~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nft_ct.c

Version: ~ [ linux-5.6-rc1 ] ~ [ linux-5.5.2 ] ~ [ linux-5.4.17 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.102 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.170 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.213 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.213 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.81 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
  3  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  *
  9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
 10  */
 11 
 12 #include <linux/kernel.h>
 13 #include <linux/init.h>
 14 #include <linux/module.h>
 15 #include <linux/netlink.h>
 16 #include <linux/netfilter.h>
 17 #include <linux/netfilter/nf_tables.h>
 18 #include <net/netfilter/nf_tables.h>
 19 #include <net/netfilter/nf_conntrack.h>
 20 #include <net/netfilter/nf_conntrack_acct.h>
 21 #include <net/netfilter/nf_conntrack_tuple.h>
 22 #include <net/netfilter/nf_conntrack_helper.h>
 23 #include <net/netfilter/nf_conntrack_ecache.h>
 24 #include <net/netfilter/nf_conntrack_labels.h>
 25 #include <net/netfilter/nf_conntrack_timeout.h>
 26 #include <net/netfilter/nf_conntrack_l4proto.h>
 27 
 28 struct nft_ct {
 29         enum nft_ct_keys        key:8;
 30         enum ip_conntrack_dir   dir:8;
 31         union {
 32                 enum nft_registers      dreg:8;
 33                 enum nft_registers      sreg:8;
 34         };
 35 };
 36 
 37 struct nft_ct_helper_obj  {
 38         struct nf_conntrack_helper *helper4;
 39         struct nf_conntrack_helper *helper6;
 40         u8 l4proto;
 41 };
 42 
 43 #ifdef CONFIG_NF_CONNTRACK_ZONES
 44 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
 45 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
 46 #endif
 47 
 48 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
 49                                    enum nft_ct_keys k,
 50                                    enum ip_conntrack_dir d)
 51 {
 52         if (d < IP_CT_DIR_MAX)
 53                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
 54                                            atomic64_read(&c[d].packets);
 55 
 56         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
 57                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
 58 }
 59 
 60 static void nft_ct_get_eval(const struct nft_expr *expr,
 61                             struct nft_regs *regs,
 62                             const struct nft_pktinfo *pkt)
 63 {
 64         const struct nft_ct *priv = nft_expr_priv(expr);
 65         u32 *dest = &regs->data[priv->dreg];
 66         enum ip_conntrack_info ctinfo;
 67         const struct nf_conn *ct;
 68         const struct nf_conn_help *help;
 69         const struct nf_conntrack_tuple *tuple;
 70         const struct nf_conntrack_helper *helper;
 71         unsigned int state;
 72 
 73         ct = nf_ct_get(pkt->skb, &ctinfo);
 74 
 75         switch (priv->key) {
 76         case NFT_CT_STATE:
 77                 if (ct)
 78                         state = NF_CT_STATE_BIT(ctinfo);
 79                 else if (ctinfo == IP_CT_UNTRACKED)
 80                         state = NF_CT_STATE_UNTRACKED_BIT;
 81                 else
 82                         state = NF_CT_STATE_INVALID_BIT;
 83                 *dest = state;
 84                 return;
 85         default:
 86                 break;
 87         }
 88 
 89         if (ct == NULL)
 90                 goto err;
 91 
 92         switch (priv->key) {
 93         case NFT_CT_DIRECTION:
 94                 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
 95                 return;
 96         case NFT_CT_STATUS:
 97                 *dest = ct->status;
 98                 return;
 99 #ifdef CONFIG_NF_CONNTRACK_MARK
100         case NFT_CT_MARK:
101                 *dest = ct->mark;
102                 return;
103 #endif
104 #ifdef CONFIG_NF_CONNTRACK_SECMARK
105         case NFT_CT_SECMARK:
106                 *dest = ct->secmark;
107                 return;
108 #endif
109         case NFT_CT_EXPIRATION:
110                 *dest = jiffies_to_msecs(nf_ct_expires(ct));
111                 return;
112         case NFT_CT_HELPER:
113                 if (ct->master == NULL)
114                         goto err;
115                 help = nfct_help(ct->master);
116                 if (help == NULL)
117                         goto err;
118                 helper = rcu_dereference(help->helper);
119                 if (helper == NULL)
120                         goto err;
121                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
122                 return;
123 #ifdef CONFIG_NF_CONNTRACK_LABELS
124         case NFT_CT_LABELS: {
125                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
126 
127                 if (labels)
128                         memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
129                 else
130                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
131                 return;
132         }
133 #endif
134         case NFT_CT_BYTES: /* fallthrough */
135         case NFT_CT_PKTS: {
136                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
137                 u64 count = 0;
138 
139                 if (acct)
