]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/netfilter/nf_conntrack_netlink.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[IPv4] diag: Use netlink_run_queue() to process the receive queue
[mirror_ubuntu-bionic-kernel.git] / net / netfilter / nf_conntrack_netlink.c
CommitLineData
c1d10adb
PNA		 1/* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
dc808fe2 5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
c1d10adb 6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
1cde6436 7 * (C) 2005-2006 by Pablo Neira Ayuso <pablo@eurodev.net>
c1d10adb 8 *
601e68e1 9 * I've reworked this stuff to use attributes instead of conntrack
c1d10adb
PNA		 10 * structures. 5.44 am. I need more tea. --pablo 05/07/11.
11 *
601e68e1 12 * Initial connection tracking via netlink development funded and
c1d10adb
PNA		 13 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
14 *
15 * Further development of this code funded by Astaro AG (http://www.astaro.com)
16 *
17 * This software may be used and distributed according to the terms
18 * of the GNU General Public License, incorporated herein by reference.
19 *
20 * Derived from ip_conntrack_netlink.c: Port by Pablo Neira Ayuso (05/11/14)
21 */
22
23#include <linux/init.h>
24#include <linux/module.h>
25#include <linux/kernel.h>
26#include <linux/types.h>
27#include <linux/timer.h>
28#include <linux/skbuff.h>
29#include <linux/errno.h>
30#include <linux/netlink.h>
31#include <linux/spinlock.h>
40a839fd 32#include <linux/interrupt.h>
c1d10adb
PNA		 33#include <linux/notifier.h>
34
35#include <linux/netfilter.h>
dc5fc579 36#include <net/netlink.h>
c1d10adb
PNA		 37#include <net/netfilter/nf_conntrack.h>
38#include <net/netfilter/nf_conntrack_core.h>
77ab9cff 39#include <net/netfilter/nf_conntrack_expect.h>
c1d10adb
PNA		 40#include <net/netfilter/nf_conntrack_helper.h>
41#include <net/netfilter/nf_conntrack_l3proto.h>
605dcad6 42#include <net/netfilter/nf_conntrack_l4proto.h>
5b1158e9
JK		 43#include <net/netfilter/nf_conntrack_tuple.h>
44#ifdef CONFIG_NF_NAT_NEEDED
45#include <net/netfilter/nf_nat_core.h>
46#include <net/netfilter/nf_nat_protocol.h>
47#endif
c1d10adb
PNA		 48
49#include <linux/netfilter/nfnetlink.h>
50#include <linux/netfilter/nfnetlink_conntrack.h>
51
52MODULE_LICENSE("GPL");
53
dc808fe2 54static char __initdata version[] = "0.93";
c1d10adb 55
c1d10adb 56static inline int
601e68e1 57ctnetlink_dump_tuples_proto(struct sk_buff *skb,
1cde6436 58 const struct nf_conntrack_tuple *tuple,
605dcad6 59 struct nf_conntrack_l4proto *l4proto)
c1d10adb 60{
c1d10adb 61 int ret = 0;
1cde6436 62 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
c1d10adb
PNA		 63
64 NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
65
605dcad6
MJ		 66 if (likely(l4proto->tuple_to_nfattr))
67 ret = l4proto->tuple_to_nfattr(skb, tuple);
601e68e1 68
1cde6436 69 NFA_NEST_END(skb, nest_parms);
c1d10adb
PNA		 70
71 return ret;
72
73nfattr_failure:
74 return -1;
75}
76
77static inline int
1cde6436
PNA		 78ctnetlink_dump_tuples_ip(struct sk_buff *skb,
79 const struct nf_conntrack_tuple *tuple,
80 struct nf_conntrack_l3proto *l3proto)
c1d10adb 81{
c1d10adb 82 int ret = 0;
1cde6436
PNA		 83 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
84
c1d10adb
PNA		 85 if (likely(l3proto->tuple_to_nfattr))
86 ret = l3proto->tuple_to_nfattr(skb, tuple);
1cde6436 87
c1d10adb
PNA		 88 NFA_NEST_END(skb, nest_parms);
89
1cde6436
PNA		 90 return ret;
91
92nfattr_failure:
93 return -1;
94}
95
96static inline int
97ctnetlink_dump_tuples(struct sk_buff *skb,
98 const struct nf_conntrack_tuple *tuple)
99{
100 int ret;
101 struct nf_conntrack_l3proto *l3proto;
605dcad6 102 struct nf_conntrack_l4proto *l4proto;
1cde6436
PNA		 103
104 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
105 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
c1d10adb
PNA		 106 nf_ct_l3proto_put(l3proto);
107
108 if (unlikely(ret < 0))
109 return ret;
110
605dcad6
MJ		 111 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
112 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
113 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 114
115 return ret;
c1d10adb
PNA		 116}
117
118static inline int
119ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
120{
bff9a89b 121 __be32 status = htonl((u_int32_t) ct->status);
c1d10adb
PNA		 122 NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
123 return 0;
124
125nfattr_failure:
126 return -1;
127}
128
129static inline int
130ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
131{
132 long timeout_l = ct->timeout.expires - jiffies;
bff9a89b 133 __be32 timeout;
c1d10adb
PNA		 134
135 if (timeout_l < 0)
136 timeout = 0;
137 else
138 timeout = htonl(timeout_l / HZ);
601e68e1 139
c1d10adb
PNA		 140 NFA_PUT(skb, CTA_TIMEOUT, sizeof(timeout), &timeout);
141 return 0;
142
143nfattr_failure:
144 return -1;
145}
146
147static inline int
148ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
149{
605dcad6 150 struct nf_conntrack_l4proto *l4proto = nf_ct_l4proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num, ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
c1d10adb
PNA		 151 struct nfattr *nest_proto;
152 int ret;
153
605dcad6
MJ		 154 if (!l4proto->to_nfattr) {
155 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 156 return 0;
157 }
601e68e1 158
c1d10adb
PNA		 159 nest_proto = NFA_NEST(skb, CTA_PROTOINFO);
160
605dcad6 161 ret = l4proto->to_nfattr(skb, nest_proto, ct);
c1d10adb 162
605dcad6 163 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 164
165 NFA_NEST_END(skb, nest_proto);
166
167 return ret;
168
169nfattr_failure:
605dcad6 170 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 171 return -1;
172}
173
174static inline int
175ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
176{
177 struct nfattr *nest_helper;
dc808fe2 178 const struct nf_conn_help *help = nfct_help(ct);
c1d10adb 179
dc808fe2 180 if (!help || !help->helper)
c1d10adb 181 return 0;
601e68e1 182
c1d10adb 183 nest_helper = NFA_NEST(skb, CTA_HELP);
dc808fe2 184 NFA_PUT(skb, CTA_HELP_NAME, strlen(help->helper->name), help->helper->name);
c1d10adb 185
dc808fe2
HW		 186 if (help->helper->to_nfattr)
187 help->helper->to_nfattr(skb, ct);
c1d10adb
PNA		 188
189 NFA_NEST_END(skb, nest_helper);
190
191 return 0;
192
193nfattr_failure:
194 return -1;
195}
196
197#ifdef CONFIG_NF_CT_ACCT
198static inline int
199ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
200 enum ip_conntrack_dir dir)
201{
202 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
203 struct nfattr *nest_count = NFA_NEST(skb, type);
bff9a89b 204 __be32 tmp;
c1d10adb
PNA		 205
206 tmp = htonl(ct->counters[dir].packets);
207 NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(u_int32_t), &tmp);
208
209 tmp = htonl(ct->counters[dir].bytes);
210 NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(u_int32_t), &tmp);
211
212 NFA_NEST_END(skb, nest_count);
213
214 return 0;
215
216nfattr_failure:
217 return -1;
218}
219#else
220#define ctnetlink_dump_counters(a, b, c) (0)
221#endif
222
223#ifdef CONFIG_NF_CONNTRACK_MARK
224static inline int
225ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
226{
bff9a89b 227 __be32 mark = htonl(ct->mark);
c1d10adb
PNA		 228
229 NFA_PUT(skb, CTA_MARK, sizeof(u_int32_t), &mark);
230 return 0;
231
232nfattr_failure:
233 return -1;
234}
235#else
236#define ctnetlink_dump_mark(a, b) (0)
237#endif
238
239static inline int
240ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
241{
bff9a89b 242 __be32 id = htonl(ct->id);
c1d10adb
PNA		 243 NFA_PUT(skb, CTA_ID, sizeof(u_int32_t), &id);
244 return 0;
245
246nfattr_failure:
247 return -1;
248}
249
250static inline int
251ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
252{
bff9a89b 253 __be32 use = htonl(atomic_read(&ct->ct_general.use));
601e68e1 254
c1d10adb
PNA		 255 NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
256 return 0;
257
258nfattr_failure:
259 return -1;
260}
261
262#define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
263
264static int
265ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
601e68e1 266 int event, int nowait,
c1d10adb
PNA		 267 const struct nf_conn *ct)
268{
269 struct nlmsghdr *nlh;
270 struct nfgenmsg *nfmsg;
271 struct nfattr *nest_parms;
27a884dc 272 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA		 273
274 event |= NFNL_SUBSYS_CTNETLINK << 8;
275 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
276 nfmsg = NLMSG_DATA(nlh);
277
278 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
601e68e1 279 nfmsg->nfgen_family =
c1d10adb
PNA		 280 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
281 nfmsg->version = NFNETLINK_V0;
282 nfmsg->res_id = 0;
283
284 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
285 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
286 goto nfattr_failure;
287 NFA_NEST_END(skb, nest_parms);
601e68e1 288
c1d10adb
PNA		 289 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
290 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
291 goto nfattr_failure;
292 NFA_NEST_END(skb, nest_parms);
293
294 if (ctnetlink_dump_status(skb, ct) < 0 ||
295 ctnetlink_dump_timeout(skb, ct) < 0 ||
296 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
297 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
298 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
299 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
300 ctnetlink_dump_mark(skb, ct) < 0 ||
301 ctnetlink_dump_id(skb, ct) < 0 ||
302 ctnetlink_dump_use(skb, ct) < 0)
303 goto nfattr_failure;
304
27a884dc 305 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA		 306 return skb->len;
307
308nlmsg_failure:
309nfattr_failure:
dc5fc579 310 nlmsg_trim(skb, b);
c1d10adb
PNA		 311 return -1;
312}
313
314#ifdef CONFIG_NF_CONNTRACK_EVENTS
315static int ctnetlink_conntrack_event(struct notifier_block *this,
601e68e1 316 unsigned long events, void *ptr)
c1d10adb
PNA		 317{
318 struct nlmsghdr *nlh;
319 struct nfgenmsg *nfmsg;
320 struct nfattr *nest_parms;
321 struct nf_conn *ct = (struct nf_conn *)ptr;
322 struct sk_buff *skb;
323 unsigned int type;
27a884dc 324 sk_buff_data_t b;
c1d10adb
PNA		 325 unsigned int flags = 0, group;
326
327 /* ignore our fake conntrack entry */
328 if (ct == &nf_conntrack_untracked)
329 return NOTIFY_DONE;
330
331 if (events & IPCT_DESTROY) {
332 type = IPCTNL_MSG_CT_DELETE;
333 group = NFNLGRP_CONNTRACK_DESTROY;
334 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
335 type = IPCTNL_MSG_CT_NEW;
336 flags = NLM_F_CREATE|NLM_F_EXCL;
c1d10adb 337 group = NFNLGRP_CONNTRACK_NEW;
1a31526b 338 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
c1d10adb
PNA		 339 type = IPCTNL_MSG_CT_NEW;
340 group = NFNLGRP_CONNTRACK_UPDATE;
341 } else
342 return NOTIFY_DONE;
a2427692
PM		 343
344 if (!nfnetlink_has_listeners(group))
345 return NOTIFY_DONE;
346
c1d10adb
PNA		 347 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
348 if (!skb)
349 return NOTIFY_DONE;
350
351 b = skb->tail;
352
353 type |= NFNL_SUBSYS_CTNETLINK << 8;
354 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
355 nfmsg = NLMSG_DATA(nlh);
356
357 nlh->nlmsg_flags = flags;
358 nfmsg->nfgen_family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
359 nfmsg->version = NFNETLINK_V0;
360 nfmsg->res_id = 0;
361
362 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
363 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
364 goto nfattr_failure;
365 NFA_NEST_END(skb, nest_parms);
601e68e1 366
c1d10adb
PNA		 367 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
368 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
369 goto nfattr_failure;
370 NFA_NEST_END(skb, nest_parms);
c1d10adb 371
7b621c1e
PNA		 372 if (events & IPCT_DESTROY) {
373 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
374 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
375 goto nfattr_failure;
376 } else {
377 if (ctnetlink_dump_status(skb, ct) < 0)
378 goto nfattr_failure;
379
380 if (ctnetlink_dump_timeout(skb, ct) < 0)
381 goto nfattr_failure;
382
383 if (events & IPCT_PROTOINFO
384 && ctnetlink_dump_protoinfo(skb, ct) < 0)
601e68e1 385 goto nfattr_failure;
7b621c1e
PNA		 386
387 if ((events & IPCT_HELPER || nfct_help(ct))
388 && ctnetlink_dump_helpinfo(skb, ct) < 0)
601e68e1 389 goto nfattr_failure;
7b621c1e 390
40e0cb00 391#ifdef CONFIG_NF_CONNTRACK_MARK
7b621c1e
PNA		 392 if ((events & IPCT_MARK || ct->mark)
393 && ctnetlink_dump_mark(skb, ct) < 0)
601e68e1 394 goto nfattr_failure;
40e0cb00 395#endif
7b621c1e
PNA		 396
397 if (events & IPCT_COUNTER_FILLING &&
398 (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
399 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
400 goto nfattr_failure;
401 }
b9a37e0c 402
c1d10adb
PNA		 403 nlh->nlmsg_len = skb->tail - b;
404 nfnetlink_send(skb, 0, group, 0);
405 return NOTIFY_DONE;
406
407nlmsg_failure:
408nfattr_failure:
409 kfree_skb(skb);
410 return NOTIFY_DONE;
411}
412#endif /* CONFIG_NF_CONNTRACK_EVENTS */
413
414static int ctnetlink_done(struct netlink_callback *cb)
415{
89f2e218
PM		 416 if (cb->args[1])
417 nf_ct_put((struct nf_conn *)cb->args[1]);
c1d10adb
PNA		 418 return 0;
419}
420
87711cb8
PNA		 421#define L3PROTO(ct) ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num
422
c1d10adb
PNA		 423static int
424ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
425{
89f2e218 426 struct nf_conn *ct, *last;
c1d10adb
PNA		 427 struct nf_conntrack_tuple_hash *h;
428 struct list_head *i;
87711cb8
PNA		 429 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
430 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 431
c1d10adb 432 read_lock_bh(&nf_conntrack_lock);
d205dc40 433 last = (struct nf_conn *)cb->args[1];
89f2e218
PM		 434 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
435restart:
c1d10adb
PNA		 436 list_for_each_prev(i, &nf_conntrack_hash[cb->args[0]]) {
437 h = (struct nf_conntrack_tuple_hash *) i;
5b1158e9 438 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
c1d10adb
PNA		 439 continue;
440 ct = nf_ct_tuplehash_to_ctrack(h);
87711cb8
PNA		 441 /* Dump entries of a given L3 protocol number.
442 * If it is not specified, ie. l3proto == 0,
443 * then dump everything. */
444 if (l3proto && L3PROTO(ct) != l3proto)
445 continue;
d205dc40
PM		 446 if (cb->args[1]) {
447 if (ct != last)
89f2e218 448 continue;
d205dc40 449 cb->args[1] = 0;
89f2e218 450 }
c1d10adb 451 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
601e68e1 452 cb->nlh->nlmsg_seq,
c1d10adb 453 IPCTNL_MSG_CT_NEW,
89f2e218
PM		 454 1, ct) < 0) {
455 nf_conntrack_get(&ct->ct_general);
456 cb->args[1] = (unsigned long)ct;
c1d10adb 457 goto out;
89f2e218 458 }
01f34848
PNA		 459#ifdef CONFIG_NF_CT_ACCT
460 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
461 IPCTNL_MSG_CT_GET_CTRZERO)
462 memset(&ct->counters, 0, sizeof(ct->counters));
463#endif
89f2e218 464 }
d205dc40 465 if (cb->args[1]) {
89f2e218
PM		 466 cb->args[1] = 0;
467 goto restart;
c1d10adb
PNA		 468 }
469 }
89f2e218 470out:
c1d10adb 471 read_unlock_bh(&nf_conntrack_lock);
d205dc40
PM		 472 if (last)
473 nf_ct_put(last);
c1d10adb 474
c1d10adb
PNA		 475 return skb->len;
476}
477
c1d10adb
PNA		 478static inline int
479ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
480{
481 struct nfattr *tb[CTA_IP_MAX];
482 struct nf_conntrack_l3proto *l3proto;
483 int ret = 0;
484
c1d10adb
PNA		 485 nfattr_parse_nested(tb, CTA_IP_MAX, attr);
486
487 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
488
489 if (likely(l3proto->nfattr_to_tuple))
490 ret = l3proto->nfattr_to_tuple(tb, tuple);
491
492 nf_ct_l3proto_put(l3proto);
493
c1d10adb
PNA		 494 return ret;
495}
496
497static const size_t cta_min_proto[CTA_PROTO_MAX] = {
498 [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
499};
500
501static inline int
601e68e1 502ctnetlink_parse_tuple_proto(struct nfattr *attr,
c1d10adb
PNA		 503 struct nf_conntrack_tuple *tuple)
504{
505 struct nfattr *tb[CTA_PROTO_MAX];
605dcad6 506 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA		 507 int ret = 0;
508
c1d10adb
PNA		 509 nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
510
511 if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
512 return -EINVAL;
513
514 if (!tb[CTA_PROTO_NUM-1])
515 return -EINVAL;
516 tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
517
605dcad6 518 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
c1d10adb 519
605dcad6
MJ		 520 if (likely(l4proto->nfattr_to_tuple))
521 ret = l4proto->nfattr_to_tuple(tb, tuple);
c1d10adb 522
605dcad6 523 nf_ct_l4proto_put(l4proto);
601e68e1 524
c1d10adb
PNA		 525 return ret;
526}
527
528static inline int
529ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
530 enum ctattr_tuple type, u_int8_t l3num)
531{
532 struct nfattr *tb[CTA_TUPLE_MAX];
533 int err;
534
c1d10adb
PNA		 535 memset(tuple, 0, sizeof(*tuple));
536
537 nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
538
539 if (!tb[CTA_TUPLE_IP-1])
540 return -EINVAL;
541
542 tuple->src.l3num = l3num;
543
544 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP-1], tuple);
545 if (err < 0)
546 return err;
547
548 if (!tb[CTA_TUPLE_PROTO-1])
549 return -EINVAL;
550
551 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO-1], tuple);
552 if (err < 0)
553 return err;
554
555 /* orig and expect tuples get DIR_ORIGINAL */
556 if (type == CTA_TUPLE_REPLY)
557 tuple->dst.dir = IP_CT_DIR_REPLY;
558 else
559 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
560
c1d10adb
PNA		 561 return 0;
562}
563
5b1158e9 564#ifdef CONFIG_NF_NAT_NEEDED
c1d10adb
PNA		 565static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
566 [CTA_PROTONAT_PORT_MIN-1] = sizeof(u_int16_t),
567 [CTA_PROTONAT_PORT_MAX-1] = sizeof(u_int16_t),
568};
569
5b1158e9 570static int nfnetlink_parse_nat_proto(struct nfattr *attr,
c1d10adb 571 const struct nf_conn *ct,
5b1158e9 572 struct nf_nat_range *range)
c1d10adb
PNA		 573{
574 struct nfattr *tb[CTA_PROTONAT_MAX];
5b1158e9 575 struct nf_nat_protocol *npt;
c1d10adb 576
c1d10adb
PNA		 577 nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
578
579 if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
580 return -EINVAL;
581
5b1158e9 582 npt = nf_nat_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
c1d10adb
PNA		 583
584 if (!npt->nfattr_to_range) {
5b1158e9 585 nf_nat_proto_put(npt);
c1d10adb
PNA		 586 return 0;
587 }
588
589 /* nfattr_to_range returns 1 if it parsed, 0 if not, neg. on error */
590 if (npt->nfattr_to_range(tb, range) > 0)
591 range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
592
5b1158e9 593 nf_nat_proto_put(npt);
c1d10adb 594
c1d10adb
PNA		 595 return 0;
596}
597
598static const size_t cta_min_nat[CTA_NAT_MAX] = {
599 [CTA_NAT_MINIP-1] = sizeof(u_int32_t),
600 [CTA_NAT_MAXIP-1] = sizeof(u_int32_t),
601};
602
603static inline int
5b1158e9
JK		 604nfnetlink_parse_nat(struct nfattr *nat,
605 const struct nf_conn *ct, struct nf_nat_range *range)
c1d10adb
PNA		 606{
607 struct nfattr *tb[CTA_NAT_MAX];
608 int err;
609
c1d10adb 610 memset(range, 0, sizeof(*range));
601e68e1 611
3726add7 612 nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
c1d10adb
PNA		 613
614 if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
615 return -EINVAL;
616
617 if (tb[CTA_NAT_MINIP-1])
bff9a89b 618 range->min_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
c1d10adb
PNA		 619
620 if (!tb[CTA_NAT_MAXIP-1])
621 range->max_ip = range->min_ip;
622 else
bff9a89b 623 range->max_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
c1d10adb
PNA		 624
625 if (range->min_ip)
626 range->flags |= IP_NAT_RANGE_MAP_IPS;
627
628 if (!tb[CTA_NAT_PROTO-1])
629 return 0;
630
5b1158e9 631 err = nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO-1], ct, range);
c1d10adb
PNA		 632 if (err < 0)
633 return err;
634
c1d10adb
PNA		 635 return 0;
636}
637#endif
638
639static inline int
640ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
641{
642 struct nfattr *tb[CTA_HELP_MAX];
643
c1d10adb
PNA		 644 nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
645
646 if (!tb[CTA_HELP_NAME-1])
647 return -EINVAL;
648
649 *helper_name = NFA_DATA(tb[CTA_HELP_NAME-1]);
650
651 return 0;
652}
653
654static const size_t cta_min[CTA_MAX] = {
655 [CTA_STATUS-1] = sizeof(u_int32_t),
656 [CTA_TIMEOUT-1] = sizeof(u_int32_t),
657 [CTA_MARK-1] = sizeof(u_int32_t),
658 [CTA_USE-1] = sizeof(u_int32_t),
659 [CTA_ID-1] = sizeof(u_int32_t)
660};
661
662static int
601e68e1 663ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 664 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 665{
666 struct nf_conntrack_tuple_hash *h;
667 struct nf_conntrack_tuple tuple;
668 struct nf_conn *ct;
669 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
670 u_int8_t u3 = nfmsg->nfgen_family;
671 int err = 0;
672
c1d10adb
PNA		 673 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
674 return -EINVAL;
675
676 if (cda[CTA_TUPLE_ORIG-1])
677 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
678 else if (cda[CTA_TUPLE_REPLY-1])
679 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
680 else {
681 /* Flush the whole table */
682 nf_conntrack_flush();
683 return 0;
684 }
685
686 if (err < 0)
687 return err;
688
689 h = nf_conntrack_find_get(&tuple, NULL);
9ea8cfd6 690 if (!h)
c1d10adb 691 return -ENOENT;
c1d10adb
PNA		 692
693 ct = nf_ct_tuplehash_to_ctrack(h);
601e68e1 694
c1d10adb 695 if (cda[CTA_ID-1]) {
bff9a89b 696 u_int32_t id = ntohl(*(__be32 *)NFA_DATA(cda[CTA_ID-1]));
c1d10adb
PNA		 697 if (ct->id != id) {
698 nf_ct_put(ct);
699 return -ENOENT;
700 }
601e68e1 701 }
c1d10adb
PNA		 702 if (del_timer(&ct->timeout))
703 ct->timeout.function((unsigned long)ct);
704
705 nf_ct_put(ct);
c1d10adb
PNA		 706
707 return 0;
708}
709
710static int
601e68e1 711ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 712 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 713{
714 struct nf_conntrack_tuple_hash *h;
715 struct nf_conntrack_tuple tuple;
716 struct nf_conn *ct;
717 struct sk_buff *skb2 = NULL;
718 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
719 u_int8_t u3 = nfmsg->nfgen_family;
720 int err = 0;
721
c1d10adb 722 if (nlh->nlmsg_flags & NLM_F_DUMP) {
01f34848
PNA		 723#ifndef CONFIG_NF_CT_ACCT
724 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO)
c1d10adb
PNA		 725 return -ENOTSUPP;
726#endif
1d00a4eb
TG		 727 err = netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
728 ctnetlink_done);
729 if (err == 0)
730 err = -EINTR;
731 return err;
c1d10adb
PNA		 732 }
733
734 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
735 return -EINVAL;
736
737 if (cda[CTA_TUPLE_ORIG-1])
738 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
739 else if (cda[CTA_TUPLE_REPLY-1])
740 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
741 else
742 return -EINVAL;
743
744 if (err < 0)
745 return err;
746
747 h = nf_conntrack_find_get(&tuple, NULL);
9ea8cfd6 748 if (!h)
c1d10adb 749 return -ENOENT;
9ea8cfd6 750
c1d10adb
PNA		 751 ct = nf_ct_tuplehash_to_ctrack(h);
752
753 err = -ENOMEM;
754 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
755 if (!skb2) {
756 nf_ct_put(ct);
757 return -ENOMEM;
758 }
c1d10adb 759
601e68e1 760 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
c1d10adb
PNA		 761 IPCTNL_MSG_CT_NEW, 1, ct);
762 nf_ct_put(ct);
763 if (err <= 0)
764 goto free;
765
766 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
767 if (err < 0)
768 goto out;
769
c1d10adb
PNA		 770 return 0;
771
772free:
773 kfree_skb(skb2);
774out:
775 return err;
776}
777
778static inline int
779ctnetlink_change_status(struct nf_conn *ct, struct nfattr *cda[])
780{
781 unsigned long d;
bff9a89b 782 unsigned int status = ntohl(*(__be32 *)NFA_DATA(cda[CTA_STATUS-1]));
c1d10adb
PNA		 783 d = ct->status ^ status;
784
785 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
786 /* unchangeable */
787 return -EINVAL;
601e68e1 788
c1d10adb
PNA		 789 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
790 /* SEEN_REPLY bit can only be set */
791 return -EINVAL;
792
601e68e1 793
c1d10adb
PNA		 794 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
795 /* ASSURED bit can only be set */
796 return -EINVAL;
797
3726add7 798 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
5b1158e9 799#ifndef CONFIG_NF_NAT_NEEDED
c1d10adb
PNA		 800 return -EINVAL;
801#else
5b1158e9 802 struct nf_nat_range range;
c1d10adb 803
3726add7 804 if (cda[CTA_NAT_DST-1]) {
5b1158e9 805 if (nfnetlink_parse_nat(cda[CTA_NAT_DST-1], ct,
3726add7
PM		 806 &range) < 0)
807 return -EINVAL;
5b1158e9 808 if (nf_nat_initialized(ct,
3726add7
PM		 809 HOOK2MANIP(NF_IP_PRE_ROUTING)))
810 return -EEXIST;
5b1158e9 811 nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING);
3726add7
PM		 812 }
813 if (cda[CTA_NAT_SRC-1]) {
5b1158e9 814 if (nfnetlink_parse_nat(cda[CTA_NAT_SRC-1], ct,
3726add7
PM		 815 &range) < 0)
816 return -EINVAL;
5b1158e9 817 if (nf_nat_initialized(ct,
3726add7
PM		 818 HOOK2MANIP(NF_IP_POST_ROUTING)))
819 return -EEXIST;
5b1158e9 820 nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING);
3726add7 821 }
c1d10adb
PNA		 822#endif
823 }
824
825 /* Be careful here, modifying NAT bits can screw up things,
826 * so don't let users modify them directly if they don't pass
5b1158e9 827 * nf_nat_range. */
c1d10adb
PNA		 828 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
829 return 0;
830}
831
832
833static inline int
834ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
835{
836 struct nf_conntrack_helper *helper;
dc808fe2 837 struct nf_conn_help *help = nfct_help(ct);
c1d10adb
PNA		 838 char *helpname;
839 int err;
840
dc808fe2
HW		 841 if (!help) {
842 /* FIXME: we need to reallocate and rehash */
843 return -EBUSY;
844 }
845
c1d10adb
PNA		 846 /* don't change helper of sibling connections */
847 if (ct->master)
848 return -EINVAL;
849
850 err = ctnetlink_parse_help(cda[CTA_HELP-1], &helpname);
851 if (err < 0)
852 return err;
853
854 helper = __nf_conntrack_helper_find_byname(helpname);
855 if (!helper) {
856 if (!strcmp(helpname, ""))
857 helper = NULL;
858 else
859 return -EINVAL;
860 }
861
dc808fe2 862 if (help->helper) {
c1d10adb
PNA		 863 if (!helper) {
864 /* we had a helper before ... */
865 nf_ct_remove_expectations(ct);
dc808fe2 866 help->helper = NULL;
c1d10adb
PNA		 867 } else {
868 /* need to zero data of old helper */
dc808fe2 869 memset(&help->help, 0, sizeof(help->help));
c1d10adb
PNA		 870 }
871 }
601e68e1 872
dc808fe2 873 help->helper = helper;
c1d10adb
PNA		 874
875 return 0;
876}
877
878static inline int
879ctnetlink_change_timeout(struct nf_conn *ct, struct nfattr *cda[])
880{
bff9a89b 881 u_int32_t timeout = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
601e68e1 882
c1d10adb
PNA		 883 if (!del_timer(&ct->timeout))
884 return -ETIME;
885
886 ct->timeout.expires = jiffies + timeout * HZ;
887 add_timer(&ct->timeout);
888
889 return 0;
890}
891
892static inline int
893ctnetlink_change_protoinfo(struct nf_conn *ct, struct nfattr *cda[])
894{
895 struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
605dcad6 896 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA		 897 u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
898 u_int16_t l3num = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
899 int err = 0;
900
901 nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr);
902
605dcad6 903 l4proto = nf_ct_l4proto_find_get(l3num, npt);
c1d10adb 904
605dcad6
MJ		 905 if (l4proto->from_nfattr)
906 err = l4proto->from_nfattr(tb, ct);
907 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 908
909 return err;
910}
911
912static int
913ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
914{
915 int err;
916
c1d10adb
PNA		 917 if (cda[CTA_HELP-1]) {
918 err = ctnetlink_change_helper(ct, cda);
919 if (err < 0)
920 return err;
921 }
922
923 if (cda[CTA_TIMEOUT-1]) {
924 err = ctnetlink_change_timeout(ct, cda);
925 if (err < 0)
926 return err;
927 }
928
929 if (cda[CTA_STATUS-1]) {
930 err = ctnetlink_change_status(ct, cda);
931 if (err < 0)
932 return err;
933 }
934
935 if (cda[CTA_PROTOINFO-1]) {
936 err = ctnetlink_change_protoinfo(ct, cda);
937 if (err < 0)
938 return err;
939 }
940
bcd1e830 941#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb 942 if (cda[CTA_MARK-1])
bff9a89b 943 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
c1d10adb
PNA		 944#endif
945
c1d10adb
PNA		 946 return 0;
947}
948
949static int
601e68e1 950ctnetlink_create_conntrack(struct nfattr *cda[],
c1d10adb
PNA		 951 struct nf_conntrack_tuple *otuple,
952 struct nf_conntrack_tuple *rtuple)
953{
954 struct nf_conn *ct;
955 int err = -EINVAL;
dafc741c 956 struct nf_conn_help *help;
c1d10adb 957
c1d10adb
PNA		 958 ct = nf_conntrack_alloc(otuple, rtuple);
959 if (ct == NULL || IS_ERR(ct))
601e68e1 960 return -ENOMEM;
c1d10adb
PNA		 961
962 if (!cda[CTA_TIMEOUT-1])
963 goto err;
bff9a89b 964 ct->timeout.expires = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
c1d10adb
PNA		 965
966 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
967 ct->status |= IPS_CONFIRMED;
968
bbb3357d
PNA		 969 if (cda[CTA_STATUS-1]) {
970 err = ctnetlink_change_status(ct, cda);
971 if (err < 0)
972 goto err;
973 }
c1d10adb
PNA		 974
975 if (cda[CTA_PROTOINFO-1]) {
976 err = ctnetlink_change_protoinfo(ct, cda);
977 if (err < 0)
c54ea3b9 978 goto err;
c1d10adb
PNA		 979 }
980
bcd1e830 981#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb 982 if (cda[CTA_MARK-1])
bff9a89b 983 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
c1d10adb
PNA		 984#endif
985
dafc741c
YK		 986 help = nfct_help(ct);
987 if (help)
988 help->helper = nf_ct_helper_find_get(rtuple);
989
c1d10adb
PNA		 990 add_timer(&ct->timeout);
991 nf_conntrack_hash_insert(ct);
992
dafc741c
YK		 993 if (help && help->helper)
994 nf_ct_helper_put(help->helper);
995
c1d10adb
PNA		 996 return 0;
997
601e68e1 998err:
c1d10adb
PNA		 999 nf_conntrack_free(ct);
1000 return err;
1001}
1002
601e68e1
YH		 1003static int
1004ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1005 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1006{
1007 struct nf_conntrack_tuple otuple, rtuple;
1008 struct nf_conntrack_tuple_hash *h = NULL;
1009 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1010 u_int8_t u3 = nfmsg->nfgen_family;
1011 int err = 0;
1012
c1d10adb
PNA		 1013 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
1014 return -EINVAL;
1015
1016 if (cda[CTA_TUPLE_ORIG-1]) {
1017 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1018 if (err < 0)
1019 return err;
1020 }
1021
1022 if (cda[CTA_TUPLE_REPLY-1]) {
1023 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1024 if (err < 0)
1025 return err;
1026 }
1027
1028 write_lock_bh(&nf_conntrack_lock);
1029 if (cda[CTA_TUPLE_ORIG-1])
1030 h = __nf_conntrack_find(&otuple, NULL);
1031 else if (cda[CTA_TUPLE_REPLY-1])
1032 h = __nf_conntrack_find(&rtuple, NULL);
1033
1034 if (h == NULL) {
1035 write_unlock_bh(&nf_conntrack_lock);
c1d10adb
PNA		 1036 err = -ENOENT;
1037 if (nlh->nlmsg_flags & NLM_F_CREATE)
1038 err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
1039 return err;
1040 }
1041 /* implicit 'else' */
1042
1043 /* we only allow nat config for new conntracks */
3726add7 1044 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
c1d10adb
PNA		 1045 err = -EINVAL;
1046 goto out_unlock;
1047 }
1048
1049 /* We manipulate the conntrack inside the global conntrack table lock,
1050 * so there's no need to increase the refcount */
c1d10adb
PNA		 1051 err = -EEXIST;
1052 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1053 err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
1054
1055out_unlock:
1056 write_unlock_bh(&nf_conntrack_lock);
1057 return err;
1058}
1059
601e68e1
YH		 1060/***********************************************************************
1061 * EXPECT
1062 ***********************************************************************/
c1d10adb
PNA		 1063
1064static inline int
1065ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1066 const struct nf_conntrack_tuple *tuple,
1067 enum ctattr_expect type)
1068{
1069 struct nfattr *nest_parms = NFA_NEST(skb, type);
601e68e1 1070
c1d10adb
PNA		 1071 if (ctnetlink_dump_tuples(skb, tuple) < 0)
1072 goto nfattr_failure;
1073
1074 NFA_NEST_END(skb, nest_parms);
1075
1076 return 0;
1077
1078nfattr_failure:
1079 return -1;
601e68e1 1080}
c1d10adb 1081
1cde6436
PNA		 1082static inline int
1083ctnetlink_exp_dump_mask(struct sk_buff *skb,
1084 const struct nf_conntrack_tuple *tuple,
1085 const struct nf_conntrack_tuple *mask)
1086{
1087 int ret;
1088 struct nf_conntrack_l3proto *l3proto;
605dcad6 1089 struct nf_conntrack_l4proto *l4proto;
1cde6436
PNA		 1090 struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
1091
1092 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
1093 ret = ctnetlink_dump_tuples_ip(skb, mask, l3proto);
1094 nf_ct_l3proto_put(l3proto);
1095
1096 if (unlikely(ret < 0))
1097 goto nfattr_failure;
1098
605dcad6
MJ		 1099 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
1100 ret = ctnetlink_dump_tuples_proto(skb, mask, l4proto);
1101 nf_ct_l4proto_put(l4proto);
1cde6436
PNA		 1102 if (unlikely(ret < 0))
1103 goto nfattr_failure;
1104
1105 NFA_NEST_END(skb, nest_parms);
1106
1107 return 0;
1108
1109nfattr_failure:
1110 return -1;
1111}
1112
c1d10adb
PNA		 1113static inline int
1114ctnetlink_exp_dump_expect(struct sk_buff *skb,
601e68e1 1115 const struct nf_conntrack_expect *exp)
c1d10adb
PNA		 1116{
1117 struct nf_conn *master = exp->master;
bff9a89b
PM		 1118 __be32 timeout = htonl((exp->timeout.expires - jiffies) / HZ);
1119 __be32 id = htonl(exp->id);
c1d10adb
PNA		 1120
1121 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1122 goto nfattr_failure;
1cde6436 1123 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
c1d10adb
PNA		 1124 goto nfattr_failure;
1125 if (ctnetlink_exp_dump_tuple(skb,
1126 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1127 CTA_EXPECT_MASTER) < 0)
1128 goto nfattr_failure;
601e68e1 1129
c1d10adb
PNA		 1130 NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(timeout), &timeout);
1131 NFA_PUT(skb, CTA_EXPECT_ID, sizeof(u_int32_t), &id);
1132
1133 return 0;
601e68e1 1134
c1d10adb
PNA		 1135nfattr_failure:
1136 return -1;
1137}
1138
1139static int
1140ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
601e68e1
YH		 1141 int event,
1142 int nowait,
c1d10adb
PNA		 1143 const struct nf_conntrack_expect *exp)
1144{
1145 struct nlmsghdr *nlh;
1146 struct nfgenmsg *nfmsg;
27a884dc 1147 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA		 1148
1149 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1150 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1151 nfmsg = NLMSG_DATA(nlh);
1152
1153 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1154 nfmsg->nfgen_family = exp->tuple.src.l3num;
1155 nfmsg->version = NFNETLINK_V0;
1156 nfmsg->res_id = 0;
1157
1158 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1159 goto nfattr_failure;
1160
27a884dc 1161 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA		 1162 return skb->len;
1163
1164nlmsg_failure:
1165nfattr_failure:
dc5fc579 1166 nlmsg_trim(skb, b);
c1d10adb
PNA		 1167 return -1;
1168}
1169
1170#ifdef CONFIG_NF_CONNTRACK_EVENTS
1171static int ctnetlink_expect_event(struct notifier_block *this,
1172 unsigned long events, void *ptr)
1173{
1174 struct nlmsghdr *nlh;
1175 struct nfgenmsg *nfmsg;
1176 struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
1177 struct sk_buff *skb;
1178 unsigned int type;
27a884dc 1179 sk_buff_data_t b;
c1d10adb
PNA		 1180 int flags = 0;
1181
1182 if (events & IPEXP_NEW) {
1183 type = IPCTNL_MSG_EXP_NEW;
1184 flags = NLM_F_CREATE|NLM_F_EXCL;
1185 } else
1186 return NOTIFY_DONE;
1187
b3a27bfb
PNA		 1188 if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
1189 return NOTIFY_DONE;
1190
c1d10adb
PNA		 1191 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1192 if (!skb)
1193 return NOTIFY_DONE;
1194
1195 b = skb->tail;
1196
b633ad5f 1197 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
c1d10adb
PNA		 1198 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
1199 nfmsg = NLMSG_DATA(nlh);
1200
1201 nlh->nlmsg_flags = flags;
1202 nfmsg->nfgen_family = exp->tuple.src.l3num;
1203 nfmsg->version = NFNETLINK_V0;
1204 nfmsg->res_id = 0;
1205
1206 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1207 goto nfattr_failure;
1208
1209 nlh->nlmsg_len = skb->tail - b;
1210 nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
1211 return NOTIFY_DONE;
1212
1213nlmsg_failure:
1214nfattr_failure:
1215 kfree_skb(skb);
1216 return NOTIFY_DONE;
1217}
1218#endif
1219
1220static int
1221ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1222{
1223 struct nf_conntrack_expect *exp = NULL;
1224 struct list_head *i;
1225 u_int32_t *id = (u_int32_t *) &cb->args[0];
87711cb8
PNA		 1226 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
1227 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 1228
c1d10adb
PNA		 1229 read_lock_bh(&nf_conntrack_lock);
1230 list_for_each_prev(i, &nf_conntrack_expect_list) {
1231 exp = (struct nf_conntrack_expect *) i;
87711cb8
PNA		 1232 if (l3proto && exp->tuple.src.l3num != l3proto)
1233 continue;
c1d10adb
PNA		 1234 if (exp->id <= *id)
1235 continue;
1236 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1237 cb->nlh->nlmsg_seq,
1238 IPCTNL_MSG_EXP_NEW,
1239 1, exp) < 0)
1240 goto out;
1241 *id = exp->id;
1242 }
601e68e1 1243out:
c1d10adb
PNA		 1244 read_unlock_bh(&nf_conntrack_lock);
1245
c1d10adb
PNA		 1246 return skb->len;
1247}
1248
1249static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
1250 [CTA_EXPECT_TIMEOUT-1] = sizeof(u_int32_t),
1251 [CTA_EXPECT_ID-1] = sizeof(u_int32_t)
1252};
1253
1254static int
601e68e1 1255ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1256 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1257{
1258 struct nf_conntrack_tuple tuple;
1259 struct nf_conntrack_expect *exp;
1260 struct sk_buff *skb2;
1261 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1262 u_int8_t u3 = nfmsg->nfgen_family;
1263 int err = 0;
1264
c1d10adb
PNA		 1265 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1266 return -EINVAL;
1267
1268 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1d00a4eb
TG		 1269 err = netlink_dump_start(ctnl, skb, nlh,
1270 ctnetlink_exp_dump_table,
1271 ctnetlink_done);
1272 if (err == 0)
1273 err = -EINTR;
1274 return err;
c1d10adb
PNA		 1275 }
1276
1277 if (cda[CTA_EXPECT_MASTER-1])
1278 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1279 else
1280 return -EINVAL;
1281
1282 if (err < 0)
1283 return err;
1284
468ec44b 1285 exp = nf_conntrack_expect_find_get(&tuple);
c1d10adb
PNA		 1286 if (!exp)
1287 return -ENOENT;
1288
1289 if (cda[CTA_EXPECT_ID-1]) {
bff9a89b 1290 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
c1d10adb
PNA		 1291 if (exp->id != ntohl(id)) {
1292 nf_conntrack_expect_put(exp);
1293 return -ENOENT;
1294 }
601e68e1 1295 }
c1d10adb
PNA		 1296
1297 err = -ENOMEM;
1298 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1299 if (!skb2)
1300 goto out;
4e9b8269 1301
601e68e1 1302 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
c1d10adb
PNA		 1303 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1304 1, exp);
1305 if (err <= 0)
1306 goto free;
1307
1308 nf_conntrack_expect_put(exp);
1309
1310 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1311
1312free:
1313 kfree_skb(skb2);
1314out:
1315 nf_conntrack_expect_put(exp);
1316 return err;
1317}
1318
1319static int
601e68e1 1320ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1321 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1322{
1323 struct nf_conntrack_expect *exp, *tmp;
1324 struct nf_conntrack_tuple tuple;
1325 struct nf_conntrack_helper *h;
1326 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1327 u_int8_t u3 = nfmsg->nfgen_family;
1328 int err;
1329
1330 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1331 return -EINVAL;
1332
1333 if (cda[CTA_EXPECT_TUPLE-1]) {
1334 /* delete a single expect by tuple */
1335 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1336 if (err < 0)
1337 return err;
1338
1339 /* bump usage count to 2 */
468ec44b 1340 exp = nf_conntrack_expect_find_get(&tuple);
c1d10adb
PNA		 1341 if (!exp)
1342 return -ENOENT;
1343
1344 if (cda[CTA_EXPECT_ID-1]) {
bff9a89b 1345 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
c1d10adb
PNA		 1346 if (exp->id != ntohl(id)) {
1347 nf_conntrack_expect_put(exp);
1348 return -ENOENT;
1349 }
1350 }
1351
1352 /* after list removal, usage count == 1 */
1353 nf_conntrack_unexpect_related(exp);
601e68e1 1354 /* have to put what we 'get' above.
c1d10adb
PNA		 1355 * after this line usage count == 0 */
1356 nf_conntrack_expect_put(exp);
1357 } else if (cda[CTA_EXPECT_HELP_NAME-1]) {
1358 char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
1359
1360 /* delete all expectations for this helper */
1361 write_lock_bh(&nf_conntrack_lock);
1362 h = __nf_conntrack_helper_find_byname(name);
1363 if (!h) {
1364 write_unlock_bh(&nf_conntrack_lock);
1365 return -EINVAL;
1366 }
1367 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1368 list) {
dc808fe2
HW		 1369 struct nf_conn_help *m_help = nfct_help(exp->master);
1370 if (m_help->helper == h
c1d10adb
PNA		 1371 && del_timer(&exp->timeout)) {
1372 nf_ct_unlink_expect(exp);
1373 nf_conntrack_expect_put(exp);
1374 }
1375 }
1376 write_unlock_bh(&nf_conntrack_lock);
1377 } else {
1378 /* This basically means we have to flush everything*/
1379 write_lock_bh(&nf_conntrack_lock);
1380 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1381 list) {
1382 if (del_timer(&exp->timeout)) {
1383 nf_ct_unlink_expect(exp);
1384 nf_conntrack_expect_put(exp);
1385 }
1386 }
1387 write_unlock_bh(&nf_conntrack_lock);
1388 }
1389
1390 return 0;
1391}
1392static int
1393ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nfattr *cda[])
1394{
1395 return -EOPNOTSUPP;
1396}
1397
1398static int
1399ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
1400{
1401 struct nf_conntrack_tuple tuple, mask, master_tuple;
1402 struct nf_conntrack_tuple_hash *h = NULL;
1403 struct nf_conntrack_expect *exp;
1404 struct nf_conn *ct;
dc808fe2 1405 struct nf_conn_help *help;
c1d10adb
PNA		 1406 int err = 0;
1407
c1d10adb
PNA		 1408 /* caller guarantees that those three CTA_EXPECT_* exist */
1409 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1410 if (err < 0)
1411 return err;
1412 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1413 if (err < 0)
1414 return err;
1415 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1416 if (err < 0)
1417 return err;
1418
1419 /* Look for master conntrack of this expectation */
1420 h = nf_conntrack_find_get(&master_tuple, NULL);
1421 if (!h)
1422 return -ENOENT;
1423 ct = nf_ct_tuplehash_to_ctrack(h);
dc808fe2 1424 help = nfct_help(ct);
c1d10adb 1425
dc808fe2 1426 if (!help || !help->helper) {
c1d10adb
PNA		 1427 /* such conntrack hasn't got any helper, abort */
1428 err = -EINVAL;
1429 goto out;
1430 }
1431
1432 exp = nf_conntrack_expect_alloc(ct);
1433 if (!exp) {
1434 err = -ENOMEM;
1435 goto out;
1436 }
601e68e1 1437
c1d10adb
PNA		 1438 exp->expectfn = NULL;
1439 exp->flags = 0;
1440 exp->master = ct;
9457d851 1441 exp->helper = NULL;
c1d10adb
PNA		 1442 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
1443 memcpy(&exp->mask, &mask, sizeof(struct nf_conntrack_tuple));
1444
1445 err = nf_conntrack_expect_related(exp);
1446 nf_conntrack_expect_put(exp);
1447
601e68e1 1448out:
c1d10adb
PNA		 1449 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1450 return err;
1451}
1452
1453static int
1454ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1455 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1456{
1457 struct nf_conntrack_tuple tuple;
1458 struct nf_conntrack_expect *exp;
1459 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1460 u_int8_t u3 = nfmsg->nfgen_family;
1461 int err = 0;
1462
c1d10adb
PNA		 1463 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1464 return -EINVAL;
1465
1466 if (!cda[CTA_EXPECT_TUPLE-1]
1467 || !cda[CTA_EXPECT_MASK-1]
1468 || !cda[CTA_EXPECT_MASTER-1])
1469 return -EINVAL;
1470
1471 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1472 if (err < 0)
1473 return err;
1474
1475 write_lock_bh(&nf_conntrack_lock);
1476 exp = __nf_conntrack_expect_find(&tuple);
1477
1478 if (!exp) {
1479 write_unlock_bh(&nf_conntrack_lock);
1480 err = -ENOENT;
1481 if (nlh->nlmsg_flags & NLM_F_CREATE)
1482 err = ctnetlink_create_expect(cda, u3);
1483 return err;
1484 }
1485
1486 err = -EEXIST;
1487 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1488 err = ctnetlink_change_expect(exp, cda);
1489 write_unlock_bh(&nf_conntrack_lock);
1490
c1d10adb
PNA		 1491 return err;
1492}
1493
1494#ifdef CONFIG_NF_CONNTRACK_EVENTS
1495static struct notifier_block ctnl_notifier = {
1496 .notifier_call = ctnetlink_conntrack_event,
1497};
1498
1499static struct notifier_block ctnl_notifier_exp = {
1500 .notifier_call = ctnetlink_expect_event,
1501};
1502#endif
1503
1504static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1505 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1506 .attr_count = CTA_MAX, },
1507 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1508 .attr_count = CTA_MAX, },
1509 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1510 .attr_count = CTA_MAX, },
1511 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1512 .attr_count = CTA_MAX, },
1513};
1514
1515static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1516 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1517 .attr_count = CTA_EXPECT_MAX, },
1518 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1519 .attr_count = CTA_EXPECT_MAX, },
1520 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1521 .attr_count = CTA_EXPECT_MAX, },
1522};
1523
1524static struct nfnetlink_subsystem ctnl_subsys = {
1525 .name = "conntrack",
1526 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1527 .cb_count = IPCTNL_MSG_MAX,
1528 .cb = ctnl_cb,
1529};
1530
1531static struct nfnetlink_subsystem ctnl_exp_subsys = {
1532 .name = "conntrack_expect",
1533 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1534 .cb_count = IPCTNL_MSG_EXP_MAX,
1535 .cb = ctnl_exp_cb,
1536};
1537
d2483dde 1538MODULE_ALIAS("ip_conntrack_netlink");
c1d10adb 1539MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
34f9a2e4 1540MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
c1d10adb
PNA		 1541
1542static int __init ctnetlink_init(void)
1543{
1544 int ret;
1545
1546 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1547 ret = nfnetlink_subsys_register(&ctnl_subsys);
1548 if (ret < 0) {
1549 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1550 goto err_out;
1551 }
1552
1553 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1554 if (ret < 0) {
1555 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1556 goto err_unreg_subsys;
1557 }
1558
1559#ifdef CONFIG_NF_CONNTRACK_EVENTS
1560 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1561 if (ret < 0) {
1562 printk("ctnetlink_init: cannot register notifier.\n");
1563 goto err_unreg_exp_subsys;
1564 }
1565
1566 ret = nf_conntrack_expect_register_notifier(&ctnl_notifier_exp);
1567 if (ret < 0) {
1568 printk("ctnetlink_init: cannot expect register notifier.\n");
1569 goto err_unreg_notifier;
1570 }
1571#endif
1572
1573 return 0;
1574
1575#ifdef CONFIG_NF_CONNTRACK_EVENTS
1576err_unreg_notifier:
1577 nf_conntrack_unregister_notifier(&ctnl_notifier);
1578err_unreg_exp_subsys:
1579 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1580#endif
1581err_unreg_subsys:
1582 nfnetlink_subsys_unregister(&ctnl_subsys);
1583err_out:
1584 return ret;
1585}
1586
1587static void __exit ctnetlink_exit(void)
1588{
1589 printk("ctnetlink: unregistering from nfnetlink.\n");
1590
1591#ifdef CONFIG_NF_CONNTRACK_EVENTS
e64a70be 1592 nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
c1d10adb
PNA		 1593 nf_conntrack_unregister_notifier(&ctnl_notifier);
1594#endif
1595
1596 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1597 nfnetlink_subsys_unregister(&ctnl_subsys);
1598 return;
1599}
1600
1601module_init(ctnetlink_init);
1602module_exit(ctnetlink_exit);
ubuntu-bionic-kernel mirror