~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nft_ct.c

Version: ~ [ linux-5.7-rc7 ] ~ [ linux-5.6.14 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.42 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.124 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.181 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.224 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.224 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.84 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
  3  *
  4  * This program is free software; you can redistribute it and/or modify
  5  * it under the terms of the GNU General Public License version 2 as
  6  * published by the Free Software Foundation.
  7  *
  8  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  9  */
 10 
 11 #include <linux/kernel.h>
 12 #include <linux/init.h>
 13 #include <linux/module.h>
 14 #include <linux/netlink.h>
 15 #include <linux/netfilter.h>
 16 #include <linux/netfilter/nf_tables.h>
 17 #include <net/netfilter/nf_tables.h>
 18 #include <net/netfilter/nf_conntrack.h>
 19 #include <net/netfilter/nf_conntrack_acct.h>
 20 #include <net/netfilter/nf_conntrack_tuple.h>
 21 #include <net/netfilter/nf_conntrack_helper.h>
 22 #include <net/netfilter/nf_conntrack_ecache.h>
 23 #include <net/netfilter/nf_conntrack_labels.h>
 24 
 25 struct nft_ct {
 26         enum nft_ct_keys        key:8;
 27         enum ip_conntrack_dir   dir:8;
 28         union {
 29                 enum nft_registers      dreg:8;
 30                 enum nft_registers      sreg:8;
 31         };
 32 };
 33 
 34 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
 35                                    enum nft_ct_keys k,
 36                                    enum ip_conntrack_dir d)
 37 {
 38         if (d < IP_CT_DIR_MAX)
 39                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
 40                                            atomic64_read(&c[d].packets);
 41 
 42         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
 43                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
 44 }
 45 
 46 static void nft_ct_get_eval(const struct nft_expr *expr,
 47                             struct nft_regs *regs,
 48                             const struct nft_pktinfo *pkt)
 49 {
 50         const struct nft_ct *priv = nft_expr_priv(expr);
 51         u32 *dest = &regs->data[priv->dreg];
 52         enum ip_conntrack_info ctinfo;
 53         const struct nf_conn *ct;
 54         const struct nf_conn_help *help;
 55         const struct nf_conntrack_tuple *tuple;
 56         const struct nf_conntrack_helper *helper;
 57         long diff;
 58         unsigned int state;
 59 
 60         ct = nf_ct_get(pkt->skb, &ctinfo);
 61 
 62         switch (priv->key) {
 63         case NFT_CT_STATE:
 64                 if (ct == NULL)
 65                         state = NF_CT_STATE_INVALID_BIT;
 66                 else if (nf_ct_is_untracked(ct))
 67                         state = NF_CT_STATE_UNTRACKED_BIT;
 68                 else
 69                         state = NF_CT_STATE_BIT(ctinfo);
 70                 *dest = state;
 71                 return;
 72         default:
 73                 break;
 74         }
 75 
 76         if (ct == NULL)
 77                 goto err;
 78 
 79         switch (priv->key) {
 80         case NFT_CT_DIRECTION:
 81                 *dest = CTINFO2DIR(ctinfo);
 82                 return;
 83         case NFT_CT_STATUS:
 84                 *dest = ct->status;
 85                 return;
 86 #ifdef CONFIG_NF_CONNTRACK_MARK
 87         case NFT_CT_MARK:
 88                 *dest = ct->mark;
 89                 return;
 90 #endif
 91 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 92         case NFT_CT_SECMARK:
 93                 *dest = ct->secmark;
 94                 return;
 95 #endif
 96         case NFT_CT_EXPIRATION:
 97                 diff = (long)jiffies - (long)ct->timeout.expires;
 98                 if (diff < 0)
 99                         diff = 0;
100                 *dest = jiffies_to_msecs(diff);
101                 return;
102         case NFT_CT_HELPER:
103                 if (ct->master == NULL)
104                         goto err;
105                 help = nfct_help(ct->master);
106                 if (help == NULL)
107                         goto err;
108                 helper = rcu_dereference(help->helper);
109                 if (helper == NULL)
110                         goto err;
111                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
112                 return;
113 #ifdef CONFIG_NF_CONNTRACK_LABELS
114         case NFT_CT_LABELS: {
115                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
116                 unsigned int size;
117 
118                 if (!labels) {
119                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
120                         return;
121                 }
122 
123                 size = labels->words * sizeof(long);
124                 memcpy(dest, labels->bits, size);
125                 if (size < NF_CT_LABELS_MAX_SIZE)
126                         memset(((char *) dest) + size, 0,
127                                NF_CT_LABELS_MAX_SIZE - size);
128                 return;
129         }
130 #endif
131         case NFT_CT_BYTES: /* fallthrough */
132         case NFT_CT_PKTS: {
133                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
134                 u64 count = 0;
135 
136                 if (acct)
137                         count = nft_ct_get_eval_counter(acct->counter,
138                                                         priv->key, priv->dir);
139                 memcpy(dest, &count, sizeof(count));
140                 return;
141         }
142         default:
143                 break;
144         }
145 
146         tuple = &ct->tuplehash[priv->dir].tuple;
147         switch (priv->key) {
148         case NFT_CT_L3PROTOCOL:
149                 *dest = nf_ct_l3num(ct);
150                 return;
151         case NFT_CT_SRC:
152                 memcpy(dest, tuple->src.u3.all,
153                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
154                 return;
155         case NFT_CT_DST:
156                 memcpy(dest, tuple->dst.u3.all,
157                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
158                 return;
159         case NFT_CT_PROTOCOL:
160                 *dest = nf_ct_protonum(ct);
161                 return;
162         case NFT_CT_PROTO_SRC:
163                 *dest = (__force __u16)tuple->src.u.all;
164                 return;
165         case NFT_CT_PROTO_DST:
166                 *dest = (__force __u16)tuple->dst.u.all;
167                 return;
168         default:
169                 break;
170         }
171         return;
172 err:
173         regs->verdict.code = NFT_BREAK;
174 }
175 
176 static void nft_ct_set_eval(const struct nft_expr *expr,
177                             struct nft_regs *regs,
178                             const struct nft_pktinfo *pkt)
179 {
180         const struct nft_ct *priv = nft_expr_priv(expr);
181         struct sk_buff *skb = pkt->skb;
182 #ifdef CONFIG_NF_CONNTRACK_MARK
183         u32 value = regs->data[priv->sreg];
184 #endif
185         enum ip_conntrack_info ctinfo;
186         struct nf_conn *ct;
187 
188         ct = nf_ct_get(skb, &ctinfo);
189         if (ct == NULL)
190                 return;
191 
192         switch (priv->key) {
193 #ifdef CONFIG_NF_CONNTRACK_MARK
194         case NFT_CT_MARK:
195                 if (ct->mark != value) {
196                         ct->mark = value;
197                         nf_conntrack_event_cache(IPCT_MARK, ct);
198                 }
199                 break;
200 #endif
201         default:
202                 break;
203         }
204 }
205 
206 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
207         [NFTA_CT_DREG]          = { .type = NLA_U32 },
208         [NFTA_CT_KEY]           = { .type = NLA_U32 },
209         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
210         [NFTA_CT_SREG]          = { .type = NLA_U32 },
211 };
212 
213 static int nft_ct_l3proto_try_module_get(uint8_t family)
214 {
215         int err;
216 
217         if (family == NFPROTO_INET) {
218                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV4);
219                 if (err < 0)
220                         goto err1;
221                 err = nf_ct_l3proto_try_module_get(NFPROTO_IPV6);
222                 if (err < 0)
223                         goto err2;
224         } else {
225                 err = nf_ct_l3proto_try_module_get(family);
226                 if (err < 0)
227                         goto err1;
228         }
229         return 0;
230 
231 err2:
232         nf_ct_l3proto_module_put(NFPROTO_IPV4);
233 err1:
234         return err;
235 }
236 
237 static void nft_ct_l3proto_module_put(uint8_t family)
238 {
239         if (family == NFPROTO_INET) {