140                         count = nft_ct_get_eval_counter(acct->counter,
141                                                         priv->key, priv->dir);
142                 memcpy(dest, &count, sizeof(count));
143                 return;
144         }
145         case NFT_CT_AVGPKT: {
146                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
147                 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
148 
149                 if (acct) {
150                         pcnt = nft_ct_get_eval_counter(acct->counter,
151                                                        NFT_CT_PKTS, priv->dir);
152                         bcnt = nft_ct_get_eval_counter(acct->counter,
153                                                        NFT_CT_BYTES, priv->dir);
154                         if (pcnt != 0)
155                                 avgcnt = div64_u64(bcnt, pcnt);
156                 }
157 
158                 memcpy(dest, &avgcnt, sizeof(avgcnt));
159                 return;
160         }
161         case NFT_CT_L3PROTOCOL:
162                 nft_reg_store8(dest, nf_ct_l3num(ct));
163                 return;
164         case NFT_CT_PROTOCOL:
165                 nft_reg_store8(dest, nf_ct_protonum(ct));
166                 return;
167 #ifdef CONFIG_NF_CONNTRACK_ZONES
168         case NFT_CT_ZONE: {
169                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
170                 u16 zoneid;
171 
172                 if (priv->dir < IP_CT_DIR_MAX)
173                         zoneid = nf_ct_zone_id(zone, priv->dir);
174                 else
175                         zoneid = zone->id;
176 
177                 nft_reg_store16(dest, zoneid);
178                 return;
179         }
180 #endif
181         default:
182                 break;
183         }
184 
185         tuple = &ct->tuplehash[priv->dir].tuple;
186         switch (priv->key) {
187         case NFT_CT_SRC:
188                 memcpy(dest, tuple->src.u3.all,
189                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
190                 return;
191         case NFT_CT_DST:
192                 memcpy(dest, tuple->dst.u3.all,
193                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
194                 return;
195         case NFT_CT_PROTO_SRC:
196                 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
197                 return;
198         case NFT_CT_PROTO_DST:
199                 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
200                 return;
201         case NFT_CT_SRC_IP:
202                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
203                         goto err;
204                 *dest = tuple->src.u3.ip;
205                 return;
206         case NFT_CT_DST_IP:
207                 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
208                         goto err;
209                 *dest = tuple->dst.u3.ip;
210                 return;
211         case NFT_CT_SRC_IP6:
212                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
213                         goto err;
214                 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
215                 return;
216         case NFT_CT_DST_IP6:
217                 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
218                         goto err;
219                 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
220                 return;
221         default:
222                 break;
223         }
224         return;
225 err:
226         regs->verdict.code = NFT_BREAK;
227 }
228 
229 #ifdef CONFIG_NF_CONNTRACK_ZONES
230 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
231                                  struct nft_regs *regs,
232                                  const struct nft_pktinfo *pkt)
233 {
234         struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
235         const struct nft_ct *priv = nft_expr_priv(expr);
236         struct sk_buff *skb = pkt->skb;
237         enum ip_conntrack_info ctinfo;
238         u16 value = nft_reg_load16(&regs->data[priv->sreg]);
239         struct nf_conn *ct;
240 
241         ct = nf_ct_get(skb, &ctinfo);
242         if (ct) /* already tracked */
243                 return;
244 
245         zone.id = value;
246 
247         switch (priv->dir) {
248         case IP_CT_DIR_ORIGINAL:
249                 zone.dir = NF_CT_ZONE_DIR_ORIG;
250                 break;
251         case IP_CT_DIR_REPLY:
252                 zone.dir = NF_CT_ZONE_DIR_REPL;
253                 break;
254         default:
255                 break;
256         }
257 
258         ct = this_cpu_read(nft_ct_pcpu_template);
259 
260         if (likely(atomic_read(&ct->ct_general.use) == 1)) {
261                 nf_ct_zone_add(ct, &zone);
262         } else {
263                 /* previous skb got queued to userspace */
264                 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
265                 if (!ct) {
266                         regs->verdict.code = NF_DROP;
267                         return;
268                 }
269         }
270 
271         atomic_inc(&ct->ct_general.use);
272         nf_ct_set(skb, ct, IP_CT_NEW);
273 }
274 #endif
275 
276 static void nft_ct_set_eval(const struct nft_expr *expr,
277                             struct nft_regs *regs,
