180	tuple = &ct->tuplehash[priv->dir].tuple;
 181	switch (priv->key) {
 182	case NFT_CT_SRC:
 183		memcpy(dest, tuple->src.u3.all,
 184		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 185		return;
 186	case NFT_CT_DST:
 187		memcpy(dest, tuple->dst.u3.all,
 188		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 189		return;
 190	case NFT_CT_PROTO_SRC:
 191		nft_reg_store16(dest, (__force u16)tuple->src.u.all);
 192		return;
 193	case NFT_CT_PROTO_DST:
 194		nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
 195		return;
 196	case NFT_CT_SRC_IP:
 197		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 198			goto err;
 199		*dest = (__force __u32)tuple->src.u3.ip;
 200		return;
 201	case NFT_CT_DST_IP:
 202		if (nf_ct_l3num(ct) != NFPROTO_IPV4)
 203			goto err;
 204		*dest = (__force __u32)tuple->dst.u3.ip;
 205		return;
 206	case NFT_CT_SRC_IP6:
 207		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 208			goto err;
 209		memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
 210		return;
 211	case NFT_CT_DST_IP6:
 212		if (nf_ct_l3num(ct) != NFPROTO_IPV6)
 213			goto err;
 214		memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
 215		return;
 216	default:
 217		break;
 218	}
 219	return;
 220err:
 221	regs->verdict.code = NFT_BREAK;
 222}
 223
 224#ifdef CONFIG_NF_CONNTRACK_ZONES
 225static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 226				 struct nft_regs *regs,
 227				 const struct nft_pktinfo *pkt)
 228{
 229	struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 230	const struct nft_ct *priv = nft_expr_priv(expr);
 231	struct sk_buff *skb = pkt->skb;
 232	enum ip_conntrack_info ctinfo;
 233	u16 value = nft_reg_load16(&regs->data[priv->sreg]);
 234	struct nf_conn *ct;
 235	int oldcnt;
 236
 237	ct = nf_ct_get(skb, &ctinfo);
 238	if (ct) /* already tracked */
 239		return;
 240
 241	zone.id = value;
 242
 243	switch (priv->dir) {
 244	case IP_CT_DIR_ORIGINAL:
 245		zone.dir = NF_CT_ZONE_DIR_ORIG;
 246		break;
 247	case IP_CT_DIR_REPLY:
 248		zone.dir = NF_CT_ZONE_DIR_REPL;
 249		break;
 250	default:
 251		break;
 252	}
 253
 254	ct = this_cpu_read(nft_ct_pcpu_template);
 255
 256	__refcount_inc(&ct->ct_general.use, &oldcnt);
 257	if (likely(oldcnt == 1)) {
 258		nf_ct_zone_add(ct, &zone);
 259	} else {
 260		refcount_dec(&ct->ct_general.use);
 261		/* previous skb got queued to userspace, allocate temporary
 262		 * one until percpu template can be reused.
 263		 */
 264		ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 265		if (!ct) {
 266			regs->verdict.code = NF_DROP;
 267			return;
 268		}
 269		__set_bit(IPS_CONFIRMED_BIT, &ct->status);
 270	}
 271
 272	nf_ct_set(skb, ct, IP_CT_NEW);
 273}
 274#endif
 275
 276static void nft_ct_set_eval(const struct nft_expr *expr,
 277			    struct nft_regs *regs,
 278			    const struct nft_pktinfo *pkt)
 279{
 280	const struct nft_ct *priv = nft_expr_priv(expr);
 281	struct sk_buff *skb = pkt->skb;
 282#if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
 283	u32 value = regs->data[priv->sreg];
 284#endif
 285	enum ip_conntrack_info ctinfo;
 286	struct nf_conn *ct;
 287
 288	ct = nf_ct_get(skb, &ctinfo);
 289	if (ct == NULL || nf_ct_is_template(ct))
 290		return;
 291
 292	switch (priv->key) {
 293#ifdef CONFIG_NF_CONNTRACK_MARK
 294	case NFT_CT_MARK:
 295		if (READ_ONCE(ct->mark) != value) {
 296			WRITE_ONCE(ct->mark, value);
 297			nf_conntrack_event_cache(IPCT_MARK, ct);
 298		}
 299		break;
 300#endif
 301#ifdef CONFIG_NF_CONNTRACK_SECMARK
 302	case NFT_CT_SECMARK:
 303		if (ct->secmark != value) {
 304			ct->secmark = value;
 305			nf_conntrack_event_cache(IPCT_SECMARK, ct);
 306		}
 307		break;
 308#endif
 309#ifdef CONFIG_NF_CONNTRACK_LABELS
 310	case NFT_CT_LABELS:
 311		nf_connlabels_replace(ct,
 312				      &regs->data[priv->sreg],
 313				      &regs->data[priv->sreg],
 314				      NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 315		break;
 316#endif
 317#ifdef CONFIG_NF_CONNTRACK_EVENTS
 318	case NFT_CT_EVENTMASK: {
 319		struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
 320		u32 ctmask = regs->data[priv->sreg];
