]> Git Repo - linux.git/blame - net/netfilter/nft_ct.c
projects / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netlink: make validation more configurable for future strictness
[linux.git] / net / netfilter / nft_ct.c
CommitLineData
96518518 1/*
ef1f7df9 2 * Copyright (c) 2008-2009 Patrick McHardy <[email protected]>
25443261 3 * Copyright (c) 2016 Pablo Neira Ayuso <[email protected]>
96518518
PM		 4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
10 */
11
12#include <linux/kernel.h>
13#include <linux/init.h>
14#include <linux/module.h>
15#include <linux/netlink.h>
16#include <linux/netfilter.h>
17#include <linux/netfilter/nf_tables.h>
18#include <net/netfilter/nf_tables.h>
19#include <net/netfilter/nf_conntrack.h>
48f66c90 20#include <net/netfilter/nf_conntrack_acct.h>
96518518
PM		 21#include <net/netfilter/nf_conntrack_tuple.h>
22#include <net/netfilter/nf_conntrack_helper.h>
c4ede3d3 23#include <net/netfilter/nf_conntrack_ecache.h>
d2bf2f34 24#include <net/netfilter/nf_conntrack_labels.h>
7e0b2b57
HS		 25#include <net/netfilter/nf_conntrack_timeout.h>
26#include <net/netfilter/nf_conntrack_l4proto.h>
96518518
PM		 27
28struct nft_ct {
29 enum nft_ct_keys key:8;
30 enum ip_conntrack_dir dir:8;
d46f2cd2 31 union {
c4ede3d3
KE		 32 enum nft_registers dreg:8;
33 enum nft_registers sreg:8;
34 };
96518518
PM		 35};
36
1a64edf5
FW		 37struct nft_ct_helper_obj {
38 struct nf_conntrack_helper *helper4;
39 struct nf_conntrack_helper *helper6;
40 u8 l4proto;
41};
42
edee4f1e
FW		 43#ifdef CONFIG_NF_CONNTRACK_ZONES
44static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
45static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
46#endif
47
48f66c90
FW		 48static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
49 enum nft_ct_keys k,
50 enum ip_conntrack_dir d)
51{
52 if (d < IP_CT_DIR_MAX)
53 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
54 atomic64_read(&c[d].packets);
55
56 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
57 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
58}
59
c4ede3d3 60static void nft_ct_get_eval(const struct nft_expr *expr,
a55e22e9 61 struct nft_regs *regs,
c4ede3d3 62 const struct nft_pktinfo *pkt)
96518518
PM		 63{
64 const struct nft_ct *priv = nft_expr_priv(expr);
49499c3e 65 u32 *dest = &regs->data[priv->dreg];
96518518
PM		 66 enum ip_conntrack_info ctinfo;
67 const struct nf_conn *ct;
68 const struct nf_conn_help *help;
69 const struct nf_conntrack_tuple *tuple;
70 const struct nf_conntrack_helper *helper;
96518518
PM		 71 unsigned int state;
72
73 ct = nf_ct_get(pkt->skb, &ctinfo);
74
75 switch (priv->key) {
76 case NFT_CT_STATE:
cc41c84b
FW		 77 if (ct)
78 state = NF_CT_STATE_BIT(ctinfo);
79 else if (ctinfo == IP_CT_UNTRACKED)
96518518
PM		 80 state = NF_CT_STATE_UNTRACKED_BIT;
81 else
cc41c84b 82 state = NF_CT_STATE_INVALID_BIT;
fad136ea 83 *dest = state;
96518518 84 return;
c1f86676
DM		 85 default:
86 break;
96518518
PM		 87 }
88
89 if (ct == NULL)
90 goto err;
91
92 switch (priv->key) {
93 case NFT_CT_DIRECTION:
10596608 94 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
96518518
PM		 95 return;
96 case NFT_CT_STATUS:
fad136ea 97 *dest = ct->status;
96518518
PM		 98 return;
99#ifdef CONFIG_NF_CONNTRACK_MARK
100 case NFT_CT_MARK:
fad136ea 101 *dest = ct->mark;
96518518
PM		 102 return;
103#endif
104#ifdef CONFIG_NF_CONNTRACK_SECMARK
105 case NFT_CT_SECMARK:
fad136ea 106 *dest = ct->secmark;
96518518
PM		 107 return;
108#endif
109 case NFT_CT_EXPIRATION:
c8607e02 110 *dest = jiffies_to_msecs(nf_ct_expires(ct));
96518518
PM		 111 return;
112 case NFT_CT_HELPER:
113 if (ct->master == NULL)
114 goto err;
115 help = nfct_help(ct->master);
116 if (help == NULL)
117 goto err;
118 helper = rcu_dereference(help->helper);
119 if (helper == NULL)
120 goto err;
fad136ea 121 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
96518518 122 return;
d2bf2f34
FW		 123#ifdef CONFIG_NF_CONNTRACK_LABELS
124 case NFT_CT_LABELS: {
125 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
d2bf2f34 126
23014011
FW		 127 if (labels)
128 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
129 else
fad136ea 130 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
d2bf2f34
FW		 131 return;
