]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - net/netfilter/nfnetlink_cthelper.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netfilter: Add nfnl_msg_type() helper function
[mirror_ubuntu-artful-kernel.git] / net / netfilter / nfnetlink_cthelper.c
CommitLineData
12f7a505
PNA		 1/*
2 * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation (or any later at your option).
7 *
8 * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com>
9 */
10#include <linux/init.h>
11#include <linux/module.h>
12#include <linux/kernel.h>
13#include <linux/skbuff.h>
14#include <linux/netlink.h>
15#include <linux/rculist.h>
16#include <linux/slab.h>
17#include <linux/types.h>
18#include <linux/list.h>
19#include <linux/errno.h>
20#include <net/netlink.h>
21#include <net/sock.h>
22
23#include <net/netfilter/nf_conntrack_helper.h>
24#include <net/netfilter/nf_conntrack_expect.h>
25#include <net/netfilter/nf_conntrack_ecache.h>
26
27#include <linux/netfilter/nfnetlink.h>
28#include <linux/netfilter/nfnetlink_conntrack.h>
29#include <linux/netfilter/nfnetlink_cthelper.h>
30
31MODULE_LICENSE("GPL");
32MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
33MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers");
34
83d90219
LZ		 35struct nfnl_cthelper {
36 struct list_head list;
37 struct nf_conntrack_helper helper;
38};
39
40static LIST_HEAD(nfnl_cthelper_list);
41
12f7a505
PNA		 42static int
43nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff,
44 struct nf_conn *ct, enum ip_conntrack_info ctinfo)
45{
46 const struct nf_conn_help *help;
47 struct nf_conntrack_helper *helper;
48
49 help = nfct_help(ct);
50 if (help == NULL)
51 return NF_DROP;
52
e2361cb9 53 /* rcu_read_lock()ed by nf_hook_thresh */
12f7a505
PNA		 54 helper = rcu_dereference(help->helper);
55 if (helper == NULL)
56 return NF_DROP;
57
9332ef9d 58 /* This is a user-space helper not yet configured, skip. */
12f7a505
PNA		 59 if ((helper->flags &
60 (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) ==
61 NF_CT_HELPER_F_USERSPACE)
62 return NF_ACCEPT;
63
64 /* If the user-space helper is not available, don't block traffic. */
65 return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS;
66}
67
68static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = {
69 [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, },
70 [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, },
71};
72
73static int
74nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
75 const struct nlattr *attr)
76{
130ffbc2 77 int err;
12f7a505
PNA		 78 struct nlattr *tb[NFCTH_TUPLE_MAX+1];
79
130ffbc2
DB		 80 err = nla_parse_nested(tb, NFCTH_TUPLE_MAX, attr, nfnl_cthelper_tuple_pol);
81 if (err < 0)
82 return err;
12f7a505
PNA		 83
84 if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
85 return -EINVAL;
86
78146572
IW		 87 /* Not all fields are initialized so first zero the tuple */
88 memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
89
fe31d1a8 90 tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
12f7a505
PNA		 91 tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
92
93 return 0;
94}
95
96static int
97nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
98{
b18c5d15 99 struct nf_conn_help *help = nfct_help(ct);
12f7a505 100
7be54ca4
PNA		 101 if (attr == NULL)
102 return -EINVAL;
103
12f7a505
PNA		 104 if (help->helper->data_len == 0)
105 return -EINVAL;
106
b18c5d15 107 memcpy(help->data, nla_data(attr), help->helper->data_len);
12f7a505
PNA		 108 return 0;
109}
110
111static int
112nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct)
113{
114 const struct nf_conn_help *help = nfct_help(ct);
115
116 if (help->helper->data_len &&
117 nla_put(skb, CTA_HELP_INFO, help->helper->data_len, &help->data))
