[linux-2.6-block.git] / net / netfilter / nft_ct.c

/*
 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_tuple.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_labels.h>

struct nft_ct {
	enum nft_ct_keys	key:8;
	enum ip_conntrack_dir	dir:8;
	union {
		enum nft_registers	dreg:8;
		enum nft_registers	sreg:8;
	};
};

static void nft_ct_get_eval(const struct nft_expr *expr,
			    struct nft_regs *regs,
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	u32 *dest = &regs->data[priv->dreg];
	enum ip_conntrack_info ctinfo;
	const struct nf_conn *ct;
	const struct nf_conn_help *help;
	const struct nf_conntrack_tuple *tuple;
	const struct nf_conntrack_helper *helper;
	long diff;
	unsigned int state;

	ct = nf_ct_get(pkt->skb, &ctinfo);

	switch (priv->key) {
	case NFT_CT_STATE:
		if (ct == NULL)
			state = NF_CT_STATE_INVALID_BIT;
		else if (nf_ct_is_untracked(ct))
			state = NF_CT_STATE_UNTRACKED_BIT;
		else
			state = NF_CT_STATE_BIT(ctinfo);
		*dest = state;
		return;
	default:
		break;
	}

	if (ct == NULL)
		goto err;

	switch (priv->key) {
	case NFT_CT_DIRECTION:
		*dest = CTINFO2DIR(ctinfo);
		return;
	case NFT_CT_STATUS:
		*dest = ct->status;
		return;
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		*dest = ct->mark;
		return;
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
		*dest = ct->secmark;
		return;
#endif
	case NFT_CT_EXPIRATION:
		diff = (long)jiffies - (long)ct->timeout.expires;
		if (diff < 0)
			diff = 0;
		*dest = jiffies_to_msecs(diff);
		return;
	case NFT_CT_HELPER:
		if (ct->master == NULL)
			goto err;
		help = nfct_help(ct->master);
		if (help == NULL)
			goto err;
		helper = rcu_dereference(help->helper);
		if (helper == NULL)
			goto err;
		strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
		return;
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS: {
		struct nf_conn_labels *labels = nf_ct_labels_find(ct);
		unsigned int size;

		if (!labels) {
			memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
			return;
		}

		size = labels->words * sizeof(long);
		memcpy(dest, labels->bits, size);
		if (size < NF_CT_LABELS_MAX_SIZE)
			memset(((char *) dest) + size, 0,
			       NF_CT_LABELS_MAX_SIZE - size);
		return;
	}
#endif
	default:
		break;
	}

	tuple = &ct->tuplehash[priv->dir].tuple;
	switch (priv->key) {
	case NFT_CT_L3PROTOCOL:
		*dest = nf_ct_l3num(ct);
		return;
	case NFT_CT_SRC:
		memcpy(dest, tuple->src.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_DST:
		memcpy(dest, tuple->dst.u3.all,
		       nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
		return;
	case NFT_CT_PROTOCOL:
		*dest = nf_ct_protonum(ct);
		return;
	case NFT_CT_PROTO_SRC:
		*dest = (__force __u16)tuple->src.u.all;
		return;
	case NFT_CT_PROTO_DST:
		*dest = (__force __u16)tuple->dst.u.all;
		return;
	default:
		break;
	}
	return;
err:
	regs->verdict.code = NFT_BREAK;
}

static void nft_ct_set_eval(const struct nft_expr *expr,
			    struct nft_regs *regs,
			    const struct nft_pktinfo *pkt)
{
	const struct nft_ct *priv = nft_expr_priv(expr);
	struct sk_buff *skb = pkt->skb;
#ifdef CONFIG_NF_CONNTRACK_MARK
	u32 value = regs->data[priv->sreg];
#endif
	enum ip_conntrack_info ctinfo;
	struct nf_conn *ct;

	ct = nf_ct_get(skb, &ctinfo);
	if (ct == NULL)
		return;

	switch (priv->key) {
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		if (ct->mark != value) {
			ct->mark = value;
			nf_conntrack_event_cache(IPCT_MARK, ct);
		}
		break;
#endif
	default:
		break;
	}
}

static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	[NFTA_CT_DREG]		= { .type = NLA_U32 },
	[NFTA_CT_KEY]		= { .type = NLA_U32 },
	[NFTA_CT_DIRECTION]	= { .type = NLA_U8 },
	[NFTA_CT_SREG]		= { .type = NLA_U32 },
};

static int nft_ct_l3proto_try_module_get(uint8_t family)
{
	int err;

	if (family == NFPROTO_INET) {
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
		if (err < 0)
			goto err1;
		err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
		if (err < 0)
			goto err2;
	} else {
		err = nf_ct_l3proto_try_module_get(family);
		if (err < 0)
			goto err1;
	}
	return 0;

err2:
	nf_ct_l3proto_module_put(NFPROTO_IPV4);
err1:
	return err;
}

static void nft_ct_l3proto_module_put(uint8_t family)
{
	if (family == NFPROTO_INET) {
		nf_ct_l3proto_module_put(NFPROTO_IPV4);
		nf_ct_l3proto_module_put(NFPROTO_IPV6);
	} else
		nf_ct_l3proto_module_put(family);
}

static int nft_ct_get_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);
	unsigned int len;
	int err;

	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	switch (priv->key) {
	case NFT_CT_DIRECTION:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = sizeof(u8);
		break;
	case NFT_CT_STATE:
	case NFT_CT_STATUS:
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
#endif
#ifdef CONFIG_NF_CONNTRACK_SECMARK
	case NFT_CT_SECMARK:
#endif
	case NFT_CT_EXPIRATION:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = sizeof(u32);
		break;
#ifdef CONFIG_NF_CONNTRACK_LABELS
	case NFT_CT_LABELS:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = NF_CT_LABELS_MAX_SIZE;
		break;
#endif
	case NFT_CT_HELPER:
		if (tb[NFTA_CT_DIRECTION] != NULL)
			return -EINVAL;
		len = NF_CT_HELPER_NAME_LEN;
		break;

	case NFT_CT_L3PROTOCOL:
	case NFT_CT_PROTOCOL:
		if (tb[NFTA_CT_DIRECTION] == NULL)
			return -EINVAL;
		len = sizeof(u8);
		break;
	case NFT_CT_SRC:
	case NFT_CT_DST:
		if (tb[NFTA_CT_DIRECTION] == NULL)
			return -EINVAL;

		switch (ctx->afi->family) {
		case NFPROTO_IPV4:
			len = FIELD_SIZEOF(struct nf_conntrack_tuple,
					   src.u3.ip);
			break;
		case NFPROTO_IPV6:
		case NFPROTO_INET:
			len = FIELD_SIZEOF(struct nf_conntrack_tuple,
					   src.u3.ip6);
			break;
		default:
			return -EAFNOSUPPORT;
		}
		break;
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (tb[NFTA_CT_DIRECTION] == NULL)
			return -EINVAL;
		len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
		break;
	default:
		return -EOPNOTSUPP;
	}

	if (tb[NFTA_CT_DIRECTION] != NULL) {
		priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
		switch (priv->dir) {
		case IP_CT_DIR_ORIGINAL:
		case IP_CT_DIR_REPLY:
			break;
		default:
			return -EINVAL;
		}
	}

	priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
	err = nft_validate_register_store(ctx, priv->dreg, NULL,
					  NFT_DATA_VALUE, len);
	if (err < 0)
		return err;

	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	if (err < 0)
		return err;

	return 0;
}

static int nft_ct_set_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_ct *priv = nft_expr_priv(expr);
	unsigned int len;
	int err;

	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	switch (priv->key) {
#ifdef CONFIG_NF_CONNTRACK_MARK
	case NFT_CT_MARK:
		len = FIELD_SIZEOF(struct nf_conn, mark);
		break;
#endif
	default:
		return -EOPNOTSUPP;
	}

	priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
	err = nft_validate_register_load(priv->sreg, len);
	if (err < 0)
		return err;

	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	if (err < 0)
		return err;

	return 0;
}

static void nft_ct_destroy(const struct nft_ctx *ctx,
			   const struct nft_expr *expr)
{
	nft_ct_l3proto_module_put(ctx->afi->family);
}

static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;

	switch (priv->key) {
	case NFT_CT_PROTOCOL:
	case NFT_CT_SRC:
	case NFT_CT_DST:
	case NFT_CT_PROTO_SRC:
	case NFT_CT_PROTO_DST:
		if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
			goto nla_put_failure;
	default:
		break;
	}

	return 0;

nla_put_failure:
	return -1;
}

static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_ct *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
		goto nla_put_failure;
	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_ct_type;
static const struct nft_expr_ops nft_ct_get_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_get_eval,
	.init		= nft_ct_get_init,
	.destroy	= nft_ct_destroy,
	.dump		= nft_ct_get_dump,
};

static const struct nft_expr_ops nft_ct_set_ops = {
	.type		= &nft_ct_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	.eval		= nft_ct_set_eval,
	.init		= nft_ct_set_init,
	.destroy	= nft_ct_destroy,
	.dump		= nft_ct_set_dump,
};

static const struct nft_expr_ops *
nft_ct_select_ops(const struct nft_ctx *ctx,
		    const struct nlattr * const tb[])
{
	if (tb[NFTA_CT_KEY] == NULL)
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
		return ERR_PTR(-EINVAL);

	if (tb[NFTA_CT_DREG])
		return &nft_ct_get_ops;

	if (tb[NFTA_CT_SREG])
		return &nft_ct_set_ops;

	return ERR_PTR(-EINVAL);
}

static struct nft_expr_type nft_ct_type __read_mostly = {
	.name		= "ct",
	.select_ops	= &nft_ct_select_ops,
	.policy		= nft_ct_policy,
	.maxattr	= NFTA_CT_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_ct_module_init(void)
{
	return nft_register_expr(&nft_ct_type);
}

static void __exit nft_ct_module_exit(void)
{
	nft_unregister_expr(&nft_ct_type);
}