240                 nf_ct_l3proto_module_put(NFPROTO_IPV4);
241                 nf_ct_l3proto_module_put(NFPROTO_IPV6);
242         } else
243                 nf_ct_l3proto_module_put(family);
244 }
245 
246 static int nft_ct_get_init(const struct nft_ctx *ctx,
247                            const struct nft_expr *expr,
248                            const struct nlattr * const tb[])
249 {
250         struct nft_ct *priv = nft_expr_priv(expr);
251         unsigned int len;
252         int err;
253 
254         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
255         switch (priv->key) {
256         case NFT_CT_DIRECTION:
257                 if (tb[NFTA_CT_DIRECTION] != NULL)
258                         return -EINVAL;
259                 len = sizeof(u8);
260                 break;
261         case NFT_CT_STATE:
262         case NFT_CT_STATUS:
263 #ifdef CONFIG_NF_CONNTRACK_MARK
264         case NFT_CT_MARK:
265 #endif
266 #ifdef CONFIG_NF_CONNTRACK_SECMARK
267         case NFT_CT_SECMARK:
268 #endif
269         case NFT_CT_EXPIRATION:
270                 if (tb[NFTA_CT_DIRECTION] != NULL)
271                         return -EINVAL;
272                 len = sizeof(u32);
273                 break;
274 #ifdef CONFIG_NF_CONNTRACK_LABELS
275         case NFT_CT_LABELS:
276                 if (tb[NFTA_CT_DIRECTION] != NULL)
277                         return -EINVAL;
278                 len = NF_CT_LABELS_MAX_SIZE;
279                 break;
280 #endif
281         case NFT_CT_HELPER:
282                 if (tb[NFTA_CT_DIRECTION] != NULL)
283                         return -EINVAL;
284                 len = NF_CT_HELPER_NAME_LEN;
285                 break;
286 
287         case NFT_CT_L3PROTOCOL:
288         case NFT_CT_PROTOCOL:
289                 if (tb[NFTA_CT_DIRECTION] == NULL)
290                         return -EINVAL;
291                 len = sizeof(u8);
292                 break;
293         case NFT_CT_SRC:
294         case NFT_CT_DST:
295                 if (tb[NFTA_CT_DIRECTION] == NULL)
296                         return -EINVAL;
297 
298                 switch (ctx->afi->family) {
299                 case NFPROTO_IPV4:
300                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
301                                            src.u3.ip);
302                         break;
303                 case NFPROTO_IPV6:
304                 case NFPROTO_INET:
305                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
306                                            src.u3.ip6);
307                         break;
308                 default:
309                         return -EAFNOSUPPORT;
310                 }
311                 break;
312         case NFT_CT_PROTO_SRC:
313         case NFT_CT_PROTO_DST:
314                 if (tb[NFTA_CT_DIRECTION] == NULL)
315                         return -EINVAL;
316                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
317                 break;
318         case NFT_CT_BYTES:
319         case NFT_CT_PKTS:
320                 /* no direction? return sum of original + reply */
321                 if (tb[NFTA_CT_DIRECTION] == NULL)
322                         priv->dir = IP_CT_DIR_MAX;
323                 len = sizeof(u64);
324                 break;
325         default:
326                 return -EOPNOTSUPP;
327         }
328 
329         if (tb[NFTA_CT_DIRECTION] != NULL) {
330                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
331                 switch (priv->dir) {
332                 case IP_CT_DIR_ORIGINAL:
333                 case IP_CT_DIR_REPLY:
334                         break;
335                 default:
336                         return -EINVAL;
337                 }
338         }
339 
340         priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
341         err = nft_validate_register_store(ctx, priv->dreg, NULL,
342                                           NFT_DATA_VALUE, len);
343         if (err < 0)
344                 return err;
345 
346         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
347         if (err < 0)
348                 return err;
349 
350         return 0;
351 }
352 
353 static int nft_ct_set_init(const struct nft_ctx *ctx,
354                            const struct nft_expr *expr,
355                            const struct nlattr * const tb[])
356 {
357         struct nft_ct *priv = nft_expr_priv(expr);
358         unsigned int len;
359         int err;
360 
361         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
362         switch (priv->key) {
363 #ifdef CONFIG_NF_CONNTRACK_MARK
364         case NFT_CT_MARK:
365                 len = FIELD_SIZEOF(struct nf_conn, mark);
366                 break;
367 #endif
368         default:
369                 return -EOPNOTSUPP;
370         }
371 
372         priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
373         err = nft_validate_register_load(priv->sreg, len);
374         if (err < 0)
375                 return err;
376 
377         err = nft_ct_l3proto_try_module_get(ctx->afi->family);
378         if (err < 0)
379                 return err;
380 
381         return 0;
382 }
383 
384 static void nft_ct_destroy(const struct nft_ctx *ctx,
385                            const struct nft_expr *expr)
386 {
387         nft_ct_l3proto_module_put(ctx->afi->family);
388 }
389 
390 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
391 {
392         const struct nft_ct *priv = nft_expr_priv(expr);
393 
394         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
395                 goto nla_put_failure;
396         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
397                 goto nla_put_failure;
398 
399         switch (priv->key) {
400         case NFT_CT_L3PROTOCOL:
401         case NFT_CT_PROTOCOL:
402         case NFT_CT_SRC:
403         case NFT_CT_DST:
404         case NFT_CT_PROTO_SRC:
405         case NFT_CT_PROTO_DST:
406                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
407                         goto nla_put_failure;
408                 break;
409         case NFT_CT_BYTES:
410         case NFT_CT_PKTS:
411                 if (priv->dir < IP_CT_DIR_MAX &&
412                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
413                         goto nla_put_failure;
414                 break;
415         default:
416                 break;
417         }
418 
419         return 0;
420 
421 nla_put_failure:
422         return -1;
423 }
424 
425 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
426 {
427         const struct nft_ct *priv = nft_expr_priv(expr);
428 
429         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
430                 goto nla_put_failure;
431         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
432                 goto nla_put_failure;
433         return 0;
434 
435 nla_put_failure:
436         return -1;
437 }
438 
439 static struct nft_expr_type nft_ct_type;
440 static const struct nft_expr_ops nft_ct_get_ops = {
441         .type           = &nft_ct_type,
442         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
443         .eval           = nft_ct_get_eval,
444         .init           = nft_ct_get_init,
445         .destroy        = nft_ct_destroy,
446         .dump           = nft_ct_get_dump,
447 };
448 
449 static const struct nft_expr_ops nft_ct_set_ops = {
450         .type           = &nft_ct_type,
451         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
452         .eval           = nft_ct_set_eval,
453         .init           = nft_ct_set_init,
454         .destroy        = nft_ct_destroy,
455         .dump           = nft_ct_set_dump,
456 };
457 
458 static const struct nft_expr_ops *
459 nft_ct_select_ops(const struct nft_ctx *ctx,
460                     const struct nlattr * const tb[])
461 {
462         if (tb[NFTA_CT_KEY] == NULL)
463                 return ERR_PTR(-EINVAL);
464 
465         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
466                 return ERR_PTR(-EINVAL);
467 
468         if (tb[NFTA_CT_DREG])
469                 return &nft_ct_get_ops;
470 
471         if (tb[NFTA_CT_SREG])
472                 return &nft_ct_set_ops;
473 
474         return ERR_PTR(-EINVAL);
475 }
476 
477 static struct nft_expr_type nft_ct_type __read_mostly = {
478         .name           = "ct",
479         .select_ops     = &nft_ct_select_ops,
480         .policy         = nft_ct_policy,
481         .maxattr        = NFTA_CT_MAX,
482         .owner          = THIS_MODULE,
483 };
484 
485 static int __init nft_ct_module_init(void)
486 {
487         return nft_register_expr(&nft_ct_type);
488 }
489 
490 static void __exit nft_ct_module_exit(void)
491 {
492         nft_unregister_expr(&nft_ct_type);
493 }
494 
495 module_init(nft_ct_module_init);
496 module_exit(nft_ct_module_exit);
497 
498 MODULE_LICENSE("GPL");
499 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
500 MODULE_ALIAS_NFT_EXPR("ct");
501 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp