net/netfilter/nft_ct.c

   1 /*
   2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
   3  * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/netlink.h>
  16 #include <linux/netfilter.h>
  17 #include <linux/netfilter/nf_tables.h>
  18 #include <net/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_conntrack.h>
  20 #include <net/netfilter/nf_conntrack_acct.h>
  21 #include <net/netfilter/nf_conntrack_tuple.h>
  22 #include <net/netfilter/nf_conntrack_helper.h>
  23 #include <net/netfilter/nf_conntrack_ecache.h>
  24 #include <net/netfilter/nf_conntrack_labels.h>
  25
  26 struct nft_ct {
  27         enum nft_ct_keys        key:8;
  28         enum ip_conntrack_dir   dir:8;
  29         union {
  30                 enum nft_registers      dreg:8;
  31                 enum nft_registers      sreg:8;
  32         };
  33 };
  34
  35 #ifdef CONFIG_NF_CONNTRACK_ZONES
  36 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
  37 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
  38 #endif
  39
  40 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
  41                                    enum nft_ct_keys k,
  42                                    enum ip_conntrack_dir d)
  43 {
  44         if (d < IP_CT_DIR_MAX)
  45                 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
  46                                            atomic64_read(&c[d].packets);
  47
  48         return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
  49                nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
  50 }
  51
  52 static void nft_ct_get_eval(const struct nft_expr *expr,
  53                             struct nft_regs *regs,
  54                             const struct nft_pktinfo *pkt)
  55 {
  56         const struct nft_ct *priv = nft_expr_priv(expr);
  57         u32 *dest = &regs->data[priv->dreg];
  58         enum ip_conntrack_info ctinfo;
  59         const struct nf_conn *ct;
  60         const struct nf_conn_help *help;
  61         const struct nf_conntrack_tuple *tuple;
  62         const struct nf_conntrack_helper *helper;
  63         unsigned int state;
  64
  65         ct = nf_ct_get(pkt->skb, &ctinfo);
  66
  67         switch (priv->key) {
  68         case NFT_CT_STATE:
  69                 if (ct == NULL)
  70                         state = NF_CT_STATE_INVALID_BIT;
  71                 else if (nf_ct_is_untracked(ct))
  72                         state = NF_CT_STATE_UNTRACKED_BIT;
  73                 else
  74                         state = NF_CT_STATE_BIT(ctinfo);
  75                 *dest = state;
  76                 return;
  77         default:
  78                 break;
  79         }
  80
  81         if (ct == NULL)
  82                 goto err;
  83
  84         switch (priv->key) {
  85         case NFT_CT_DIRECTION:
  86                 *dest = CTINFO2DIR(ctinfo);
  87                 return;
  88         case NFT_CT_STATUS:
  89                 *dest = ct->status;
  90                 return;
  91 #ifdef CONFIG_NF_CONNTRACK_MARK
  92         case NFT_CT_MARK:
  93                 *dest = ct->mark;
  94                 return;
  95 #endif
  96 #ifdef CONFIG_NF_CONNTRACK_SECMARK
  97         case NFT_CT_SECMARK:
  98                 *dest = ct->secmark;
  99                 return;
 100 #endif
 101         case NFT_CT_EXPIRATION:
 102                 *dest = jiffies_to_msecs(nf_ct_expires(ct));
 103                 return;
 104         case NFT_CT_HELPER:
 105                 if (ct->master == NULL)
 106                         goto err;
 107                 help = nfct_help(ct->master);
 108                 if (help == NULL)
 109                         goto err;
 110                 helper = rcu_dereference(help->helper);
 111                 if (helper == NULL)
 112                         goto err;
 113                 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
 114                 return;
 115 #ifdef CONFIG_NF_CONNTRACK_LABELS
 116         case NFT_CT_LABELS: {
 117                 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 118
 119                 if (labels)
 120                         memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
 121                 else
 122                         memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
 123                 return;
 124         }
 125 #endif
 126         case NFT_CT_BYTES: /* fallthrough */
 127         case NFT_CT_PKTS: {
 128                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 129                 u64 count = 0;
 130
 131                 if (acct)
 132                         count = nft_ct_get_eval_counter(acct->counter,
 133                                                         priv->key, priv->dir);
 134                 memcpy(dest, &count, sizeof(count));
 135                 return;