118 goto nla_put_failure;
119
120 return 0;
121
122nla_put_failure:
123 return -ENOSPC;
124}
125
126static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = {
127 [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING,
128 .len = NF_CT_HELPER_NAME_LEN-1 },
129 [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, },
130 [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, },
131};
132
133static int
134nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
135 const struct nlattr *attr)
136{
130ffbc2 137 int err;
12f7a505
PNA		 138 struct nlattr *tb[NFCTH_POLICY_MAX+1];
139
130ffbc2
DB		 140 err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr, nfnl_cthelper_expect_pol);
141 if (err < 0)
142 return err;
12f7a505
PNA		 143
144 if (!tb[NFCTH_POLICY_NAME] ||
145 !tb[NFCTH_POLICY_EXPECT_MAX] ||
146 !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
147 return -EINVAL;
148
149 strncpy(expect_policy->name,
150 nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
151 expect_policy->max_expected =
152 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
92f73221
GF		 153 if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
154 return -EINVAL;
155
12f7a505
PNA		 156 expect_policy->timeout =
157 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
158
159 return 0;
160}
161
162static const struct nla_policy
163nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = {
164 [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, },
165};
166
167static int
168nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
169 const struct nlattr *attr)
170{
171 int i, ret;
172 struct nf_conntrack_expect_policy *expect_policy;
173 struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
ae5c6821 174 unsigned int class_max;
12f7a505 175
130ffbc2
DB		 176 ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
177 nfnl_cthelper_expect_policy_set);
178 if (ret < 0)
179 return ret;
12f7a505
PNA		 180
181 if (!tb[NFCTH_POLICY_SET_NUM])
182 return -EINVAL;
183
ae5c6821
LZ		 184 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
185 if (class_max == 0)
186 return -EINVAL;
187 if (class_max > NF_CT_MAX_EXPECT_CLASSES)
12f7a505
PNA		 188 return -EOVERFLOW;
189
190 expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
ae5c6821 191 class_max, GFP_KERNEL);
12f7a505
PNA		 192 if (expect_policy == NULL)
193 return -ENOMEM;
194
ae5c6821 195 for (i = 0; i < class_max; i++) {
12f7a505
PNA		 196 if (!tb[NFCTH_POLICY_SET+i])
197 goto err;
198
199 ret = nfnl_cthelper_expect_policy(&expect_policy[i],
200 tb[NFCTH_POLICY_SET+i]);
201 if (ret < 0)
202 goto err;
203 }
ae5c6821
LZ		 204
205 helper->expect_class_max = class_max - 1;
12f7a505
PNA		 206 helper->expect_policy = expect_policy;
207 return 0;
208err:
209 kfree(expect_policy);
210 return -EINVAL;
211}
212
213static int
214nfnl_cthelper_create(const struct nlattr * const tb[],
215 struct nf_conntrack_tuple *tuple)
216{
217 struct nf_conntrack_helper *helper;
83d90219 218 struct nfnl_cthelper *nfcth;
12f7a505
PNA		 219 int ret;
220
221 if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN])
222 return -EINVAL;
223
83d90219
LZ		 224 nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL);
225 if (nfcth == NULL)
12f7a505 226 return -ENOMEM;
83d90219 227 helper = &nfcth->helper;
12f7a505
PNA		 228
229 ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]);
230 if (ret < 0)
f83bf8da 231 goto err1;
12f7a505
PNA		 232
233 strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
234 helper->data_len = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
235 helper->flags |= NF_CT_HELPER_F_USERSPACE;
236 memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));
237
238 helper->me = THIS_MODULE;
239 helper->help = nfnl_userspace_cthelper;
240 helper->from_nlattr = nfnl_cthelper_from_nlattr;
241 helper->to_nlattr = nfnl_cthelper_to_nlattr;
242
243 /* Default to queue number zero, this can be updated at any time. */
244 if (tb[NFCTH_QUEUE_NUM])
245 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
246
247 if (tb[NFCTH_STATUS]) {
248 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
249
250 switch(status) {
251 case NFCT_HELPER_STATUS_ENABLED:
252 helper->flags |= NF_CT_HELPER_F_CONFIGURED;
253 break;
254 case NFCT_HELPER_STATUS_DISABLED:
255 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED;
256 break;
257 }
258 }
259
260 ret = nf_conntrack_helper_register(helper);
261 if (ret < 0)
f83bf8da 262 goto err2;
12f7a505 263
83d90219 264 list_add_tail(&nfcth->list, &nfnl_cthelper_list);
12f7a505 265 return 0;
f83bf8da
JC		 266err2:
267 kfree(helper->expect_policy);
268err1:
83d90219 269 kfree(nfcth);
12f7a505
PNA		 270 return ret;
271}
272
2c422257
PNA		 273static int
274nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy,
275 struct nf_conntrack_expect_policy *new_policy,
276 const struct nlattr *attr)
277{
278 struct nlattr *tb[NFCTH_POLICY_MAX + 1];
279 int err;
280
281 err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr,
282 nfnl_cthelper_expect_pol);
283 if (err < 0)
284 return err;
285
286 if (!tb[NFCTH_POLICY_NAME] ||
287 !tb[NFCTH_POLICY_EXPECT_MAX] ||
288 !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
289 return -EINVAL;
290
291 if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name))
292 return -EBUSY;
293
294 new_policy->max_expected =
295 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
92f73221
GF		 296 if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
297 return -EINVAL;
298
2c422257
PNA		 299 new_policy->timeout =
300 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
301
302 return 0;
303}
304
305static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
306 struct nf_conntrack_helper *helper)
307{
308 struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1];
309 struct nf_conntrack_expect_policy *policy;
310 int i, err;
311
312 /* Check first that all policy attributes are well-formed, so we don't
313 * leave things in inconsistent state on errors.
314 */
315 for (i = 0; i < helper->expect_class_max + 1; i++) {
316
317 if (!tb[NFCTH_POLICY_SET + i])
318 return -EINVAL;
319
320 err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
321 &new_policy[i],
322 tb[NFCTH_POLICY_SET + i]);
323 if (err < 0)
324 return err;
325 }
326 /* Now we can safely update them. */
327 for (i = 0; i < helper->expect_class_max + 1; i++) {
328 policy = (struct nf_conntrack_expect_policy *)
329 &helper->expect_policy[i];
330 policy->max_expected = new_policy->max_expected;
331 policy->timeout = new_policy->timeout;
332 }
333
334 return 0;
335}
336
337static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper,
338 const struct nlattr *attr)
339{
340 struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1];
341 unsigned int class_max;
342 int err;
343
344 err = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
345 nfnl_cthelper_expect_policy_set);
346 if (err < 0)
347 return err;
348
349 if (!tb[NFCTH_POLICY_SET_NUM])
350 return -EINVAL;
351
352 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
353 if (helper->expect_class_max + 1 != class_max)
354 return -EBUSY;
355
356 return nfnl_cthelper_update_policy_all(tb, helper);
357}
358
12f7a505
PNA		 359static int
360nfnl_cthelper_update(const struct nlattr * const tb[],
361 struct nf_conntrack_helper *helper)
362{
363 int ret;
364
365 if (tb[NFCTH_PRIV_DATA_LEN])
366 return -EBUSY;
367
368 if (tb[NFCTH_POLICY]) {
2c422257 369 ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);
12f7a505
PNA		 370 if (ret < 0)
371 return ret;
372 }
373 if (tb[NFCTH_QUEUE_NUM])
374 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
375
376 if (tb[NFCTH_STATUS]) {
377 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
378
379 switch(status) {
380 case NFCT_HELPER_STATUS_ENABLED:
381 helper->flags |= NF_CT_HELPER_F_CONFIGURED;
382 break;
383 case NFCT_HELPER_STATUS_DISABLED:
384 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED;
385 break;
386 }
387 }
388 return 0;
389}
390
7b8002a1
PNA		 391static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
392 struct sk_buff *skb, const struct nlmsghdr *nlh,
393 const struct nlattr * const tb[])
12f7a505
PNA		 394{
395 const char *helper_name;
396 struct nf_conntrack_helper *cur, *helper = NULL;
397 struct nf_conntrack_tuple tuple;
83d90219
LZ		 398 struct nfnl_cthelper *nlcth;
399 int ret = 0;
12f7a505
PNA		 400
401 if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
402 return -EINVAL;
403
404 helper_name = nla_data(tb[NFCTH_NAME]);
405
406 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
407 if (ret < 0)
408 return ret;
409
83d90219
LZ		 410 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
411 cur = &nlcth->helper;
12f7a505 412
83d90219
LZ		 413 if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
414 continue;
12f7a505 415
83d90219
LZ		 416 if ((tuple.src.l3num != cur->tuple.src.l3num ||
417 tuple.dst.protonum != cur->tuple.dst.protonum))
418 continue;
12f7a505 419
83d90219
LZ		 420 if (nlh->nlmsg_flags & NLM_F_EXCL)
421 return -EEXIST;
12f7a505 422
83d90219
LZ		 423 helper = cur;
424 break;
12f7a505 425 }
12f7a505
PNA		 426
427 if (helper == NULL)
428 ret = nfnl_cthelper_create(tb, &tuple);
429 else
430 ret = nfnl_cthelper_update(tb, helper);
431
432 return ret;
12f7a505
PNA		 433}
434
435static int
436nfnl_cthelper_dump_tuple(struct sk_buff *skb,
437 struct nf_conntrack_helper *helper)
438{
439 struct nlattr *nest_parms;
440
441 nest_parms = nla_nest_start(skb, NFCTH_TUPLE | NLA_F_NESTED);
442 if (nest_parms == NULL)
443 goto nla_put_failure;
444
445 if (nla_put_be16(skb, NFCTH_TUPLE_L3PROTONUM,
446 htons(helper->tuple.src.l3num)))
447 goto nla_put_failure;
448
449 if (nla_put_u8(skb, NFCTH_TUPLE_L4PROTONUM, helper->tuple.dst.protonum))
450 goto nla_put_failure;
451
452 nla_nest_end(skb, nest_parms);
453 return 0;
454
455nla_put_failure:
456 return -1;
457}
458
459static int
460nfnl_cthelper_dump_policy(struct sk_buff *skb,
461 struct nf_conntrack_helper *helper)
462{
463 int i;
464 struct nlattr *nest_parms1, *nest_parms2;
465
466 nest_parms1 = nla_nest_start(skb, NFCTH_POLICY | NLA_F_NESTED);
467 if (nest_parms1 == NULL)
468 goto nla_put_failure;
469
470 if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
ae5c6821 471 htonl(helper->expect_class_max + 1)))
12f7a505
PNA		 472 goto nla_put_failure;
473
ae5c6821 474 for (i = 0; i < helper->expect_class_max + 1; i++) {
12f7a505
PNA		 475 nest_parms2 = nla_nest_start(skb,
476 (NFCTH_POLICY_SET+i) | NLA_F_NESTED);
477 if (nest_parms2 == NULL)
478 goto nla_put_failure;
479
480 if (nla_put_string(skb, NFCTH_POLICY_NAME,
481 helper->expect_policy[i].name))
482 goto nla_put_failure;
483
484 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_MAX,
485 htonl(helper->expect_policy[i].max_expected)))
486 goto nla_put_failure;
487
488 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_TIMEOUT,
489 htonl(helper->expect_policy[i].timeout)))
490 goto nla_put_failure;
491
492 nla_nest_end(skb, nest_parms2);
493 }
494 nla_nest_end(skb, nest_parms1);
495 return 0;
496
497nla_put_failure:
498 return -1;
499}
500
501static int
15e47304 502nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
12f7a505
PNA		 503 int event, struct nf_conntrack_helper *helper)
504{
505 struct nlmsghdr *nlh;
506 struct nfgenmsg *nfmsg;
15e47304 507 unsigned int flags = portid ? NLM_F_MULTI : 0;
12f7a505
PNA		 508 int status;
509
dedb67c4 510 event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event);
15e47304 511 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
12f7a505
PNA		 512 if (nlh == NULL)
513 goto nlmsg_failure;
514
515 nfmsg = nlmsg_data(nlh);
516 nfmsg->nfgen_family = AF_UNSPEC;
517 nfmsg->version = NFNETLINK_V0;
518 nfmsg->res_id = 0;
519
520 if (nla_put_string(skb, NFCTH_NAME, helper->name))
521 goto nla_put_failure;
522
523 if (nla_put_be32(skb, NFCTH_QUEUE_NUM, htonl(helper->queue_num)))
524 goto nla_put_failure;
525
526 if (nfnl_cthelper_dump_tuple(skb, helper) < 0)
527 goto nla_put_failure;
528
529 if (nfnl_cthelper_dump_policy(skb, helper) < 0)
530 goto nla_put_failure;
531
532 if (nla_put_be32(skb, NFCTH_PRIV_DATA_LEN, htonl(helper->data_len)))
533 goto nla_put_failure;
534
535 if (helper->flags & NF_CT_HELPER_F_CONFIGURED)
536 status = NFCT_HELPER_STATUS_ENABLED;
537 else
538 status = NFCT_HELPER_STATUS_DISABLED;
539
540 if (nla_put_be32(skb, NFCTH_STATUS, htonl(status)))
541 goto nla_put_failure;
542
543 nlmsg_end(skb, nlh);
544 return skb->len;
545
546nlmsg_failure:
547nla_put_failure:
548 nlmsg_cancel(skb, nlh);
549 return -1;
550}
551
552static int
553nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
554{
555 struct nf_conntrack_helper *cur, *last;
12f7a505
PNA		 556
557 rcu_read_lock();
558 last = (struct nf_conntrack_helper *)cb->args[1];
559 for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) {
560restart:
b67bfe0d 561 hlist_for_each_entry_rcu(cur,
12f7a505
PNA		 562 &nf_ct_helper_hash[cb->args[0]], hnode) {
563
564 /* skip non-userspace conntrack helpers. */
565 if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
566 continue;
567
568 if (cb->args[1]) {
569 if (cur != last)
570 continue;
571 cb->args[1] = 0;
572 }
573 if (nfnl_cthelper_fill_info(skb,
15e47304 574 NETLINK_CB(cb->skb).portid,
12f7a505
PNA		 575 cb->nlh->nlmsg_seq,
576 NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
577 NFNL_MSG_CTHELPER_NEW, cur) < 0) {
578 cb->args[1] = (unsigned long)cur;
579 goto out;
580 }
581 }
582 }
583 if (cb->args[1]) {
584 cb->args[1] = 0;
585 goto restart;
586 }
587out:
588 rcu_read_unlock();
589 return skb->len;
590}
591
7b8002a1
PNA		 592static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
593 struct sk_buff *skb, const struct nlmsghdr *nlh,
594 const struct nlattr * const tb[])
12f7a505 595{
83d90219 596 int ret = -ENOENT;
12f7a505 597 struct nf_conntrack_helper *cur;
12f7a505
PNA		 598 struct sk_buff *skb2;
599 char *helper_name = NULL;
600 struct nf_conntrack_tuple tuple;
83d90219 601 struct nfnl_cthelper *nlcth;
12f7a505
PNA		 602 bool tuple_set = false;
603
604 if (nlh->nlmsg_flags & NLM_F_DUMP) {
605 struct netlink_dump_control c = {
606 .dump = nfnl_cthelper_dump_table,
607 };
608 return netlink_dump_start(nfnl, skb, nlh, &c);
609 }
610
611 if (tb[NFCTH_NAME])
612 helper_name = nla_data(tb[NFCTH_NAME]);
613
614 if (tb[NFCTH_TUPLE]) {
615 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
616 if (ret < 0)
617 return ret;
618
619 tuple_set = true;
620 }
621
83d90219
LZ		 622 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
623 cur = &nlcth->helper;
624 if (helper_name &&
625 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
626 continue;
12f7a505 627
83d90219
LZ		 628 if (tuple_set &&
629 (tuple.src.l3num != cur->tuple.src.l3num ||
630 tuple.dst.protonum != cur->tuple.dst.protonum))
631 continue;
12f7a505 632
83d90219
LZ		 633 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
634 if (skb2 == NULL) {
635 ret = -ENOMEM;
636 break;
637 }
12f7a505 638
83d90219
LZ		 639 ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
640 nlh->nlmsg_seq,
641 NFNL_MSG_TYPE(nlh->nlmsg_type),
642 NFNL_MSG_CTHELPER_NEW, cur);
643 if (ret <= 0) {
644 kfree_skb(skb2);
645 break;
646 }
12f7a505 647
83d90219
LZ		 648 ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
649 MSG_DONTWAIT);
650 if (ret > 0)
651 ret = 0;
12f7a505 652
83d90219
LZ		 653 /* this avoids a loop in nfnetlink. */
654 return ret == -EAGAIN ? -ENOBUFS : ret;
12f7a505
PNA		 655 }
656 return ret;
657}
658
7b8002a1
PNA		 659static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
660 struct sk_buff *skb, const struct nlmsghdr *nlh,
661 const struct nlattr * const tb[])
12f7a505
PNA		 662{
663 char *helper_name = NULL;
664 struct nf_conntrack_helper *cur;
12f7a505
PNA		 665 struct nf_conntrack_tuple tuple;
666 bool tuple_set = false, found = false;
83d90219
LZ		 667 struct nfnl_cthelper *nlcth, *n;
668 int j = 0, ret;
12f7a505
PNA		 669
670 if (tb[NFCTH_NAME])
671 helper_name = nla_data(tb[NFCTH_NAME]);
672
673 if (tb[NFCTH_TUPLE]) {
674 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
675 if (ret < 0)
676 return ret;
677
678 tuple_set = true;
679 }
680
83d90219
LZ		 681 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
682 cur = &nlcth->helper;
683 j++;
12f7a505 684
83d90219
LZ		 685 if (helper_name &&
686 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
687 continue;
12f7a505 688
83d90219
LZ		 689 if (tuple_set &&
690 (tuple.src.l3num != cur->tuple.src.l3num ||
691 tuple.dst.protonum != cur->tuple.dst.protonum))
692 continue;
12f7a505 693
83d90219
LZ		 694 found = true;
695 nf_conntrack_helper_unregister(cur);
696 kfree(cur->expect_policy);
697
698 list_del(&nlcth->list);
699 kfree(nlcth);
12f7a505 700 }
83d90219 701
12f7a505
PNA		 702 /* Make sure we return success if we flush and there is no helpers */
703 return (found || j == 0) ? 0 : -ENOENT;
704}
705
706static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
707 [NFCTH_NAME] = { .type = NLA_NUL_STRING,
708 .len = NF_CT_HELPER_NAME_LEN-1 },
709 [NFCTH_QUEUE_NUM] = { .type = NLA_U32, },
710};
711
712static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = {
713 [NFNL_MSG_CTHELPER_NEW] = { .call = nfnl_cthelper_new,
714 .attr_count = NFCTH_MAX,
715 .policy = nfnl_cthelper_policy },
716 [NFNL_MSG_CTHELPER_GET] = { .call = nfnl_cthelper_get,
717 .attr_count = NFCTH_MAX,
718 .policy = nfnl_cthelper_policy },
719 [NFNL_MSG_CTHELPER_DEL] = { .call = nfnl_cthelper_del,
720 .attr_count = NFCTH_MAX,
721 .policy = nfnl_cthelper_policy },
722};
723
724static const struct nfnetlink_subsystem nfnl_cthelper_subsys = {
725 .name = "cthelper",
726 .subsys_id = NFNL_SUBSYS_CTHELPER,
727 .cb_count = NFNL_MSG_CTHELPER_MAX,
728 .cb = nfnl_cthelper_cb,
729};
730
731MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER);
732
733static int __init nfnl_cthelper_init(void)
734{
735 int ret;
736
737 ret = nfnetlink_subsys_register(&nfnl_cthelper_subsys);
738 if (ret < 0) {
739 pr_err("nfnl_cthelper: cannot register with nfnetlink.\n");
740 goto err_out;
741 }
742 return 0;
743err_out:
744 return ret;
745}
746
747static void __exit nfnl_cthelper_exit(void)
748{
749 struct nf_conntrack_helper *cur;
83d90219 750 struct nfnl_cthelper *nlcth, *n;
12f7a505
PNA		 751
752 nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
753
83d90219
LZ		 754 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
755 cur = &nlcth->helper;
12f7a505 756
83d90219
LZ		 757 nf_conntrack_helper_unregister(cur);
758 kfree(cur->expect_policy);
759 kfree(nlcth);
12f7a505
PNA		 760 }
761}
762
763module_init(nfnl_cthelper_init);
764module_exit(nfnl_cthelper_exit);
Ubuntu Artful kernel mirror