132 }
efaea94a 133#endif
48f66c90
FW		 134 case NFT_CT_BYTES: /* fallthrough */
135 case NFT_CT_PKTS: {
136 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
137 u64 count = 0;
138
139 if (acct)
140 count = nft_ct_get_eval_counter(acct->counter,
141 priv->key, priv->dir);
142 memcpy(dest, &count, sizeof(count));
143 return;
144 }
949a3584
LZ		 145 case NFT_CT_AVGPKT: {
146 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
147 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
148
149 if (acct) {
150 pcnt = nft_ct_get_eval_counter(acct->counter,
151 NFT_CT_PKTS, priv->dir);
152 bcnt = nft_ct_get_eval_counter(acct->counter,
153 NFT_CT_BYTES, priv->dir);
154 if (pcnt != 0)
155 avgcnt = div64_u64(bcnt, pcnt);
156 }
157
158 memcpy(dest, &avgcnt, sizeof(avgcnt));
159 return;
160 }
d767ff2c 161 case NFT_CT_L3PROTOCOL:
10596608 162 nft_reg_store8(dest, nf_ct_l3num(ct));
d767ff2c
LZ		 163 return;
164 case NFT_CT_PROTOCOL:
10596608 165 nft_reg_store8(dest, nf_ct_protonum(ct));
d767ff2c 166 return;
ab23821f
FW		 167#ifdef CONFIG_NF_CONNTRACK_ZONES
168 case NFT_CT_ZONE: {
169 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
10596608 170 u16 zoneid;
ab23821f
FW		 171
172 if (priv->dir < IP_CT_DIR_MAX)
10596608 173 zoneid = nf_ct_zone_id(zone, priv->dir);
ab23821f 174 else
10596608 175 zoneid = zone->id;
ab23821f 176
10596608 177 nft_reg_store16(dest, zoneid);
ab23821f
FW		 178 return;
179 }
180#endif
c1f86676
DM		 181 default:
182 break;
96518518
PM		 183 }
184
185 tuple = &ct->tuplehash[priv->dir].tuple;
186 switch (priv->key) {
96518518 187 case NFT_CT_SRC:
fad136ea 188 memcpy(dest, tuple->src.u3.all,
96518518
PM		 189 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
190 return;
191 case NFT_CT_DST:
fad136ea 192 memcpy(dest, tuple->dst.u3.all,
96518518
PM		 193 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
194 return;
96518518 195 case NFT_CT_PROTO_SRC:
10596608 196 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
96518518
PM		 197 return;
198 case NFT_CT_PROTO_DST:
10596608 199 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
96518518 200 return;
d719e3f2
PNA		 201 case NFT_CT_SRC_IP:
202 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
203 goto err;
204 *dest = tuple->src.u3.ip;
205 return;
206 case NFT_CT_DST_IP:
207 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
208 goto err;
209 *dest = tuple->dst.u3.ip;
210 return;
211 case NFT_CT_SRC_IP6:
212 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
213 goto err;
214 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
215 return;
216 case NFT_CT_DST_IP6:
217 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
218 goto err;
219 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
220 return;
c1f86676
DM		 221 default:
222 break;
96518518
PM		 223 }
224 return;
225err:
a55e22e9 226 regs->verdict.code = NFT_BREAK;
96518518
PM		 227}
228
edee4f1e
FW		 229#ifdef CONFIG_NF_CONNTRACK_ZONES
230static void nft_ct_set_zone_eval(const struct nft_expr *expr,
231 struct nft_regs *regs,
232 const struct nft_pktinfo *pkt)
233{
234 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
235 const struct nft_ct *priv = nft_expr_priv(expr);
236 struct sk_buff *skb = pkt->skb;
237 enum ip_conntrack_info ctinfo;
10596608 238 u16 value = nft_reg_load16(&regs->data[priv->sreg]);
edee4f1e
FW		 239 struct nf_conn *ct;
240
241 ct = nf_ct_get(skb, &ctinfo);
242 if (ct) /* already tracked */
243 return;
244
245 zone.id = value;
246
247 switch (priv->dir) {
248 case IP_CT_DIR_ORIGINAL:
249 zone.dir = NF_CT_ZONE_DIR_ORIG;
250 break;
251 case IP_CT_DIR_REPLY:
252 zone.dir = NF_CT_ZONE_DIR_REPL;
253 break;
254 default:
255 break;
256 }
257
258 ct = this_cpu_read(nft_ct_pcpu_template);
259
260 if (likely(atomic_read(&ct->ct_general.use) == 1)) {
261 nf_ct_zone_add(ct, &zone);
262 } else {
263 /* previous skb got queued to userspace */
264 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
265 if (!ct) {
266 regs->verdict.code = NF_DROP;
267 return;
268 }
269 }
270
271 atomic_inc(&ct->ct_general.use);
272 nf_ct_set(skb, ct, IP_CT_NEW);
273}
274#endif
275
c4ede3d3 276static void nft_ct_set_eval(const struct nft_expr *expr,
a55e22e9 277 struct nft_regs *regs,
c4ede3d3
