net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/init.h>
  13 #include <linux/module.h>
  14 #include <linux/netlink.h>
  15 #include <linux/netfilter.h>
  16 #include <linux/netfilter/nf_tables.h>
  17 #include <net/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_conntrack.h>
  19 #include <net/netfilter/nf_conntrack_acct.h>
  20 #include <net/netfilter/nf_conntrack_tuple.h>
  21 #include <net/netfilter/nf_conntrack_helper.h>
  22 #include <net/netfilter/nf_conntrack_ecache.h>
  23 #include <net/netfilter/nf_conntrack_labels.h>
  24
  25 struct nft_ct {
  26         enum nft_ct_keys        key:8;
  27         enum ip_conntrack_dir   dir:8;
  28         union {
  29                 enum nft_registers      dreg:8;
  30                 enum nft_registers      sreg:8;
  31         };
  32 };
  33
  34 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  35                                    enum nft_ct_keys k,
  36                                    enum ip_conntrack_dir d)
  37 {
  38         if (d < IP_CT_DIR_MAX)
  39                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  40                                            atomic64_read(&c[d].packets);
  41
  42         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  43                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  44 }
  45
  46 static void nft_ct_get_eval(const struct nft_expr *expr,
  47                             struct nft_regs *regs,
  48                             const struct nft_pktinfo *pkt)
  49 {
  50         const struct nft_ct *priv = nft_expr_priv(expr);
  51         u32 *dest = &regs->data[priv->dreg];
  52         enum ip_conntrack_info ctinfo;
  53         const struct nf_conn *ct;
  54         const struct nf_conn_help *help;
  55         const struct nf_conntrack_tuple *tuple;
  56         const struct nf_conntrack_helper *helper;
  57         long diff;
  58         unsigned int state;
  59
  60         ct = nf_ct_get(pkt->skb, &ctinfo);
  61
  62         switch (priv->key) {
  63         case NFT_CT_STATE:
  64                 if (ct == NULL)
  65                         state = NF_CT_STATE_INVALID_BIT;
  66                 else if (nf_ct_is_untracked(ct))
  67                         state = NF_CT_STATE_UNTRACKED_BIT;
  68                 else
  69                         state = NF_CT_STATE_BIT(ctinfo);
  70                 *dest = state;
  71                 return;
  72         default:
  73                 break;
  74         }
  75
  76         if (ct == NULL)
  77                 goto err;
  78
  79         switch (priv->key) {
  80         case NFT_CT_DIRECTION:
  81                 *dest = CTINFO2DIR(ctinfo);
  82                 return;
  83         case NFT_CT_STATUS:
  84                 *dest = ct->status;
  85                 return;
  86 #ifdef CONFIG_NF_CONNTRACK_MARK
  87         case NFT_CT_MARK:
  88                 *dest = ct->mark;
  89                 return;
  90 #endif
  91 #ifdef CONFIG_NF_CONNTRACK_SECMARK
  92         case NFT_CT_SECMARK:
  93                 *dest = ct->secmark;
  94                 return;
  95 #endif
  96         case NFT_CT_EXPIRATION:
  97                 diff = (long)jiffies - (long)ct->timeout.expires;
  98                 if (diff < 0)
  99                         diff = 0;
 100                 *dest = jiffies_to_msecs(diff);
 101                 return;
 102         case NFT_CT_HELPER:
 103                 if (ct->master == NULL)
 104                         goto err;
 105                 help = nfct_help(ct->master);
 106                 if (help == NULL)
 107                         goto err;
 108                 helper = rcu_dereference(help->helper);
 109                 if (helper == NULL)
 110                         goto err;
 111                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 112                 return;
 113 #ifdef CONFIG_NF_CONNTRACK_LABELS
 114         case NFT_CT_LABELS: {
 115                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 116
 117                 if (labels)
 118                         memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 119                 else
 120                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 121                 return;
 122         }
 123 #endif
 124         case NFT_CT_BYTES: /* fallthrough */
 125         case NFT_CT_PKTS: {
 126                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 127                 u64 count = 0;
 128
 129                 if (acct)
 130                         count = nft_ct_get_eval_counter(acct->counter,
 131                                                         priv->key, priv->dir);
 132                 memcpy(dest, &count, sizeof(count));
 133                 return;
 134         }
 135         default:
 136                 break;
 137         }
 138
 139         tuple = &ct->tuplehash[priv->dir].tuple;
 140         switch (priv->key) {
 141         case NFT_CT_L3PROTOCOL:
 142                 *dest = nf_ct_l3num(ct);
 143                 return;
 144         case NFT_CT_SRC:
 145                 memcpy(dest, tuple->src.u3.all,
 146                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 147                 return;
 148         case NFT_CT_DST:
 149                 memcpy(dest, tuple->dst.u3.all,
 150                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 151                 return;
 152         case NFT_CT_PROTOCOL:
 153                 *dest = nf_ct_protonum(ct);
 154                 return;
 155         case NFT_CT_PROTO_SRC:
 156                 *dest = (__force __u16)tuple->src.u.all;
 157                 return;
 158         case NFT_CT_PROTO_DST:
 159                 *dest = (__force __u16)tuple->dst.u.all;
 160                 return;
 161         default:
 162                 break;
 163         }
 164         return;
 165 err:
 166         regs->verdict.code = NFT_BREAK;
 167 }
 168
 169 static void nft_ct_set_eval(const struct nft_expr *expr,
 170                             struct nft_regs *regs,
 171                             const struct nft_pktinfo *pkt)
 172 {
 173         const struct nft_ct *priv = nft_expr_priv(expr);
 174         struct sk_buff *skb = pkt->skb;
 175 #ifdef CONFIG_NF_CONNTRACK_MARK
 176         u32 value = regs->data[priv->sreg];
 177 #endif
 178         enum ip_conntrack_info ctinfo;
 179         struct nf_conn *ct;
 180
 181         ct = nf_ct_get(skb, &ctinfo);
 182         if (ct == NULL)
 183                 return;
 184
 185         switch (priv->key) {
 186 #ifdef CONFIG_NF_CONNTRACK_MARK
 187         case NFT_CT_MARK:
 188                 if (ct->mark != value) {
 189                         ct->mark = value;
 190                         nf_conntrack_event_cache(IPCT_MARK, ct);
 191                 }
 192                 break;
 193 #endif
 194 #ifdef CONFIG_NF_CONNTRACK_LABELS
 195         case NFT_CT_LABELS:
 196                 nf_connlabels_replace(ct,
 197                                       &regs->data[priv->sreg],
 198                                       &regs->data[priv->sreg],
 199                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 200                 break;
 201 #endif
 202         default:
 203                 break;
 204         }
 205 }
 206
 207 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 208         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 209         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 210         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 211         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 212 };
 213
 214 static int nft_ct_l3proto_try_module_get(uint8_t family)
 215 {
 216         int err;
 217
 218         if (family == NFPROTO_INET) {
 219                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
 220                 if (err < 0)
 221                         goto err1;
 222                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
 223                 if (err < 0)
 224                         goto err2;
 225         } else {
 226                 err = nf_ct_l3proto_try_module_get(family);
 227                 if (err < 0)
 228                         goto err1;
 229         }
 230         return 0;
 231
 232 err2:
 233         nf_ct_l3proto_module_put(NFPROTO_IPV4);
 234 err1:
 235         return err;
 236 }
 237
 238 static void nft_ct_l3proto_module_put(uint8_t family)
 239 {
 240         if (family == NFPROTO_INET) {
 241                 nf_ct_l3proto_module_put(NFPROTO_IPV4);
 242                 nf_ct_l3proto_module_put(NFPROTO_IPV6);
 243         } else
 244                 nf_ct_l3proto_module_put(family);
 245 }
 246
 247 static int nft_ct_get_init(const struct nft_ctx *ctx,
 248                            const struct nft_expr *expr,
 249                            const struct nlattr * const tb[])
 250 {
 251         struct nft_ct *priv = nft_expr_priv(expr);
 252         unsigned int len;
 253         int err;
 254
 255         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 256         switch (priv->key) {
 257         case NFT_CT_DIRECTION:
 258                 if (tb[NFTA_CT_DIRECTION] != NULL)
 259                         return -EINVAL;
 260                 len = sizeof(u8);
 261                 break;
 262         case NFT_CT_STATE:
 263         case NFT_CT_STATUS:
 264 #ifdef CONFIG_NF_CONNTRACK_MARK
 265         case NFT_CT_MARK:
 266 #endif
 267 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 268         case NFT_CT_SECMARK:
 269 #endif
 270         case NFT_CT_EXPIRATION:
 271                 if (tb[NFTA_CT_DIRECTION] != NULL)
 272                         return -EINVAL;
 273                 len = sizeof(u32);
 274                 break;
 275 #ifdef CONFIG_NF_CONNTRACK_LABELS
 276         case NFT_CT_LABELS:
 277                 if (tb[NFTA_CT_DIRECTION] != NULL)
 278                         return -EINVAL;
 279                 len = NF_CT_LABELS_MAX_SIZE;
 280                 break;
 281 #endif
 282         case NFT_CT_HELPER:
 283                 if (tb[NFTA_CT_DIRECTION] != NULL)
 284                         return -EINVAL;
 285                 len = NF_CT_HELPER_NAME_LEN;
 286                 break;
 287
 288         case NFT_CT_L3PROTOCOL:
 289         case NFT_CT_PROTOCOL:
 290                 if (tb[NFTA_CT_DIRECTION] == NULL)
 291                         return -EINVAL;
 292                 len = sizeof(u8);
 293                 break;
 294         case NFT_CT_SRC:
 295         case NFT_CT_DST:
 296                 if (tb[NFTA_CT_DIRECTION] == NULL)
 297                         return -EINVAL;
 298
 299                 switch (ctx->afi->family) {
 300                 case NFPROTO_IPV4:
 301                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 302                                            src.u3.ip);
 303                         break;
 304                 case NFPROTO_IPV6:
 305                 case NFPROTO_INET:
 306                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 307                                            src.u3.ip6);
 308                         break;
 309                 default:
 310                         return -EAFNOSUPPORT;
 311                 }
 312                 break;
 313         case NFT_CT_PROTO_SRC:
 314         case NFT_CT_PROTO_DST:
 315                 if (tb[NFTA_CT_DIRECTION] == NULL)
 316                         return -EINVAL;
 317                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
 318                 break;
 319         case NFT_CT_BYTES:
 320         case NFT_CT_PKTS:
 321                 /* no direction? return sum of original + reply */
 322                 if (tb[NFTA_CT_DIRECTION] == NULL)
 323                         priv->dir = IP_CT_DIR_MAX;
 324                 len = sizeof(u64);
 325                 break;
 326         default:
 327                 return -EOPNOTSUPP;
 328         }
 329
 330         if (tb[NFTA_CT_DIRECTION] != NULL) {
 331                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 332                 switch (priv->dir) {
 333                 case IP_CT_DIR_ORIGINAL:
 334                 case IP_CT_DIR_REPLY:
 335                         break;
 336                 default:
 337                         return -EINVAL;
 338                 }
 339         }
 340
 341         priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
 342         err = nft_validate_register_store(ctx, priv->dreg, NULL,
 343                                           NFT_DATA_VALUE, len);
 344         if (err < 0)
 345                 return err;
 346
 347         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 348         if (err < 0)
 349                 return err;
 350
 351         if (priv->key == NFT_CT_BYTES || priv->key == NFT_CT_PKTS)
 352                 nf_ct_set_acct(ctx->net, true);
 353
 354         return 0;
 355 }
 356
 357 static int nft_ct_set_init(const struct nft_ctx *ctx,
 358                            const struct nft_expr *expr,
 359                            const struct nlattr * const tb[])
 360 {
 361         struct nft_ct *priv = nft_expr_priv(expr);
 362         bool label_got = false;
 363         unsigned int len;
 364         int err;
 365
 366         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 367         switch (priv->key) {
 368 #ifdef CONFIG_NF_CONNTRACK_MARK
 369         case NFT_CT_MARK:
 370                 len = FIELD_SIZEOF(struct nf_conn, mark);
 371                 break;
 372 #endif
 373 #ifdef CONFIG_NF_CONNTRACK_LABELS
 374         case NFT_CT_LABELS:
 375                 if (tb[NFTA_CT_DIRECTION])
 376                         return -EINVAL;
 377                 len = NF_CT_LABELS_MAX_SIZE;
 378                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 379                 if (err)
 380                         return err;
 381                 label_got = true;
 382                 break;
 383 #endif
 384         default:
 385                 return -EOPNOTSUPP;
 386         }
 387
 388         priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
 389         err = nft_validate_register_load(priv->sreg, len);
 390         if (err < 0)
 391                 goto err1;
 392
 393         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
 394         if (err < 0)
 395                 goto err1;
 396
 397         return 0;
 398
 399 err1:
 400         if (label_got)
 401                 nf_connlabels_put(ctx->net);
 402         return err;
 403 }
 404
 405 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 406                                const struct nft_expr *expr)
 407 {
 408         nft_ct_l3proto_module_put(ctx->afi->family);
 409 }
 410
 411 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 412                                const struct nft_expr *expr)
 413 {
 414         struct nft_ct *priv = nft_expr_priv(expr);
 415
 416         switch (priv->key) {
 417 #ifdef CONFIG_NF_CONNTRACK_LABELS
 418         case NFT_CT_LABELS:
 419                 nf_connlabels_put(ctx->net);
 420                 break;
 421 #endif
 422         default:
 423                 break;
 424         }
 425
 426         nft_ct_l3proto_module_put(ctx->afi->family);
 427 }
 428
 429 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 430 {
 431         const struct nft_ct *priv = nft_expr_priv(expr);
 432
 433         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 434                 goto nla_put_failure;
 435         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 436                 goto nla_put_failure;
 437
 438         switch (priv->key) {
 439         case NFT_CT_L3PROTOCOL:
 440         case NFT_CT_PROTOCOL:
 441         case NFT_CT_SRC:
 442         case NFT_CT_DST:
 443         case NFT_CT_PROTO_SRC:
 444         case NFT_CT_PROTO_DST:
 445                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 446                         goto nla_put_failure;
 447                 break;
 448         case NFT_CT_BYTES:
 449         case NFT_CT_PKTS:
 450                 if (priv->dir < IP_CT_DIR_MAX &&
 451                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 452                         goto nla_put_failure;
 453                 break;
 454         default:
 455                 break;
 456         }
 457
 458         return 0;
 459
 460 nla_put_failure:
 461         return -1;
 462 }
 463
 464 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 465 {
 466         const struct nft_ct *priv = nft_expr_priv(expr);
 467
 468         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 469                 goto nla_put_failure;
 470         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 471                 goto nla_put_failure;
 472         return 0;
 473
 474 nla_put_failure:
 475         return -1;
 476 }
 477
 478 static struct nft_expr_type nft_ct_type;
 479 static const struct nft_expr_ops nft_ct_get_ops = {
 480         .type           = &nft_ct_type,
 481         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 482         .eval           = nft_ct_get_eval,
 483         .init           = nft_ct_get_init,
 484         .destroy        = nft_ct_get_destroy,
 485         .dump           = nft_ct_get_dump,
 486 };
 487
 488 static const struct nft_expr_ops nft_ct_set_ops = {
 489         .type           = &nft_ct_type,
 490         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 491         .eval           = nft_ct_set_eval,
 492         .init           = nft_ct_set_init,
 493         .destroy        = nft_ct_set_destroy,
 494         .dump           = nft_ct_set_dump,
 495 };
 496
 497 static const struct nft_expr_ops *
 498 nft_ct_select_ops(const struct nft_ctx *ctx,
 499                     const struct nlattr * const tb[])
 500 {
 501         if (tb[NFTA_CT_KEY] == NULL)
 502                 return ERR_PTR(-EINVAL);
 503
 504         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 505                 return ERR_PTR(-EINVAL);
 506
 507         if (tb[NFTA_CT_DREG])
 508                 return &nft_ct_get_ops;
 509
 510         if (tb[NFTA_CT_SREG])
 511                 return &nft_ct_set_ops;
 512
 513         return ERR_PTR(-EINVAL);
 514 }
 515
 516 static struct nft_expr_type nft_ct_type __read_mostly = {
 517         .name           = "ct",
 518         .select_ops     = &nft_ct_select_ops,
 519         .policy         = nft_ct_policy,
 520         .maxattr        = NFTA_CT_MAX,
 521         .owner          = THIS_MODULE,
 522 };
 523
 524 static int __init nft_ct_module_init(void)
 525 {
 526         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
 527
 528         return nft_register_expr(&nft_ct_type);
 529 }
 530
 531 static void __exit nft_ct_module_exit(void)
 532 {
 533         nft_unregister_expr(&nft_ct_type);
 534 }
 535
 536 module_init(nft_ct_module_init);
 537 module_exit(nft_ct_module_exit);
 538
 539 MODULE_LICENSE("GPL");
 540 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 541 MODULE_ALIAS_NFT_EXPR("ct");