 136         }
 137         case NFT_CT_AVGPKT: {
 138                 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 139                 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
 140
 141                 if (acct) {
 142                         pcnt = nft_ct_get_eval_counter(acct->counter,
 143                                                        NFT_CT_PKTS, priv->dir);
 144                         bcnt = nft_ct_get_eval_counter(acct->counter,
 145                                                        NFT_CT_BYTES, priv->dir);
 146                         if (pcnt != 0)
 147                                 avgcnt = div64_u64(bcnt, pcnt);
 148                 }
 149
 150                 memcpy(dest, &avgcnt, sizeof(avgcnt));
 151                 return;
 152         }
 153         case NFT_CT_L3PROTOCOL:
 154                 *dest = nf_ct_l3num(ct);
 155                 return;
 156         case NFT_CT_PROTOCOL:
 157                 *dest = nf_ct_protonum(ct);
 158                 return;
 159 #ifdef CONFIG_NF_CONNTRACK_ZONES
 160         case NFT_CT_ZONE: {
 161                 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
 162
 163                 if (priv->dir < IP_CT_DIR_MAX)
 164                         *dest = nf_ct_zone_id(zone, priv->dir);
 165                 else
 166                         *dest = zone->id;
 167
 168                 return;
 169         }
 170 #endif
 171         default:
 172                 break;
 173         }
 174
 175         tuple = &ct->tuplehash[priv->dir].tuple;
 176         switch (priv->key) {
 177         case NFT_CT_SRC:
 178                 memcpy(dest, tuple->src.u3.all,
 179                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 180                 return;
 181         case NFT_CT_DST:
 182                 memcpy(dest, tuple->dst.u3.all,
 183                        nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
 184                 return;
 185         case NFT_CT_PROTO_SRC:
 186                 *dest = (__force __u16)tuple->src.u.all;
 187                 return;
 188         case NFT_CT_PROTO_DST:
 189                 *dest = (__force __u16)tuple->dst.u.all;
 190                 return;
 191         default:
 192                 break;
 193         }
 194         return;
 195 err:
 196         regs->verdict.code = NFT_BREAK;
 197 }
 198
 199 #ifdef CONFIG_NF_CONNTRACK_ZONES
 200 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
 201                                  struct nft_regs *regs,
 202                                  const struct nft_pktinfo *pkt)
 203 {
 204         struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
 205         const struct nft_ct *priv = nft_expr_priv(expr);
 206         struct sk_buff *skb = pkt->skb;
 207         enum ip_conntrack_info ctinfo;
 208         u16 value = regs->data[priv->sreg];
 209         struct nf_conn *ct;
 210
 211         ct = nf_ct_get(skb, &ctinfo);
 212         if (ct) /* already tracked */
 213                 return;
 214
 215         zone.id = value;
 216
 217         switch (priv->dir) {
 218         case IP_CT_DIR_ORIGINAL:
 219                 zone.dir = NF_CT_ZONE_DIR_ORIG;
 220                 break;
 221         case IP_CT_DIR_REPLY:
 222                 zone.dir = NF_CT_ZONE_DIR_REPL;
 223                 break;
 224         default:
 225                 break;
 226         }
 227
 228         ct = this_cpu_read(nft_ct_pcpu_template);
 229
 230         if (likely(atomic_read(&ct->ct_general.use) == 1)) {
 231                 nf_ct_zone_add(ct, &zone);
 232         } else {
 233                 /* previous skb got queued to userspace */
 234                 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
 235                 if (!ct) {
 236                         regs->verdict.code = NF_DROP;
 237                         return;
 238                 }
 239         }
 240
 241         atomic_inc(&ct->ct_general.use);
 242         nf_ct_set(skb, ct, IP_CT_NEW);
 243 }
 244 #endif
 245
 246 static void nft_ct_set_eval(const struct nft_expr *expr,
 247                             struct nft_regs *regs,
 248                             const struct nft_pktinfo *pkt)
 249 {
 250         const struct nft_ct *priv = nft_expr_priv(expr);
 251         struct sk_buff *skb = pkt->skb;
 252 #ifdef CONFIG_NF_CONNTRACK_MARK
 253         u32 value = regs->data[priv->sreg];
 254 #endif
 255         enum ip_conntrack_info ctinfo;
 256         struct nf_conn *ct;
 257
 258         ct = nf_ct_get(skb, &ctinfo);
 259         if (ct == NULL)
 260                 return;
 261
 262         switch (priv->key) {
 263 #ifdef CONFIG_NF_CONNTRACK_MARK
 264         case NFT_CT_MARK:
 265                 if (ct->mark != value) {
 266                         ct->mark = value;
 267                         nf_conntrack_event_cache(IPCT_MARK, ct);
 268                 }
 269                 break;
 270 #endif
 271 #ifdef CONFIG_NF_CONNTRACK_LABELS
 272         case NFT_CT_LABELS:
 273                 nf_connlabels_replace(ct,
 274                                       &regs->data[priv->sreg],
 275                                       &regs->data[priv->sreg],
 276                                       NF_CT_LABELS_MAX_SIZE / sizeof(u32));
 277                 break;
 278 #endif
 279         default:
 280                 break;
 281         }
 282 }
 283
 284 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
 285         [NFTA_CT_DREG]          = { .type = NLA_U32 },
 286         [NFTA_CT_KEY]           = { .type = NLA_U32 },
 287         [NFTA_CT_DIRECTION]     = { .type = NLA_U8 },
 288         [NFTA_CT_SREG]          = { .type = NLA_U32 },
 289 };
 290
 291 static int nft_ct_netns_get(struct net *net, uint8_t family)
 292 {
 293         int err;
 294
 295         if (family == NFPROTO_INET) {
 296                 err = nf_ct_netns_get(net, NFPROTO_IPV4);
 297                 if (err < 0)
 298                         goto err1;
 299                 err = nf_ct_netns_get(net, NFPROTO_IPV6);
 300                 if (err < 0)
 301                         goto err2;
 302         } else {
 303                 err = nf_ct_netns_get(net, family);
 304                 if (err < 0)
 305                         goto err1;
 306         }
 307         return 0;
 308
 309 err2:
 310         nf_ct_netns_put(net, NFPROTO_IPV4);
 311 err1:
 312         return err;
 313 }
 314
 315 static void nft_ct_netns_put(struct net *net, uint8_t family)
 316 {
 317         if (family == NFPROTO_INET) {
 318                 nf_ct_netns_put(net, NFPROTO_IPV4);
 319                 nf_ct_netns_put(net, NFPROTO_IPV6);
 320         } else
 321                 nf_ct_netns_put(net, family);
 322 }
 323
 324 #ifdef CONFIG_NF_CONNTRACK_ZONES
 325 static void nft_ct_tmpl_put_pcpu(void)
 326 {
 327         struct nf_conn *ct;
 328         int cpu;
 329
 330         for_each_possible_cpu(cpu) {
 331                 ct = per_cpu(nft_ct_pcpu_template, cpu);
 332                 if (!ct)
 333                         break;
 334                 nf_ct_put(ct);
 335                 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
 336         }
 337 }
 338
 339 static bool nft_ct_tmpl_alloc_pcpu(void)
 340 {
 341         struct nf_conntrack_zone zone = { .id = 0 };
 342         struct nf_conn *tmp;
 343         int cpu;
 344
 345         if (nft_ct_pcpu_template_refcnt)
 346                 return true;
 347
 348         for_each_possible_cpu(cpu) {
 349                 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
 350                 if (!tmp) {
 351                         nft_ct_tmpl_put_pcpu();
 352                         return false;
 353                 }
 354
 355                 atomic_set(&tmp->ct_general.use, 1);
 356                 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
 357         }
 358
 359         return true;
 360 }
 361 #endif
 362
 363 static int nft_ct_get_init(const struct nft_ctx *ctx,
 364                            const struct nft_expr *expr,
 365                            const struct nlattr * const tb[])
 366 {
 367         struct nft_ct *priv = nft_expr_priv(expr);
 368         unsigned int len;
 369         int err;
 370
 371         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 372         priv->dir = IP_CT_DIR_MAX;
 373         switch (priv->key) {
 374         case NFT_CT_DIRECTION:
 375                 if (tb[NFTA_CT_DIRECTION] != NULL)
 376                         return -EINVAL;
 377                 len = sizeof(u8);
 378                 break;
 379         case NFT_CT_STATE:
 380         case NFT_CT_STATUS:
 381 #ifdef CONFIG_NF_CONNTRACK_MARK
 382         case NFT_CT_MARK:
 383 #endif
 384 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 385         case NFT_CT_SECMARK:
 386 #endif
 387         case NFT_CT_EXPIRATION:
 388                 if (tb[NFTA_CT_DIRECTION] != NULL)
 389                         return -EINVAL;
 390                 len = sizeof(u32);
 391                 break;
 392 #ifdef CONFIG_NF_CONNTRACK_LABELS
 393         case NFT_CT_LABELS:
 394                 if (tb[NFTA_CT_DIRECTION] != NULL)
 395                         return -EINVAL;
 396                 len = NF_CT_LABELS_MAX_SIZE;
 397                 break;
 398 #endif
 399         case NFT_CT_HELPER:
 400                 if (tb[NFTA_CT_DIRECTION] != NULL)
 401                         return -EINVAL;
 402                 len = NF_CT_HELPER_NAME_LEN;
 403                 break;
 404
 405         case NFT_CT_L3PROTOCOL:
 406         case NFT_CT_PROTOCOL:
 407                 /* For compatibility, do not report error if NFTA_CT_DIRECTION
 408                  * attribute is specified.
 409                  */
 410                 len = sizeof(u8);
 411                 break;
 412         case NFT_CT_SRC:
 413         case NFT_CT_DST:
 414                 if (tb[NFTA_CT_DIRECTION] == NULL)
 415                         return -EINVAL;
 416
 417                 switch (ctx->afi->family) {
 418                 case NFPROTO_IPV4:
 419                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 420                                            src.u3.ip);
 421                         break;
 422                 case NFPROTO_IPV6:
 423                 case NFPROTO_INET:
 424                         len = FIELD_SIZEOF(struct nf_conntrack_tuple,
 425                                            src.u3.ip6);
 426                         break;
 427                 default:
 428                         return -EAFNOSUPPORT;
 429                 }
 430                 break;
 431         case NFT_CT_PROTO_SRC:
 432         case NFT_CT_PROTO_DST:
 433                 if (tb[NFTA_CT_DIRECTION] == NULL)
 434                         return -EINVAL;
 435                 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
 436                 break;
 437         case NFT_CT_BYTES:
 438         case NFT_CT_PKTS:
 439         case NFT_CT_AVGPKT:
 440                 len = sizeof(u64);
 441                 break;
 442 #ifdef CONFIG_NF_CONNTRACK_ZONES
 443         case NFT_CT_ZONE:
 444                 len = sizeof(u16);
 445                 break;
 446 #endif
 447         default:
 448                 return -EOPNOTSUPP;
 449         }
 450
 451         if (tb[NFTA_CT_DIRECTION] != NULL) {
 452                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 453                 switch (priv->dir) {
 454                 case IP_CT_DIR_ORIGINAL:
 455                 case IP_CT_DIR_REPLY:
 456                         break;
 457                 default:
 458                         return -EINVAL;
 459                 }
 460         }
 461
 462         priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
 463         err = nft_validate_register_store(ctx, priv->dreg, NULL,
 464                                           NFT_DATA_VALUE, len);
 465         if (err < 0)
 466                 return err;
 467
 468         err = nft_ct_netns_get(ctx->net, ctx->afi->family);
 469         if (err < 0)
 470                 return err;
 471
 472         if (priv->key == NFT_CT_BYTES ||
 473             priv->key == NFT_CT_PKTS  ||
 474             priv->key == NFT_CT_AVGPKT)
 475                 nf_ct_set_acct(ctx->net, true);
 476
 477         return 0;
 478 }
 479
 480 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 481 {
 482         switch (priv->key) {
 483 #ifdef CONFIG_NF_CONNTRACK_LABELS
 484         case NFT_CT_LABELS:
 485                 nf_connlabels_put(ctx->net);
 486                 break;
 487 #endif
 488 #ifdef CONFIG_NF_CONNTRACK_ZONES
 489         case NFT_CT_ZONE:
 490                 if (--nft_ct_pcpu_template_refcnt == 0)
 491                         nft_ct_tmpl_put_pcpu();
 492 #endif
 493         default:
 494                 break;
 495         }
 496 }
 497
 498 static int nft_ct_set_init(const struct nft_ctx *ctx,
 499                            const struct nft_expr *expr,
 500                            const struct nlattr * const tb[])
 501 {
 502         struct nft_ct *priv = nft_expr_priv(expr);
 503         unsigned int len;
 504         int err;
 505
 506         priv->dir = IP_CT_DIR_MAX;
 507         priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
 508         switch (priv->key) {
 509 #ifdef CONFIG_NF_CONNTRACK_MARK
 510         case NFT_CT_MARK:
 511                 if (tb[NFTA_CT_DIRECTION])
 512                         return -EINVAL;
 513                 len = FIELD_SIZEOF(struct nf_conn, mark);
 514                 break;
 515 #endif
 516 #ifdef CONFIG_NF_CONNTRACK_LABELS
 517         case NFT_CT_LABELS:
 518                 if (tb[NFTA_CT_DIRECTION])
 519                         return -EINVAL;
 520                 len = NF_CT_LABELS_MAX_SIZE;
 521                 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
 522                 if (err)
 523                         return err;
 524                 break;
 525 #endif
 526 #ifdef CONFIG_NF_CONNTRACK_ZONES
 527         case NFT_CT_ZONE:
 528                 if (!nft_ct_tmpl_alloc_pcpu())
 529                         return -ENOMEM;
 530                 nft_ct_pcpu_template_refcnt++;
 531                 len = sizeof(u16);
 532                 break;
 533 #endif
 534         default:
 535                 return -EOPNOTSUPP;
 536         }
 537
 538         if (tb[NFTA_CT_DIRECTION]) {
 539                 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
 540                 switch (priv->dir) {
 541                 case IP_CT_DIR_ORIGINAL:
 542                 case IP_CT_DIR_REPLY:
 543                         break;
 544                 default:
 545                         return -EINVAL;
 546                 }
 547         }
 548
 549         priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
 550         err = nft_validate_register_load(priv->sreg, len);
 551         if (err < 0)
 552                 goto err1;
 553
 554         err = nft_ct_netns_get(ctx->net, ctx->afi->family);
 555         if (err < 0)
 556                 goto err1;
 557
 558         return 0;
 559
 560 err1:
 561         __nft_ct_set_destroy(ctx, priv);
 562         return err;
 563 }
 564
 565 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
 566                                const struct nft_expr *expr)
 567 {
 568         nf_ct_netns_put(ctx->net, ctx->afi->family);
 569 }
 570
 571 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
 572                                const struct nft_expr *expr)
 573 {
 574         struct nft_ct *priv = nft_expr_priv(expr);
 575
 576         __nft_ct_set_destroy(ctx, priv);
 577         nft_ct_netns_put(ctx->net, ctx->afi->family);
 578 }
 579
 580 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
 581 {
 582         const struct nft_ct *priv = nft_expr_priv(expr);
 583
 584         if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
 585                 goto nla_put_failure;
 586         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 587                 goto nla_put_failure;
 588
 589         switch (priv->key) {
 590         case NFT_CT_SRC:
 591         case NFT_CT_DST:
 592         case NFT_CT_PROTO_SRC:
 593         case NFT_CT_PROTO_DST:
 594                 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 595                         goto nla_put_failure;
 596                 break;
 597         case NFT_CT_BYTES:
 598         case NFT_CT_PKTS:
 599         case NFT_CT_AVGPKT:
 600         case NFT_CT_ZONE:
 601                 if (priv->dir < IP_CT_DIR_MAX &&
 602                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 603                         goto nla_put_failure;
 604                 break;
 605         default:
 606                 break;
 607         }
 608
 609         return 0;
 610
 611 nla_put_failure:
 612         return -1;
 613 }
 614
 615 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
 616 {
 617         const struct nft_ct *priv = nft_expr_priv(expr);
 618
 619         if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
 620                 goto nla_put_failure;
 621         if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
 622                 goto nla_put_failure;
 623
 624         switch (priv->key) {
 625         case NFT_CT_ZONE:
 626                 if (priv->dir < IP_CT_DIR_MAX &&
 627                     nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
 628                         goto nla_put_failure;
 629                 break;
 630         default:
 631                 break;
 632         }
 633
 634         return 0;
 635
 636 nla_put_failure:
 637         return -1;
 638 }
 639
 640 static struct nft_expr_type nft_ct_type;
 641 static const struct nft_expr_ops nft_ct_get_ops = {
 642         .type           = &nft_ct_type,
 643         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 644         .eval           = nft_ct_get_eval,
 645         .init           = nft_ct_get_init,
 646         .destroy        = nft_ct_get_destroy,
 647         .dump           = nft_ct_get_dump,
 648 };
 649
 650 static const struct nft_expr_ops nft_ct_set_ops = {
 651         .type           = &nft_ct_type,
 652         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 653         .eval           = nft_ct_set_eval,
 654         .init           = nft_ct_set_init,
 655         .destroy        = nft_ct_set_destroy,
 656         .dump           = nft_ct_set_dump,
 657 };
 658
 659 #ifdef CONFIG_NF_CONNTRACK_ZONES
 660 static const struct nft_expr_ops nft_ct_set_zone_ops = {
 661         .type           = &nft_ct_type,
 662         .size           = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
 663         .eval           = nft_ct_set_zone_eval,
 664         .init           = nft_ct_set_init,
 665         .destroy        = nft_ct_set_destroy,
 666         .dump           = nft_ct_set_dump,
 667 };
 668 #endif
 669
 670 static const struct nft_expr_ops *
 671 nft_ct_select_ops(const struct nft_ctx *ctx,
 672                     const struct nlattr * const tb[])
 673 {
 674         if (tb[NFTA_CT_KEY] == NULL)
 675                 return ERR_PTR(-EINVAL);
 676
 677         if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
 678                 return ERR_PTR(-EINVAL);
 679
 680         if (tb[NFTA_CT_DREG])
 681                 return &nft_ct_get_ops;
 682
 683         if (tb[NFTA_CT_SREG]) {
 684 #ifdef CONFIG_NF_CONNTRACK_ZONES
 685                 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
 686                         return &nft_ct_set_zone_ops;
 687 #endif
 688                 return &nft_ct_set_ops;
 689         }
 690
 691         return ERR_PTR(-EINVAL);
 692 }
 693
 694 static struct nft_expr_type nft_ct_type __read_mostly = {
 695         .name           = "ct",
 696         .select_ops     = &nft_ct_select_ops,
 697         .policy         = nft_ct_policy,
 698         .maxattr        = NFTA_CT_MAX,
 699         .owner          = THIS_MODULE,
 700 };
 701
 702 static void nft_notrack_eval(const struct nft_expr *expr,
 703                              struct nft_regs *regs,
 704                              const struct nft_pktinfo *pkt)
 705 {
 706         struct sk_buff *skb = pkt->skb;
 707         enum ip_conntrack_info ctinfo;
 708         struct nf_conn *ct;
 709
 710         ct = nf_ct_get(pkt->skb, &ctinfo);
 711         /* Previously seen (loopback or untracked)?  Ignore. */
 712         if (ct)
 713                 return;
 714
 715         ct = nf_ct_untracked_get();
 716         atomic_inc(&ct->ct_general.use);
 717         nf_ct_set(skb, ct, IP_CT_NEW);
 718 }
 719
 720 static struct nft_expr_type nft_notrack_type;
 721 static const struct nft_expr_ops nft_notrack_ops = {
 722         .type           = &nft_notrack_type,
 723         .size           = NFT_EXPR_SIZE(0),
 724         .eval           = nft_notrack_eval,
 725 };
 726
 727 static struct nft_expr_type nft_notrack_type __read_mostly = {
 728         .name           = "notrack",
 729         .ops            = &nft_notrack_ops,
 730         .owner          = THIS_MODULE,
 731 };
 732
 733 static int __init nft_ct_module_init(void)
 734 {
 735         int err;
 736
 737         BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
 738
 739         err = nft_register_expr(&nft_ct_type);
 740         if (err < 0)
 741                 return err;
 742
 743         err = nft_register_expr(&nft_notrack_type);
 744         if (err < 0)
 745                 goto err1;
 746
 747         return 0;
 748 err1:
 749         nft_unregister_expr(&nft_ct_type);
 750         return err;
 751 }
 752
 753 static void __exit nft_ct_module_exit(void)
 754 {
 755         nft_unregister_expr(&nft_notrack_type);
 756         nft_unregister_expr(&nft_ct_type);
 757 }
 758
 759 module_init(nft_ct_module_init);
 760 module_exit(nft_ct_module_exit);
 761
 762 MODULE_LICENSE("GPL");
 763 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 764 MODULE_ALIAS_NFT_EXPR("ct");
 765 MODULE_ALIAS_NFT_EXPR("notrack");