 321
 322		if (e) {
 323			if (e->ctmask != ctmask)
 324				e->ctmask = ctmask;
 325			break;
 326		}
 327
 328		if (ctmask && !nf_ct_is_confirmed(ct))
 329			nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
 330		break;
 331	}
 332#endif
 333	default:
 334		break;
 335	}
 336}
 337
 338static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 339	[NFTA_CT_DREG]		= { .type = NLA_U32 },
 340	[NFTA_CT_KEY]		= NLA_POLICY_MAX(NLA_BE32, 255),
 341	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
 342	[NFTA_CT_SREG]		= { .type = NLA_U32 },
 343};
 344
 345#ifdef CONFIG_NF_CONNTRACK_ZONES
 346static void nft_ct_tmpl_put_pcpu(void)
 347{
 348	struct nf_conn *ct;
 349	int cpu;
 350
 351	for_each_possible_cpu(cpu) {
 352		ct = per_cpu(nft_ct_pcpu_template, cpu);
 353		if (!ct)
 354			break;
 355		nf_ct_put(ct);
 356		per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 357	}
 358}
 359
 360static bool nft_ct_tmpl_alloc_pcpu(void)
 361{
 362	struct nf_conntrack_zone zone = { .id = 0 };
 363	struct nf_conn *tmp;
 364	int cpu;
 365
 366	if (nft_ct_pcpu_template_refcnt)
 367		return true;
 368
 369	for_each_possible_cpu(cpu) {
 370		tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 371		if (!tmp) {
 372			nft_ct_tmpl_put_pcpu();
 373			return false;
 374		}
 375
 376		__set_bit(IPS_CONFIRMED_BIT, &tmp->status);
 377		per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 378	}
 379
 380	return true;
 381}
 382#endif
 383
 384static void __nft_ct_get_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 385{
 386#ifdef CONFIG_NF_CONNTRACK_LABELS
 387	if (priv->key == NFT_CT_LABELS)
 388		nf_connlabels_put(ctx->net);
 389#endif
 390}
 391
 392static int nft_ct_get_init(const struct nft_ctx *ctx,
 393			   const struct nft_expr *expr,
 394			   const struct nlattr * const tb[])
 395{
 396	struct nft_ct *priv = nft_expr_priv(expr);
 397	unsigned int len;
 398	int err;
 399
 400	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 401	priv->dir = IP_CT_DIR_MAX;
 402	switch (priv->key) {
 403	case NFT_CT_DIRECTION:
 404		if (tb[NFTA_CT_DIRECTION] != NULL)
 405			return -EINVAL;
 406		len = sizeof(u8);
 407		break;
 408	case NFT_CT_STATE:
 409	case NFT_CT_STATUS:
 410#ifdef CONFIG_NF_CONNTRACK_MARK
 411	case NFT_CT_MARK:
 412#endif
 413#ifdef CONFIG_NF_CONNTRACK_SECMARK
 414	case NFT_CT_SECMARK:
 415#endif
 416	case NFT_CT_EXPIRATION:
 417		if (tb[NFTA_CT_DIRECTION] != NULL)
 418			return -EINVAL;
 419		len = sizeof(u32);
 420		break;
 421#ifdef CONFIG_NF_CONNTRACK_LABELS
 422	case NFT_CT_LABELS:
 423		if (tb[NFTA_CT_DIRECTION] != NULL)
 424			return -EINVAL;
 425		len = NF_CT_LABELS_MAX_SIZE;
 426
 427		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 428		if (err)
 429			return err;
 430		break;
 431#endif
 432	case NFT_CT_HELPER:
 433		if (tb[NFTA_CT_DIRECTION] != NULL)
 434			return -EINVAL;
 435		len = NF_CT_HELPER_NAME_LEN;
 436		break;
 437
 438	case NFT_CT_L3PROTOCOL:
 439	case NFT_CT_PROTOCOL:
 440		/* For compatibility, do not report error if NFTA_CT_DIRECTION
 441		 * attribute is specified.
 442		 */
 443		len = sizeof(u8);
 444		break;
 445	case NFT_CT_SRC:
 446	case NFT_CT_DST:
 447		if (tb[NFTA_CT_DIRECTION] == NULL)
 448			return -EINVAL;
 449
 450		switch (ctx->family) {
 451		case NFPROTO_IPV4:
 452			len = sizeof_field(struct nf_conntrack_tuple,
 453					   src.u3.ip);
 454			break;
 455		case NFPROTO_IPV6:
 456		case NFPROTO_INET:
 457			len = sizeof_field(struct nf_conntrack_tuple,
 458					   src.u3.ip6);
 459			break;
 460		default:
 461			return -EAFNOSUPPORT;
 462		}
 463		break;
 464	case NFT_CT_SRC_IP:
 465	case NFT_CT_DST_IP:
 466		if (tb[NFTA_CT_DIRECTION] == NULL)
 467			return -EINVAL;
 468
 469		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip);
 470		break;
 471	case NFT_CT_SRC_IP6:
 472	case NFT_CT_DST_IP6:
 473		if (tb[NFTA_CT_DIRECTION] == NULL)
 474			return -EINVAL;
 475
 476		len = sizeof_field(struct nf_conntrack_tuple, src.u3.ip6);
 477		break;
 478	case NFT_CT_PROTO_SRC:
 479	case NFT_CT_PROTO_DST:
 480		if (tb[NFTA_CT_DIRECTION] == NULL)
 481			return -EINVAL;
 482		len = sizeof_field(struct nf_conntrack_tuple, src.u.all);
 483		break;
 484	case NFT_CT_BYTES:
 485	case NFT_CT_PKTS:
 486	case NFT_CT_AVGPKT:
 487		len = sizeof(u64);
 488		break;
 489#ifdef CONFIG_NF_CONNTRACK_ZONES
 490	case NFT_CT_ZONE:
 491		len = sizeof(u16);
 492		break;
 493#endif
 494	case NFT_CT_ID:
 495		if (tb[NFTA_CT_DIRECTION])
 496			return -EINVAL;
 497
 498		len = sizeof(u32);
 499		break;
 500	default:
 501		return -EOPNOTSUPP;
 502	}
 503
 504	if (tb[NFTA_CT_DIRECTION] != NULL) {
 505		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 506		switch (priv->dir) {
 507		case IP_CT_DIR_ORIGINAL:
 508		case IP_CT_DIR_REPLY:
 509			break;
 510		default:
 511			err = -EINVAL;
 512			goto err;
 513		}
 514	}
 515
 516	priv->len = len;
 517	err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL,
 518				       NFT_DATA_VALUE, len);
 519	if (err < 0)
 520		goto err;
 521
 522	err = nf_ct_netns_get(ctx->net, ctx->family);
 523	if (err < 0)
 524		goto err;
 525
 526	if (priv->key == NFT_CT_BYTES ||
 527	    priv->key == NFT_CT_PKTS  ||
 528	    priv->key == NFT_CT_AVGPKT)
 529		nf_ct_set_acct(ctx->net, true);
 530
 531	return 0;
 532err:
 533	__nft_ct_get_destroy(ctx, priv);
 534	return err;
 535}
 536
 537static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 538{
 539	switch (priv->key) {
 540#ifdef CONFIG_NF_CONNTRACK_LABELS
 541	case NFT_CT_LABELS:
 542		nf_connlabels_put(ctx->net);
 543		break;
 544#endif
 545#ifdef CONFIG_NF_CONNTRACK_ZONES
 546	case NFT_CT_ZONE:
 547		nf_queue_nf_hook_drop(ctx->net);
 548		mutex_lock(&nft_ct_pcpu_mutex);
 549		if (--nft_ct_pcpu_template_refcnt == 0)
 550			nft_ct_tmpl_put_pcpu();
 551		mutex_unlock(&nft_ct_pcpu_mutex);
 552		break;
 553#endif
 554	default:
 555		break;
 556	}
 557}
 558
 559static int nft_ct_set_init(const struct nft_ctx *ctx,
 560			   const struct nft_expr *expr,
 561			   const struct nlattr * const tb[])
 562{
 563	struct nft_ct *priv = nft_expr_priv(expr);
 564	unsigned int len;
 565	int err;
 566
 567	priv->dir = IP_CT_DIR_MAX;
 568	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 569	switch (priv->key) {
 570#ifdef CONFIG_NF_CONNTRACK_MARK
 571	case NFT_CT_MARK:
 572		if (tb[NFTA_CT_DIRECTION])
 573			return -EINVAL;
 574		len = sizeof_field(struct nf_conn, mark);
 575		break;
 576#endif
 577#ifdef CONFIG_NF_CONNTRACK_LABELS
 578	case NFT_CT_LABELS:
 579		if (tb[NFTA_CT_DIRECTION])
 580			return -EINVAL;
 581		len = NF_CT_LABELS_MAX_SIZE;
 582		err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 583		if (err)
 584			return err;
 585		break;
 586#endif
 587#ifdef CONFIG_NF_CONNTRACK_ZONES
 588	case NFT_CT_ZONE:
 589		mutex_lock(&nft_ct_pcpu_mutex);
 590		if (!nft_ct_tmpl_alloc_pcpu()) {
 591			mutex_unlock(&nft_ct_pcpu_mutex);
 592			return -ENOMEM;
 593		}
 594		nft_ct_pcpu_template_refcnt++;
 595		mutex_unlock(&nft_ct_pcpu_mutex);
 596		len = sizeof(u16);
 597		break;
 598#endif
 599#ifdef CONFIG_NF_CONNTRACK_EVENTS
 600	case NFT_CT_EVENTMASK:
 601		if (tb[NFTA_CT_DIRECTION])
 602			return -EINVAL;
 603		len = sizeof(u32);
 604		break;
 605#endif
 606#ifdef CONFIG_NF_CONNTRACK_SECMARK
 607	case NFT_CT_SECMARK:
 608		if (tb[NFTA_CT_DIRECTION])
 609			return -EINVAL;
 610		len = sizeof(u32);
 611		break;
 612#endif
 613	default:
 614		return -EOPNOTSUPP;
 615	}
 616
 617	if (tb[NFTA_CT_DIRECTION]) {
 618		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 619		switch (priv->dir) {
 620		case IP_CT_DIR_ORIGINAL:
 621		case IP_CT_DIR_REPLY:
 622			break;
 623		default:
 624			err = -EINVAL;
 625			goto err1;
 626		}
 627	}
 628
 629	priv->len = len;
 630	err = nft_parse_register_load(ctx, tb[NFTA_CT_SREG], &priv->sreg, len);
 631	if (err < 0)
 632		goto err1;
 633
 634	err = nf_ct_netns_get(ctx->net, ctx->family);
 635	if (err < 0)
 636		goto err1;
 637
 638	return 0;
 639
 640err1:
 641	__nft_ct_set_destroy(ctx, priv);
 642	return err;
 643}
 644
 645static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 646			       const struct nft_expr *expr)
 647{
 648	struct nft_ct *priv = nft_expr_priv(expr);
 649
 650	__nft_ct_get_destroy(ctx, priv);
 651	nf_ct_netns_put(ctx->net, ctx->family);
 652}
 653
 654static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 655			       const struct nft_expr *expr)
 656{
 657	struct nft_ct *priv = nft_expr_priv(expr);
 658
 659	__nft_ct_set_destroy(ctx, priv);
 660	nf_ct_netns_put(ctx->net, ctx->family);
 661}
 662
 663static int nft_ct_get_dump(struct sk_buff *skb,
 664			   const struct nft_expr *expr, bool reset)
 665{
 666	const struct nft_ct *priv = nft_expr_priv(expr);
 667
 668	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 669		goto nla_put_failure;
 670	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 671		goto nla_put_failure;
 672
 673	switch (priv->key) {
 674	case NFT_CT_SRC:
 675	case NFT_CT_DST:
 676	case NFT_CT_SRC_IP:
 677	case NFT_CT_DST_IP:
 678	case NFT_CT_SRC_IP6:
 679	case NFT_CT_DST_IP6:
 680	case NFT_CT_PROTO_SRC:
 681	case NFT_CT_PROTO_DST:
 682		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 683			goto nla_put_failure;
 684		break;
 685	case NFT_CT_BYTES:
 686	case NFT_CT_PKTS:
 687	case NFT_CT_AVGPKT:
 688	case NFT_CT_ZONE:
 689		if (priv->dir < IP_CT_DIR_MAX &&
 690		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 691			goto nla_put_failure;
 692		break;
 693	default:
 694		break;
 695	}
 696
 697	return 0;
 698
 699nla_put_failure:
 700	return -1;
 701}
 702
 703static bool nft_ct_get_reduce(struct nft_regs_track *track,
 704			      const struct nft_expr *expr)
 705{
 706	const struct nft_ct *priv = nft_expr_priv(expr);
 707	const struct nft_ct *ct;
 708
 709	if (!nft_reg_track_cmp(track, expr, priv->dreg)) {
 710		nft_reg_track_update(track, expr, priv->dreg, priv->len);
 711		return false;
 712	}
 713
 714	ct = nft_expr_priv(track->regs[priv->dreg].selector);
 715	if (priv->key != ct->key) {
 716		nft_reg_track_update(track, expr, priv->dreg, priv->len);
 717		return false;
 718	}
 719
 720	if (!track->regs[priv->dreg].bitwise)
 721		return true;
 722
 723	return nft_expr_reduce_bitwise(track, expr);
 724}
 725
 726static int nft_ct_set_dump(struct sk_buff *skb,
 727			   const struct nft_expr *expr, bool reset)
 728{
 729	const struct nft_ct *priv = nft_expr_priv(expr);
 730
 731	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 732		goto nla_put_failure;
 733	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 734		goto nla_put_failure;
 735
 736	switch (priv->key) {
 737	case NFT_CT_ZONE:
 738		if (priv->dir < IP_CT_DIR_MAX &&
 739		    nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 740			goto nla_put_failure;
 741		break;
 742	default:
 743		break;
 744	}
 745
 746	return 0;
 747
 748nla_put_failure:
 749	return -1;
 750}
 751
 752static struct nft_expr_type nft_ct_type;
 753static const struct nft_expr_ops nft_ct_get_ops = {
 754	.type		= &nft_ct_type,
 755	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 756	.eval		= nft_ct_get_eval,
 757	.init		= nft_ct_get_init,
 758	.destroy	= nft_ct_get_destroy,
 759	.dump		= nft_ct_get_dump,
 760	.reduce		= nft_ct_get_reduce,
 761};
 762
 763static bool nft_ct_set_reduce(struct nft_regs_track *track,
 764			      const struct nft_expr *expr)
 765{
 766	int i;
 767
 768	for (i = 0; i < NFT_REG32_NUM; i++) {
 769		if (!track->regs[i].selector)
 770			continue;
 771
 772		if (track->regs[i].selector->ops != &nft_ct_get_ops)
 773			continue;
 774
 775		__nft_reg_track_cancel(track, i);
 776	}
 777
 778	return false;
 779}
 780
 781#ifdef CONFIG_MITIGATION_RETPOLINE
 782static const struct nft_expr_ops nft_ct_get_fast_ops = {
 783	.type		= &nft_ct_type,
 784	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 785	.eval		= nft_ct_get_fast_eval,
 786	.init		= nft_ct_get_init,
 787	.destroy	= nft_ct_get_destroy,
 788	.dump		= nft_ct_get_dump,
 789	.reduce		= nft_ct_set_reduce,
 790};
 791#endif
 792
 793static const struct nft_expr_ops nft_ct_set_ops = {
 794	.type		= &nft_ct_type,
 795	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 796	.eval		= nft_ct_set_eval,
 797	.init		= nft_ct_set_init,
 798	.destroy	= nft_ct_set_destroy,
 799	.dump		= nft_ct_set_dump,
 800	.reduce		= nft_ct_set_reduce,
 801};
 802
 803#ifdef CONFIG_NF_CONNTRACK_ZONES
 804static const struct nft_expr_ops nft_ct_set_zone_ops = {
 805	.type		= &nft_ct_type,
 806	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 807	.eval		= nft_ct_set_zone_eval,
 808	.init		= nft_ct_set_init,
 809	.destroy	= nft_ct_set_destroy,
 810	.dump		= nft_ct_set_dump,
 811	.reduce		= nft_ct_set_reduce,
 812};
 813#endif
 814
 815static const struct nft_expr_ops *
 816nft_ct_select_ops(const struct nft_ctx *ctx,
 817		    const struct nlattr * const tb[])
 818{
 819	if (tb[NFTA_CT_KEY] == NULL)
 820		return ERR_PTR(-EINVAL);
 821
 822	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 823		return ERR_PTR(-EINVAL);
 824
 825	if (tb[NFTA_CT_DREG]) {
 826#ifdef CONFIG_MITIGATION_RETPOLINE
 827		u32 k = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 828
 829		switch (k) {
 830		case NFT_CT_STATE:
 831		case NFT_CT_DIRECTION:
 832		case NFT_CT_STATUS:
 833		case NFT_CT_MARK:
 834		case NFT_CT_SECMARK:
 835			return &nft_ct_get_fast_ops;
 836		}
 837#endif
 838		return &nft_ct_get_ops;
 839	}
 840
 841	if (tb[NFTA_CT_SREG]) {
 842#ifdef CONFIG_NF_CONNTRACK_ZONES
 843		if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 844			return &nft_ct_set_zone_ops;
 845#endif
 846		return &nft_ct_set_ops;
 847	}
 848
 849	return ERR_PTR(-EINVAL);
 850}
 851
 852static struct nft_expr_type nft_ct_type __read_mostly = {
 853	.name		= "ct",
 854	.select_ops	= nft_ct_select_ops,
 855	.policy		= nft_ct_policy,
 856	.maxattr	= NFTA_CT_MAX,
 857	.owner		= THIS_MODULE,
 858};
 859
 860static void nft_notrack_eval(const struct nft_expr *expr,
 861			     struct nft_regs *regs,
 862			     const struct nft_pktinfo *pkt)
 863{
 864	struct sk_buff *skb = pkt->skb;
 865	enum ip_conntrack_info ctinfo;
 866	struct nf_conn *ct;
 867
 868	ct = nf_ct_get(pkt->skb, &ctinfo);
 869	/* Previously seen (loopback or untracked)?  Ignore. */
 870	if (ct || ctinfo == IP_CT_UNTRACKED)
 871		return;
 872
 873	nf_ct_set(skb, ct, IP_CT_UNTRACKED);
 874}
 875
 876static struct nft_expr_type nft_notrack_type;
 877static const struct nft_expr_ops nft_notrack_ops = {
 878	.type		= &nft_notrack_type,
 879	.size		= NFT_EXPR_SIZE(0),
 880	.eval		= nft_notrack_eval,
 881	.reduce		= NFT_REDUCE_READONLY,
 882};
 883
 884static struct nft_expr_type nft_notrack_type __read_mostly = {
 885	.name		= "notrack",
 886	.ops		= &nft_notrack_ops,
 887	.owner		= THIS_MODULE,
 888};
 889
 890#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 891static int
 892nft_ct_timeout_parse_policy(void *timeouts,
 893			    const struct nf_conntrack_l4proto *l4proto,
 894			    struct net *net, const struct nlattr *attr)
 895{
 896	struct nlattr **tb;
 897	int ret = 0;
 898
 899	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
 900		     GFP_KERNEL);
 901
 902	if (!tb)
 903		return -ENOMEM;
 904
 905	ret = nla_parse_nested_deprecated(tb,
 906					  l4proto->ctnl_timeout.nlattr_max,
 907					  attr,
 908					  l4proto->ctnl_timeout.nla_policy,
 909					  NULL);
 910	if (ret < 0)
 911		goto err;
 912
 913	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
 914
 915err:
 916	kfree(tb);
 917	return ret;
 918}
 919
 920struct nft_ct_timeout_obj {
 921	struct nf_ct_timeout    *timeout;
 922	u8			l4proto;
 923};
 924
 925static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 926				    struct nft_regs *regs,
 927				    const struct nft_pktinfo *pkt)
 928{
 929	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 930	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
 931	struct nf_conn_timeout *timeout;
 932	const unsigned int *values;
 933
 934	if (priv->l4proto != pkt->tprot)
 935		return;
 936
 937	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
 938		return;
 939
 940	timeout = nf_ct_timeout_find(ct);
 941	if (!timeout) {
 942		timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
 943		if (!timeout) {
 944			regs->verdict.code = NF_DROP;
 945			return;
 946		}
 947	}
 948
 949	rcu_assign_pointer(timeout->timeout, priv->timeout);
 950
 951	/* adjust the timeout as per 'new' state. ct is unconfirmed,
 952	 * so the current timestamp must not be added.
 953	 */
 954	values = nf_ct_timeout_data(timeout);
 955	if (values)
 956		nf_ct_refresh(ct, values[0]);
 957}
 958
 959static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 960				   const struct nlattr * const tb[],
 961				   struct nft_object *obj)
 962{
 963	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
 964	const struct nf_conntrack_l4proto *l4proto;
 965	struct nf_ct_timeout *timeout;
 966	int l3num = ctx->family;
 967	__u8 l4num;
 968	int ret;
 969
 970	if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
 971	    !tb[NFTA_CT_TIMEOUT_DATA])
 972		return -EINVAL;
 973
 974	if (tb[NFTA_CT_TIMEOUT_L3PROTO])
 975		l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
 976
 977	l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
 978	priv->l4proto = l4num;
 979
 980	l4proto = nf_ct_l4proto_find(l4num);
 981
 982	if (l4proto->l4proto != l4num) {
 983		ret = -EOPNOTSUPP;
 984		goto err_proto_put;
 985	}
 986
 987	timeout = kzalloc(sizeof(struct nf_ct_timeout) +
 988			  l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
 989	if (timeout == NULL) {
 990		ret = -ENOMEM;
 991		goto err_proto_put;
 992	}
 993
 994	ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
 995					  tb[NFTA_CT_TIMEOUT_DATA]);
 996	if (ret < 0)
 997		goto err_free_timeout;
 998
 999	timeout->l3num = l3num;
1000	timeout->l4proto = l4proto;
1001
1002	ret = nf_ct_netns_get(ctx->net, ctx->family);
1003	if (ret < 0)
1004		goto err_free_timeout;
1005
1006	priv->timeout = timeout;
1007	return 0;
1008
1009err_free_timeout:
1010	kfree(timeout);
1011err_proto_put:
1012	return ret;
1013}
1014
1015static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
1016				       struct nft_object *obj)
1017{
1018	struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
1019	struct nf_ct_timeout *timeout = priv->timeout;
1020
1021	nf_queue_nf_hook_drop(ctx->net);
1022	nf_ct_untimeout(ctx->net, timeout);
1023	nf_ct_netns_put(ctx->net, ctx->family);
1024	kfree_rcu(priv->timeout, rcu);
1025}
1026
1027static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
1028				   struct nft_object *obj, bool reset)
1029{
1030	const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
1031	const struct nf_ct_timeout *timeout = priv->timeout;
1032	struct nlattr *nest_params;
1033	int ret;
1034
1035	if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
1036	    nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
1037		return -1;
1038
1039	nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
1040	if (!nest_params)
1041		return -1;
1042
1043	ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
1044	if (ret < 0)
1045		return -1;
1046	nla_nest_end(skb, nest_params);
1047	return 0;
1048}
1049
1050static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
1051	[NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
1052	[NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
1053	[NFTA_CT_TIMEOUT_DATA]	  = {.type = NLA_NESTED },
1054};
1055
1056static struct nft_object_type nft_ct_timeout_obj_type;
1057
1058static const struct nft_object_ops nft_ct_timeout_obj_ops = {
1059	.type		= &nft_ct_timeout_obj_type,
1060	.size		= sizeof(struct nft_ct_timeout_obj),
1061	.eval		= nft_ct_timeout_obj_eval,
1062	.init		= nft_ct_timeout_obj_init,
1063	.destroy	= nft_ct_timeout_obj_destroy,
1064	.dump		= nft_ct_timeout_obj_dump,
1065};
1066
1067static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
1068	.type		= NFT_OBJECT_CT_TIMEOUT,
1069	.ops		= &nft_ct_timeout_obj_ops,
1070	.maxattr	= NFTA_CT_TIMEOUT_MAX,
1071	.policy		= nft_ct_timeout_policy,
1072	.owner		= THIS_MODULE,
1073};
1074#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
1075
1076static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
1077				  const struct nlattr * const tb[],
1078				  struct nft_object *obj)
1079{
1080	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1081	struct nf_conntrack_helper *help4, *help6;
1082	char name[NF_CT_HELPER_NAME_LEN];
1083	int family = ctx->family;
1084	int err;
1085
1086	if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
1087		return -EINVAL;
1088
1089	priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
1090	if (!priv->l4proto)
1091		return -ENOENT;
1092
1093	nla_strscpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
1094
1095	if (tb[NFTA_CT_HELPER_L3PROTO])
1096		family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
1097
1098	help4 = NULL;
1099	help6 = NULL;
1100
1101	switch (family) {
1102	case NFPROTO_IPV4:
1103		if (ctx->family == NFPROTO_IPV6)
1104			return -EINVAL;
1105
1106		help4 = nf_conntrack_helper_try_module_get(name, family,
1107							   priv->l4proto);
1108		break;
1109	case NFPROTO_IPV6:
1110		if (ctx->family == NFPROTO_IPV4)
1111			return -EINVAL;
1112
1113		help6 = nf_conntrack_helper_try_module_get(name, family,
1114							   priv->l4proto);
1115		break;
1116	case NFPROTO_NETDEV:
1117	case NFPROTO_BRIDGE:
1118	case NFPROTO_INET:
1119		help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1120							   priv->l4proto);
1121		help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1122							   priv->l4proto);
1123		break;
1124	default:
1125		return -EAFNOSUPPORT;
1126	}
1127
1128	/* && is intentional; only error if INET found neither ipv4 or ipv6 */
1129	if (!help4 && !help6)
1130		return -ENOENT;
1131
1132	priv->helper4 = help4;
1133	priv->helper6 = help6;
1134
1135	err = nf_ct_netns_get(ctx->net, ctx->family);
1136	if (err < 0)
1137		goto err_put_helper;
1138
1139	return 0;
1140
1141err_put_helper:
1142	if (priv->helper4)
1143		nf_conntrack_helper_put(priv->helper4);
1144	if (priv->helper6)
1145		nf_conntrack_helper_put(priv->helper6);
1146	return err;
1147}
1148
1149static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1150				      struct nft_object *obj)
1151{
1152	struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1153
1154	nf_queue_nf_hook_drop(ctx->net);
1155	if (priv->helper4)
1156		nf_conntrack_helper_put(priv->helper4);
1157	if (priv->helper6)
1158		nf_conntrack_helper_put(priv->helper6);
1159
1160	nf_ct_netns_put(ctx->net, ctx->family);
1161}
1162
1163static void nft_ct_helper_obj_eval(struct nft_object *obj,
1164				   struct nft_regs *regs,
1165				   const struct nft_pktinfo *pkt)
1166{
1167	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1168	struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1169	struct nf_conntrack_helper *to_assign = NULL;
1170	struct nf_conn_help *help;
1171
1172	if (!ct ||
1173	    nf_ct_is_confirmed(ct) ||
1174	    nf_ct_is_template(ct) ||
1175	    priv->l4proto != nf_ct_protonum(ct))
1176		return;
1177
1178	switch (nf_ct_l3num(ct)) {
1179	case NFPROTO_IPV4:
1180		to_assign = priv->helper4;
1181		break;
1182	case NFPROTO_IPV6:
1183		to_assign = priv->helper6;
1184		break;
1185	default:
1186		WARN_ON_ONCE(1);
1187		return;
1188	}
1189
1190	if (!to_assign)
1191		return;
1192
1193	if (test_bit(IPS_HELPER_BIT, &ct->status))
1194		return;
1195
1196	help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1197	if (help) {
1198		rcu_assign_pointer(help->helper, to_assign);
1199		set_bit(IPS_HELPER_BIT, &ct->status);
1200
1201		if ((ct->status & IPS_NAT_MASK) && !nfct_seqadj(ct))
1202			if (!nfct_seqadj_ext_add(ct))
1203				regs->verdict.code = NF_DROP;
1204	}
1205}
1206
1207static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1208				  struct nft_object *obj, bool reset)
1209{
1210	const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1211	const struct nf_conntrack_helper *helper;
1212	u16 family;
1213
1214	if (priv->helper4 && priv->helper6) {
1215		family = NFPROTO_INET;
1216		helper = priv->helper4;
1217	} else if (priv->helper6) {
1218		family = NFPROTO_IPV6;
1219		helper = priv->helper6;
1220	} else {
1221		family = NFPROTO_IPV4;
1222		helper = priv->helper4;
1223	}
1224
1225	if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1226		return -1;
1227
1228	if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1229		return -1;
1230
1231	if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1232		return -1;
1233
1234	return 0;
1235}
1236
1237static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1238	[NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1239				  .len = NF_CT_HELPER_NAME_LEN - 1 },
1240	[NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1241	[NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1242};
1243
1244static struct nft_object_type nft_ct_helper_obj_type;
1245static const struct nft_object_ops nft_ct_helper_obj_ops = {
1246	.type		= &nft_ct_helper_obj_type,
1247	.size		= sizeof(struct nft_ct_helper_obj),
1248	.eval		= nft_ct_helper_obj_eval,
1249	.init		= nft_ct_helper_obj_init,
1250	.destroy	= nft_ct_helper_obj_destroy,
1251	.dump		= nft_ct_helper_obj_dump,
1252};
1253
1254static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1255	.type		= NFT_OBJECT_CT_HELPER,
1256	.ops		= &nft_ct_helper_obj_ops,
1257	.maxattr	= NFTA_CT_HELPER_MAX,
1258	.policy		= nft_ct_helper_policy,
1259	.owner		= THIS_MODULE,
1260};
1261
1262struct nft_ct_expect_obj {
1263	u16		l3num;
1264	__be16		dport;
1265	u8		l4proto;
1266	u8		size;
1267	u32		timeout;
1268};
1269
1270static int nft_ct_expect_obj_init(const struct nft_ctx *ctx,
1271				  const struct nlattr * const tb[],
1272				  struct nft_object *obj)
1273{
1274	struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1275
1276	if (!tb[NFTA_CT_EXPECT_L4PROTO] ||
1277	    !tb[NFTA_CT_EXPECT_DPORT] ||
1278	    !tb[NFTA_CT_EXPECT_TIMEOUT] ||
1279	    !tb[NFTA_CT_EXPECT_SIZE])
1280		return -EINVAL;
1281
1282	priv->l3num = ctx->family;
1283	if (tb[NFTA_CT_EXPECT_L3PROTO])
1284		priv->l3num = ntohs(nla_get_be16(tb[NFTA_CT_EXPECT_L3PROTO]));
1285
1286	switch (priv->l3num) {
1287	case NFPROTO_IPV4:
1288	case NFPROTO_IPV6:
1289		if (priv->l3num == ctx->family || ctx->family == NFPROTO_INET)
1290			break;
1291
1292		return -EINVAL;
1293	case NFPROTO_INET: /* tuple.src.l3num supports NFPROTO_IPV4/6 only */
1294	default:
1295		return -EAFNOSUPPORT;
1296	}
1297
1298	priv->l4proto = nla_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
1299	switch (priv->l4proto) {
1300	case IPPROTO_TCP:
1301	case IPPROTO_UDP:
1302	case IPPROTO_UDPLITE:
1303	case IPPROTO_DCCP:
1304	case IPPROTO_SCTP:
1305		break;
1306	default:
1307		return -EOPNOTSUPP;
1308	}
1309
1310	priv->dport = nla_get_be16(tb[NFTA_CT_EXPECT_DPORT]);
1311	priv->timeout = nla_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
1312	priv->size = nla_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
1313
1314	return nf_ct_netns_get(ctx->net, ctx->family);
1315}
1316
1317static void nft_ct_expect_obj_destroy(const struct nft_ctx *ctx,
1318				       struct nft_object *obj)
1319{
1320	nf_ct_netns_put(ctx->net, ctx->family);
1321}
1322
1323static int nft_ct_expect_obj_dump(struct sk_buff *skb,
1324				  struct nft_object *obj, bool reset)
1325{
1326	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1327
1328	if (nla_put_be16(skb, NFTA_CT_EXPECT_L3PROTO, htons(priv->l3num)) ||
1329	    nla_put_u8(skb, NFTA_CT_EXPECT_L4PROTO, priv->l4proto) ||
1330	    nla_put_be16(skb, NFTA_CT_EXPECT_DPORT, priv->dport) ||
1331	    nla_put_u32(skb, NFTA_CT_EXPECT_TIMEOUT, priv->timeout) ||
1332	    nla_put_u8(skb, NFTA_CT_EXPECT_SIZE, priv->size))
1333		return -1;
1334
1335	return 0;
1336}
1337
1338static void nft_ct_expect_obj_eval(struct nft_object *obj,
1339				   struct nft_regs *regs,
1340				   const struct nft_pktinfo *pkt)
1341{
1342	const struct nft_ct_expect_obj *priv = nft_obj_data(obj);
1343	struct nf_conntrack_expect *exp;
1344	enum ip_conntrack_info ctinfo;
1345	struct nf_conn_help *help;
1346	enum ip_conntrack_dir dir;
1347	u16 l3num = priv->l3num;
1348	struct nf_conn *ct;
1349
1350	ct = nf_ct_get(pkt->skb, &ctinfo);
1351	if (!ct || nf_ct_is_confirmed(ct) || nf_ct_is_template(ct)) {
1352		regs->verdict.code = NFT_BREAK;
1353		return;
1354	}
1355	dir = CTINFO2DIR(ctinfo);
1356
1357	help = nfct_help(ct);
1358	if (!help)
1359		help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1360	if (!help) {
1361		regs->verdict.code = NF_DROP;
1362		return;
1363	}
1364
1365	if (help->expecting[NF_CT_EXPECT_CLASS_DEFAULT] >= priv->size) {
1366		regs->verdict.code = NFT_BREAK;
1367		return;
1368	}
1369	if (l3num == NFPROTO_INET)
1370		l3num = nf_ct_l3num(ct);
1371
1372	exp = nf_ct_expect_alloc(ct);
1373	if (exp == NULL) {
1374		regs->verdict.code = NF_DROP;
1375		return;
1376	}
1377	nf_ct_expect_init(exp, NF_CT_EXPECT_CLASS_DEFAULT, l3num,
1378		          &ct->tuplehash[!dir].tuple.src.u3,
1379		          &ct->tuplehash[!dir].tuple.dst.u3,
1380		          priv->l4proto, NULL, &priv->dport);
1381	exp->timeout.expires = jiffies + priv->timeout * HZ;
1382
1383	if (nf_ct_expect_related(exp, 0) != 0)
1384		regs->verdict.code = NF_DROP;
1385}
1386
1387static const struct nla_policy nft_ct_expect_policy[NFTA_CT_EXPECT_MAX + 1] = {
1388	[NFTA_CT_EXPECT_L3PROTO]	= { .type = NLA_U16 },
1389	[NFTA_CT_EXPECT_L4PROTO]	= { .type = NLA_U8 },
1390	[NFTA_CT_EXPECT_DPORT]		= { .type = NLA_U16 },
1391	[NFTA_CT_EXPECT_TIMEOUT]	= { .type = NLA_U32 },
1392	[NFTA_CT_EXPECT_SIZE]		= { .type = NLA_U8 },
1393};
1394
1395static struct nft_object_type nft_ct_expect_obj_type;
1396
1397static const struct nft_object_ops nft_ct_expect_obj_ops = {
1398	.type		= &nft_ct_expect_obj_type,
1399	.size		= sizeof(struct nft_ct_expect_obj),
1400	.eval		= nft_ct_expect_obj_eval,
1401	.init		= nft_ct_expect_obj_init,
1402	.destroy	= nft_ct_expect_obj_destroy,
1403	.dump		= nft_ct_expect_obj_dump,
1404};
1405
1406static struct nft_object_type nft_ct_expect_obj_type __read_mostly = {
1407	.type		= NFT_OBJECT_CT_EXPECT,
1408	.ops		= &nft_ct_expect_obj_ops,
1409	.maxattr	= NFTA_CT_EXPECT_MAX,
1410	.policy		= nft_ct_expect_policy,
1411	.owner		= THIS_MODULE,
1412};
1413
1414static int __init nft_ct_module_init(void)
1415{
1416	int err;
1417
1418	BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1419
1420	err = nft_register_expr(&nft_ct_type);
1421	if (err < 0)
1422		return err;
1423
1424	err = nft_register_expr(&nft_notrack_type);
1425	if (err < 0)
1426		goto err1;
1427
1428	err = nft_register_obj(&nft_ct_helper_obj_type);
1429	if (err < 0)
1430		goto err2;
1431
1432	err = nft_register_obj(&nft_ct_expect_obj_type);
1433	if (err < 0)
1434		goto err3;
1435#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1436	err = nft_register_obj(&nft_ct_timeout_obj_type);
1437	if (err < 0)
1438		goto err4;
1439#endif
1440	return 0;
1441
1442#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1443err4:
1444	nft_unregister_obj(&nft_ct_expect_obj_type);
1445#endif
1446err3:
1447	nft_unregister_obj(&nft_ct_helper_obj_type);
1448err2:
1449	nft_unregister_expr(&nft_notrack_type);
1450err1:
1451	nft_unregister_expr(&nft_ct_type);
1452	return err;
1453}
1454
1455static void __exit nft_ct_module_exit(void)
1456{
1457#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1458	nft_unregister_obj(&nft_ct_timeout_obj_type);
1459#endif
1460	nft_unregister_obj(&nft_ct_expect_obj_type);
1461	nft_unregister_obj(&nft_ct_helper_obj_type);
1462	nft_unregister_expr(&nft_notrack_type);
1463	nft_unregister_expr(&nft_ct_type);
1464}
1465
1466module_init(nft_ct_module_init);
1467module_exit(nft_ct_module_exit);
1468
1469MODULE_LICENSE("GPL");
1470MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1471MODULE_ALIAS_NFT_EXPR("ct");
1472MODULE_ALIAS_NFT_EXPR("notrack");
1473MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1474MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1475MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_EXPECT);
1476MODULE_DESCRIPTION("Netfilter nf_tables conntrack module");