278                             const struct nft_pktinfo *pkt)
279 {
280         const struct nft_ct *priv = nft_expr_priv(expr);
281         struct sk_buff *skb = pkt->skb;
282 #if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
283         u32 value = regs->data[priv->sreg];
284 #endif
285         enum ip_conntrack_info ctinfo;
286         struct nf_conn *ct;
287 
288         ct = nf_ct_get(skb, &ctinfo);
289         if (ct == NULL || nf_ct_is_template(ct))
290                 return;
291 
292         switch (priv->key) {
293 #ifdef CONFIG_NF_CONNTRACK_MARK
294         case NFT_CT_MARK:
295                 if (ct->mark != value) {
296                         ct->mark = value;
297                         nf_conntrack_event_cache(IPCT_MARK, ct);
298                 }
299                 break;
300 #endif
301 #ifdef CONFIG_NF_CONNTRACK_SECMARK
302         case NFT_CT_SECMARK:
303                 if (ct->secmark != value) {
304                         ct->secmark = value;
305                         nf_conntrack_event_cache(IPCT_SECMARK, ct);
306                 }
307                 break;
308 #endif
309 #ifdef CONFIG_NF_CONNTRACK_LABELS
310         case NFT_CT_LABELS:
311                 nf_connlabels_replace(ct,
312                                       &regs->data[priv->sreg],
313                                       &regs->data[priv->sreg],
314                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
315                 break;
316 #endif
317 #ifdef CONFIG_NF_CONNTRACK_EVENTS
318         case NFT_CT_EVENTMASK: {
319                 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
320                 u32 ctmask = regs->data[priv->sreg];
321 
322                 if (e) {
323                         if (e->ctmask != ctmask)
324                                 e->ctmask = ctmask;
325                         break;
326                 }
327 
328                 if (ctmask && !nf_ct_is_confirmed(ct))
329                         nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
330                 break;
331         }
332 #endif
333         default:
334                 break;
335         }
336 }
337 
338 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
339         [NFTA_CT_DREG]          = { .type = NLA_U32 },
340         [NFTA_CT_KEY]           = { .type = NLA_U32 },
341         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
342         [NFTA_CT_SREG]          = { .type = NLA_U32 },
343 };
344 
345 #ifdef CONFIG_NF_CONNTRACK_ZONES
346 static void nft_ct_tmpl_put_pcpu(void)
347 {
348         struct nf_conn *ct;
349         int cpu;
350 
351         for_each_possible_cpu(cpu) {
352                 ct = per_cpu(nft_ct_pcpu_template, cpu);
353                 if (!ct)
354                         break;
355                 nf_ct_put(ct);
356                 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
357         }
358 }
359 
360 static bool nft_ct_tmpl_alloc_pcpu(void)
361 {
362         struct nf_conntrack_zone zone = { .id = 0 };
363         struct nf_conn *tmp;
364         int cpu;
365 
366         if (nft_ct_pcpu_template_refcnt)
367                 return true;
368 
369         for_each_possible_cpu(cpu) {
370                 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
371                 if (!tmp) {
372                         nft_ct_tmpl_put_pcpu();
373                         return false;
374                 }
375 
376                 atomic_set(&tmp->ct_general.use, 1);
377                 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
378         }
379 
380         return true;
381 }
382 #endif
383 
384 static int nft_ct_get_init(const struct nft_ctx *ctx,
385                            const struct nft_expr *expr,
386                            const struct nlattr * const tb[])
387 {
388         struct nft_ct *priv = nft_expr_priv(expr);
389         unsigned int len;
390         int err;
391 
392         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
393         priv->dir = IP_CT_DIR_MAX;
394         switch (priv->key) {
395         case NFT_CT_DIRECTION:
396                 if (tb[NFTA_CT_DIRECTION] != NULL)
397                         return -EINVAL;
398                 len = sizeof(u8);
399                 break;
400         case NFT_CT_STATE:
401         case NFT_CT_STATUS:
402 #ifdef CONFIG_NF_CONNTRACK_MARK
403         case NFT_CT_MARK:
404 #endif
405 #ifdef CONFIG_NF_CONNTRACK_SECMARK
406         case NFT_CT_SECMARK:
407 #endif
408         case NFT_CT_EXPIRATION:
409                 if (tb[NFTA_CT_DIRECTION] != NULL)
410                         return -EINVAL;
411                 len = sizeof(u32);
412                 break;
413 #ifdef CONFIG_NF_CONNTRACK_LABELS
414         case NFT_CT_LABELS:
415                 if (tb[NFTA_CT_DIRECTION] != NULL)
416                         return -EINVAL;
417                 len = NF_CT_LABELS_MAX_SIZE;
418                 break;
419 #endif
420         case NFT_CT_HELPER:
421                 if (tb[NFTA_CT_DIRECTION] != NULL)
422                         return -EINVAL;
423                 len = NF_CT_HELPER_NAME_LEN;
424                 break;
425 
426         case NFT_CT_L3PROTOCOL:
427         case NFT_CT_PROTOCOL:
428                 /* For compatibility, do not report error if NFTA_CT_DIRECTION
429                  * attribute is specified.
