]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/netfilter/nf_conntrack_netlink.c
netfilter: ctnetlink: remove nowait parameter from *fill_info()
[mirror_ubuntu-bionic-kernel.git] / net / netfilter / nf_conntrack_netlink.c
CommitLineData
c1d10adb
PNA
1/* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
dc808fe2 5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
c1d10adb 6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
0adf9d67 7 * (C) 2005-2008 by Pablo Neira Ayuso <pablo@netfilter.org>
c1d10adb 8 *
601e68e1 9 * Initial connection tracking via netlink development funded and
c1d10adb
PNA
10 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 *
12 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 *
14 * This software may be used and distributed according to the terms
15 * of the GNU General Public License, incorporated herein by reference.
c1d10adb
PNA
16 */
17
18#include <linux/init.h>
19#include <linux/module.h>
20#include <linux/kernel.h>
711bbdd6 21#include <linux/rculist.h>
ea781f19 22#include <linux/rculist_nulls.h>
c1d10adb
PNA
23#include <linux/types.h>
24#include <linux/timer.h>
25#include <linux/skbuff.h>
26#include <linux/errno.h>
27#include <linux/netlink.h>
28#include <linux/spinlock.h>
40a839fd 29#include <linux/interrupt.h>
c1d10adb
PNA
30#include <linux/notifier.h>
31
32#include <linux/netfilter.h>
dc5fc579 33#include <net/netlink.h>
c1d10adb
PNA
34#include <net/netfilter/nf_conntrack.h>
35#include <net/netfilter/nf_conntrack_core.h>
77ab9cff 36#include <net/netfilter/nf_conntrack_expect.h>
c1d10adb
PNA
37#include <net/netfilter/nf_conntrack_helper.h>
38#include <net/netfilter/nf_conntrack_l3proto.h>
605dcad6 39#include <net/netfilter/nf_conntrack_l4proto.h>
5b1158e9 40#include <net/netfilter/nf_conntrack_tuple.h>
58401572 41#include <net/netfilter/nf_conntrack_acct.h>
5b1158e9
JK
42#ifdef CONFIG_NF_NAT_NEEDED
43#include <net/netfilter/nf_nat_core.h>
44#include <net/netfilter/nf_nat_protocol.h>
45#endif
c1d10adb
PNA
46
47#include <linux/netfilter/nfnetlink.h>
48#include <linux/netfilter/nfnetlink_conntrack.h>
49
50MODULE_LICENSE("GPL");
51
dc808fe2 52static char __initdata version[] = "0.93";
c1d10adb 53
c1d10adb 54static inline int
601e68e1 55ctnetlink_dump_tuples_proto(struct sk_buff *skb,
1cde6436 56 const struct nf_conntrack_tuple *tuple,
605dcad6 57 struct nf_conntrack_l4proto *l4proto)
c1d10adb 58{
c1d10adb 59 int ret = 0;
df6fb868 60 struct nlattr *nest_parms;
c1d10adb 61
df6fb868
PM
62 nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
63 if (!nest_parms)
64 goto nla_put_failure;
77236b6e 65 NLA_PUT_U8(skb, CTA_PROTO_NUM, tuple->dst.protonum);
c1d10adb 66
fdf70832
PM
67 if (likely(l4proto->tuple_to_nlattr))
68 ret = l4proto->tuple_to_nlattr(skb, tuple);
601e68e1 69
df6fb868 70 nla_nest_end(skb, nest_parms);
c1d10adb
PNA
71
72 return ret;
73
df6fb868 74nla_put_failure:
c1d10adb
PNA
75 return -1;
76}
77
78static inline int
1cde6436
PNA
79ctnetlink_dump_tuples_ip(struct sk_buff *skb,
80 const struct nf_conntrack_tuple *tuple,
81 struct nf_conntrack_l3proto *l3proto)
c1d10adb 82{
c1d10adb 83 int ret = 0;
df6fb868
PM
84 struct nlattr *nest_parms;
85
86 nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);
87 if (!nest_parms)
88 goto nla_put_failure;
1cde6436 89
fdf70832
PM
90 if (likely(l3proto->tuple_to_nlattr))
91 ret = l3proto->tuple_to_nlattr(skb, tuple);
1cde6436 92
df6fb868 93 nla_nest_end(skb, nest_parms);
c1d10adb 94
1cde6436
PNA
95 return ret;
96
df6fb868 97nla_put_failure:
1cde6436
PNA
98 return -1;
99}
100
bb5cf80e 101static int
1cde6436
PNA
102ctnetlink_dump_tuples(struct sk_buff *skb,
103 const struct nf_conntrack_tuple *tuple)
104{
105 int ret;
106 struct nf_conntrack_l3proto *l3proto;
605dcad6 107 struct nf_conntrack_l4proto *l4proto;
1cde6436 108
528a3a6f 109 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
1cde6436 110 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
c1d10adb
PNA
111
112 if (unlikely(ret < 0))
113 return ret;
114
528a3a6f 115 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
605dcad6 116 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
c1d10adb
PNA
117
118 return ret;
c1d10adb
PNA
119}
120
121static inline int
122ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
123{
77236b6e 124 NLA_PUT_BE32(skb, CTA_STATUS, htonl(ct->status));
c1d10adb
PNA
125 return 0;
126
df6fb868 127nla_put_failure:
c1d10adb
PNA
128 return -1;
129}
130
131static inline int
132ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
133{
77236b6e 134 long timeout = (ct->timeout.expires - jiffies) / HZ;
c1d10adb 135
77236b6e 136 if (timeout < 0)
c1d10adb 137 timeout = 0;
601e68e1 138
77236b6e 139 NLA_PUT_BE32(skb, CTA_TIMEOUT, htonl(timeout));
c1d10adb
PNA
140 return 0;
141
df6fb868 142nla_put_failure:
c1d10adb
PNA
143 return -1;
144}
145
146static inline int
147ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
148{
5e8fbe2a 149 struct nf_conntrack_l4proto *l4proto;
df6fb868 150 struct nlattr *nest_proto;
c1d10adb
PNA
151 int ret;
152
528a3a6f
PNA
153 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
154 if (!l4proto->to_nlattr)
c1d10adb 155 return 0;
601e68e1 156
df6fb868
PM
157 nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
158 if (!nest_proto)
159 goto nla_put_failure;
c1d10adb 160
fdf70832 161 ret = l4proto->to_nlattr(skb, nest_proto, ct);
c1d10adb 162
df6fb868 163 nla_nest_end(skb, nest_proto);
c1d10adb
PNA
164
165 return ret;
166
df6fb868 167nla_put_failure:
c1d10adb
PNA
168 return -1;
169}
170
171static inline int
172ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
173{
df6fb868 174 struct nlattr *nest_helper;
dc808fe2 175 const struct nf_conn_help *help = nfct_help(ct);
3c158f7f 176 struct nf_conntrack_helper *helper;
c1d10adb 177
3c158f7f 178 if (!help)
c1d10adb 179 return 0;
601e68e1 180
3c158f7f
PM
181 helper = rcu_dereference(help->helper);
182 if (!helper)
183 goto out;
184
df6fb868
PM
185 nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
186 if (!nest_helper)
187 goto nla_put_failure;
77236b6e 188 NLA_PUT_STRING(skb, CTA_HELP_NAME, helper->name);
c1d10adb 189
fdf70832
PM
190 if (helper->to_nlattr)
191 helper->to_nlattr(skb, ct);
c1d10adb 192
df6fb868 193 nla_nest_end(skb, nest_helper);
3c158f7f 194out:
c1d10adb
PNA
195 return 0;
196
df6fb868 197nla_put_failure:
c1d10adb
PNA
198 return -1;
199}
200
bb5cf80e 201static int
c1d10adb
PNA
202ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
203 enum ip_conntrack_dir dir)
204{
205 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
df6fb868 206 struct nlattr *nest_count;
58401572
KPO
207 const struct nf_conn_counter *acct;
208
209 acct = nf_conn_acct_find(ct);
210 if (!acct)
211 return 0;
c1d10adb 212
df6fb868
PM
213 nest_count = nla_nest_start(skb, type | NLA_F_NESTED);
214 if (!nest_count)
215 goto nla_put_failure;
216
58401572
KPO
217 NLA_PUT_BE64(skb, CTA_COUNTERS_PACKETS,
218 cpu_to_be64(acct[dir].packets));
219 NLA_PUT_BE64(skb, CTA_COUNTERS_BYTES,
220 cpu_to_be64(acct[dir].bytes));
c1d10adb 221
df6fb868 222 nla_nest_end(skb, nest_count);
c1d10adb
PNA
223
224 return 0;
225
df6fb868 226nla_put_failure:
c1d10adb
PNA
227 return -1;
228}
c1d10adb
PNA
229
230#ifdef CONFIG_NF_CONNTRACK_MARK
231static inline int
232ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
233{
77236b6e 234 NLA_PUT_BE32(skb, CTA_MARK, htonl(ct->mark));
c1d10adb
PNA
235 return 0;
236
df6fb868 237nla_put_failure:
c1d10adb
PNA
238 return -1;
239}
240#else
241#define ctnetlink_dump_mark(a, b) (0)
242#endif
243
37fccd85
PNA
244#ifdef CONFIG_NF_CONNTRACK_SECMARK
245static inline int
246ctnetlink_dump_secmark(struct sk_buff *skb, const struct nf_conn *ct)
247{
77236b6e 248 NLA_PUT_BE32(skb, CTA_SECMARK, htonl(ct->secmark));
37fccd85
PNA
249 return 0;
250
251nla_put_failure:
252 return -1;
253}
254#else
255#define ctnetlink_dump_secmark(a, b) (0)
256#endif
257
0f417ce9
PNA
258#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
259
260static inline int
261ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)
262{
263 struct nlattr *nest_parms;
264
265 if (!(ct->status & IPS_EXPECTED))
266 return 0;
267
268 nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);
269 if (!nest_parms)
270 goto nla_put_failure;
271 if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
272 goto nla_put_failure;
273 nla_nest_end(skb, nest_parms);
274
275 return 0;
276
277nla_put_failure:
278 return -1;
279}
280
13eae15a 281#ifdef CONFIG_NF_NAT_NEEDED
bb5cf80e 282static int
13eae15a
PNA
283dump_nat_seq_adj(struct sk_buff *skb, const struct nf_nat_seq *natseq, int type)
284{
13eae15a
PNA
285 struct nlattr *nest_parms;
286
287 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
288 if (!nest_parms)
289 goto nla_put_failure;
290
77236b6e
PM
291 NLA_PUT_BE32(skb, CTA_NAT_SEQ_CORRECTION_POS,
292 htonl(natseq->correction_pos));
293 NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
294 htonl(natseq->offset_before));
295 NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
296 htonl(natseq->offset_after));
13eae15a
PNA
297
298 nla_nest_end(skb, nest_parms);
299
300 return 0;
301
302nla_put_failure:
303 return -1;
304}
305
306static inline int
307ctnetlink_dump_nat_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
308{
309 struct nf_nat_seq *natseq;
310 struct nf_conn_nat *nat = nfct_nat(ct);
311
312 if (!(ct->status & IPS_SEQ_ADJUST) || !nat)
313 return 0;
314
315 natseq = &nat->seq[IP_CT_DIR_ORIGINAL];
316 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_ORIG) == -1)
317 return -1;
318
319 natseq = &nat->seq[IP_CT_DIR_REPLY];
320 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_REPLY) == -1)
321 return -1;
322
323 return 0;
324}
325#else
326#define ctnetlink_dump_nat_seq_adj(a, b) (0)
327#endif
328
c1d10adb
PNA
329static inline int
330ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
331{
77236b6e 332 NLA_PUT_BE32(skb, CTA_ID, htonl((unsigned long)ct));
c1d10adb
PNA
333 return 0;
334
df6fb868 335nla_put_failure:
c1d10adb
PNA
336 return -1;
337}
338
339static inline int
340ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
341{
77236b6e 342 NLA_PUT_BE32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use)));
c1d10adb
PNA
343 return 0;
344
df6fb868 345nla_put_failure:
c1d10adb
PNA
346 return -1;
347}
348
349#define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
350
351static int
352ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
8b0a231d 353 int event, const struct nf_conn *ct)
c1d10adb
PNA
354{
355 struct nlmsghdr *nlh;
356 struct nfgenmsg *nfmsg;
df6fb868 357 struct nlattr *nest_parms;
27a884dc 358 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA
359
360 event |= NFNL_SUBSYS_CTNETLINK << 8;
361 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
362 nfmsg = NLMSG_DATA(nlh);
363
8b0a231d 364 nlh->nlmsg_flags = pid ? NLM_F_MULTI : 0;
5e8fbe2a 365 nfmsg->nfgen_family = nf_ct_l3num(ct);
c1d10adb
PNA
366 nfmsg->version = NFNETLINK_V0;
367 nfmsg->res_id = 0;
368
df6fb868
PM
369 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
370 if (!nest_parms)
371 goto nla_put_failure;
c1d10adb 372 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
df6fb868
PM
373 goto nla_put_failure;
374 nla_nest_end(skb, nest_parms);
601e68e1 375
df6fb868
PM
376 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
377 if (!nest_parms)
378 goto nla_put_failure;
c1d10adb 379 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
df6fb868
PM
380 goto nla_put_failure;
381 nla_nest_end(skb, nest_parms);
c1d10adb
PNA
382
383 if (ctnetlink_dump_status(skb, ct) < 0 ||
384 ctnetlink_dump_timeout(skb, ct) < 0 ||
385 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
386 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
387 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
388 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
389 ctnetlink_dump_mark(skb, ct) < 0 ||
37fccd85 390 ctnetlink_dump_secmark(skb, ct) < 0 ||
c1d10adb 391 ctnetlink_dump_id(skb, ct) < 0 ||
13eae15a 392 ctnetlink_dump_use(skb, ct) < 0 ||
0f417ce9 393 ctnetlink_dump_master(skb, ct) < 0 ||
13eae15a 394 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
df6fb868 395 goto nla_put_failure;
c1d10adb 396
27a884dc 397 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA
398 return skb->len;
399
400nlmsg_failure:
df6fb868 401nla_put_failure:
dc5fc579 402 nlmsg_trim(skb, b);
c1d10adb
PNA
403 return -1;
404}
405
406#ifdef CONFIG_NF_CONNTRACK_EVENTS
2732c4e4
HE
407/*
408 * The general structure of a ctnetlink event is
409 *
410 * CTA_TUPLE_ORIG
411 * <l3/l4-proto-attributes>
412 * CTA_TUPLE_REPLY
413 * <l3/l4-proto-attributes>
414 * CTA_ID
415 * ...
416 * CTA_PROTOINFO
417 * <l4-proto-attributes>
418 * CTA_TUPLE_MASTER
419 * <l3/l4-proto-attributes>
420 *
421 * Therefore the formular is
422 *
423 * size = sizeof(headers) + sizeof(generic_nlas) + 3 * sizeof(tuple_nlas)
424 * + sizeof(protoinfo_nlas)
425 */
426static struct sk_buff *
427ctnetlink_alloc_skb(const struct nf_conntrack_tuple *tuple, gfp_t gfp)
428{
429 struct nf_conntrack_l3proto *l3proto;
430 struct nf_conntrack_l4proto *l4proto;
431 int len;
432
433#define NLA_TYPE_SIZE(type) nla_total_size(sizeof(type))
434
435 /* proto independant part */
436 len = NLMSG_SPACE(sizeof(struct nfgenmsg))
437 + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
438 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
439 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
440 + 3 * NLA_TYPE_SIZE(u_int8_t) /* CTA_PROTO_NUM */
441 + NLA_TYPE_SIZE(u_int32_t) /* CTA_ID */
442 + NLA_TYPE_SIZE(u_int32_t) /* CTA_STATUS */
d271e8bd 443#ifdef CONFIG_NF_CT_ACCT
2732c4e4
HE
444 + 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */
445 + 2 * NLA_TYPE_SIZE(uint64_t) /* CTA_COUNTERS_PACKETS */
446 + 2 * NLA_TYPE_SIZE(uint64_t) /* CTA_COUNTERS_BYTES */
d271e8bd 447#endif
2732c4e4
HE
448 + NLA_TYPE_SIZE(u_int32_t) /* CTA_TIMEOUT */
449 + nla_total_size(0) /* CTA_PROTOINFO */
450 + nla_total_size(0) /* CTA_HELP */
451 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
d271e8bd 452#ifdef CONFIG_NF_CONNTRACK_SECMARK
2732c4e4 453 + NLA_TYPE_SIZE(u_int32_t) /* CTA_SECMARK */
d271e8bd
HE
454#endif
455#ifdef CONFIG_NF_NAT_NEEDED
2732c4e4
HE
456 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
457 + 2 * NLA_TYPE_SIZE(u_int32_t) /* CTA_NAT_SEQ_CORRECTION_POS */
458 + 2 * NLA_TYPE_SIZE(u_int32_t) /* CTA_NAT_SEQ_CORRECTION_BEFORE */
459 + 2 * NLA_TYPE_SIZE(u_int32_t) /* CTA_NAT_SEQ_CORRECTION_AFTER */
d271e8bd
HE
460#endif
461#ifdef CONFIG_NF_CONNTRACK_MARK
462 + NLA_TYPE_SIZE(u_int32_t) /* CTA_MARK */
463#endif
464 ;
2732c4e4
HE
465
466#undef NLA_TYPE_SIZE
467
468 rcu_read_lock();
469 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
470 len += l3proto->nla_size;
471
472 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
473 len += l4proto->nla_size;
474 rcu_read_unlock();
475
476 return alloc_skb(len, gfp);
477}
478
c1d10adb 479static int ctnetlink_conntrack_event(struct notifier_block *this,
601e68e1 480 unsigned long events, void *ptr)
c1d10adb
PNA
481{
482 struct nlmsghdr *nlh;
483 struct nfgenmsg *nfmsg;
df6fb868 484 struct nlattr *nest_parms;
19abb7b0
PNA
485 struct nf_ct_event *item = (struct nf_ct_event *)ptr;
486 struct nf_conn *ct = item->ct;
c1d10adb
PNA
487 struct sk_buff *skb;
488 unsigned int type;
27a884dc 489 sk_buff_data_t b;
c1d10adb
PNA
490 unsigned int flags = 0, group;
491
492 /* ignore our fake conntrack entry */
493 if (ct == &nf_conntrack_untracked)
494 return NOTIFY_DONE;
495
496 if (events & IPCT_DESTROY) {
497 type = IPCTNL_MSG_CT_DELETE;
498 group = NFNLGRP_CONNTRACK_DESTROY;
499 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
500 type = IPCTNL_MSG_CT_NEW;
501 flags = NLM_F_CREATE|NLM_F_EXCL;
c1d10adb 502 group = NFNLGRP_CONNTRACK_NEW;
1a31526b 503 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
c1d10adb
PNA
504 type = IPCTNL_MSG_CT_NEW;
505 group = NFNLGRP_CONNTRACK_UPDATE;
506 } else
507 return NOTIFY_DONE;
a2427692 508
1f9da256 509 if (!item->report && !nfnetlink_has_listeners(group))
a2427692
PM
510 return NOTIFY_DONE;
511
2732c4e4 512 skb = ctnetlink_alloc_skb(tuple(ct, IP_CT_DIR_ORIGINAL), GFP_ATOMIC);
c1d10adb 513 if (!skb)
150ace0d 514 goto errout;
c1d10adb
PNA
515
516 b = skb->tail;
517
518 type |= NFNL_SUBSYS_CTNETLINK << 8;
19abb7b0 519 nlh = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
c1d10adb
PNA
520 nfmsg = NLMSG_DATA(nlh);
521
522 nlh->nlmsg_flags = flags;
5e8fbe2a 523 nfmsg->nfgen_family = nf_ct_l3num(ct);
c1d10adb
PNA
524 nfmsg->version = NFNETLINK_V0;
525 nfmsg->res_id = 0;
526
528a3a6f 527 rcu_read_lock();
df6fb868
PM
528 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
529 if (!nest_parms)
530 goto nla_put_failure;
c1d10adb 531 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
df6fb868
PM
532 goto nla_put_failure;
533 nla_nest_end(skb, nest_parms);
601e68e1 534
df6fb868
PM
535 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
536 if (!nest_parms)
537 goto nla_put_failure;
c1d10adb 538 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
df6fb868
PM
539 goto nla_put_failure;
540 nla_nest_end(skb, nest_parms);
c1d10adb 541
1eedf699
EL
542 if (ctnetlink_dump_id(skb, ct) < 0)
543 goto nla_put_failure;
544
e57dce60
FH
545 if (ctnetlink_dump_status(skb, ct) < 0)
546 goto nla_put_failure;
547
7b621c1e
PNA
548 if (events & IPCT_DESTROY) {
549 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
550 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
df6fb868 551 goto nla_put_failure;
7b621c1e 552 } else {
7b621c1e 553 if (ctnetlink_dump_timeout(skb, ct) < 0)
df6fb868 554 goto nla_put_failure;
7b621c1e
PNA
555
556 if (events & IPCT_PROTOINFO
557 && ctnetlink_dump_protoinfo(skb, ct) < 0)
df6fb868 558 goto nla_put_failure;
7b621c1e
PNA
559
560 if ((events & IPCT_HELPER || nfct_help(ct))
561 && ctnetlink_dump_helpinfo(skb, ct) < 0)
df6fb868 562 goto nla_put_failure;
7b621c1e 563
37fccd85
PNA
564#ifdef CONFIG_NF_CONNTRACK_SECMARK
565 if ((events & IPCT_SECMARK || ct->secmark)
566 && ctnetlink_dump_secmark(skb, ct) < 0)
567 goto nla_put_failure;
568#endif
7b621c1e 569
0f417ce9
PNA
570 if (events & IPCT_RELATED &&
571 ctnetlink_dump_master(skb, ct) < 0)
572 goto nla_put_failure;
573
13eae15a
PNA
574 if (events & IPCT_NATSEQADJ &&
575 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
576 goto nla_put_failure;
7b621c1e 577 }
b9a37e0c 578
a83099a6
EL
579#ifdef CONFIG_NF_CONNTRACK_MARK
580 if ((events & IPCT_MARK || ct->mark)
581 && ctnetlink_dump_mark(skb, ct) < 0)
582 goto nla_put_failure;
583#endif
528a3a6f 584 rcu_read_unlock();
a83099a6 585
c1d10adb 586 nlh->nlmsg_len = skb->tail - b;
19abb7b0 587 nfnetlink_send(skb, item->pid, group, item->report);
c1d10adb
PNA
588 return NOTIFY_DONE;
589
df6fb868 590nla_put_failure:
528a3a6f
PNA
591 rcu_read_unlock();
592nlmsg_failure:
c1d10adb 593 kfree_skb(skb);
150ace0d
PNA
594errout:
595 nfnetlink_set_err(0, group, -ENOBUFS);
c1d10adb
PNA
596 return NOTIFY_DONE;
597}
598#endif /* CONFIG_NF_CONNTRACK_EVENTS */
599
600static int ctnetlink_done(struct netlink_callback *cb)
601{
89f2e218
PM
602 if (cb->args[1])
603 nf_ct_put((struct nf_conn *)cb->args[1]);
c1d10adb
PNA
604 return 0;
605}
606
607static int
608ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
609{
89f2e218 610 struct nf_conn *ct, *last;
c1d10adb 611 struct nf_conntrack_tuple_hash *h;
ea781f19 612 struct hlist_nulls_node *n;
87711cb8
PNA
613 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
614 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 615
76507f69 616 rcu_read_lock();
d205dc40 617 last = (struct nf_conn *)cb->args[1];
89f2e218
PM
618 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
619restart:
ea781f19
ED
620 hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
621 hnnode) {
5b1158e9 622 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
c1d10adb
PNA
623 continue;
624 ct = nf_ct_tuplehash_to_ctrack(h);
ea781f19
ED
625 if (!atomic_inc_not_zero(&ct->ct_general.use))
626 continue;
87711cb8
PNA
627 /* Dump entries of a given L3 protocol number.
628 * If it is not specified, ie. l3proto == 0,
629 * then dump everything. */
5e8fbe2a 630 if (l3proto && nf_ct_l3num(ct) != l3proto)
ea781f19 631 goto releasect;
d205dc40
PM
632 if (cb->args[1]) {
633 if (ct != last)
ea781f19 634 goto releasect;
d205dc40 635 cb->args[1] = 0;
89f2e218 636 }
c1d10adb 637 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
601e68e1 638 cb->nlh->nlmsg_seq,
8b0a231d 639 IPCTNL_MSG_CT_NEW, ct) < 0) {
89f2e218 640 cb->args[1] = (unsigned long)ct;
c1d10adb 641 goto out;
89f2e218 642 }
58401572 643
01f34848 644 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
58401572
KPO
645 IPCTNL_MSG_CT_GET_CTRZERO) {
646 struct nf_conn_counter *acct;
647
648 acct = nf_conn_acct_find(ct);
649 if (acct)
650 memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));
651 }
ea781f19
ED
652releasect:
653 nf_ct_put(ct);
89f2e218 654 }
d205dc40 655 if (cb->args[1]) {
89f2e218
PM
656 cb->args[1] = 0;
657 goto restart;
c1d10adb
PNA
658 }
659 }
89f2e218 660out:
76507f69 661 rcu_read_unlock();
d205dc40
PM
662 if (last)
663 nf_ct_put(last);
c1d10adb 664
c1d10adb
PNA
665 return skb->len;
666}
667
c1d10adb 668static inline int
df6fb868 669ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)
c1d10adb 670{
df6fb868 671 struct nlattr *tb[CTA_IP_MAX+1];
c1d10adb
PNA
672 struct nf_conntrack_l3proto *l3proto;
673 int ret = 0;
674
df6fb868 675 nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
c1d10adb 676
cd91566e
FW
677 rcu_read_lock();
678 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
c1d10adb 679
f73e924c
PM
680 if (likely(l3proto->nlattr_to_tuple)) {
681 ret = nla_validate_nested(attr, CTA_IP_MAX,
682 l3proto->nla_policy);
683 if (ret == 0)
684 ret = l3proto->nlattr_to_tuple(tb, tuple);
685 }
c1d10adb 686
cd91566e 687 rcu_read_unlock();
c1d10adb 688
c1d10adb
PNA
689 return ret;
690}
691
f73e924c
PM
692static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
693 [CTA_PROTO_NUM] = { .type = NLA_U8 },
c1d10adb
PNA
694};
695
696static inline int
df6fb868 697ctnetlink_parse_tuple_proto(struct nlattr *attr,
c1d10adb
PNA
698 struct nf_conntrack_tuple *tuple)
699{
df6fb868 700 struct nlattr *tb[CTA_PROTO_MAX+1];
605dcad6 701 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA
702 int ret = 0;
703
f73e924c
PM
704 ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);
705 if (ret < 0)
706 return ret;
c1d10adb 707
df6fb868 708 if (!tb[CTA_PROTO_NUM])
c1d10adb 709 return -EINVAL;
77236b6e 710 tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);
c1d10adb 711
cd91566e
FW
712 rcu_read_lock();
713 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
c1d10adb 714
f73e924c
PM
715 if (likely(l4proto->nlattr_to_tuple)) {
716 ret = nla_validate_nested(attr, CTA_PROTO_MAX,
717 l4proto->nla_policy);
718 if (ret == 0)
719 ret = l4proto->nlattr_to_tuple(tb, tuple);
720 }
c1d10adb 721
cd91566e 722 rcu_read_unlock();
601e68e1 723
c1d10adb
PNA
724 return ret;
725}
726
bb5cf80e 727static int
df6fb868 728ctnetlink_parse_tuple(struct nlattr *cda[], struct nf_conntrack_tuple *tuple,
c1d10adb
PNA
729 enum ctattr_tuple type, u_int8_t l3num)
730{
df6fb868 731 struct nlattr *tb[CTA_TUPLE_MAX+1];
c1d10adb
PNA
732 int err;
733
c1d10adb
PNA
734 memset(tuple, 0, sizeof(*tuple));
735
df6fb868 736 nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], NULL);
c1d10adb 737
df6fb868 738 if (!tb[CTA_TUPLE_IP])
c1d10adb
PNA
739 return -EINVAL;
740
741 tuple->src.l3num = l3num;
742
df6fb868 743 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
c1d10adb
PNA
744 if (err < 0)
745 return err;
746
df6fb868 747 if (!tb[CTA_TUPLE_PROTO])
c1d10adb
PNA
748 return -EINVAL;
749
df6fb868 750 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);
c1d10adb
PNA
751 if (err < 0)
752 return err;
753
754 /* orig and expect tuples get DIR_ORIGINAL */
755 if (type == CTA_TUPLE_REPLY)
756 tuple->dst.dir = IP_CT_DIR_REPLY;
757 else
758 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
759
c1d10adb
PNA
760 return 0;
761}
762
c1d10adb 763static inline int
df6fb868 764ctnetlink_parse_help(struct nlattr *attr, char **helper_name)
c1d10adb 765{
df6fb868 766 struct nlattr *tb[CTA_HELP_MAX+1];
c1d10adb 767
df6fb868 768 nla_parse_nested(tb, CTA_HELP_MAX, attr, NULL);
c1d10adb 769
df6fb868 770 if (!tb[CTA_HELP_NAME])
c1d10adb
PNA
771 return -EINVAL;
772
df6fb868 773 *helper_name = nla_data(tb[CTA_HELP_NAME]);
c1d10adb
PNA
774
775 return 0;
776}
777
f73e924c
PM
778static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
779 [CTA_STATUS] = { .type = NLA_U32 },
780 [CTA_TIMEOUT] = { .type = NLA_U32 },
781 [CTA_MARK] = { .type = NLA_U32 },
782 [CTA_USE] = { .type = NLA_U32 },
783 [CTA_ID] = { .type = NLA_U32 },
c1d10adb
PNA
784};
785
786static int
601e68e1 787ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
df6fb868 788 struct nlmsghdr *nlh, struct nlattr *cda[])
c1d10adb
PNA
789{
790 struct nf_conntrack_tuple_hash *h;
791 struct nf_conntrack_tuple tuple;
792 struct nf_conn *ct;
793 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
794 u_int8_t u3 = nfmsg->nfgen_family;
795 int err = 0;
796
df6fb868 797 if (cda[CTA_TUPLE_ORIG])
c1d10adb 798 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
df6fb868 799 else if (cda[CTA_TUPLE_REPLY])
c1d10adb
PNA
800 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
801 else {
802 /* Flush the whole table */
19abb7b0
PNA
803 nf_conntrack_flush(&init_net,
804 NETLINK_CB(skb).pid,
805 nlmsg_report(nlh));
c1d10adb
PNA
806 return 0;
807 }
808
809 if (err < 0)
810 return err;
811
400dad39 812 h = nf_conntrack_find_get(&init_net, &tuple);
9ea8cfd6 813 if (!h)
c1d10adb 814 return -ENOENT;
c1d10adb
PNA
815
816 ct = nf_ct_tuplehash_to_ctrack(h);
601e68e1 817
df6fb868 818 if (cda[CTA_ID]) {
77236b6e 819 u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
7f85f914 820 if (id != (u32)(unsigned long)ct) {
c1d10adb
PNA
821 nf_ct_put(ct);
822 return -ENOENT;
823 }
601e68e1 824 }
c1d10adb 825
19abb7b0
PNA
826 nf_conntrack_event_report(IPCT_DESTROY,
827 ct,
828 NETLINK_CB(skb).pid,
829 nlmsg_report(nlh));
830
831 /* death_by_timeout would report the event again */
832 set_bit(IPS_DYING_BIT, &ct->status);
833
51091764 834 nf_ct_kill(ct);
c1d10adb 835 nf_ct_put(ct);
c1d10adb
PNA
836
837 return 0;
838}
839
840static int
601e68e1 841ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
df6fb868 842 struct nlmsghdr *nlh, struct nlattr *cda[])
c1d10adb
PNA
843{
844 struct nf_conntrack_tuple_hash *h;
845 struct nf_conntrack_tuple tuple;
846 struct nf_conn *ct;
847 struct sk_buff *skb2 = NULL;
848 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
849 u_int8_t u3 = nfmsg->nfgen_family;
850 int err = 0;
851
58401572 852 if (nlh->nlmsg_flags & NLM_F_DUMP)
c702e804
TG
853 return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
854 ctnetlink_done);
c1d10adb 855
df6fb868 856 if (cda[CTA_TUPLE_ORIG])
c1d10adb 857 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
df6fb868 858 else if (cda[CTA_TUPLE_REPLY])
c1d10adb
PNA
859 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
860 else
861 return -EINVAL;
862
863 if (err < 0)
864 return err;
865
400dad39 866 h = nf_conntrack_find_get(&init_net, &tuple);
9ea8cfd6 867 if (!h)
c1d10adb 868 return -ENOENT;
9ea8cfd6 869
c1d10adb
PNA
870 ct = nf_ct_tuplehash_to_ctrack(h);
871
872 err = -ENOMEM;
873 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
874 if (!skb2) {
875 nf_ct_put(ct);
876 return -ENOMEM;
877 }
c1d10adb 878
528a3a6f 879 rcu_read_lock();
601e68e1 880 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
8b0a231d 881 IPCTNL_MSG_CT_NEW, ct);
528a3a6f 882 rcu_read_unlock();
c1d10adb
PNA
883 nf_ct_put(ct);
884 if (err <= 0)
885 goto free;
886
887 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
888 if (err < 0)
889 goto out;
890
c1d10adb
PNA
891 return 0;
892
893free:
894 kfree_skb(skb2);
895out:
896 return err;
897}
898
67671841 899#ifdef CONFIG_NF_NAT_NEEDED
e6a7d3c0
PNA
900static int
901ctnetlink_parse_nat_setup(struct nf_conn *ct,
902 enum nf_nat_manip_type manip,
903 struct nlattr *attr)
904{
905 typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;
906
907 parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);
908 if (!parse_nat_setup) {
95a5afca 909#ifdef CONFIG_MODULES
e6a7d3c0 910 rcu_read_unlock();
748085fc 911 spin_unlock_bh(&nf_conntrack_lock);
e6a7d3c0
PNA
912 nfnl_unlock();
913 if (request_module("nf-nat-ipv4") < 0) {
914 nfnl_lock();
748085fc 915 spin_lock_bh(&nf_conntrack_lock);
e6a7d3c0
PNA
916 rcu_read_lock();
917 return -EOPNOTSUPP;
918 }
919 nfnl_lock();
748085fc 920 spin_lock_bh(&nf_conntrack_lock);
e6a7d3c0
PNA
921 rcu_read_lock();
922 if (nfnetlink_parse_nat_setup_hook)
923 return -EAGAIN;
924#endif
925 return -EOPNOTSUPP;
926 }
927
928 return parse_nat_setup(ct, manip, attr);
929}
67671841 930#endif
e6a7d3c0 931
bb5cf80e 932static int
df6fb868 933ctnetlink_change_status(struct nf_conn *ct, struct nlattr *cda[])
c1d10adb
PNA
934{
935 unsigned long d;
77236b6e 936 unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
c1d10adb
PNA
937 d = ct->status ^ status;
938
939 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
940 /* unchangeable */
0adf9d67 941 return -EBUSY;
601e68e1 942
c1d10adb
PNA
943 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
944 /* SEEN_REPLY bit can only be set */
0adf9d67 945 return -EBUSY;
601e68e1 946
c1d10adb
PNA
947 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
948 /* ASSURED bit can only be set */
0adf9d67 949 return -EBUSY;
c1d10adb 950
c1d10adb
PNA
951 /* Be careful here, modifying NAT bits can screw up things,
952 * so don't let users modify them directly if they don't pass
5b1158e9 953 * nf_nat_range. */
c1d10adb
PNA
954 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
955 return 0;
956}
957
e6a7d3c0
PNA
958static int
959ctnetlink_change_nat(struct nf_conn *ct, struct nlattr *cda[])
960{
961#ifdef CONFIG_NF_NAT_NEEDED
962 int ret;
963
964 if (cda[CTA_NAT_DST]) {
965 ret = ctnetlink_parse_nat_setup(ct,
966 IP_NAT_MANIP_DST,
967 cda[CTA_NAT_DST]);
968 if (ret < 0)
969 return ret;
970 }
971 if (cda[CTA_NAT_SRC]) {
972 ret = ctnetlink_parse_nat_setup(ct,
973 IP_NAT_MANIP_SRC,
974 cda[CTA_NAT_SRC]);
975 if (ret < 0)
976 return ret;
977 }
978 return 0;
979#else
980 return -EOPNOTSUPP;
981#endif
982}
c1d10adb
PNA
983
984static inline int
df6fb868 985ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
c1d10adb
PNA
986{
987 struct nf_conntrack_helper *helper;
dc808fe2 988 struct nf_conn_help *help = nfct_help(ct);
29fe1b48 989 char *helpname = NULL;
c1d10adb
PNA
990 int err;
991
c1d10adb
PNA
992 /* don't change helper of sibling connections */
993 if (ct->master)
0adf9d67 994 return -EBUSY;
c1d10adb 995
df6fb868 996 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
c1d10adb
PNA
997 if (err < 0)
998 return err;
999
df293bbb
YK
1000 if (!strcmp(helpname, "")) {
1001 if (help && help->helper) {
c1d10adb
PNA
1002 /* we had a helper before ... */
1003 nf_ct_remove_expectations(ct);
3c158f7f 1004 rcu_assign_pointer(help->helper, NULL);
c1d10adb 1005 }
df293bbb
YK
1006
1007 return 0;
c1d10adb 1008 }
601e68e1 1009
df293bbb 1010 helper = __nf_conntrack_helper_find_byname(helpname);
226c0c0e
PNA
1011 if (helper == NULL) {
1012#ifdef CONFIG_MODULES
1013 spin_unlock_bh(&nf_conntrack_lock);
1014
1015 if (request_module("nfct-helper-%s", helpname) < 0) {
1016 spin_lock_bh(&nf_conntrack_lock);
1017 return -EOPNOTSUPP;
1018 }
1019
1020 spin_lock_bh(&nf_conntrack_lock);
1021 helper = __nf_conntrack_helper_find_byname(helpname);
1022 if (helper)
1023 return -EAGAIN;
1024#endif
0adf9d67 1025 return -EOPNOTSUPP;
226c0c0e 1026 }
df293bbb 1027
ceceae1b
YK
1028 if (help) {
1029 if (help->helper == helper)
1030 return 0;
1031 if (help->helper)
1032 return -EBUSY;
1033 /* need to zero data of old helper */
1034 memset(&help->help, 0, sizeof(help->help));
1035 } else {
fab00c5d 1036 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
ceceae1b
YK
1037 if (help == NULL)
1038 return -ENOMEM;
1039 }
df293bbb 1040
3c158f7f 1041 rcu_assign_pointer(help->helper, helper);
c1d10adb
PNA
1042
1043 return 0;
1044}
1045
1046static inline int
df6fb868 1047ctnetlink_change_timeout(struct nf_conn *ct, struct nlattr *cda[])
c1d10adb 1048{
77236b6e 1049 u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
601e68e1 1050
c1d10adb
PNA
1051 if (!del_timer(&ct->timeout))
1052 return -ETIME;
1053
1054 ct->timeout.expires = jiffies + timeout * HZ;
1055 add_timer(&ct->timeout);
1056
1057 return 0;
1058}
1059
1060static inline int
df6fb868 1061ctnetlink_change_protoinfo(struct nf_conn *ct, struct nlattr *cda[])
c1d10adb 1062{
df6fb868 1063 struct nlattr *tb[CTA_PROTOINFO_MAX+1], *attr = cda[CTA_PROTOINFO];
605dcad6 1064 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA
1065 int err = 0;
1066
df6fb868 1067 nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, NULL);
c1d10adb 1068
cd91566e
FW
1069 rcu_read_lock();
1070 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
fdf70832
PM
1071 if (l4proto->from_nlattr)
1072 err = l4proto->from_nlattr(tb, ct);
cd91566e 1073 rcu_read_unlock();
c1d10adb
PNA
1074
1075 return err;
1076}
1077
13eae15a
PNA
1078#ifdef CONFIG_NF_NAT_NEEDED
1079static inline int
1080change_nat_seq_adj(struct nf_nat_seq *natseq, struct nlattr *attr)
1081{
1082 struct nlattr *cda[CTA_NAT_SEQ_MAX+1];
1083
1084 nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, NULL);
1085
1086 if (!cda[CTA_NAT_SEQ_CORRECTION_POS])
1087 return -EINVAL;
1088
1089 natseq->correction_pos =
77236b6e 1090 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_CORRECTION_POS]));
13eae15a
PNA
1091
1092 if (!cda[CTA_NAT_SEQ_OFFSET_BEFORE])
1093 return -EINVAL;
1094
1095 natseq->offset_before =
77236b6e 1096 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_BEFORE]));
13eae15a
PNA
1097
1098 if (!cda[CTA_NAT_SEQ_OFFSET_AFTER])
1099 return -EINVAL;
1100
1101 natseq->offset_after =
77236b6e 1102 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_AFTER]));
13eae15a
PNA
1103
1104 return 0;
1105}
1106
1107static int
1108ctnetlink_change_nat_seq_adj(struct nf_conn *ct, struct nlattr *cda[])
1109{
1110 int ret = 0;
1111 struct nf_conn_nat *nat = nfct_nat(ct);
1112
1113 if (!nat)
1114 return 0;
1115
1116 if (cda[CTA_NAT_SEQ_ADJ_ORIG]) {
1117 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_ORIGINAL],
1118 cda[CTA_NAT_SEQ_ADJ_ORIG]);
1119 if (ret < 0)
1120 return ret;
1121
1122 ct->status |= IPS_SEQ_ADJUST;
1123 }
1124
1125 if (cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1126 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_REPLY],
1127 cda[CTA_NAT_SEQ_ADJ_REPLY]);
1128 if (ret < 0)
1129 return ret;
1130
1131 ct->status |= IPS_SEQ_ADJUST;
1132 }
1133
1134 return 0;
1135}
1136#endif
1137
c1d10adb 1138static int
df6fb868 1139ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
c1d10adb
PNA
1140{
1141 int err;
1142
e098360f
PNA
1143 /* only allow NAT changes and master assignation for new conntracks */
1144 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])
1145 return -EOPNOTSUPP;
1146
df6fb868 1147 if (cda[CTA_HELP]) {
c1d10adb
PNA
1148 err = ctnetlink_change_helper(ct, cda);
1149 if (err < 0)
1150 return err;
1151 }
1152
df6fb868 1153 if (cda[CTA_TIMEOUT]) {
c1d10adb
PNA
1154 err = ctnetlink_change_timeout(ct, cda);
1155 if (err < 0)
1156 return err;
1157 }
1158
df6fb868 1159 if (cda[CTA_STATUS]) {
c1d10adb
PNA
1160 err = ctnetlink_change_status(ct, cda);
1161 if (err < 0)
1162 return err;
1163 }
1164
df6fb868 1165 if (cda[CTA_PROTOINFO]) {
c1d10adb
PNA
1166 err = ctnetlink_change_protoinfo(ct, cda);
1167 if (err < 0)
1168 return err;
1169 }
1170
bcd1e830 1171#if defined(CONFIG_NF_CONNTRACK_MARK)
df6fb868 1172 if (cda[CTA_MARK])
77236b6e 1173 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
c1d10adb
PNA
1174#endif
1175
13eae15a
PNA
1176#ifdef CONFIG_NF_NAT_NEEDED
1177 if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1178 err = ctnetlink_change_nat_seq_adj(ct, cda);
1179 if (err < 0)
1180 return err;
1181 }
1182#endif
1183
c1d10adb
PNA
1184 return 0;
1185}
1186
f0a3c086 1187static struct nf_conn *
df6fb868 1188ctnetlink_create_conntrack(struct nlattr *cda[],
c1d10adb 1189 struct nf_conntrack_tuple *otuple,
5faa1f4c 1190 struct nf_conntrack_tuple *rtuple,
7ec47496 1191 u8 u3)
c1d10adb
PNA
1192{
1193 struct nf_conn *ct;
1194 int err = -EINVAL;
ceceae1b 1195 struct nf_conntrack_helper *helper;
c1d10adb 1196
b54ad409 1197 ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
cd7fcbf1 1198 if (IS_ERR(ct))
f0a3c086 1199 return ERR_PTR(-ENOMEM);
c1d10adb 1200
df6fb868 1201 if (!cda[CTA_TIMEOUT])
0f5b3e85 1202 goto err1;
77236b6e 1203 ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
c1d10adb
PNA
1204
1205 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
1206 ct->status |= IPS_CONFIRMED;
1207
1575e7ea 1208 rcu_read_lock();
226c0c0e 1209 if (cda[CTA_HELP]) {
29fe1b48 1210 char *helpname = NULL;
226c0c0e
PNA
1211
1212 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
0f5b3e85
PM
1213 if (err < 0)
1214 goto err2;
226c0c0e
PNA
1215
1216 helper = __nf_conntrack_helper_find_byname(helpname);
1217 if (helper == NULL) {
1218 rcu_read_unlock();
1219#ifdef CONFIG_MODULES
1220 if (request_module("nfct-helper-%s", helpname) < 0) {
1221 err = -EOPNOTSUPP;
0f5b3e85 1222 goto err1;
226c0c0e
PNA
1223 }
1224
1225 rcu_read_lock();
1226 helper = __nf_conntrack_helper_find_byname(helpname);
1227 if (helper) {
226c0c0e 1228 err = -EAGAIN;
0f5b3e85 1229 goto err2;
226c0c0e
PNA
1230 }
1231 rcu_read_unlock();
1232#endif
1233 err = -EOPNOTSUPP;
0f5b3e85 1234 goto err1;
226c0c0e
PNA
1235 } else {
1236 struct nf_conn_help *help;
1237
1238 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1239 if (help == NULL) {
226c0c0e 1240 err = -ENOMEM;
0f5b3e85 1241 goto err2;
226c0c0e
PNA
1242 }
1243
1244 /* not in hash table yet so not strictly necessary */
1245 rcu_assign_pointer(help->helper, helper);
1246 }
1247 } else {
1248 /* try an implicit helper assignation */
1249 err = __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
0f5b3e85
PM
1250 if (err < 0)
1251 goto err2;
1575e7ea
PNA
1252 }
1253
df6fb868 1254 if (cda[CTA_STATUS]) {
bbb3357d 1255 err = ctnetlink_change_status(ct, cda);
0f5b3e85
PM
1256 if (err < 0)
1257 goto err2;
e6a7d3c0
PNA
1258 }
1259
1260 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
1261 err = ctnetlink_change_nat(ct, cda);
0f5b3e85
PM
1262 if (err < 0)
1263 goto err2;
bbb3357d 1264 }
c1d10adb 1265
c969aa7d
PNA
1266#ifdef CONFIG_NF_NAT_NEEDED
1267 if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1268 err = ctnetlink_change_nat_seq_adj(ct, cda);
0f5b3e85
PM
1269 if (err < 0)
1270 goto err2;
c969aa7d
PNA
1271 }
1272#endif
1273
df6fb868 1274 if (cda[CTA_PROTOINFO]) {
c1d10adb 1275 err = ctnetlink_change_protoinfo(ct, cda);
0f5b3e85
PM
1276 if (err < 0)
1277 goto err2;
c1d10adb
PNA
1278 }
1279
3ec19255 1280 nf_ct_acct_ext_add(ct, GFP_ATOMIC);
58401572 1281
bcd1e830 1282#if defined(CONFIG_NF_CONNTRACK_MARK)
df6fb868 1283 if (cda[CTA_MARK])
77236b6e 1284 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
c1d10adb
PNA
1285#endif
1286
5faa1f4c 1287 /* setup master conntrack: this is a confirmed expectation */
7ec47496
PNA
1288 if (cda[CTA_TUPLE_MASTER]) {
1289 struct nf_conntrack_tuple master;
1290 struct nf_conntrack_tuple_hash *master_h;
1291 struct nf_conn *master_ct;
1292
1293 err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);
1294 if (err < 0)
0f5b3e85 1295 goto err2;
7ec47496 1296
ea781f19 1297 master_h = nf_conntrack_find_get(&init_net, &master);
7ec47496
PNA
1298 if (master_h == NULL) {
1299 err = -ENOENT;
0f5b3e85 1300 goto err2;
7ec47496
PNA
1301 }
1302 master_ct = nf_ct_tuplehash_to_ctrack(master_h);
f2a89004 1303 __set_bit(IPS_EXPECTED_BIT, &ct->status);
5faa1f4c 1304 ct->master = master_ct;
f2a89004 1305 }
5faa1f4c 1306
c1d10adb
PNA
1307 add_timer(&ct->timeout);
1308 nf_conntrack_hash_insert(ct);
58a3c9bb 1309 rcu_read_unlock();
dafc741c 1310
f0a3c086 1311 return ct;
c1d10adb 1312
0f5b3e85
PM
1313err2:
1314 rcu_read_unlock();
1315err1:
c1d10adb 1316 nf_conntrack_free(ct);
f0a3c086 1317 return ERR_PTR(err);
c1d10adb
PNA
1318}
1319
601e68e1
YH
1320static int
1321ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
df6fb868 1322 struct nlmsghdr *nlh, struct nlattr *cda[])
c1d10adb
PNA
1323{
1324 struct nf_conntrack_tuple otuple, rtuple;
1325 struct nf_conntrack_tuple_hash *h = NULL;
1326 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1327 u_int8_t u3 = nfmsg->nfgen_family;
1328 int err = 0;
1329
df6fb868 1330 if (cda[CTA_TUPLE_ORIG]) {
c1d10adb
PNA
1331 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1332 if (err < 0)
1333 return err;
1334 }
1335
df6fb868 1336 if (cda[CTA_TUPLE_REPLY]) {
c1d10adb
PNA
1337 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1338 if (err < 0)
1339 return err;
1340 }
1341
f8ba1aff 1342 spin_lock_bh(&nf_conntrack_lock);
df6fb868 1343 if (cda[CTA_TUPLE_ORIG])
400dad39 1344 h = __nf_conntrack_find(&init_net, &otuple);
df6fb868 1345 else if (cda[CTA_TUPLE_REPLY])
400dad39 1346 h = __nf_conntrack_find(&init_net, &rtuple);
c1d10adb
PNA
1347
1348 if (h == NULL) {
c1d10adb 1349 err = -ENOENT;
f0a3c086
PNA
1350 if (nlh->nlmsg_flags & NLM_F_CREATE) {
1351 struct nf_conn *ct;
fecc1133 1352 enum ip_conntrack_events events;
5faa1f4c 1353
f0a3c086
PNA
1354 ct = ctnetlink_create_conntrack(cda, &otuple,
1355 &rtuple, u3);
1356 if (IS_ERR(ct)) {
1357 err = PTR_ERR(ct);
5faa1f4c
PNA
1358 goto out_unlock;
1359 }
f0a3c086
PNA
1360 err = 0;
1361 nf_conntrack_get(&ct->ct_general);
1362 spin_unlock_bh(&nf_conntrack_lock);
fecc1133
PNA
1363 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1364 events = IPCT_RELATED;
1365 else
1366 events = IPCT_NEW;
1367
1368 nf_conntrack_event_report(IPCT_STATUS |
1369 IPCT_HELPER |
1370 IPCT_PROTOINFO |
1371 IPCT_NATSEQADJ |
1372 IPCT_MARK | events,
1373 ct, NETLINK_CB(skb).pid,
1374 nlmsg_report(nlh));
f0a3c086
PNA
1375 nf_ct_put(ct);
1376 } else
1377 spin_unlock_bh(&nf_conntrack_lock);
5faa1f4c 1378
c1d10adb
PNA
1379 return err;
1380 }
1381 /* implicit 'else' */
1382
c1d10adb
PNA
1383 /* We manipulate the conntrack inside the global conntrack table lock,
1384 * so there's no need to increase the refcount */
c1d10adb 1385 err = -EEXIST;
ff4ca827 1386 if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
19abb7b0
PNA
1387 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
1388
19abb7b0
PNA
1389 err = ctnetlink_change_conntrack(ct, cda);
1390 if (err == 0) {
1391 nf_conntrack_get(&ct->ct_general);
1392 spin_unlock_bh(&nf_conntrack_lock);
fecc1133
PNA
1393 nf_conntrack_event_report(IPCT_STATUS |
1394 IPCT_HELPER |
1395 IPCT_PROTOINFO |
1396 IPCT_NATSEQADJ |
1397 IPCT_MARK,
1398 ct, NETLINK_CB(skb).pid,
1399 nlmsg_report(nlh));
19abb7b0
PNA
1400 nf_ct_put(ct);
1401 } else
1402 spin_unlock_bh(&nf_conntrack_lock);
1403
1404 return err;
ff4ca827 1405 }
c1d10adb
PNA
1406
1407out_unlock:
f8ba1aff 1408 spin_unlock_bh(&nf_conntrack_lock);
c1d10adb
PNA
1409 return err;
1410}
1411
601e68e1
YH
1412/***********************************************************************
1413 * EXPECT
1414 ***********************************************************************/
c1d10adb
PNA
1415
1416static inline int
1417ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1418 const struct nf_conntrack_tuple *tuple,
1419 enum ctattr_expect type)
1420{
df6fb868 1421 struct nlattr *nest_parms;
601e68e1 1422
df6fb868
PM
1423 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
1424 if (!nest_parms)
1425 goto nla_put_failure;
c1d10adb 1426 if (ctnetlink_dump_tuples(skb, tuple) < 0)
df6fb868
PM
1427 goto nla_put_failure;
1428 nla_nest_end(skb, nest_parms);
c1d10adb
PNA
1429
1430 return 0;
1431
df6fb868 1432nla_put_failure:
c1d10adb 1433 return -1;
601e68e1 1434}
c1d10adb 1435
1cde6436
PNA
1436static inline int
1437ctnetlink_exp_dump_mask(struct sk_buff *skb,
1438 const struct nf_conntrack_tuple *tuple,
d4156e8c 1439 const struct nf_conntrack_tuple_mask *mask)
1cde6436
PNA
1440{
1441 int ret;
1442 struct nf_conntrack_l3proto *l3proto;
605dcad6 1443 struct nf_conntrack_l4proto *l4proto;
d4156e8c 1444 struct nf_conntrack_tuple m;
df6fb868 1445 struct nlattr *nest_parms;
d4156e8c
PM
1446
1447 memset(&m, 0xFF, sizeof(m));
1448 m.src.u.all = mask->src.u.all;
1449 memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
1450
df6fb868
PM
1451 nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
1452 if (!nest_parms)
1453 goto nla_put_failure;
1cde6436 1454
528a3a6f 1455 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
d4156e8c 1456 ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
1cde6436
PNA
1457
1458 if (unlikely(ret < 0))
df6fb868 1459 goto nla_put_failure;
1cde6436 1460
528a3a6f 1461 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
d4156e8c 1462 ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
1cde6436 1463 if (unlikely(ret < 0))
df6fb868 1464 goto nla_put_failure;
1cde6436 1465
df6fb868 1466 nla_nest_end(skb, nest_parms);
1cde6436
PNA
1467
1468 return 0;
1469
df6fb868 1470nla_put_failure:
1cde6436
PNA
1471 return -1;
1472}
1473
bb5cf80e 1474static int
c1d10adb 1475ctnetlink_exp_dump_expect(struct sk_buff *skb,
601e68e1 1476 const struct nf_conntrack_expect *exp)
c1d10adb
PNA
1477{
1478 struct nf_conn *master = exp->master;
d978e5da
PM
1479 long timeout = (exp->timeout.expires - jiffies) / HZ;
1480
1481 if (timeout < 0)
1482 timeout = 0;
c1d10adb
PNA
1483
1484 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
df6fb868 1485 goto nla_put_failure;
1cde6436 1486 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
df6fb868 1487 goto nla_put_failure;
c1d10adb
PNA
1488 if (ctnetlink_exp_dump_tuple(skb,
1489 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1490 CTA_EXPECT_MASTER) < 0)
df6fb868 1491 goto nla_put_failure;
601e68e1 1492
d978e5da 1493 NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
77236b6e 1494 NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
c1d10adb
PNA
1495
1496 return 0;
601e68e1 1497
df6fb868 1498nla_put_failure:
c1d10adb
PNA
1499 return -1;
1500}
1501
1502static int
1503ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
8b0a231d 1504 int event, const struct nf_conntrack_expect *exp)
c1d10adb
PNA
1505{
1506 struct nlmsghdr *nlh;
1507 struct nfgenmsg *nfmsg;
27a884dc 1508 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA
1509
1510 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1511 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1512 nfmsg = NLMSG_DATA(nlh);
1513
8b0a231d 1514 nlh->nlmsg_flags = pid ? NLM_F_MULTI : 0;
c1d10adb
PNA
1515 nfmsg->nfgen_family = exp->tuple.src.l3num;
1516 nfmsg->version = NFNETLINK_V0;
1517 nfmsg->res_id = 0;
1518
1519 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
df6fb868 1520 goto nla_put_failure;
c1d10adb 1521
27a884dc 1522 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA
1523 return skb->len;
1524
1525nlmsg_failure:
df6fb868 1526nla_put_failure:
dc5fc579 1527 nlmsg_trim(skb, b);
c1d10adb
PNA
1528 return -1;
1529}
1530
1531#ifdef CONFIG_NF_CONNTRACK_EVENTS
1532static int ctnetlink_expect_event(struct notifier_block *this,
1533 unsigned long events, void *ptr)
1534{
1535 struct nlmsghdr *nlh;
1536 struct nfgenmsg *nfmsg;
19abb7b0
PNA
1537 struct nf_exp_event *item = (struct nf_exp_event *)ptr;
1538 struct nf_conntrack_expect *exp = item->exp;
c1d10adb
PNA
1539 struct sk_buff *skb;
1540 unsigned int type;
27a884dc 1541 sk_buff_data_t b;
c1d10adb
PNA
1542 int flags = 0;
1543
1544 if (events & IPEXP_NEW) {
1545 type = IPCTNL_MSG_EXP_NEW;
1546 flags = NLM_F_CREATE|NLM_F_EXCL;
1547 } else
1548 return NOTIFY_DONE;
1549
1f9da256
PNA
1550 if (!item->report &&
1551 !nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
b3a27bfb
PNA
1552 return NOTIFY_DONE;
1553
c1d10adb
PNA
1554 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1555 if (!skb)
150ace0d 1556 goto errout;
c1d10adb
PNA
1557
1558 b = skb->tail;
1559
b633ad5f 1560 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
19abb7b0 1561 nlh = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
c1d10adb
PNA
1562 nfmsg = NLMSG_DATA(nlh);
1563
1564 nlh->nlmsg_flags = flags;
1565 nfmsg->nfgen_family = exp->tuple.src.l3num;
1566 nfmsg->version = NFNETLINK_V0;
1567 nfmsg->res_id = 0;
1568
528a3a6f 1569 rcu_read_lock();
c1d10adb 1570 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
df6fb868 1571 goto nla_put_failure;
528a3a6f 1572 rcu_read_unlock();
c1d10adb
PNA
1573
1574 nlh->nlmsg_len = skb->tail - b;
19abb7b0 1575 nfnetlink_send(skb, item->pid, NFNLGRP_CONNTRACK_EXP_NEW, item->report);
c1d10adb
PNA
1576 return NOTIFY_DONE;
1577
df6fb868 1578nla_put_failure:
528a3a6f
PNA
1579 rcu_read_unlock();
1580nlmsg_failure:
c1d10adb 1581 kfree_skb(skb);
150ace0d
PNA
1582errout:
1583 nfnetlink_set_err(0, 0, -ENOBUFS);
c1d10adb
PNA
1584 return NOTIFY_DONE;
1585}
1586#endif
cf6994c2
PM
1587static int ctnetlink_exp_done(struct netlink_callback *cb)
1588{
31f15875
PM
1589 if (cb->args[1])
1590 nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
cf6994c2
PM
1591 return 0;
1592}
c1d10adb
PNA
1593
1594static int
1595ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1596{
9b03f38d 1597 struct net *net = &init_net;
cf6994c2 1598 struct nf_conntrack_expect *exp, *last;
87711cb8 1599 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
31f15875 1600 struct hlist_node *n;
87711cb8 1601 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 1602
7d0742da 1603 rcu_read_lock();
31f15875
PM
1604 last = (struct nf_conntrack_expect *)cb->args[1];
1605 for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
cf6994c2 1606restart:
9b03f38d 1607 hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
31f15875
PM
1608 hnode) {
1609 if (l3proto && exp->tuple.src.l3num != l3proto)
cf6994c2 1610 continue;
31f15875
PM
1611 if (cb->args[1]) {
1612 if (exp != last)
1613 continue;
1614 cb->args[1] = 0;
1615 }
8b0a231d
PNA
1616 if (ctnetlink_exp_fill_info(skb,
1617 NETLINK_CB(cb->skb).pid,
31f15875
PM
1618 cb->nlh->nlmsg_seq,
1619 IPCTNL_MSG_EXP_NEW,
8b0a231d 1620 exp) < 0) {
7d0742da
PM
1621 if (!atomic_inc_not_zero(&exp->use))
1622 continue;
31f15875
PM
1623 cb->args[1] = (unsigned long)exp;
1624 goto out;
1625 }
cf6994c2 1626 }
31f15875
PM
1627 if (cb->args[1]) {
1628 cb->args[1] = 0;
1629 goto restart;
cf6994c2
PM
1630 }
1631 }
601e68e1 1632out:
7d0742da 1633 rcu_read_unlock();
cf6994c2
PM
1634 if (last)
1635 nf_ct_expect_put(last);
c1d10adb 1636
c1d10adb
PNA
1637 return skb->len;
1638}
1639
f73e924c
PM
1640static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
1641 [CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1642 [CTA_EXPECT_ID] = { .type = NLA_U32 },
c1d10adb
PNA
1643};
1644
1645static int
601e68e1 1646ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
df6fb868 1647 struct nlmsghdr *nlh, struct nlattr *cda[])
c1d10adb
PNA
1648{
1649 struct nf_conntrack_tuple tuple;
1650 struct nf_conntrack_expect *exp;
1651 struct sk_buff *skb2;
1652 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1653 u_int8_t u3 = nfmsg->nfgen_family;
1654 int err = 0;
1655
c1d10adb 1656 if (nlh->nlmsg_flags & NLM_F_DUMP) {
c702e804
TG
1657 return netlink_dump_start(ctnl, skb, nlh,
1658 ctnetlink_exp_dump_table,
cf6994c2 1659 ctnetlink_exp_done);
c1d10adb
PNA
1660 }
1661
df6fb868 1662 if (cda[CTA_EXPECT_MASTER])
c1d10adb
PNA
1663 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1664 else
1665 return -EINVAL;
1666
1667 if (err < 0)
1668 return err;
1669
9b03f38d 1670 exp = nf_ct_expect_find_get(&init_net, &tuple);
c1d10adb
PNA
1671 if (!exp)
1672 return -ENOENT;
1673
df6fb868 1674 if (cda[CTA_EXPECT_ID]) {
77236b6e 1675 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
35832402 1676 if (ntohl(id) != (u32)(unsigned long)exp) {
6823645d 1677 nf_ct_expect_put(exp);
c1d10adb
PNA
1678 return -ENOENT;
1679 }
601e68e1 1680 }
c1d10adb
PNA
1681
1682 err = -ENOMEM;
1683 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1684 if (!skb2)
1685 goto out;
4e9b8269 1686
528a3a6f 1687 rcu_read_lock();
601e68e1 1688 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
8b0a231d 1689 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);
528a3a6f 1690 rcu_read_unlock();
c1d10adb
PNA
1691 if (err <= 0)
1692 goto free;
1693
6823645d 1694 nf_ct_expect_put(exp);
c1d10adb
PNA
1695
1696 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1697
1698free:
1699 kfree_skb(skb2);
1700out:
6823645d 1701 nf_ct_expect_put(exp);
c1d10adb
PNA
1702 return err;
1703}
1704
1705static int
601e68e1 1706ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
df6fb868 1707 struct nlmsghdr *nlh, struct nlattr *cda[])
c1d10adb 1708{
31f15875 1709 struct nf_conntrack_expect *exp;
c1d10adb
PNA
1710 struct nf_conntrack_tuple tuple;
1711 struct nf_conntrack_helper *h;
1712 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
31f15875 1713 struct hlist_node *n, *next;
c1d10adb 1714 u_int8_t u3 = nfmsg->nfgen_family;
31f15875 1715 unsigned int i;
c1d10adb
PNA
1716 int err;
1717
df6fb868 1718 if (cda[CTA_EXPECT_TUPLE]) {
c1d10adb
PNA
1719 /* delete a single expect by tuple */
1720 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1721 if (err < 0)
1722 return err;
1723
1724 /* bump usage count to 2 */
9b03f38d 1725 exp = nf_ct_expect_find_get(&init_net, &tuple);
c1d10adb
PNA
1726 if (!exp)
1727 return -ENOENT;
1728
df6fb868 1729 if (cda[CTA_EXPECT_ID]) {
77236b6e 1730 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
35832402 1731 if (ntohl(id) != (u32)(unsigned long)exp) {
6823645d 1732 nf_ct_expect_put(exp);
c1d10adb
PNA
1733 return -ENOENT;
1734 }
1735 }
1736
1737 /* after list removal, usage count == 1 */
6823645d 1738 nf_ct_unexpect_related(exp);
601e68e1 1739 /* have to put what we 'get' above.
c1d10adb 1740 * after this line usage count == 0 */
6823645d 1741 nf_ct_expect_put(exp);
df6fb868
PM
1742 } else if (cda[CTA_EXPECT_HELP_NAME]) {
1743 char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
31f15875 1744 struct nf_conn_help *m_help;
c1d10adb
PNA
1745
1746 /* delete all expectations for this helper */
f8ba1aff 1747 spin_lock_bh(&nf_conntrack_lock);
c1d10adb
PNA
1748 h = __nf_conntrack_helper_find_byname(name);
1749 if (!h) {
f8ba1aff 1750 spin_unlock_bh(&nf_conntrack_lock);
0adf9d67 1751 return -EOPNOTSUPP;
c1d10adb 1752 }
31f15875
PM
1753 for (i = 0; i < nf_ct_expect_hsize; i++) {
1754 hlist_for_each_entry_safe(exp, n, next,
9b03f38d 1755 &init_net.ct.expect_hash[i],
31f15875
PM
1756 hnode) {
1757 m_help = nfct_help(exp->master);
1758 if (m_help->helper == h
1759 && del_timer(&exp->timeout)) {
1760 nf_ct_unlink_expect(exp);
1761 nf_ct_expect_put(exp);
1762 }
c1d10adb
PNA
1763 }
1764 }
f8ba1aff 1765 spin_unlock_bh(&nf_conntrack_lock);
c1d10adb
PNA
1766 } else {
1767 /* This basically means we have to flush everything*/
f8ba1aff 1768 spin_lock_bh(&nf_conntrack_lock);
31f15875
PM
1769 for (i = 0; i < nf_ct_expect_hsize; i++) {
1770 hlist_for_each_entry_safe(exp, n, next,
9b03f38d 1771 &init_net.ct.expect_hash[i],
31f15875
PM
1772 hnode) {
1773 if (del_timer(&exp->timeout)) {
1774 nf_ct_unlink_expect(exp);
1775 nf_ct_expect_put(exp);
1776 }
c1d10adb
PNA
1777 }
1778 }
f8ba1aff 1779 spin_unlock_bh(&nf_conntrack_lock);
c1d10adb
PNA
1780 }
1781
1782 return 0;
1783}
1784static int
df6fb868 1785ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nlattr *cda[])
c1d10adb
PNA
1786{
1787 return -EOPNOTSUPP;
1788}
1789
1790static int
19abb7b0 1791ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)
c1d10adb
PNA
1792{
1793 struct nf_conntrack_tuple tuple, mask, master_tuple;
1794 struct nf_conntrack_tuple_hash *h = NULL;
1795 struct nf_conntrack_expect *exp;
1796 struct nf_conn *ct;
dc808fe2 1797 struct nf_conn_help *help;
c1d10adb
PNA
1798 int err = 0;
1799
c1d10adb
PNA
1800 /* caller guarantees that those three CTA_EXPECT_* exist */
1801 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1802 if (err < 0)
1803 return err;
1804 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1805 if (err < 0)
1806 return err;
1807 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1808 if (err < 0)
1809 return err;
1810
1811 /* Look for master conntrack of this expectation */
400dad39 1812 h = nf_conntrack_find_get(&init_net, &master_tuple);
c1d10adb
PNA
1813 if (!h)
1814 return -ENOENT;
1815 ct = nf_ct_tuplehash_to_ctrack(h);
dc808fe2 1816 help = nfct_help(ct);
c1d10adb 1817
dc808fe2 1818 if (!help || !help->helper) {
c1d10adb 1819 /* such conntrack hasn't got any helper, abort */
bfe29677 1820 err = -EOPNOTSUPP;
c1d10adb
PNA
1821 goto out;
1822 }
1823
6823645d 1824 exp = nf_ct_expect_alloc(ct);
c1d10adb
PNA
1825 if (!exp) {
1826 err = -ENOMEM;
1827 goto out;
1828 }
601e68e1 1829
626ba8fb 1830 exp->class = 0;
c1d10adb
PNA
1831 exp->expectfn = NULL;
1832 exp->flags = 0;
1833 exp->master = ct;
9457d851 1834 exp->helper = NULL;
c1d10adb 1835 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
d4156e8c
PM
1836 memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
1837 exp->mask.src.u.all = mask.src.u.all;
c1d10adb 1838
19abb7b0 1839 err = nf_ct_expect_related_report(exp, pid, report);
6823645d 1840 nf_ct_expect_put(exp);
c1d10adb 1841
601e68e1 1842out:
c1d10adb
PNA
1843 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1844 return err;
1845}
1846
1847static int
1848ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
df6fb868 1849 struct nlmsghdr *nlh, struct nlattr *cda[])
c1d10adb
PNA
1850{
1851 struct nf_conntrack_tuple tuple;
1852 struct nf_conntrack_expect *exp;
1853 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1854 u_int8_t u3 = nfmsg->nfgen_family;
1855 int err = 0;
1856
df6fb868
PM
1857 if (!cda[CTA_EXPECT_TUPLE]
1858 || !cda[CTA_EXPECT_MASK]
1859 || !cda[CTA_EXPECT_MASTER])
c1d10adb
PNA
1860 return -EINVAL;
1861
1862 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1863 if (err < 0)
1864 return err;
1865
f8ba1aff 1866 spin_lock_bh(&nf_conntrack_lock);
9b03f38d 1867 exp = __nf_ct_expect_find(&init_net, &tuple);
c1d10adb
PNA
1868
1869 if (!exp) {
f8ba1aff 1870 spin_unlock_bh(&nf_conntrack_lock);
c1d10adb 1871 err = -ENOENT;
19abb7b0
PNA
1872 if (nlh->nlmsg_flags & NLM_F_CREATE) {
1873 err = ctnetlink_create_expect(cda,
1874 u3,
1875 NETLINK_CB(skb).pid,
1876 nlmsg_report(nlh));
1877 }
c1d10adb
PNA
1878 return err;
1879 }
1880
1881 err = -EEXIST;
1882 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1883 err = ctnetlink_change_expect(exp, cda);
f8ba1aff 1884 spin_unlock_bh(&nf_conntrack_lock);
c1d10adb 1885
c1d10adb
PNA
1886 return err;
1887}
1888
1889#ifdef CONFIG_NF_CONNTRACK_EVENTS
1890static struct notifier_block ctnl_notifier = {
1891 .notifier_call = ctnetlink_conntrack_event,
1892};
1893
1894static struct notifier_block ctnl_notifier_exp = {
1895 .notifier_call = ctnetlink_expect_event,
1896};
1897#endif
1898
7c8d4cb4 1899static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
c1d10adb 1900 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
f73e924c
PM
1901 .attr_count = CTA_MAX,
1902 .policy = ct_nla_policy },
c1d10adb 1903 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
f73e924c
PM
1904 .attr_count = CTA_MAX,
1905 .policy = ct_nla_policy },
c1d10adb 1906 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
f73e924c
PM
1907 .attr_count = CTA_MAX,
1908 .policy = ct_nla_policy },
c1d10adb 1909 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
f73e924c
PM
1910 .attr_count = CTA_MAX,
1911 .policy = ct_nla_policy },
c1d10adb
PNA
1912};
1913
7c8d4cb4 1914static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
c1d10adb 1915 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
f73e924c
PM
1916 .attr_count = CTA_EXPECT_MAX,
1917 .policy = exp_nla_policy },
c1d10adb 1918 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
f73e924c
PM
1919 .attr_count = CTA_EXPECT_MAX,
1920 .policy = exp_nla_policy },
c1d10adb 1921 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
f73e924c
PM
1922 .attr_count = CTA_EXPECT_MAX,
1923 .policy = exp_nla_policy },
c1d10adb
PNA
1924};
1925
7c8d4cb4 1926static const struct nfnetlink_subsystem ctnl_subsys = {
c1d10adb
PNA
1927 .name = "conntrack",
1928 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1929 .cb_count = IPCTNL_MSG_MAX,
1930 .cb = ctnl_cb,
1931};
1932
7c8d4cb4 1933static const struct nfnetlink_subsystem ctnl_exp_subsys = {
c1d10adb
PNA
1934 .name = "conntrack_expect",
1935 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1936 .cb_count = IPCTNL_MSG_EXP_MAX,
1937 .cb = ctnl_exp_cb,
1938};
1939
d2483dde 1940MODULE_ALIAS("ip_conntrack_netlink");
c1d10adb 1941MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
34f9a2e4 1942MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
c1d10adb
PNA
1943
1944static int __init ctnetlink_init(void)
1945{
1946 int ret;
1947
1948 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1949 ret = nfnetlink_subsys_register(&ctnl_subsys);
1950 if (ret < 0) {
1951 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1952 goto err_out;
1953 }
1954
1955 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1956 if (ret < 0) {
1957 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1958 goto err_unreg_subsys;
1959 }
1960
1961#ifdef CONFIG_NF_CONNTRACK_EVENTS
1962 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1963 if (ret < 0) {
1964 printk("ctnetlink_init: cannot register notifier.\n");
1965 goto err_unreg_exp_subsys;
1966 }
1967
6823645d 1968 ret = nf_ct_expect_register_notifier(&ctnl_notifier_exp);
c1d10adb
PNA
1969 if (ret < 0) {
1970 printk("ctnetlink_init: cannot expect register notifier.\n");
1971 goto err_unreg_notifier;
1972 }
1973#endif
1974
1975 return 0;
1976
1977#ifdef CONFIG_NF_CONNTRACK_EVENTS
1978err_unreg_notifier:
1979 nf_conntrack_unregister_notifier(&ctnl_notifier);
1980err_unreg_exp_subsys:
1981 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1982#endif
1983err_unreg_subsys:
1984 nfnetlink_subsys_unregister(&ctnl_subsys);
1985err_out:
1986 return ret;
1987}
1988
1989static void __exit ctnetlink_exit(void)
1990{
1991 printk("ctnetlink: unregistering from nfnetlink.\n");
1992
1993#ifdef CONFIG_NF_CONNTRACK_EVENTS
6823645d 1994 nf_ct_expect_unregister_notifier(&ctnl_notifier_exp);
c1d10adb
PNA
1995 nf_conntrack_unregister_notifier(&ctnl_notifier);
1996#endif
1997
1998 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1999 nfnetlink_subsys_unregister(&ctnl_subsys);
2000 return;
2001}
2002
2003module_init(ctnetlink_init);
2004module_exit(ctnetlink_exit);