net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/netlink.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nf_tables.h>
  17 #include <net/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_conntrack.h>
  19 #include <net/netfilter/nf_conntrack_acct.h>
  20 #include <net/netfilter/nf_conntrack_tuple.h>
  21 #include <net/netfilter/nf_conntrack_helper.h>
  22 #include <net/netfilter/nf_conntrack_ecache.h>
  23 #include <net/netfilter/nf_conntrack_labels.h>
  24
  25 struct nft_ct {
  26         enum nft_ct_keys        key:8;
  27         enum ip_conntrack_dir   dir:8;
  28         union {
  29                 enum nft_registers      dreg:8;
  30                 enum nft_registers      sreg:8;
  31         };
  32 };
  33
  34 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  35                                    enum nft_ct_keys k,
  36                                    enum ip_conntrack_dir d)
  37 {
  38         if (d < IP_CT_DIR_MAX)
  39                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  40                                            atomic64_read(&c[d].packets);
  41
  42         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  43                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  44 }
  45
  46 static void nft_ct_get_eval(const struct nft_expr *expr,
  47                             struct nft_regs *regs,
  48                             const struct nft_pktinfo *pkt)
  49 {
  50         const struct nft_ct *priv = nft_expr_priv(expr);
  51         u32 *dest = &regs->data[priv->dreg];
  52         enum ip_conntrack_info ctinfo;
  53         const struct nf_conn *ct;
  54         const struct nf_conn_help *help;
  55         const struct nf_conntrack_tuple *tuple;
  56         const struct nf_conntrack_helper *helper;
  57         long diff;
  58         unsigned int state;
  59
  60         ct = nf_ct_get(pkt->skb, &ctinfo);
  61
  62         switch (priv->key) {
  63         case NFT_CT_STATE:
  64                 if (ct == NULL)
  65                         state = NF_CT_STATE_INVALID_BIT;
  66                 else if (nf_ct_is_untracked(ct))
  67                         state = NF_CT_STATE_UNTRACKED_BIT;
  68                 else
  69                         state = NF_CT_STATE_BIT(ctinfo);
  70                 *dest = state;
  71                 return;
  72         default:
  73                 break;
  74         }
  75
  76         if (ct == NULL)
  77                 goto err;
  78
  79         switch (priv->key) {
  80         case NFT_CT_DIRECTION:
  81                 *dest = CTINFO2DIR(ctinfo);
  82                 return;
  83         case NFT_CT_STATUS:
  84                 *dest = ct->status;
  85                 return;
  86 #ifdef CONFIG_NF_CONNTRACK_MARK
  87         case NFT_CT_MARK:
  88                 *dest = ct->mark;
  89                 return;
  90 #endif
  91 #ifdef CONFIG_NF_CONNTRACK_SECMARK
  92         case NFT_CT_SECMARK:
  93                 *dest = ct->secmark;
  94                 return;
  95 #endif
  96         case NFT_CT_EXPIRATION:
  97                 diff = (long)jiffies - (long)ct->timeout.expires;
  98                 if (diff < 0)
  99                         diff = 0;
 100                 *dest = jiffies_to_msecs(diff);
 101                 return;
 102         case NFT_CT_HELPER:
 103                 if (ct->master == NULL)
 104                         goto err;
 105                 help = nfct_help(ct->master);
 106                 if (help == NULL)
 107                         goto err;
 108                 helper = rcu_dereference(help->helper);
 109                 if (helper == NULL)
 110                         goto err;
 111                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 112                 return;
 113 #ifdef CONFIG_NF_CONNTRACK_LABELS
 114         case NFT_CT_LABELS: {
 115                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 116                 unsigned int size;
 117
 118                 if (!labels) {
 119                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 120                         return;
 121                 }
 122
 123                 size = labels->words * sizeof(long);
 124                 memcpy(dest, labels->bits, size);
 125                 if (size < NF_CT_LABELS_MAX_SIZE)
 126                         memset(((char *) dest) + size, 0,
 127                                NF_CT_LABELS_MAX_SIZE - size);
 128                 return;
 129         }
 130 #endif
 131         case NFT_CT_BYTES: /* fallthrough */
 132         case NFT_CT_PKTS: {
 133                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 134                 u64 count = 0;
 135
 136                 if (acct)
 137                         count = nft_ct_get_eval_counter(acct->counter,
 138                                                         priv->key, priv->dir);
 139                 memcpy(dest, &count, sizeof(count));
 140                 return;
 141         }
 142         default:
 143                 break;
 144         }
 145
 146         tuple = &ct->tuplehash[priv->dir].tuple;
 147         switch (priv->key) {
 148         case NFT_CT_L3PROTOCOL:
 149                 *dest = nf_ct_l3num(ct);
 150                 return;
 151         case NFT_CT_SRC:
 152                 memcpy(dest, tuple->src.u3.all,
 153                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 154                 return;
 155         case NFT_CT_DST:
 156                 memcpy(dest, tuple->dst.u3.all,
 157                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 158                 return;
 159         case NFT_CT_PROTOCOL:
 160                 *dest = nf_ct_protonum(ct);
 161                 return;
 162         case NFT_CT_PROTO_SRC:
 163                 *dest = (__force __u16)tuple->src.u.all;
 164                 return;
 165         case NFT_CT_PROTO_DST:
 166                 *dest = (__force __u16)tuple->dst.u.all;
 167                 return;
 168         default:
 169                 break;
 170         }
 171         return;
 172 err:
 173         regs->verdict.code = NFT_BREAK;
 174 }
 175
 176 static void nft_ct_set_eval(const struct nft_expr *expr,
 177                             struct nft_regs *regs,
 178                             const struct nft_pktinfo *pkt)
 179 {
 180         const struct nft_ct *priv = nft_expr_priv(expr);
 181         struct sk_buff *skb = pkt->skb;
 182 #ifdef CONFIG_NF_CONNTRACK_MARK
 183         u32 value = regs->data[priv->sreg];
 184 #endif
 185         enum ip_conntrack_info ctinfo;
 186         struct nf_conn *ct;
 187
 188         ct = nf_ct_get(skb, &ctinfo);
 189         if (ct == NULL)
 190                 return;
 191
 192         switch (priv->key) {
 193 #ifdef CONFIG_NF_CONNTRACK_MARK
 194         case NFT_CT_MARK:
 195                 if (ct->mark != value) {
 196                         ct->mark = value;
 197                         nf_conntrack_event_cache(IPCT_MARK, ct);
 198                 }
 199                 break;
 200 #endif
 201 #ifdef CONFIG_NF_CONNTRACK_LABELS
 202         case NFT_CT_LABELS:
 203                 nf_connlabels_replace(ct,
 204                                       &regs->data[priv->sreg],
 205                                       &regs->data[priv->sreg],
 206                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 207                 break;
 208 #endif
 209         default:
 210                 break;
 211         }
 212 }
 213
 214 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 215         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 216         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 217         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 218         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 219 };
 220
 221 static int nft_ct_l3proto_try_module_get(uint8_t family)
 222 {
 223         int err;
 224
 225         if (family == NFPROTO_INET) {
 226                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
 227                 if (err < 0)
 228                         goto err1;
 229                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
 230                 if (err < 0)
 231                         goto err2;
 232         } else {
 233                 err = nf_ct_l3proto_try_module_get(family);
 234                 if (err < 0)
 235                         goto err1;
 236         }
 237         return 0;
 238
 239 err2:
 240         nf_ct_l3proto_module_put(NFPROTO_IPV4);
 241 err1:
 242         return err;
 243 }
 244
 245 static void nft_ct_l3proto_module_put(uint8_t family)
 246 {
 247         if (family == NFPROTO_INET) {
 248                 nf_ct_l3proto_module_put(NFPROTO_IPV4);
 249                 nf_ct_l3proto_module_put(NFPROTO_IPV6);
 250         } else
 251                 nf_ct_l3proto_module_put(family);
 252 }
 253
 254 static int nft_ct_get_init(const struct nft_ctx *ctx,
 255                            const struct nft_expr *expr,
 256                            const struct nlattr * const tb[])
 257 {
 258         struct nft_ct *priv = nft_expr_priv(expr);
 259         unsigned int len;
 260         int err;
 261
 262         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 263         switch (priv->key) {
 264         case NFT_CT_DIRECTION:
 265                 if (tb[NFTA_CT_DIRECTION] != NULL)
 266                         return -EINVAL;
 267                 len = sizeof(u8);
 268                 break;
 269         case NFT_CT_STATE:
 270         case NFT_CT_STATUS:
 271 #ifdef CONFIG_NF_CONNTRACK_MARK
 272         case NFT_CT_MARK:
 273 #endif
 274 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 275         case NFT_CT_SECMARK:
 276 #endif
 277         case NFT_CT_EXPIRATION:
 278                 if (tb[NFTA_CT_DIRECTION] != NULL)
 279                         return -EINVAL;
 280                 len = sizeof(u32);
 281                 break;
 282 #ifdef CONFIG_NF_CONNTRACK_LABELS
 283         case NFT_CT_LABELS:
 284                 if (tb[NFTA_CT_DIRECTION] != NULL)
 285                         return -EINVAL;
 286                 len = NF_CT_LABELS_MAX_SIZE;
 287                 break;
 288 #endif
 289         case NFT_CT_HELPER:
 290                 if (tb[NFTA_CT_DIRECTION] != NULL)
 291                         return -EINVAL;
 292                 len = NF_CT_HELPER_NAME_LEN;
 293                 break;
 294
 295         case NFT_CT_L3PROTOCOL:
 296         case NFT_CT_PROTOCOL:
 297                 if (tb[NFTA_CT_DIRECTION] == NULL)
 298                         return -EINVAL;
 299                 len = sizeof(u8);
 300                 break;
 301         case NFT_CT_SRC:
 302         case NFT_CT_DST:
 303                 if (tb[NFTA_CT_DIRECTION] == NULL)
 304                         return -EINVAL;
 305
 306                 switch (ctx->afi->family) {
 307                 case NFPROTO_IPV4:
 308                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 309                                            src.u3.ip);
 310                         break;
 311                 case NFPROTO_IPV6:
 312                 case NFPROTO_INET:
 313                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 314                                            src.u3.ip6);
 315                         break;
 316                 default:
 317                         return -EAFNOSUPPORT;
 318                 }
 319                 break;
 320         case NFT_CT_PROTO_SRC:
 321         case NFT_CT_PROTO_DST:
 322                 if (tb[NFTA_CT_DIRECTION] == NULL)
 323                         return -EINVAL;
 324                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
 325                 break;
 326         case NFT_CT_BYTES:
 327         case NFT_CT_PKTS:
 328                 /* no direction? return sum of original + reply */
 329                 if (tb[NFTA_CT_DIRECTION] == NULL)
 330                         priv->dir = IP_CT_DIR_MAX;
 331                 len = sizeof(u64);
 332                 break;
 333         default:
 334                 return -EOPNOTSUPP;
 335         }
 336
 337         if (tb[NFTA_CT_DIRECTION] != NULL) {
 338                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 339                 switch (priv->dir) {
 340                 case IP_CT_DIR_ORIGINAL:
 341                 case IP_CT_DIR_REPLY:
 342                         break;
 343                 default:
 344                         return -EINVAL;
 345                 }
 346         }
 347
 348         priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
 349         err = nft_validate_register_store(ctx, priv->dreg, NULL,
 350                                           NFT_DATA_VALUE, len);
 351         if (err < 0)
 352                 return err;
 353
 354         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 355         if (err < 0)
 356                 return err;
 357
 358         return 0;
 359 }
 360
 361 static int nft_ct_set_init(const struct nft_ctx *ctx,
 362                            const struct nft_expr *expr,
 363                            const struct nlattr * const tb[])
 364 {
 365         struct nft_ct *priv = nft_expr_priv(expr);
 366         unsigned int len;
 367         int err;
 368
 369         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 370         switch (priv->key) {
 371 #ifdef CONFIG_NF_CONNTRACK_MARK
 372         case NFT_CT_MARK:
 373                 len = FIELD_SIZEOF(struct nf_conn, mark);
 374                 break;
 375 #endif
 376 #ifdef CONFIG_NF_CONNTRACK_LABELS
 377         case NFT_CT_LABELS:
 378                 if (tb[NFTA_CT_DIRECTION])
 379                         return -EINVAL;
 380                 len = NF_CT_LABELS_MAX_SIZE;
 381                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 382                 if (err)
 383                         return err;
 384                 break;
 385 #endif
 386         default:
 387                 return -EOPNOTSUPP;