KE		 278 const struct nft_pktinfo *pkt)
279{
280 const struct nft_ct *priv = nft_expr_priv(expr);
281 struct sk_buff *skb = pkt->skb;
b473a1f5 282#if defined(CONFIG_NF_CONNTRACK_MARK) || defined(CONFIG_NF_CONNTRACK_SECMARK)
49499c3e 283 u32 value = regs->data[priv->sreg];
847c8e29 284#endif
c4ede3d3
KE		 285 enum ip_conntrack_info ctinfo;
286 struct nf_conn *ct;
287
288 ct = nf_ct_get(skb, &ctinfo);
694a0055 289 if (ct == NULL || nf_ct_is_template(ct))
c4ede3d3
KE		 290 return;
291
292 switch (priv->key) {
293#ifdef CONFIG_NF_CONNTRACK_MARK
294 case NFT_CT_MARK:
295 if (ct->mark != value) {
296 ct->mark = value;
297 nf_conntrack_event_cache(IPCT_MARK, ct);
298 }
299 break;
1ad8f48d 300#endif
b473a1f5
CG		 301#ifdef CONFIG_NF_CONNTRACK_SECMARK
302 case NFT_CT_SECMARK:
303 if (ct->secmark != value) {
304 ct->secmark = value;
305 nf_conntrack_event_cache(IPCT_SECMARK, ct);
306 }
307 break;
308#endif
1ad8f48d
FW		 309#ifdef CONFIG_NF_CONNTRACK_LABELS
310 case NFT_CT_LABELS:
311 nf_connlabels_replace(ct,
312 &regs->data[priv->sreg],
313 &regs->data[priv->sreg],
314 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
315 break;
694a0055
FW		 316#endif
317#ifdef CONFIG_NF_CONNTRACK_EVENTS
318 case NFT_CT_EVENTMASK: {
319 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
320 u32 ctmask = regs->data[priv->sreg];
321
322 if (e) {
323 if (e->ctmask != ctmask)
324 e->ctmask = ctmask;
325 break;
326 }
327
328 if (ctmask && !nf_ct_is_confirmed(ct))
329 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
330 break;
331 }
c4ede3d3 332#endif
c1f86676
DM		 333 default:
334 break;
c4ede3d3
KE		 335 }
336}
337
96518518
PM		 338static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
339 [NFTA_CT_DREG] = { .type = NLA_U32 },
340 [NFTA_CT_KEY] = { .type = NLA_U32 },
341 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
c4ede3d3 342 [NFTA_CT_SREG] = { .type = NLA_U32 },
96518518
PM		 343};
344
edee4f1e
FW		 345#ifdef CONFIG_NF_CONNTRACK_ZONES
346static void nft_ct_tmpl_put_pcpu(void)
347{
348 struct nf_conn *ct;
349 int cpu;
350
351 for_each_possible_cpu(cpu) {
352 ct = per_cpu(nft_ct_pcpu_template, cpu);
353 if (!ct)
354 break;
355 nf_ct_put(ct);
356 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
357 }
358}
359
360static bool nft_ct_tmpl_alloc_pcpu(void)
361{
362 struct nf_conntrack_zone zone = { .id = 0 };
363 struct nf_conn *tmp;
364 int cpu;
365
366 if (nft_ct_pcpu_template_refcnt)
367 return true;
368
369 for_each_possible_cpu(cpu) {
370 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
371 if (!tmp) {
372 nft_ct_tmpl_put_pcpu();
373 return false;
374 }
375
376 atomic_set(&tmp->ct_general.use, 1);
377 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
378 }
379
380 return true;
381}
382#endif
383
fe92ca45
PM		 384static int nft_ct_get_init(const struct nft_ctx *ctx,
385 const struct nft_expr *expr,
386 const struct nlattr * const tb[])
96518518
PM		 387{
388 struct nft_ct *priv = nft_expr_priv(expr);
45d9bcda 389 unsigned int len;
fe92ca45 390 int err;
96518518 391
fe92ca45 392 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
ab23821f 393 priv->dir = IP_CT_DIR_MAX;
96518518 394 switch (priv->key) {
96518518 395 case NFT_CT_DIRECTION:
45d9bcda
PM		 396 if (tb[NFTA_CT_DIRECTION] != NULL)
397 return -EINVAL;
398 len = sizeof(u8);
399 break;
400 case NFT_CT_STATE:
96518518
PM		 401 case NFT_CT_STATUS:
402#ifdef CONFIG_NF_CONNTRACK_MARK
403 case NFT_CT_MARK:
404#endif
405#ifdef CONFIG_NF_CONNTRACK_SECMARK
406 case NFT_CT_SECMARK:
d2bf2f34 407#endif
45d9bcda
PM		 408 case NFT_CT_EXPIRATION:
409 if (tb[NFTA_CT_DIRECTION] != NULL)
410 return -EINVAL;
411 len = sizeof(u32);
412 break;
d2bf2f34
FW		 413#ifdef CONFIG_NF_CONNTRACK_LABELS
414 case NFT_CT_LABELS:
45d9bcda
PM		 415 if (tb[NFTA_CT_DIRECTION] != NULL)
416 return -EINVAL;
417 len = NF_CT_LABELS_MAX_SIZE;
418 break;
96518518 419#endif
96518518
PM		 420 case NFT_CT_HELPER:
421 if (tb[NFTA_CT_DIRECTION] != NULL)
422 return -EINVAL;
45d9bcda 423 len = NF_CT_HELPER_NAME_LEN;
96518518 424 break;
45d9bcda 425
51292c07 426 case NFT_CT_L3PROTOCOL:
96518518 427 case NFT_CT_PROTOCOL:
d767ff2c
LZ		 428 /* For compatibility, do not report error if NFTA_CT_DIRECTION
429 * attribute is specified.
430 */
45d9bcda
PM		 431 len = sizeof(u8);
432 break;
96518518
PM		 433 case NFT_CT_SRC:
434 case NFT_CT_DST:
45d9bcda
PM		 435 if (tb[NFTA_CT_DIRECTION] == NULL)
436 return -EINVAL;
437
36596dad 438 switch (ctx->family) {
45d9bcda
PM		 439 case NFPROTO_IPV4:
440 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
441 src.u3.ip);
442 break;
443 case NFPROTO_IPV6:
444 case NFPROTO_INET:
445 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
446 src.u3.ip6);
447 break;
448 default:
449 return -EAFNOSUPPORT;
450 }
451 break;
d719e3f2
PNA		 452 case NFT_CT_SRC_IP:
453 case NFT_CT_DST_IP:
454 if (tb[NFTA_CT_DIRECTION] == NULL)
455 return -EINVAL;
456
457 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip);
458 break;
459 case NFT_CT_SRC_IP6:
460 case NFT_CT_DST_IP6:
461 if (tb[NFTA_CT_DIRECTION] == NULL)
462 return -EINVAL;
463
464 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip6);
465 break;
96518518
PM		 466 case NFT_CT_PROTO_SRC:
467 case NFT_CT_PROTO_DST:
468 if (tb[NFTA_CT_DIRECTION] == NULL)
469 return -EINVAL;
45d9bcda 470 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
96518518 471 break;
48f66c90
FW		 472 case NFT_CT_BYTES:
473 case NFT_CT_PKTS:
949a3584 474 case NFT_CT_AVGPKT:
48f66c90
FW		 475 len = sizeof(u64);
476 break;
ab23821f
FW		 477#ifdef CONFIG_NF_CONNTRACK_ZONES
478 case NFT_CT_ZONE:
479 len = sizeof(u16);
480 break;
481#endif
96518518
PM		 482 default:
483 return -EOPNOTSUPP;
484 }
485
fe92ca45
PM		 486 if (tb[NFTA_CT_DIRECTION] != NULL) {
487 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
488 switch (priv->dir) {
489 case IP_CT_DIR_ORIGINAL:
490 case IP_CT_DIR_REPLY:
491 break;
492 default:
493 return -EINVAL;
494 }
495 }
496
b1c96ed3 497 priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
1ec10212
PM		 498 err = nft_validate_register_store(ctx, priv->dreg, NULL,
499 NFT_DATA_VALUE, len);
fe92ca45
PM		 500 if (err < 0)
501 return err;
502
36596dad 503 err = nf_ct_netns_get(ctx->net, ctx->family);
fe92ca45
PM		 504 if (err < 0)
505 return err;
506
949a3584
LZ		 507 if (priv->key == NFT_CT_BYTES ||
508 priv->key == NFT_CT_PKTS ||
509 priv->key == NFT_CT_AVGPKT)
3f8b61b7
LZ		 510 nf_ct_set_acct(ctx->net, true);
511
c4ede3d3
KE		 512 return 0;
513}
514
5c178d81
FW		 515static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
516{
517 switch (priv->key) {
518#ifdef CONFIG_NF_CONNTRACK_LABELS
519 case NFT_CT_LABELS:
520 nf_connlabels_put(ctx->net);
521 break;
edee4f1e
FW		 522#endif
523#ifdef CONFIG_NF_CONNTRACK_ZONES
524 case NFT_CT_ZONE:
525 if (--nft_ct_pcpu_template_refcnt == 0)
526 nft_ct_tmpl_put_pcpu();
5c178d81
FW		 527#endif
528 default:
529 break;
530 }
531}
532
fe92ca45
PM		 533static int nft_ct_set_init(const struct nft_ctx *ctx,
534 const struct nft_expr *expr,
535 const struct nlattr * const tb[])
c4ede3d3 536{
fe92ca45 537 struct nft_ct *priv = nft_expr_priv(expr);
d07db988 538 unsigned int len;
fe92ca45
PM		 539 int err;
540
edee4f1e 541 priv->dir = IP_CT_DIR_MAX;
fe92ca45
PM		 542 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
543 switch (priv->key) {
e88e514e 544#ifdef CONFIG_NF_CONNTRACK_MARK
c4ede3d3 545 case NFT_CT_MARK:
7bfdde70
LZ		 546 if (tb[NFTA_CT_DIRECTION])
547 return -EINVAL;
d07db988 548 len = FIELD_SIZEOF(struct nf_conn, mark);
c4ede3d3 549 break;
1ad8f48d
FW		 550#endif
551#ifdef CONFIG_NF_CONNTRACK_LABELS
552 case NFT_CT_LABELS:
553 if (tb[NFTA_CT_DIRECTION])
554 return -EINVAL;
555 len = NF_CT_LABELS_MAX_SIZE;
556 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
557 if (err)
558 return err;
559 break;
edee4f1e
FW		 560#endif
561#ifdef CONFIG_NF_CONNTRACK_ZONES
562 case NFT_CT_ZONE:
563 if (!nft_ct_tmpl_alloc_pcpu())
564 return -ENOMEM;
565 nft_ct_pcpu_template_refcnt++;
427345d6 566 len = sizeof(u16);
edee4f1e 567 break;
694a0055
FW		 568#endif
569#ifdef CONFIG_NF_CONNTRACK_EVENTS
570 case NFT_CT_EVENTMASK:
571 if (tb[NFTA_CT_DIRECTION])
572 return -EINVAL;
573 len = sizeof(u32);
574 break;
b473a1f5
CG		 575#endif
576#ifdef CONFIG_NF_CONNTRACK_SECMARK
577 case NFT_CT_SECMARK:
578 if (tb[NFTA_CT_DIRECTION])
579 return -EINVAL;
580 len = sizeof(u32);
581 break;
e88e514e 582#endif
c4ede3d3
KE		 583 default:
584 return -EOPNOTSUPP;
585 }
586
edee4f1e
FW		 587 if (tb[NFTA_CT_DIRECTION]) {
588 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
589 switch (priv->dir) {
590 case IP_CT_DIR_ORIGINAL:
591 case IP_CT_DIR_REPLY:
592 break;
593 default:
4494dbc6
LZ		 594 err = -EINVAL;
595 goto err1;
edee4f1e
FW		 596 }
597 }
598
b1c96ed3 599 priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
d07db988 600 err = nft_validate_register_load(priv->sreg, len);
fe92ca45 601 if (err < 0)
590025a2 602 goto err1;
c4ede3d3 603
36596dad 604 err = nf_ct_netns_get(ctx->net, ctx->family);
96518518 605 if (err < 0)
590025a2 606 goto err1;
96518518 607
96518518 608 return 0;
590025a2
LZ		 609
610err1:
5c178d81 611 __nft_ct_set_destroy(ctx, priv);
590025a2
LZ		 612 return err;
613}
614
615static void nft_ct_get_destroy(const struct nft_ctx *ctx,
616 const struct nft_expr *expr)
617{
36596dad 618 nf_ct_netns_put(ctx->net, ctx->family);
96518518
PM		 619}
620
590025a2
LZ		 621static void nft_ct_set_destroy(const struct nft_ctx *ctx,
622 const struct nft_expr *expr)
96518518 623{
1ad8f48d
FW		 624 struct nft_ct *priv = nft_expr_priv(expr);
625
5c178d81 626 __nft_ct_set_destroy(ctx, priv);
36596dad 627 nf_ct_netns_put(ctx->net, ctx->family);
96518518
PM		 628}
629
c4ede3d3 630static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
96518518
PM		 631{
632 const struct nft_ct *priv = nft_expr_priv(expr);
633
b1c96ed3 634 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
96518518
PM		 635 goto nla_put_failure;
636 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
637 goto nla_put_failure;
2a53bfb3
AB		 638
639 switch (priv->key) {
2a53bfb3
AB		 640 case NFT_CT_SRC:
641 case NFT_CT_DST:
d719e3f2
PNA		 642 case NFT_CT_SRC_IP:
643 case NFT_CT_DST_IP:
644 case NFT_CT_SRC_IP6:
645 case NFT_CT_DST_IP6:
2a53bfb3
AB		 646 case NFT_CT_PROTO_SRC:
647 case NFT_CT_PROTO_DST:
648 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
649 goto nla_put_failure;
48f66c90
FW		 650 break;
651 case NFT_CT_BYTES:
652 case NFT_CT_PKTS:
949a3584 653 case NFT_CT_AVGPKT:
ab23821f 654 case NFT_CT_ZONE:
48f66c90
FW		 655 if (priv->dir < IP_CT_DIR_MAX &&
656 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
657 goto nla_put_failure;
658 break;
2a53bfb3
AB		 659 default:
660 break;
661 }
662
96518518
PM		 663 return 0;
664
665nla_put_failure:
666 return -1;
667}
668
c4ede3d3
KE		 669static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
670{
671 const struct nft_ct *priv = nft_expr_priv(expr);
672
b1c96ed3 673 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
c4ede3d3
KE		 674 goto nla_put_failure;
675 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
676 goto nla_put_failure;
edee4f1e
FW		 677
678 switch (priv->key) {
679 case NFT_CT_ZONE:
680 if (priv->dir < IP_CT_DIR_MAX &&
681 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
682 goto nla_put_failure;
683 break;
684 default:
685 break;
686 }
687
c4ede3d3
KE		 688 return 0;
689
690nla_put_failure:
691 return -1;
692}
693
ef1f7df9 694static struct nft_expr_type nft_ct_type;
c4ede3d3 695static const struct nft_expr_ops nft_ct_get_ops = {
ef1f7df9 696 .type = &nft_ct_type,
96518518 697 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
c4ede3d3 698 .eval = nft_ct_get_eval,
fe92ca45 699 .init = nft_ct_get_init,
590025a2 700 .destroy = nft_ct_get_destroy,
c4ede3d3 701 .dump = nft_ct_get_dump,
ef1f7df9
PM		 702};
703
c4ede3d3
KE		 704static const struct nft_expr_ops nft_ct_set_ops = {
705 .type = &nft_ct_type,
706 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
707 .eval = nft_ct_set_eval,
fe92ca45 708 .init = nft_ct_set_init,
590025a2 709 .destroy = nft_ct_set_destroy,
c4ede3d3
KE		 710 .dump = nft_ct_set_dump,
711};
712
edee4f1e
FW		 713#ifdef CONFIG_NF_CONNTRACK_ZONES
714static const struct nft_expr_ops nft_ct_set_zone_ops = {
715 .type = &nft_ct_type,
716 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
717 .eval = nft_ct_set_zone_eval,
718 .init = nft_ct_set_init,
719 .destroy = nft_ct_set_destroy,
720 .dump = nft_ct_set_dump,
721};
722#endif
723
c4ede3d3
KE		 724static const struct nft_expr_ops *
725nft_ct_select_ops(const struct nft_ctx *ctx,
726 const struct nlattr * const tb[])
727{
728 if (tb[NFTA_CT_KEY] == NULL)
729 return ERR_PTR(-EINVAL);
730
731 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
732 return ERR_PTR(-EINVAL);
733
734 if (tb[NFTA_CT_DREG])
735 return &nft_ct_get_ops;
736
edee4f1e
FW		 737 if (tb[NFTA_CT_SREG]) {
738#ifdef CONFIG_NF_CONNTRACK_ZONES
739 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
740 return &nft_ct_set_zone_ops;
741#endif
c4ede3d3 742 return &nft_ct_set_ops;
edee4f1e 743 }
c4ede3d3
KE		 744
745 return ERR_PTR(-EINVAL);
746}
747
ef1f7df9
PM		 748static struct nft_expr_type nft_ct_type __read_mostly = {
749 .name = "ct",
d4ef3835 750 .select_ops = nft_ct_select_ops,
96518518
PM		 751 .policy = nft_ct_policy,
752 .maxattr = NFTA_CT_MAX,
ef1f7df9 753 .owner = THIS_MODULE,
96518518
PM		 754};
755
25443261
PNA		 756static void nft_notrack_eval(const struct nft_expr *expr,
757 struct nft_regs *regs,
758 const struct nft_pktinfo *pkt)
759{
760 struct sk_buff *skb = pkt->skb;
761 enum ip_conntrack_info ctinfo;
762 struct nf_conn *ct;
763
764 ct = nf_ct_get(pkt->skb, &ctinfo);
765 /* Previously seen (loopback or untracked)? Ignore. */
cc41c84b 766 if (ct || ctinfo == IP_CT_UNTRACKED)
25443261
PNA		 767 return;
768
cc41c84b 769 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
25443261
PNA		 770}
771
772static struct nft_expr_type nft_notrack_type;
773static const struct nft_expr_ops nft_notrack_ops = {
774 .type = &nft_notrack_type,
775 .size = NFT_EXPR_SIZE(0),
776 .eval = nft_notrack_eval,
777};
778
779static struct nft_expr_type nft_notrack_type __read_mostly = {
780 .name = "notrack",
781 .ops = &nft_notrack_ops,
782 .owner = THIS_MODULE,
783};
784
7e0b2b57
HS		 785#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
786static int
787nft_ct_timeout_parse_policy(void *timeouts,
788 const struct nf_conntrack_l4proto *l4proto,
789 struct net *net, const struct nlattr *attr)
790{
791 struct nlattr **tb;
792 int ret = 0;
793
7e0b2b57
HS		 794 tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
795 GFP_KERNEL);
796
797 if (!tb)
798 return -ENOMEM;
799
8cb08174
JB		 800 ret = nla_parse_nested_deprecated(tb,
801 l4proto->ctnl_timeout.nlattr_max,
802 attr,
803 l4proto->ctnl_timeout.nla_policy,
804 NULL);
7e0b2b57
HS		 805 if (ret < 0)
806 goto err;
807
808 ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
809
810err:
811 kfree(tb);
812 return ret;
813}
814
815struct nft_ct_timeout_obj {
0434ccdc 816 struct nf_ct_timeout *timeout;
7e0b2b57
HS		 817 u8 l4proto;
818};
819
820static void nft_ct_timeout_obj_eval(struct nft_object *obj,
821 struct nft_regs *regs,
822 const struct nft_pktinfo *pkt)
823{
824 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
825 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
0434ccdc
FW		 826 struct nf_conn_timeout *timeout;
827 const unsigned int *values;
828
829 if (priv->l4proto != pkt->tprot)
830 return;
7e0b2b57 831
0434ccdc 832 if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
7e0b2b57
HS		 833 return;
834
0434ccdc
FW		 835 timeout = nf_ct_timeout_find(ct);
836 if (!timeout) {
837 timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
838 if (!timeout) {
839 regs->verdict.code = NF_DROP;
840 return;
841 }
842 }
843
844 rcu_assign_pointer(timeout->timeout, priv->timeout);
845
846 /* adjust the timeout as per 'new' state. ct is unconfirmed,
847 * so the current timestamp must not be added.
848 */
849 values = nf_ct_timeout_data(timeout);
850 if (values)
851 nf_ct_refresh(ct, pkt->skb, values[0]);
7e0b2b57
HS		 852}
853
854static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
855 const struct nlattr * const tb[],
856 struct nft_object *obj)
857{
7e0b2b57
HS		 858 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
859 const struct nf_conntrack_l4proto *l4proto;
7e0b2b57
HS		 860 struct nf_ct_timeout *timeout;
861 int l3num = ctx->family;
7e0b2b57
HS		 862 __u8 l4num;
863 int ret;
864
3206c516 865 if (!tb[NFTA_CT_TIMEOUT_L4PROTO] ||
7e0b2b57
HS		 866 !tb[NFTA_CT_TIMEOUT_DATA])
867 return -EINVAL;
868
3206c516
HS		 869 if (tb[NFTA_CT_TIMEOUT_L3PROTO])
870 l3num = ntohs(nla_get_be16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
871
7e0b2b57
HS		 872 l4num = nla_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
873 priv->l4proto = l4num;
874
4a60dc74 875 l4proto = nf_ct_l4proto_find(l4num);
7e0b2b57
HS		 876
877 if (l4proto->l4proto != l4num) {
878 ret = -EOPNOTSUPP;
879 goto err_proto_put;
880 }
881
882 timeout = kzalloc(sizeof(struct nf_ct_timeout) +
883 l4proto->ctnl_timeout.obj_size, GFP_KERNEL);
884 if (timeout == NULL) {
885 ret = -ENOMEM;
886 goto err_proto_put;
887 }
888
889 ret = nft_ct_timeout_parse_policy(&timeout->data, l4proto, ctx->net,
890 tb[NFTA_CT_TIMEOUT_DATA]);
891 if (ret < 0)
892 goto err_free_timeout;
893
894 timeout->l3num = l3num;
895 timeout->l4proto = l4proto;
7e0b2b57
HS		 896
897 ret = nf_ct_netns_get(ctx->net, ctx->family);
898 if (ret < 0)
0434ccdc 899 goto err_free_timeout;
7e0b2b57 900
0434ccdc 901 priv->timeout = timeout;
7e0b2b57
HS		 902 return 0;
903
7e0b2b57
HS		 904err_free_timeout:
905 kfree(timeout);
906err_proto_put:
7e0b2b57
HS		 907 return ret;
908}
909
910static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
911 struct nft_object *obj)
912{
913 struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
0434ccdc 914 struct nf_ct_timeout *timeout = priv->timeout;
7e0b2b57 915
7e0b2b57 916 nf_ct_untimeout(ctx->net, timeout);
7e0b2b57 917 nf_ct_netns_put(ctx->net, ctx->family);
0434ccdc 918 kfree(priv->timeout);
7e0b2b57
HS		 919}
920
921static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
922 struct nft_object *obj, bool reset)
923{
924 const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
0434ccdc 925 const struct nf_ct_timeout *timeout = priv->timeout;
7e0b2b57
HS		 926 struct nlattr *nest_params;
927 int ret;
928
929 if (nla_put_u8(skb, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto->l4proto) ||
930 nla_put_be16(skb, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3num)))
931 return -1;
932
ae0be8de 933 nest_params = nla_nest_start(skb, NFTA_CT_TIMEOUT_DATA);
7e0b2b57
HS		 934 if (!nest_params)
935 return -1;
936
937 ret = timeout->l4proto->ctnl_timeout.obj_to_nlattr(skb, &timeout->data);
938 if (ret < 0)
939 return -1;
940 nla_nest_end(skb, nest_params);
941 return 0;
942}
943
944static const struct nla_policy nft_ct_timeout_policy[NFTA_CT_TIMEOUT_MAX + 1] = {
945 [NFTA_CT_TIMEOUT_L3PROTO] = {.type = NLA_U16 },
946 [NFTA_CT_TIMEOUT_L4PROTO] = {.type = NLA_U8 },
947 [NFTA_CT_TIMEOUT_DATA] = {.type = NLA_NESTED },
948};
949
950static struct nft_object_type nft_ct_timeout_obj_type;
951
952static const struct nft_object_ops nft_ct_timeout_obj_ops = {
953 .type = &nft_ct_timeout_obj_type,
954 .size = sizeof(struct nft_ct_timeout_obj),
955 .eval = nft_ct_timeout_obj_eval,
956 .init = nft_ct_timeout_obj_init,
957 .destroy = nft_ct_timeout_obj_destroy,
958 .dump = nft_ct_timeout_obj_dump,
959};
960
961static struct nft_object_type nft_ct_timeout_obj_type __read_mostly = {
962 .type = NFT_OBJECT_CT_TIMEOUT,
963 .ops = &nft_ct_timeout_obj_ops,
964 .maxattr = NFTA_CT_TIMEOUT_MAX,
965 .policy = nft_ct_timeout_policy,
966 .owner = THIS_MODULE,
967};
968#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
969
1a64edf5
FW		 970static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
971 const struct nlattr * const tb[],
972 struct nft_object *obj)
973{
974 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
975 struct nf_conntrack_helper *help4, *help6;
976 char name[NF_CT_HELPER_NAME_LEN];
36596dad 977 int family = ctx->family;
f699edb1 978 int err;
1a64edf5
FW		 979
980 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
981 return -EINVAL;
982
983 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
984 if (!priv->l4proto)
985 return -ENOENT;
986
987 nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
988
989 if (tb[NFTA_CT_HELPER_L3PROTO])
990 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
991
992 help4 = NULL;
993 help6 = NULL;
994
995 switch (family) {
996 case NFPROTO_IPV4:
36596dad 997 if (ctx->family == NFPROTO_IPV6)
1a64edf5
FW		 998 return -EINVAL;
999
1000 help4 = nf_conntrack_helper_try_module_get(name, family,
1001 priv->l4proto);
1002 break;
1003 case NFPROTO_IPV6:
36596dad 1004 if (ctx->family == NFPROTO_IPV4)
1a64edf5
FW		 1005 return -EINVAL;
1006
1007 help6 = nf_conntrack_helper_try_module_get(name, family,
1008 priv->l4proto);
1009 break;
1010 case NFPROTO_NETDEV: /* fallthrough */
1011 case NFPROTO_BRIDGE: /* same */
1012 case NFPROTO_INET:
1013 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
1014 priv->l4proto);
1015 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
1016 priv->l4proto);
1017 break;
1018 default:
1019 return -EAFNOSUPPORT;
1020 }
1021
1022 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
1023 if (!help4 && !help6)
1024 return -ENOENT;
1025
1026 priv->helper4 = help4;
1027 priv->helper6 = help6;
1028
f699edb1
PNA		 1029 err = nf_ct_netns_get(ctx->net, ctx->family);
1030 if (err < 0)
1031 goto err_put_helper;
1032
1a64edf5 1033 return 0;
f699edb1
PNA		 1034
1035err_put_helper:
1036 if (priv->helper4)
1037 nf_conntrack_helper_put(priv->helper4);
1038 if (priv->helper6)
1039 nf_conntrack_helper_put(priv->helper6);
1040 return err;
1a64edf5
FW		 1041}
1042
00bfb320
PNA		 1043static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx,
1044 struct nft_object *obj)
1a64edf5
FW		 1045{
1046 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1047
1048 if (priv->helper4)
d91fc59c 1049 nf_conntrack_helper_put(priv->helper4);
1a64edf5 1050 if (priv->helper6)
d91fc59c 1051 nf_conntrack_helper_put(priv->helper6);
f699edb1
PNA		 1052
1053 nf_ct_netns_put(ctx->net, ctx->family);
1a64edf5
FW		 1054}
1055
1056static void nft_ct_helper_obj_eval(struct nft_object *obj,
1057 struct nft_regs *regs,
1058 const struct nft_pktinfo *pkt)
1059{
1060 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
1061 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
1062 struct nf_conntrack_helper *to_assign = NULL;
1063 struct nf_conn_help *help;
1064
1065 if (!ct ||
1066 nf_ct_is_confirmed(ct) ||
1067 nf_ct_is_template(ct) ||
1068 priv->l4proto != nf_ct_protonum(ct))
1069 return;
1070
1071 switch (nf_ct_l3num(ct)) {
1072 case NFPROTO_IPV4:
1073 to_assign = priv->helper4;
1074 break;
1075 case NFPROTO_IPV6:
1076 to_assign = priv->helper6;
1077 break;
1078 default:
1079 WARN_ON_ONCE(1);
1080 return;
1081 }
1082
1083 if (!to_assign)
1084 return;
1085
1086 if (test_bit(IPS_HELPER_BIT, &ct->status))
1087 return;
1088
440534d3 1089 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1a64edf5
FW		 1090 if (help) {
1091 rcu_assign_pointer(help->helper, to_assign);
1092 set_bit(IPS_HELPER_BIT, &ct->status);
1093 }
1094}
1095
1096static int nft_ct_helper_obj_dump(struct sk_buff *skb,
1097 struct nft_object *obj, bool reset)
1098{
1099 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
b7153458 1100 const struct nf_conntrack_helper *helper;
1a64edf5
FW		 1101 u16 family;
1102
b7153458
TY		 1103 if (priv->helper4 && priv->helper6) {
1104 family = NFPROTO_INET;
1105 helper = priv->helper4;
1106 } else if (priv->helper6) {
1107 family = NFPROTO_IPV6;
1108 helper = priv->helper6;
1109 } else {
1110 family = NFPROTO_IPV4;
1111 helper = priv->helper4;
1112 }
1113
1a64edf5
FW		 1114 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
1115 return -1;
1116
1117 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
1118 return -1;
1119
1a64edf5
FW		 1120 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
1121 return -1;
1122
1123 return 0;
1124}
1125
1126static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
1127 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
1128 .len = NF_CT_HELPER_NAME_LEN - 1 },
1129 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
1130 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
1131};
1132
dfc46034
PBG		 1133static struct nft_object_type nft_ct_helper_obj_type;
1134static const struct nft_object_ops nft_ct_helper_obj_ops = {
1135 .type = &nft_ct_helper_obj_type,
1a64edf5 1136 .size = sizeof(struct nft_ct_helper_obj),
1a64edf5
FW		 1137 .eval = nft_ct_helper_obj_eval,
1138 .init = nft_ct_helper_obj_init,
1139 .destroy = nft_ct_helper_obj_destroy,
1140 .dump = nft_ct_helper_obj_dump,
dfc46034
PBG		 1141};
1142
1143static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
1144 .type = NFT_OBJECT_CT_HELPER,
1145 .ops = &nft_ct_helper_obj_ops,
1146 .maxattr = NFTA_CT_HELPER_MAX,
1147 .policy = nft_ct_helper_policy,
1a64edf5
FW		 1148 .owner = THIS_MODULE,
1149};
1150
96518518
PM		 1151static int __init nft_ct_module_init(void)
1152{
25443261
PNA		 1153 int err;
1154
adff6c65
FW		 1155 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
1156
25443261
PNA		 1157 err = nft_register_expr(&nft_ct_type);
1158 if (err < 0)
1159 return err;
1160
1161 err = nft_register_expr(&nft_notrack_type);
1162 if (err < 0)
1163 goto err1;
1164
dfc46034 1165 err = nft_register_obj(&nft_ct_helper_obj_type);
1a64edf5
FW		 1166 if (err < 0)
1167 goto err2;
7e0b2b57
HS		 1168#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1169 err = nft_register_obj(&nft_ct_timeout_obj_type);
1170 if (err < 0)
1171 goto err3;
1172#endif
25443261 1173 return 0;
1a64edf5 1174
7e0b2b57
HS		 1175#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1176err3:
1177 nft_unregister_obj(&nft_ct_helper_obj_type);
1178#endif
1a64edf5
FW		 1179err2:
1180 nft_unregister_expr(&nft_notrack_type);
25443261
PNA		 1181err1:
1182 nft_unregister_expr(&nft_ct_type);
1183 return err;
96518518
PM		 1184}
1185
1186static void __exit nft_ct_module_exit(void)
1187{
7e0b2b57
HS		 1188#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
1189 nft_unregister_obj(&nft_ct_timeout_obj_type);
1190#endif
dfc46034 1191 nft_unregister_obj(&nft_ct_helper_obj_type);
25443261 1192 nft_unregister_expr(&nft_notrack_type);
ef1f7df9 1193 nft_unregister_expr(&nft_ct_type);
96518518
PM		 1194}
1195
1196module_init(nft_ct_module_init);
1197module_exit(nft_ct_module_exit);
1198
1199MODULE_LICENSE("GPL");
1200MODULE_AUTHOR("Patrick McHardy <[email protected]>");
1201MODULE_ALIAS_NFT_EXPR("ct");
25443261 1202MODULE_ALIAS_NFT_EXPR("notrack");
1a64edf5 1203MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);
7e0b2b57 1204MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_TIMEOUT);
Empty description
This page took 0.608863 seconds and 4 git commands to generate.