430                  */
431                 len = sizeof(u8);
432                 break;
433         case NFT_CT_SRC:
434         case NFT_CT_DST:
435                 if (tb[NFTA_CT_DIRECTION] == NULL)
436                         return -EINVAL;
437 
438                 switch (ctx->family) {
439                 case NFPROTO_IPV4:
440                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
441                                            src.u3.ip);
442                         break;
443                 case NFPROTO_IPV6:
444                 case NFPROTO_INET:
445                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
446                                            src.u3.ip6);
447                         break;
448                 default:
449                         return -EAFNOSUPPORT;
450                 }
451                 break;
452         case NFT_CT_SRC_IP:
453         case NFT_CT_DST_IP:
454                 if (tb[NFTA_CT_DIRECTION] == NULL)
455                         return -EINVAL;
456 
457                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip);
458                 break;
459         case NFT_CT_SRC_IP6:
460         case NFT_CT_DST_IP6:
461                 if (tb[NFTA_CT_DIRECTION] == NULL)
462                         return -EINVAL;
463 
464                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip6);
465                 break;
466         case NFT_CT_PROTO_SRC:
467         case NFT_CT_PROTO_DST:
468                 if (tb[NFTA_CT_DIRECTION] == NULL)
469                         return -EINVAL;
470                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
471                 break;
472         case NFT_CT_BYTES:
473         case NFT_CT_PKTS:
474         case NFT_CT_AVGPKT:
475                 len = sizeof(u64);
476                 break;
477 #ifdef CONFIG_NF_CONNTRACK_ZONES
478         case NFT_CT_ZONE:
479                 len = sizeof(u16);
480                 break;
481 #endif
482         default:
483                 return -EOPNOTSUPP;
484         }
485 
486         if (tb[NFTA_CT_DIRECTION] != NULL) {
487                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
488                 switch (priv->dir) {
489                 case IP_CT_DIR_ORIGINAL:
490                 case IP_CT_DIR_REPLY:
491                         break;
492                 default:
493                         return -EINVAL;
494                 }
495         }
496 
497         priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
498         err = nft_validate_register_store(ctx, priv->dreg, NULL,
499                                           NFT_DATA_VALUE, len);
500         if (err < 0)
501                 return err;
502 
503         err = nf_ct_netns_get(ctx->net, ctx->family);
504         if (err < 0)
505                 return err;
506 
507         if (priv->key == NFT_CT_BYTES ||
508             priv->key == NFT_CT_PKTS  ||
509             priv->key == NFT_CT_AVGPKT)
510                 nf_ct_set_acct(ctx->net, true);
511 
512         return 0;
513 }
514 
515 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
516 {
517         switch (priv->key) {
518 #ifdef CONFIG_NF_CONNTRACK_LABELS
519         case NFT_CT_LABELS:
520                 nf_connlabels_put(ctx->net);
521                 break;
522 #endif
523 #ifdef CONFIG_NF_CONNTRACK_ZONES
524         case NFT_CT_ZONE:
525                 if (--nft_ct_pcpu_template_refcnt == 0)
526                         nft_ct_tmpl_put_pcpu();
527 #endif
528         default:
529                 break;
530         }
531 }
532 
533 static int nft_ct_set_init(const struct nft_ctx *ctx,
534                            const struct nft_expr *expr,
535                            const struct nlattr * const tb[])
536 {
537         struct nft_ct *priv = nft_expr_priv(expr);
538         unsigned int len;
539         int err;
540 
541         priv->dir = IP_CT_DIR_MAX;
542         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
543         switch (priv->key) {
544 #ifdef CONFIG_NF_CONNTRACK_MARK
545         case NFT_CT_MARK:
546                 if (tb[NFTA_CT_DIRECTION])
547                         return -EINVAL;
548                 len = FIELD_SIZEOF(struct nf_conn, mark);
549                 break;
550 #endif
551 #ifdef CONFIG_NF_CONNTRACK_LABELS
552         case NFT_CT_LABELS:
553                 if (tb[NFTA_CT_DIRECTION])
554                         return -EINVAL;
555                 len = NF_CT_LABELS_MAX_SIZE;
556                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
557                 if (err)
558                         return err;
559                 break;
560 #endif
561 #ifdef CONFIG_NF_CONNTRACK_ZONES
562         case NFT_CT_ZONE:
563                 if (!nft_ct_tmpl_alloc_pcpu())
564                         return -ENOMEM;
565                 nft_ct_pcpu_template_refcnt++;
566                 len = sizeof(u16);
567                 break;
568 #endif
569 #ifdef CONFIG_NF_CONNTRACK_EVENTS
570         case NFT_CT_EVENTMASK:
571                 if (tb[NFTA_CT_DIRECTION])
572                         return -EINVAL;
573                 len = sizeof(u32);
574                 break;
575 #endif
576 #ifdef CONFIG_NF_CONNTRACK_SECMARK
577         case NFT_CT_SECMARK:
578                 if (tb[NFTA_CT_DIRECTION])
579                         return -EINVAL;
580                 len = sizeof(u32);
581                 break;
582 #endif
583         default:
584                 return -EOPNOTSUPP;
585         }
586 
587         if (tb[NFTA_CT_DIRECTION]) {
588                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
589                 switch (priv->dir) {
590                 case IP_CT_DIR_ORIGINAL:
591                 case IP_CT_DIR_REPLY:
592                         break;
593                 default:
594                         err = -EINVAL;
595                         goto err1;
596                 }
597         }
598 
599         priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
600         err = nft_validate_register_load(priv->sreg, len);
601         if (err < 0)
602                 goto err1;
603 
604         err = nf_ct_netns_get(ctx->net, ctx->family);
605         if (err < 0)
606                 goto err1;
607 
608         return 0;
609 
610 err1:
611         __nft_ct_set_destroy(ctx, priv);
612         return err;
613 }
614 
615 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
616                                const struct nft_expr *expr)
617 {
618         nf_ct_netns_put(ctx->net, ctx->family);
619 }
620 
621 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
622                                const struct nft_expr *expr)
623 {
624         struct nft_ct *priv = nft_expr_priv(expr);
625 
626         __nft_ct_set_destroy(ctx, priv);
627         nf_ct_netns_put(ctx->net, ctx->family);
628 }
629 
630 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
631 {
632         const struct nft_ct *priv = nft_expr_priv(expr);
633 
634         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
635                 goto nla_put_failure;
636         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
637                 goto nla_put_failure;
638 
639         switch (priv->key) {
640         case NFT_CT_SRC:
641         case NFT_CT_DST:
642         case NFT_CT_SRC_IP:
643         case NFT_CT_DST_IP:
644         case NFT_CT_SRC_IP6:
645         case NFT_CT_DST_IP6:
646         case NFT_CT_PROTO_SRC:
647         case NFT_CT_PROTO_DST:
648                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
649                         goto nla_put_failure;
650                 break;
651         case NFT_CT_BYTES:
652         case NFT_CT_PKTS:
653         case NFT_CT_AVGPKT:
654         case NFT_CT_ZONE:
655                 if (priv->dir < IP_CT_DIR_MAX &&
656                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
657                         goto nla_put_failure;
658                 break;
659         default:
660                 break;
661         }
662 
663         return 0;
664 
665 nla_put_failure:
666         return -1;
667 }
668 
669 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
670 {
671         const struct nft_ct *priv = nft_expr_priv(expr);
672 
673         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
674                 goto nla_put_failure;
675         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
676                 goto nla_put_failure;
677 
678         switch (priv->key) {
679         case NFT_CT_ZONE:
680                 if (priv->dir < IP_CT_DIR_MAX &&
681                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
682                         goto nla_put_failure;
683                 break;
684         default:
685                 break;
686         }
687 
688         return 0;
689 
690 nla_put_failure:
691         return -1;
692 }
693 
694 static struct nft_expr_type nft_ct_type;
695 static const struct nft_expr_ops nft_ct_get_ops = {
696         .type           = &nft_ct_type,
697         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
698         .eval           = nft_ct_get_eval,
699         .init           = nft_ct_get_init,
700         .destroy        = nft_ct_get_destroy,
701         .dump           = nft_ct_get_dump,
702 };
703 
704 static const struct nft_expr_ops nft_ct_set_ops = {
705         .type           = &nft_ct_type,
706         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
707         .eval           = nft_ct_set_eval,
708         .init           = nft_ct_set_init,
709         .destroy        = nft_ct_set_destroy,
710         .dump           = nft_ct_set_dump,
711 };
712 
713 #ifdef CONFIG_NF_CONNTRACK_ZONES
714 static const struct nft_expr_ops nft_ct_set_zone_ops = {
715         .type           = &nft_ct_type,
716         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
717         .eval           = nft_ct_set_zone_eval,
718         .init           = nft_ct_set_init,
719         .destroy        = nft_ct_set_destroy,
720         .dump           = nft_ct_set_dump,
721 };
722 #endif
723 
724 static const struct nft_expr_ops *
725 nft_ct_select_ops(const struct nft_ctx *ctx,
726                     const struct nlattr * const tb[])
727 {
728         if (tb[NFTA_CT_KEY] == NULL)
729                 return ERR_PTR(-EINVAL);
730 
731         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
732                 return ERR_PTR(-EINVAL);
733 
734         if (tb[NFTA_CT_DREG])
735                 return &nft_ct_get_ops;
736 
737         if (tb[NFTA_CT_SREG]) {
738 #ifdef CONFIG_NF_CONNTRACK_ZONES
739                 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
740                         return &nft_ct_set_zone_ops;
741 #endif
742                 return &nft_ct_set_ops;
743         }
744 
745         return ERR_PTR(-EINVAL);
746 }
747 
748 static struct nft_expr_type nft_ct_type __read_mostly = {
749         .name           = "ct",
750         .select_ops     = nft_ct_select_ops,
751         .policy         = nft_ct_policy,
752         .maxattr        = NFTA_CT_MAX,
753         .owner          = THIS_MODULE,
754 };
755 
756 static void nft_notrack_eval(const struct nft_expr *expr,
757                              struct nft_regs *regs,
758                              const struct nft_pktinfo *pkt)
759 {
760         struct sk_buff *skb = pkt->skb;
761         enum ip_conntrack_info ctinfo;
762         struct nf_conn *ct;
763 
764         ct = nf_ct_get(pkt->skb, &ctinfo);
765         /* Previously seen (loopback or untracked)?  Ignore. */
766         if (ct || ctinfo == IP_CT_UNTRACKED)
767                 return;
768 
769         nf_ct_set(skb, ct, IP_CT_UNTRACKED);
770 }
771 
772 static struct nft_expr_type nft_notrack_type;
773 static const struct nft_expr_ops nft_notrack_ops = {
774         .type           = &nft_notrack_type,
775         .size           = NFT_EXPR_SIZE(0),
776         .eval           = nft_notrack_eval,
777 };
778 
779 static struct nft_expr_type nft_notrack_type __read_mostly = {
780         .name           = "notrack",
781         .ops            = &nft_notrack_ops,
782         .owner          = THIS_MODULE,
783 };
784 
785 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
786 static int
787 nft_ct_timeout_parse_policy(void *timeouts,
788                             const struct nf_conntrack_l4proto *l4proto,
789                             struct net *net, const struct nlattr *attr)
790 {
791         struct nlattr **tb;
792         int ret = 0;
793 
794         tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
795                      GFP_KERNEL);
796 
797         if (!tb)
798                 return -ENOMEM;
799 
800         ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
801                                attr, l4proto->ctnl_timeout.nla_policy,
802                                NULL);
803         if (ret < 0)
804                 goto err;
805 
806         ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
807 
808 err:
809         kfree(tb);
810         return ret;
811 }
812 
813 struct nft_ct_timeout_obj {
814         struct nf_ct_timeout    *timeout;
815         u8                      l4proto;
816 };
817 
818 static void nft_ct_timeout_obj_eval(struct nft_object *obj,
819                                     struct nft_regs *regs,
820                                     const struct nft_pktinfo *pkt)
821 {
822         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
823         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
824         struct nf_conn_timeout *timeout;
825         const unsigned int *values;
826 
827         if (priv->l4proto != pkt->tprot)
828                 return;
829 
830         if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
831                 return;
832 
833         timeout = nf_ct_timeout_find(ct);
834         if (!timeout) {
835                 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
836                 if (!timeout) {
837                         regs->verdict.code = NF_DROP;
838                         return;
839                 }
840         }
841 
842         rcu_assign_pointer(timeout->timeout, priv->timeout);
843 
844         /* adjust the timeout as per 'new' state. ct is unconfirmed,
845          * so the current timestamp must not be added.
846          */
847         values = nf_ct_timeout_data(timeout);
848         if (values)
849                 nf_ct_refresh(ct, pkt->skb, values[0]);
850 }
851 
852 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
853                                    const struct nlattr * const tb[],
854                                    struct nft_object *obj)
855 {
856         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
857         const struct nf_conntrack_l4proto *l4proto;
858         struct nf_ct_timeout *timeout;
859         int l3num = ctx->family;
860         __u8 l4num;
861         int ret;
862 
863         if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
864             !tb[NFTA_CT_TIMEOUT_DATA])
865                 return -EINVAL;
866 
867         if (tb[NFTA_CT_TIMEOUT_L3PROTO])
868                 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
869 
870         l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
871         priv->l4proto = l4num;
872 
873         l4proto = nf_ct_l4proto_find_get(l4num);
874 
875         if (l4proto->l4proto != l4num) {
876                 ret = -EOPNOTSUPP;
877                 goto err_proto_put;
878         }
879 
880         timeout = kzalloc(sizeof(struct nf_ct_timeout) +
881                           l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
882         if (timeout == NULL) {
883                 ret = -ENOMEM;
884                 goto err_proto_put;
885         }
886 
887         ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
888                                           tb[NFTA_CT_TIMEOUT_DATA]);
889         if (ret < 0)
890                 goto err_free_timeout;
891 
892         timeout->l3num = l3num;
893         timeout->l4proto = l4proto;
894 
895         ret = nf_ct_netns_get(ctx->net, ctx->family);
896         if (ret < 0)
897                 goto err_free_timeout;
898 
899         priv->timeout = timeout;
900         return 0;
901 
902 err_free_timeout:
903         kfree(timeout);
904 err_proto_put:
905         nf_ct_l4proto_put(l4proto);
906         return ret;
907 }
908 
909 static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
910                                        struct nft_object *obj)
911 {
912         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
913         struct nf_ct_timeout *timeout = priv->timeout;
914 
915         nf_ct_untimeout(ctx->net, timeout);
916         nf_ct_l4proto_put(timeout->l4proto);
917         nf_ct_netns_put(ctx->net, ctx->family);
918         kfree(priv->timeout);
919 }
920 
921 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
922                                    struct nft_object *obj, bool reset)
923 {
924         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
925         const struct nf_ct_timeout *timeout = priv->timeout;
926         struct nlattr *nest_params;
927         int ret;
928 
929         if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
930             nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
931                 return -1;
932 
933         nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA | NLA_F_NESTED);
934         if (!nest_params)
935                 return -1;
936 
937         ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
938         if (ret < 0)
939                 return -1;
940         nla_nest_end(skb, nest_params);
941         return 0;
942 }
943 
944 static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
945         [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
946         [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
947         [NFTA_CT_TIMEOUT_DATA]    = {.type = NLA_NESTED },
948 };
949 
950 static struct nft_object_type nft_ct_timeout_obj_type;
951 
952 static const struct nft_object_ops nft_ct_timeout_obj_ops = {
953         .type           = &nft_ct_timeout_obj_type,
954         .size           = sizeof(struct nft_ct_timeout_obj),
955         .eval           = nft_ct_timeout_obj_eval,
956         .init           = nft_ct_timeout_obj_init,
957         .destroy        = nft_ct_timeout_obj_destroy,
958         .dump           = nft_ct_timeout_obj_dump,
959 };
960 
961 static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
962         .type           = NFT_OBJECT_CT_TIMEOUT,
963         .ops            = &nft_ct_timeout_obj_ops,
964         .maxattr        = NFTA_CT_TIMEOUT_MAX,
965         .policy         = nft_ct_timeout_policy,
966         .owner          = THIS_MODULE,
967 };
968 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
969 
970 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
971                                   const struct nlattr * const tb[],
972                                   struct nft_object *obj)
973 {
974         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
975         struct nf_conntrack_helper *help4, *help6;
976         char name[NF_CT_HELPER_NAME_LEN];
977         int family = ctx->family;
978         int err;
979 
980         if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
981                 return -EINVAL;
982 
983         priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
984         if (!priv->l4proto)
985                 return -ENOENT;
986 
987         nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
988 
989         if (tb[NFTA_CT_HELPER_L3PROTO])
990                 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
991 
992         help4 = NULL;
993         help6 = NULL;
994 
995         switch (family) {
996         case NFPROTO_IPV4:
997                 if (ctx->family == NFPROTO_IPV6)
998                         return -EINVAL;
999 
1000                 help4 = nf_conntrack_helper_try_module_get(name, family,
1001                                                            priv->l4proto);
1002                 break;
1003         case NFPROTO_IPV6:
1004                 if (ctx->family == NFPROTO_IPV4)
1005                         return -EINVAL;
1006 
1007                 help6 = nf_conntrack_helper_try_module_get(name, family,
1008                                                            priv->l4proto);
1009                 break;
1010         case NFPROTO_NETDEV: /* fallthrough */
1011         case NFPROTO_BRIDGE: /* same */
1012         case NFPROTO_INET:
1013                 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1014                                                            priv->l4proto);
1015                 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1016                                                            priv->l4proto);
1017                 break;
1018         default:
1019                 return -EAFNOSUPPORT;
1020         }
1021 
1022         /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1023         if (!help4 && !help6)
1024                 return -ENOENT;
1025 
1026         priv->helper4 = help4;
1027         priv->helper6 = help6;
1028 
1029         err = nf_ct_netns_get(ctx->net, ctx->family);
1030         if (err < 0)
1031                 goto err_put_helper;
1032 
1033         return 0;
1034 
1035 err_put_helper:
1036         if (priv->helper4)
1037                 nf_conntrack_helper_put(priv->helper4);
1038         if (priv->helper6)
1039                 nf_conntrack_helper_put(priv->helper6);
1040         return err;
1041 }
1042 
1043 static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1044                                       struct nft_object *obj)
1045 {
1046         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1047 
1048         if (priv->helper4)
1049                 nf_conntrack_helper_put(priv->helper4);
1050         if (priv->helper6)
1051                 nf_conntrack_helper_put(priv->helper6);