 388         }
 389
 390         priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
 391         err = nft_validate_register_load(priv->sreg, len);
 392         if (err < 0)
 393                 return err;
 394
 395         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 396         if (err < 0)
 397                 return err;
 398
 399         return 0;
 400 }
 401
 402 static void nft_ct_destroy(const struct nft_ctx *ctx,
 403                            const struct nft_expr *expr)
 404 {
 405         struct nft_ct *priv = nft_expr_priv(expr);
 406
 407         switch (priv->key) {
 408 #ifdef CONFIG_NF_CONNTRACK_LABELS
 409         case NFT_CT_LABELS:
 410                 nf_connlabels_put(ctx->net);
 411                 break;
 412 #endif
 413         default:
 414                 break;
 415         }
 416
 417         nft_ct_l3proto_module_put(ctx->afi->family);
 418 }
 419
 420 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 421 {
 422         const struct nft_ct *priv = nft_expr_priv(expr);
 423
 424         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 425                 goto nla_put_failure;
 426         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 427                 goto nla_put_failure;
 428
 429         switch (priv->key) {
 430         case NFT_CT_L3PROTOCOL:
 431         case NFT_CT_PROTOCOL:
 432         case NFT_CT_SRC:
 433         case NFT_CT_DST:
 434         case NFT_CT_PROTO_SRC:
 435         case NFT_CT_PROTO_DST:
 436                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 437                         goto nla_put_failure;
 438                 break;
 439         case NFT_CT_BYTES:
 440         case NFT_CT_PKTS:
 441                 if (priv->dir < IP_CT_DIR_MAX &&
 442                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 443                         goto nla_put_failure;
 444                 break;
 445         default:
 446                 break;
 447         }
 448
 449         return 0;
 450
 451 nla_put_failure:
 452         return -1;
 453 }
 454
 455 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 456 {
 457         const struct nft_ct *priv = nft_expr_priv(expr);
 458
 459         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 460                 goto nla_put_failure;
 461         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 462                 goto nla_put_failure;
 463         return 0;
 464
 465 nla_put_failure:
 466         return -1;
 467 }
 468
 469 static struct nft_expr_type nft_ct_type;
 470 static const struct nft_expr_ops nft_ct_get_ops = {
 471         .type           = &nft_ct_type,
 472         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 473         .eval           = nft_ct_get_eval,
 474         .init           = nft_ct_get_init,
 475         .destroy        = nft_ct_destroy,
 476         .dump           = nft_ct_get_dump,
 477 };
 478
 479 static const struct nft_expr_ops nft_ct_set_ops = {
 480         .type           = &nft_ct_type,
 481         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 482         .eval           = nft_ct_set_eval,
 483         .init           = nft_ct_set_init,
 484         .destroy        = nft_ct_destroy,
 485         .dump           = nft_ct_set_dump,
 486 };
 487
 488 static const struct nft_expr_ops *
 489 nft_ct_select_ops(const struct nft_ctx *ctx,
 490                     const struct nlattr * const tb[])
 491 {
 492         if (tb[NFTA_CT_KEY] == NULL)
 493                 return ERR_PTR(-EINVAL);
 494
 495         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 496                 return ERR_PTR(-EINVAL);
 497
 498         if (tb[NFTA_CT_DREG])
 499                 return &nft_ct_get_ops;
 500
 501         if (tb[NFTA_CT_SREG])
 502                 return &nft_ct_set_ops;
 503
 504         return ERR_PTR(-EINVAL);
 505 }
 506
 507 static struct nft_expr_type nft_ct_type __read_mostly = {
 508         .name           = "ct",
 509         .select_ops     = &nft_ct_select_ops,
 510         .policy         = nft_ct_policy,
 511         .maxattr        = NFTA_CT_MAX,
 512         .owner          = THIS_MODULE,
 513 };
 514
 515 static int __init nft_ct_module_init(void)
 516 {
 517         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
 518
 519         return nft_register_expr(&nft_ct_type);
 520 }
 521
 522 static void __exit nft_ct_module_exit(void)
 523 {
 524         nft_unregister_expr(&nft_ct_type);
 525 }
 526
 527 module_init(nft_ct_module_init);
 528 module_exit(nft_ct_module_exit);
 529
 530 MODULE_LICENSE("GPL");
 531 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 532 MODULE_ALIAS_NFT_EXPR("ct");