module_init(nft_ct_module_init);
module_exit(nft_ct_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_EXPR("ct");
Commit	Line	Data
96518518	1	/*
ef1f7df9	2	* Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
96518518 PM	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	9	*/
	10
	11	#include <linux/kernel.h>
	12	#include <linux/init.h>
	13	#include <linux/module.h>
	14	#include <linux/netlink.h>
	15	#include <linux/netfilter.h>
	16	#include <linux/netfilter/nf_tables.h>
	17	#include <net/netfilter/nf_tables.h>
	18	#include <net/netfilter/nf_conntrack.h>
	19	#include <net/netfilter/nf_conntrack_tuple.h>
	20	#include <net/netfilter/nf_conntrack_helper.h>
c4ede3d3	21	#include <net/netfilter/nf_conntrack_ecache.h>
d2bf2f34	22	#include <net/netfilter/nf_conntrack_labels.h>
96518518 PM	23
	24	struct nft_ct {
	25	enum nft_ct_keys key:8;
	26	enum ip_conntrack_dir dir:8;
d46f2cd2	27	union {
c4ede3d3 KE	28	enum nft_registers dreg:8;
	29	enum nft_registers sreg:8;
	30	};
96518518 PM	31	};
96518518 PM	32
c4ede3d3	33	static void nft_ct_get_eval(const struct nft_expr *expr,
a55e22e9	34	struct nft_regs *regs,
c4ede3d3	35	const struct nft_pktinfo *pkt)
96518518 PM	36	{
96518518 PM	37	const struct nft_ct *priv = nft_expr_priv(expr);
49499c3e	38	u32 *dest = &regs->data[priv->dreg];
96518518 PM	39	enum ip_conntrack_info ctinfo;
	40	const struct nf_conn *ct;
	41	const struct nf_conn_help *help;
	42	const struct nf_conntrack_tuple *tuple;
	43	const struct nf_conntrack_helper *helper;
	44	long diff;
	45	unsigned int state;
	46
	47	ct = nf_ct_get(pkt->skb, &ctinfo);
	48
	49	switch (priv->key) {
	50	case NFT_CT_STATE:
	51	if (ct == NULL)
	52	state = NF_CT_STATE_INVALID_BIT;
	53	else if (nf_ct_is_untracked(ct))
	54	state = NF_CT_STATE_UNTRACKED_BIT;
	55	else
	56	state = NF_CT_STATE_BIT(ctinfo);
fad136ea	57	*dest = state;
96518518	58	return;
c1f86676 DM	59	default:
c1f86676 DM	60	break;
96518518 PM	61	}
	62
	63	if (ct == NULL)
	64	goto err;
	65
	66	switch (priv->key) {
	67	case NFT_CT_DIRECTION:
fad136ea	68	*dest = CTINFO2DIR(ctinfo);
96518518 PM	69	return;
96518518 PM	70	case NFT_CT_STATUS:
fad136ea	71	*dest = ct->status;
96518518 PM	72	return;
	73	#ifdef CONFIG_NF_CONNTRACK_MARK
	74	case NFT_CT_MARK:
fad136ea	75	*dest = ct->mark;
96518518 PM	76	return;
	77	#endif
	78	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	79	case NFT_CT_SECMARK:
fad136ea	80	*dest = ct->secmark;
96518518 PM	81	return;
	82	#endif
	83	case NFT_CT_EXPIRATION:
	84	diff = (long)jiffies - (long)ct->timeout.expires;
	85	if (diff < 0)
	86	diff = 0;
fad136ea	87	*dest = jiffies_to_msecs(diff);
96518518 PM	88	return;
	89	case NFT_CT_HELPER:
	90	if (ct->master == NULL)
	91	goto err;
	92	help = nfct_help(ct->master);
	93	if (help == NULL)
	94	goto err;
	95	helper = rcu_dereference(help->helper);
	96	if (helper == NULL)
	97	goto err;
fad136ea	98	strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
96518518	99	return;
d2bf2f34 FW	100	#ifdef CONFIG_NF_CONNTRACK_LABELS
	101	case NFT_CT_LABELS: {
	102	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
	103	unsigned int size;
	104
	105	if (!labels) {
fad136ea	106	memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
d2bf2f34 FW	107	return;
	108	}
	109
d2bf2f34	110	size = labels->words * sizeof(long);
fad136ea PM	111	memcpy(dest, labels->bits, size);
	112	if (size < NF_CT_LABELS_MAX_SIZE)
	113	memset(((char *) dest) + size, 0,
	114	NF_CT_LABELS_MAX_SIZE - size);
d2bf2f34 FW	115	return;
	116	}
	117	#endif
c1f86676 DM	118	default:
c1f86676 DM	119	break;
96518518 PM	120	}
	121
	122	tuple = &ct->tuplehash[priv->dir].tuple;
	123	switch (priv->key) {
	124	case NFT_CT_L3PROTOCOL:
fad136ea	125	*dest = nf_ct_l3num(ct);
96518518 PM	126	return;
96518518 PM	127	case NFT_CT_SRC:
fad136ea	128	memcpy(dest, tuple->src.u3.all,
96518518 PM	129	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
	130	return;
	131	case NFT_CT_DST:
fad136ea	132	memcpy(dest, tuple->dst.u3.all,
96518518 PM	133	nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
	134	return;
	135	case NFT_CT_PROTOCOL:
fad136ea	136	*dest = nf_ct_protonum(ct);
96518518 PM	137	return;
96518518 PM	138	case NFT_CT_PROTO_SRC:
fad136ea	139	*dest = (__force __u16)tuple->src.u.all;
96518518 PM	140	return;
96518518 PM	141	case NFT_CT_PROTO_DST:
fad136ea	142	*dest = (__force __u16)tuple->dst.u.all;
96518518	143	return;
c1f86676 DM	144	default:
c1f86676 DM	145	break;
96518518 PM	146	}
	147	return;
	148	err:
a55e22e9	149	regs->verdict.code = NFT_BREAK;
96518518 PM	150	}
96518518 PM	151
c4ede3d3	152	static void nft_ct_set_eval(const struct nft_expr *expr,
a55e22e9	153	struct nft_regs *regs,
c4ede3d3 KE	154	const struct nft_pktinfo *pkt)
	155	{
	156	const struct nft_ct *priv = nft_expr_priv(expr);
	157	struct sk_buff *skb = pkt->skb;
847c8e29	158	#ifdef CONFIG_NF_CONNTRACK_MARK
49499c3e	159	u32 value = regs->data[priv->sreg];
847c8e29	160	#endif
c4ede3d3 KE	161	enum ip_conntrack_info ctinfo;
	162	struct nf_conn *ct;
	163
	164	ct = nf_ct_get(skb, &ctinfo);
	165	if (ct == NULL)
	166	return;
	167
	168	switch (priv->key) {
	169	#ifdef CONFIG_NF_CONNTRACK_MARK
	170	case NFT_CT_MARK:
	171	if (ct->mark != value) {
	172	ct->mark = value;
	173	nf_conntrack_event_cache(IPCT_MARK, ct);
	174	}
	175	break;
	176	#endif
c1f86676 DM	177	default:
c1f86676 DM	178	break;
c4ede3d3 KE	179	}
	180	}
	181
96518518 PM	182	static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
	183	[NFTA_CT_DREG] = { .type = NLA_U32 },
	184	[NFTA_CT_KEY] = { .type = NLA_U32 },
	185	[NFTA_CT_DIRECTION] = { .type = NLA_U8 },
c4ede3d3	186	[NFTA_CT_SREG] = { .type = NLA_U32 },
96518518 PM	187	};
96518518 PM	188
9638f33e PM	189	static int nft_ct_l3proto_try_module_get(uint8_t family)
	190	{
	191	int err;
	192
	193	if (family == NFPROTO_INET) {
	194	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
	195	if (err < 0)
	196	goto err1;
	197	err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
	198	if (err < 0)
	199	goto err2;
	200	} else {
	201	err = nf_ct_l3proto_try_module_get(family);
	202	if (err < 0)
	203	goto err1;
	204	}
	205	return 0;
	206
	207	err2:
	208	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	209	err1:
	210	return err;
	211	}
	212
	213	static void nft_ct_l3proto_module_put(uint8_t family)
	214	{
	215	if (family == NFPROTO_INET) {
	216	nf_ct_l3proto_module_put(NFPROTO_IPV4);
	217	nf_ct_l3proto_module_put(NFPROTO_IPV6);
	218	} else
	219	nf_ct_l3proto_module_put(family);
	220	}
	221
fe92ca45 PM	222	static int nft_ct_get_init(const struct nft_ctx *ctx,
	223	const struct nft_expr *expr,
	224	const struct nlattr * const tb[])
96518518 PM	225	{
96518518 PM	226	struct nft_ct *priv = nft_expr_priv(expr);
45d9bcda	227	unsigned int len;
fe92ca45	228	int err;
96518518	229
fe92ca45	230	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
96518518	231	switch (priv->key) {
96518518	232	case NFT_CT_DIRECTION:
45d9bcda PM	233	if (tb[NFTA_CT_DIRECTION] != NULL)
	234	return -EINVAL;
	235	len = sizeof(u8);
	236	break;
	237	case NFT_CT_STATE:
96518518 PM	238	case NFT_CT_STATUS:
	239	#ifdef CONFIG_NF_CONNTRACK_MARK
	240	case NFT_CT_MARK:
	241	#endif
	242	#ifdef CONFIG_NF_CONNTRACK_SECMARK
	243	case NFT_CT_SECMARK:
d2bf2f34	244	#endif
45d9bcda PM	245	case NFT_CT_EXPIRATION:
	246	if (tb[NFTA_CT_DIRECTION] != NULL)
	247	return -EINVAL;
	248	len = sizeof(u32);
	249	break;
d2bf2f34 FW	250	#ifdef CONFIG_NF_CONNTRACK_LABELS
d2bf2f34 FW	251	case NFT_CT_LABELS:
45d9bcda PM	252	if (tb[NFTA_CT_DIRECTION] != NULL)
	253	return -EINVAL;
	254	len = NF_CT_LABELS_MAX_SIZE;
	255	break;
96518518	256	#endif
96518518 PM	257	case NFT_CT_HELPER:
	258	if (tb[NFTA_CT_DIRECTION] != NULL)
	259	return -EINVAL;
45d9bcda	260	len = NF_CT_HELPER_NAME_LEN;
96518518	261	break;
45d9bcda	262
51292c07	263	case NFT_CT_L3PROTOCOL:
96518518	264	case NFT_CT_PROTOCOL:
45d9bcda PM	265	if (tb[NFTA_CT_DIRECTION] == NULL)
	266	return -EINVAL;
	267	len = sizeof(u8);
	268	break;
96518518 PM	269	case NFT_CT_SRC:
96518518 PM	270	case NFT_CT_DST:
45d9bcda PM	271	if (tb[NFTA_CT_DIRECTION] == NULL)
	272	return -EINVAL;
	273
	274	switch (ctx->afi->family) {
	275	case NFPROTO_IPV4:
	276	len = FIELD_SIZEOF(struct nf_conntrack_tuple,
	277	src.u3.ip);
	278	break;
	279	case NFPROTO_IPV6:
	280	case NFPROTO_INET:
	281	len = FIELD_SIZEOF(struct nf_conntrack_tuple,
	282	src.u3.ip6);
	283	break;
	284	default:
	285	return -EAFNOSUPPORT;
	286	}
	287	break;
96518518 PM	288	case NFT_CT_PROTO_SRC:
	289	case NFT_CT_PROTO_DST:
	290	if (tb[NFTA_CT_DIRECTION] == NULL)
	291	return -EINVAL;
45d9bcda	292	len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
96518518 PM	293	break;
	294	default:
	295	return -EOPNOTSUPP;
	296	}
	297
fe92ca45 PM	298	if (tb[NFTA_CT_DIRECTION] != NULL) {
	299	priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
	300	switch (priv->dir) {
	301	case IP_CT_DIR_ORIGINAL:
	302	case IP_CT_DIR_REPLY:
	303	break;
	304	default:
	305	return -EINVAL;
	306	}
	307	}
	308
b1c96ed3	309	priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
1ec10212 PM	310	err = nft_validate_register_store(ctx, priv->dreg, NULL,
1ec10212 PM	311	NFT_DATA_VALUE, len);
fe92ca45 PM	312	if (err < 0)
	313	return err;
	314
	315	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
	316	if (err < 0)
	317	return err;
	318
c4ede3d3 KE	319	return 0;
	320	}
	321
fe92ca45 PM	322	static int nft_ct_set_init(const struct nft_ctx *ctx,
	323	const struct nft_expr *expr,
	324	const struct nlattr * const tb[])
c4ede3d3	325	{
fe92ca45	326	struct nft_ct *priv = nft_expr_priv(expr);
d07db988	327	unsigned int len;
fe92ca45 PM	328	int err;
	329
	330	priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
	331	switch (priv->key) {
e88e514e	332	#ifdef CONFIG_NF_CONNTRACK_MARK
c4ede3d3	333	case NFT_CT_MARK:
d07db988	334	len = FIELD_SIZEOF(struct nf_conn, mark);
c4ede3d3	335	break;
e88e514e	336	#endif
c4ede3d3 KE	337	default:
	338	return -EOPNOTSUPP;
	339	}
	340
b1c96ed3	341	priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
d07db988	342	err = nft_validate_register_load(priv->sreg, len);
fe92ca45 PM	343	if (err < 0)
fe92ca45 PM	344	return err;
c4ede3d3	345
9638f33e	346	err = nft_ct_l3proto_try_module_get(ctx->afi->family);
96518518 PM	347	if (err < 0)
96518518 PM	348	return err;
96518518	349
96518518	350	return 0;
96518518 PM	351	}
96518518 PM	352
62472bce PM	353	static void nft_ct_destroy(const struct nft_ctx *ctx,
62472bce PM	354	const struct nft_expr *expr)
96518518	355	{
d46f2cd2	356	nft_ct_l3proto_module_put(ctx->afi->family);
96518518 PM	357	}
96518518 PM	358
c4ede3d3	359	static int nft_ct_get_dump(struct sk_buff skb, const struct nft_expr expr)
96518518 PM	360	{
	361	const struct nft_ct *priv = nft_expr_priv(expr);
	362
b1c96ed3	363	if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
96518518 PM	364	goto nla_put_failure;
	365	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	366	goto nla_put_failure;
2a53bfb3 AB	367
	368	switch (priv->key) {
	369	case NFT_CT_PROTOCOL:
	370	case NFT_CT_SRC:
	371	case NFT_CT_DST:
	372	case NFT_CT_PROTO_SRC:
	373	case NFT_CT_PROTO_DST:
	374	if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
	375	goto nla_put_failure;
	376	default:
	377	break;
	378	}
	379
96518518 PM	380	return 0;
	381
	382	nla_put_failure:
	383	return -1;
	384	}
	385
c4ede3d3 KE	386	static int nft_ct_set_dump(struct sk_buff skb, const struct nft_expr expr)
	387	{
	388	const struct nft_ct *priv = nft_expr_priv(expr);
	389
b1c96ed3	390	if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
c4ede3d3 KE	391	goto nla_put_failure;
	392	if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
	393	goto nla_put_failure;
	394	return 0;
	395
	396	nla_put_failure:
	397	return -1;
	398	}
	399
ef1f7df9	400	static struct nft_expr_type nft_ct_type;
c4ede3d3	401	static const struct nft_expr_ops nft_ct_get_ops = {
ef1f7df9	402	.type = &nft_ct_type,
96518518	403	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
c4ede3d3	404	.eval = nft_ct_get_eval,
fe92ca45	405	.init = nft_ct_get_init,
96518518	406	.destroy = nft_ct_destroy,
c4ede3d3	407	.dump = nft_ct_get_dump,
ef1f7df9 PM	408	};
ef1f7df9 PM	409
c4ede3d3 KE	410	static const struct nft_expr_ops nft_ct_set_ops = {
	411	.type = &nft_ct_type,
	412	.size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
	413	.eval = nft_ct_set_eval,
fe92ca45	414	.init = nft_ct_set_init,
c4ede3d3 KE	415	.destroy = nft_ct_destroy,
	416	.dump = nft_ct_set_dump,
	417	};
	418
	419	static const struct nft_expr_ops *
	420	nft_ct_select_ops(const struct nft_ctx *ctx,
	421	const struct nlattr * const tb[])
	422	{
	423	if (tb[NFTA_CT_KEY] == NULL)
	424	return ERR_PTR(-EINVAL);
	425
	426	if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
	427	return ERR_PTR(-EINVAL);
	428
	429	if (tb[NFTA_CT_DREG])
	430	return &nft_ct_get_ops;
	431
	432	if (tb[NFTA_CT_SREG])
	433	return &nft_ct_set_ops;
	434
	435	return ERR_PTR(-EINVAL);
	436	}
	437
ef1f7df9 PM	438	static struct nft_expr_type nft_ct_type __read_mostly = {
ef1f7df9 PM	439	.name = "ct",
c4ede3d3	440	.select_ops = &nft_ct_select_ops,
96518518 PM	441	.policy = nft_ct_policy,
96518518 PM	442	.maxattr = NFTA_CT_MAX,
ef1f7df9	443	.owner = THIS_MODULE,
96518518 PM	444	};
	445
	446	static int __init nft_ct_module_init(void)
	447	{
ef1f7df9	448	return nft_register_expr(&nft_ct_type);
96518518 PM	449	}
	450
	451	static void __exit nft_ct_module_exit(void)
	452	{
ef1f7df9	453	nft_unregister_expr(&nft_ct_type);
96518518 PM	454	}
	455
	456	module_init(nft_ct_module_init);
	457	module_exit(nft_ct_module_exit);
	458
	459	MODULE_LICENSE("GPL");
	460	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	461	MODULE_ALIAS_NFT_EXPR("ct");