1052 
1053         nf_ct_netns_put(ctx->net, ctx->family);
1054 }
1055 
1056 static void nft_ct_helper_obj_eval(struct nft_object *obj,
1057                                    struct nft_regs *regs,
1058                                    const struct nft_pktinfo *pkt)
1059 {
1060         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1061         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1062         struct nf_conntrack_helper *to_assign = NULL;
1063         struct nf_conn_help *help;
1064 
1065         if (!ct ||
1066             nf_ct_is_confirmed(ct) ||
1067             nf_ct_is_template(ct) ||
1068             priv->l4proto != nf_ct_protonum(ct))
1069                 return;
1070 
1071         switch (nf_ct_l3num(ct)) {
1072         case NFPROTO_IPV4:
1073                 to_assign = priv->helper4;
1074                 break;
1075         case NFPROTO_IPV6:
1076                 to_assign = priv->helper6;
1077                 break;
1078         default:
1079                 WARN_ON_ONCE(1);
1080                 return;
1081         }
1082 
1083         if (!to_assign)
1084                 return;
1085 
1086         if (test_bit(IPS_HELPER_BIT, &ct->status))
1087                 return;
1088 
1089         help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1090         if (help) {
1091                 rcu_assign_pointer(help->helper, to_assign);
1092                 set_bit(IPS_HELPER_BIT, &ct->status);
1093         }
1094 }
1095 
1096 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1097                                   struct nft_object *obj, bool reset)
1098 {
1099         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1100         const struct nf_conntrack_helper *helper;
1101         u16 family;
1102 
1103         if (priv->helper4 && priv->helper6) {
1104                 family = NFPROTO_INET;
1105                 helper = priv->helper4;
1106         } else if (priv->helper6) {
1107                 family = NFPROTO_IPV6;
1108                 helper = priv->helper6;
1109         } else {
1110                 family = NFPROTO_IPV4;
1111                 helper = priv->helper4;
1112         }
1113 
1114         if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1115                 return -1;
1116 
1117         if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1118                 return -1;
1119 
1120         if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1121                 return -1;
1122 
1123         return 0;
1124 }
1125 
1126 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1127         [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1128                                   .len = NF_CT_HELPER_NAME_LEN - 1 },
1129         [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1130         [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1131 };
1132 
1133 static struct nft_object_type nft_ct_helper_obj_type;
1134 static const struct nft_object_ops nft_ct_helper_obj_ops = {
1135         .type           = &nft_ct_helper_obj_type,
1136         .size           = sizeof(struct nft_ct_helper_obj),
1137         .eval           = nft_ct_helper_obj_eval,
1138         .init           = nft_ct_helper_obj_init,
1139         .destroy        = nft_ct_helper_obj_destroy,
1140         .dump           = nft_ct_helper_obj_dump,
1141 };
1142 
1143 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1144         .type           = NFT_OBJECT_CT_HELPER,
1145         .ops            = &nft_ct_helper_obj_ops,
1146         .maxattr        = NFTA_CT_HELPER_MAX,
1147         .policy         = nft_ct_helper_policy,
1148         .owner          = THIS_MODULE,
1149 };
1150 
1151 static int __init nft_ct_module_init(void)
1152 {
1153         int err;
1154 
1155         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1156 
1157         err = nft_register_expr(&nft_ct_type);
1158         if (err < 0)
1159                 return err;
1160 
1161         err = nft_register_expr(&nft_notrack_type);
1162         if (err < 0)
1163                 goto err1;
1164 
1165         err = nft_register_obj(&nft_ct_helper_obj_type);
1166         if (err < 0)
1167                 goto err2;
1168 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1169         err = nft_register_obj(&nft_ct_timeout_obj_type);
1170         if (err < 0)
1171                 goto err3;
1172 #endif
1173         return 0;
1174 
1175 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1176 err3:
1177         nft_unregister_obj(&nft_ct_helper_obj_type);
1178 #endif
1179 err2:
1180         nft_unregister_expr(&nft_notrack_type);
1181 err1:
1182         nft_unregister_expr(&nft_ct_type);
1183         return err;
1184 }
1185 
1186 static void __exit nft_ct_module_exit(void)
1187 {
1188 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1189         nft_unregister_obj(&nft_ct_timeout_obj_type);
1190 #endif
1191         nft_unregister_obj(&nft_ct_helper_obj_type);
1192         nft_unregister_expr(&nft_notrack_type);
1193         nft_unregister_expr(&nft_ct_type);
1194 }
1195 
1196 module_init(nft_ct_module_init);
1197 module_exit(nft_ct_module_exit);
1198 
1199 MODULE_LICENSE("GPL");
1200 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
1201 MODULE_ALIAS_NFT_EXPR("ct");
1202 MODULE_ALIAS_NFT_EXPR("notrack");
1203 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
1204 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
1205 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp