1 /* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
7 * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
9 * Initial connection tracking via netlink development funded and
10 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
12 * Further development of this code funded by Astaro AG (http://www.astaro.com)
14 * This software may be used and distributed according to the terms
15 * of the GNU General Public License, incorporated herein by reference.
18 #include <linux/init.h>
19 #include <linux/module.h>
20 #include <linux/kernel.h>
21 #include <linux/rculist.h>
22 #include <linux/rculist_nulls.h>
23 #include <linux/types.h>
24 #include <linux/timer.h>
25 #include <linux/security.h>
26 #include <linux/skbuff.h>
27 #include <linux/errno.h>
28 #include <linux/netlink.h>
29 #include <linux/spinlock.h>
30 #include <linux/interrupt.h>
31 #include <linux/slab.h>
32 #include <linux/siphash.h>
34 #include <linux/netfilter.h>
35 #include <net/netlink.h>
37 #include <net/netfilter/nf_conntrack.h>
38 #include <net/netfilter/nf_conntrack_core.h>
39 #include <net/netfilter/nf_conntrack_expect.h>
40 #include <net/netfilter/nf_conntrack_helper.h>
41 #include <net/netfilter/nf_conntrack_seqadj.h>
42 #include <net/netfilter/nf_conntrack_l4proto.h>
43 #include <net/netfilter/nf_conntrack_tuple.h>
44 #include <net/netfilter/nf_conntrack_acct.h>
45 #include <net/netfilter/nf_conntrack_zones.h>
46 #include <net/netfilter/nf_conntrack_timestamp.h>
47 #include <net/netfilter/nf_conntrack_labels.h>
48 #include <net/netfilter/nf_conntrack_synproxy.h>
49 #if IS_ENABLED(CONFIG_NF_NAT)
50 #include <net/netfilter/nf_nat.h>
51 #include <net/netfilter/nf_nat_helper.h>
54 #include <linux/netfilter/nfnetlink.h>
55 #include <linux/netfilter/nfnetlink_conntrack.h>
57 MODULE_LICENSE("GPL");
59 static int ctnetlink_dump_tuples_proto(struct sk_buff
*skb
,
60 const struct nf_conntrack_tuple
*tuple
,
61 const struct nf_conntrack_l4proto
*l4proto
)
64 struct nlattr
*nest_parms
;
66 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_PROTO
);
69 if (nla_put_u8(skb
, CTA_PROTO_NUM
, tuple
->dst
.protonum
))
72 if (likely(l4proto
->tuple_to_nlattr
))
73 ret
= l4proto
->tuple_to_nlattr(skb
, tuple
);
75 nla_nest_end(skb
, nest_parms
);
83 static int ipv4_tuple_to_nlattr(struct sk_buff
*skb
,
84 const struct nf_conntrack_tuple
*tuple
)
86 if (nla_put_in_addr(skb
, CTA_IP_V4_SRC
, tuple
->src
.u3
.ip
) ||
87 nla_put_in_addr(skb
, CTA_IP_V4_DST
, tuple
->dst
.u3
.ip
))
92 static int ipv6_tuple_to_nlattr(struct sk_buff
*skb
,
93 const struct nf_conntrack_tuple
*tuple
)
95 if (nla_put_in6_addr(skb
, CTA_IP_V6_SRC
, &tuple
->src
.u3
.in6
) ||
96 nla_put_in6_addr(skb
, CTA_IP_V6_DST
, &tuple
->dst
.u3
.in6
))
101 static int ctnetlink_dump_tuples_ip(struct sk_buff
*skb
,
102 const struct nf_conntrack_tuple
*tuple
)
105 struct nlattr
*nest_parms
;
107 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_IP
);
109 goto nla_put_failure
;
111 switch (tuple
->src
.l3num
) {
113 ret
= ipv4_tuple_to_nlattr(skb
, tuple
);
116 ret
= ipv6_tuple_to_nlattr(skb
, tuple
);
120 nla_nest_end(skb
, nest_parms
);
128 static int ctnetlink_dump_tuples(struct sk_buff
*skb
,
129 const struct nf_conntrack_tuple
*tuple
)
131 const struct nf_conntrack_l4proto
*l4proto
;
135 ret
= ctnetlink_dump_tuples_ip(skb
, tuple
);
138 l4proto
= nf_ct_l4proto_find(tuple
->dst
.protonum
);
139 ret
= ctnetlink_dump_tuples_proto(skb
, tuple
, l4proto
);
145 static int ctnetlink_dump_zone_id(struct sk_buff
*skb
, int attrtype
,
146 const struct nf_conntrack_zone
*zone
, int dir
)
148 if (zone
->id
== NF_CT_DEFAULT_ZONE_ID
|| zone
->dir
!= dir
)
150 if (nla_put_be16(skb
, attrtype
, htons(zone
->id
)))
151 goto nla_put_failure
;
158 static int ctnetlink_dump_status(struct sk_buff
*skb
, const struct nf_conn
*ct
)
160 if (nla_put_be32(skb
, CTA_STATUS
, htonl(ct
->status
)))
161 goto nla_put_failure
;
168 static int ctnetlink_dump_timeout(struct sk_buff
*skb
, const struct nf_conn
*ct
)
170 long timeout
= nf_ct_expires(ct
) / HZ
;
172 if (nla_put_be32(skb
, CTA_TIMEOUT
, htonl(timeout
)))
173 goto nla_put_failure
;
180 static int ctnetlink_dump_protoinfo(struct sk_buff
*skb
, struct nf_conn
*ct
)
182 const struct nf_conntrack_l4proto
*l4proto
;
183 struct nlattr
*nest_proto
;
186 l4proto
= nf_ct_l4proto_find(nf_ct_protonum(ct
));
187 if (!l4proto
->to_nlattr
)
190 nest_proto
= nla_nest_start(skb
, CTA_PROTOINFO
);
192 goto nla_put_failure
;
194 ret
= l4proto
->to_nlattr(skb
, nest_proto
, ct
);
196 nla_nest_end(skb
, nest_proto
);
204 static int ctnetlink_dump_helpinfo(struct sk_buff
*skb
,
205 const struct nf_conn
*ct
)
207 struct nlattr
*nest_helper
;
208 const struct nf_conn_help
*help
= nfct_help(ct
);
209 struct nf_conntrack_helper
*helper
;
214 helper
= rcu_dereference(help
->helper
);
218 nest_helper
= nla_nest_start(skb
, CTA_HELP
);
220 goto nla_put_failure
;
221 if (nla_put_string(skb
, CTA_HELP_NAME
, helper
->name
))
222 goto nla_put_failure
;
224 if (helper
->to_nlattr
)
225 helper
->to_nlattr(skb
, ct
);
227 nla_nest_end(skb
, nest_helper
);
236 dump_counters(struct sk_buff
*skb
, struct nf_conn_acct
*acct
,
237 enum ip_conntrack_dir dir
, int type
)
239 enum ctattr_type attr
= dir
? CTA_COUNTERS_REPLY
: CTA_COUNTERS_ORIG
;
240 struct nf_conn_counter
*counter
= acct
->counter
;
241 struct nlattr
*nest_count
;
244 if (type
== IPCTNL_MSG_CT_GET_CTRZERO
) {
245 pkts
= atomic64_xchg(&counter
[dir
].packets
, 0);
246 bytes
= atomic64_xchg(&counter
[dir
].bytes
, 0);
248 pkts
= atomic64_read(&counter
[dir
].packets
);
249 bytes
= atomic64_read(&counter
[dir
].bytes
);
252 nest_count
= nla_nest_start(skb
, attr
);
254 goto nla_put_failure
;
256 if (nla_put_be64(skb
, CTA_COUNTERS_PACKETS
, cpu_to_be64(pkts
),
258 nla_put_be64(skb
, CTA_COUNTERS_BYTES
, cpu_to_be64(bytes
),
260 goto nla_put_failure
;
262 nla_nest_end(skb
, nest_count
);
271 ctnetlink_dump_acct(struct sk_buff
*skb
, const struct nf_conn
*ct
, int type
)
273 struct nf_conn_acct
*acct
= nf_conn_acct_find(ct
);
278 if (dump_counters(skb
, acct
, IP_CT_DIR_ORIGINAL
, type
) < 0)
280 if (dump_counters(skb
, acct
, IP_CT_DIR_REPLY
, type
) < 0)
287 ctnetlink_dump_timestamp(struct sk_buff
*skb
, const struct nf_conn
*ct
)
289 struct nlattr
*nest_count
;
290 const struct nf_conn_tstamp
*tstamp
;
292 tstamp
= nf_conn_tstamp_find(ct
);
296 nest_count
= nla_nest_start(skb
, CTA_TIMESTAMP
);
298 goto nla_put_failure
;
300 if (nla_put_be64(skb
, CTA_TIMESTAMP_START
, cpu_to_be64(tstamp
->start
),
301 CTA_TIMESTAMP_PAD
) ||
302 (tstamp
->stop
!= 0 && nla_put_be64(skb
, CTA_TIMESTAMP_STOP
,
303 cpu_to_be64(tstamp
->stop
),
305 goto nla_put_failure
;
306 nla_nest_end(skb
, nest_count
);
314 #ifdef CONFIG_NF_CONNTRACK_MARK
315 static int ctnetlink_dump_mark(struct sk_buff
*skb
, const struct nf_conn
*ct
)
317 if (nla_put_be32(skb
, CTA_MARK
, htonl(ct
->mark
)))
318 goto nla_put_failure
;
325 #define ctnetlink_dump_mark(a, b) (0)
328 #ifdef CONFIG_NF_CONNTRACK_SECMARK
329 static int ctnetlink_dump_secctx(struct sk_buff
*skb
, const struct nf_conn
*ct
)
331 struct nlattr
*nest_secctx
;
335 ret
= security_secid_to_secctx(ct
->secmark
, &secctx
, &len
);
340 nest_secctx
= nla_nest_start(skb
, CTA_SECCTX
);
342 goto nla_put_failure
;
344 if (nla_put_string(skb
, CTA_SECCTX_NAME
, secctx
))
345 goto nla_put_failure
;
346 nla_nest_end(skb
, nest_secctx
);
350 security_release_secctx(secctx
, len
);
354 #define ctnetlink_dump_secctx(a, b) (0)
357 #ifdef CONFIG_NF_CONNTRACK_LABELS
358 static inline int ctnetlink_label_size(const struct nf_conn
*ct
)
360 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
364 return nla_total_size(sizeof(labels
->bits
));
368 ctnetlink_dump_labels(struct sk_buff
*skb
, const struct nf_conn
*ct
)
370 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
378 if (labels
->bits
[i
] != 0)
379 return nla_put(skb
, CTA_LABELS
, sizeof(labels
->bits
),
382 } while (i
< ARRAY_SIZE(labels
->bits
));
387 #define ctnetlink_dump_labels(a, b) (0)
388 #define ctnetlink_label_size(a) (0)
391 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
393 static int ctnetlink_dump_master(struct sk_buff
*skb
, const struct nf_conn
*ct
)
395 struct nlattr
*nest_parms
;
397 if (!(ct
->status
& IPS_EXPECTED
))
400 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_MASTER
);
402 goto nla_put_failure
;
403 if (ctnetlink_dump_tuples(skb
, master_tuple(ct
)) < 0)
404 goto nla_put_failure
;
405 nla_nest_end(skb
, nest_parms
);
414 dump_ct_seq_adj(struct sk_buff
*skb
, const struct nf_ct_seqadj
*seq
, int type
)
416 struct nlattr
*nest_parms
;
418 nest_parms
= nla_nest_start(skb
, type
);
420 goto nla_put_failure
;
422 if (nla_put_be32(skb
, CTA_SEQADJ_CORRECTION_POS
,
423 htonl(seq
->correction_pos
)) ||
424 nla_put_be32(skb
, CTA_SEQADJ_OFFSET_BEFORE
,
425 htonl(seq
->offset_before
)) ||
426 nla_put_be32(skb
, CTA_SEQADJ_OFFSET_AFTER
,
427 htonl(seq
->offset_after
)))
428 goto nla_put_failure
;
430 nla_nest_end(skb
, nest_parms
);
438 static int ctnetlink_dump_ct_seq_adj(struct sk_buff
*skb
, struct nf_conn
*ct
)
440 struct nf_conn_seqadj
*seqadj
= nfct_seqadj(ct
);
441 struct nf_ct_seqadj
*seq
;
443 if (!(ct
->status
& IPS_SEQ_ADJUST
) || !seqadj
)
446 spin_lock_bh(&ct
->lock
);
447 seq
= &seqadj
->seq
[IP_CT_DIR_ORIGINAL
];
448 if (dump_ct_seq_adj(skb
, seq
, CTA_SEQ_ADJ_ORIG
) == -1)
451 seq
= &seqadj
->seq
[IP_CT_DIR_REPLY
];
452 if (dump_ct_seq_adj(skb
, seq
, CTA_SEQ_ADJ_REPLY
) == -1)
455 spin_unlock_bh(&ct
->lock
);
458 spin_unlock_bh(&ct
->lock
);
462 static int ctnetlink_dump_ct_synproxy(struct sk_buff
*skb
, struct nf_conn
*ct
)
464 struct nf_conn_synproxy
*synproxy
= nfct_synproxy(ct
);
465 struct nlattr
*nest_parms
;
470 nest_parms
= nla_nest_start(skb
, CTA_SYNPROXY
);
472 goto nla_put_failure
;
474 if (nla_put_be32(skb
, CTA_SYNPROXY_ISN
, htonl(synproxy
->isn
)) ||
475 nla_put_be32(skb
, CTA_SYNPROXY_ITS
, htonl(synproxy
->its
)) ||
476 nla_put_be32(skb
, CTA_SYNPROXY_TSOFF
, htonl(synproxy
->tsoff
)))
477 goto nla_put_failure
;
479 nla_nest_end(skb
, nest_parms
);
487 static int ctnetlink_dump_id(struct sk_buff
*skb
, const struct nf_conn
*ct
)
489 __be32 id
= (__force __be32
)nf_ct_get_id(ct
);
491 if (nla_put_be32(skb
, CTA_ID
, id
))
492 goto nla_put_failure
;
499 static int ctnetlink_dump_use(struct sk_buff
*skb
, const struct nf_conn
*ct
)
501 if (nla_put_be32(skb
, CTA_USE
, htonl(atomic_read(&ct
->ct_general
.use
))))
502 goto nla_put_failure
;
510 ctnetlink_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
513 const struct nf_conntrack_zone
*zone
;
514 struct nlmsghdr
*nlh
;
515 struct nfgenmsg
*nfmsg
;
516 struct nlattr
*nest_parms
;
517 unsigned int flags
= portid
? NLM_F_MULTI
: 0, event
;
519 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
, IPCTNL_MSG_CT_NEW
);
520 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
524 nfmsg
= nlmsg_data(nlh
);
525 nfmsg
->nfgen_family
= nf_ct_l3num(ct
);
526 nfmsg
->version
= NFNETLINK_V0
;
529 zone
= nf_ct_zone(ct
);
531 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_ORIG
);
533 goto nla_put_failure
;
534 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_ORIGINAL
)) < 0)
535 goto nla_put_failure
;
536 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
537 NF_CT_ZONE_DIR_ORIG
) < 0)
538 goto nla_put_failure
;
539 nla_nest_end(skb
, nest_parms
);
541 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_REPLY
);
543 goto nla_put_failure
;
544 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_REPLY
)) < 0)
545 goto nla_put_failure
;
546 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
547 NF_CT_ZONE_DIR_REPL
) < 0)
548 goto nla_put_failure
;
549 nla_nest_end(skb
, nest_parms
);
551 if (ctnetlink_dump_zone_id(skb
, CTA_ZONE
, zone
,
552 NF_CT_DEFAULT_ZONE_DIR
) < 0)
553 goto nla_put_failure
;
555 if (ctnetlink_dump_status(skb
, ct
) < 0 ||
556 ctnetlink_dump_acct(skb
, ct
, type
) < 0 ||
557 ctnetlink_dump_timestamp(skb
, ct
) < 0 ||
558 ctnetlink_dump_helpinfo(skb
, ct
) < 0 ||
559 ctnetlink_dump_mark(skb
, ct
) < 0 ||
560 ctnetlink_dump_secctx(skb
, ct
) < 0 ||
561 ctnetlink_dump_labels(skb
, ct
) < 0 ||
562 ctnetlink_dump_id(skb
, ct
) < 0 ||
563 ctnetlink_dump_use(skb
, ct
) < 0 ||
564 ctnetlink_dump_master(skb
, ct
) < 0 ||
565 ctnetlink_dump_ct_seq_adj(skb
, ct
) < 0 ||
566 ctnetlink_dump_ct_synproxy(skb
, ct
) < 0)
567 goto nla_put_failure
;
569 if (!test_bit(IPS_OFFLOAD_BIT
, &ct
->status
) &&
570 (ctnetlink_dump_timeout(skb
, ct
) < 0 ||
571 ctnetlink_dump_protoinfo(skb
, ct
) < 0))
572 goto nla_put_failure
;
579 nlmsg_cancel(skb
, nlh
);
583 static const struct nla_policy cta_ip_nla_policy
[CTA_IP_MAX
+ 1] = {
584 [CTA_IP_V4_SRC
] = { .type
= NLA_U32
},
585 [CTA_IP_V4_DST
] = { .type
= NLA_U32
},
586 [CTA_IP_V6_SRC
] = { .len
= sizeof(__be32
) * 4 },
587 [CTA_IP_V6_DST
] = { .len
= sizeof(__be32
) * 4 },
590 #if defined(CONFIG_NETFILTER_NETLINK_GLUE_CT) || defined(CONFIG_NF_CONNTRACK_EVENTS)
591 static size_t ctnetlink_proto_size(const struct nf_conn
*ct
)
593 const struct nf_conntrack_l4proto
*l4proto
;
594 size_t len
, len4
= 0;
596 len
= nla_policy_len(cta_ip_nla_policy
, CTA_IP_MAX
+ 1);
597 len
*= 3u; /* ORIG, REPLY, MASTER */
599 l4proto
= nf_ct_l4proto_find(nf_ct_protonum(ct
));
600 len
+= l4proto
->nlattr_size
;
601 if (l4proto
->nlattr_tuple_size
) {
602 len4
= l4proto
->nlattr_tuple_size();
603 len4
*= 3u; /* ORIG, REPLY, MASTER */
610 static inline size_t ctnetlink_acct_size(const struct nf_conn
*ct
)
612 if (!nf_ct_ext_exist(ct
, NF_CT_EXT_ACCT
))
614 return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */
615 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */
616 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */
620 static inline int ctnetlink_secctx_size(const struct nf_conn
*ct
)
622 #ifdef CONFIG_NF_CONNTRACK_SECMARK
625 ret
= security_secid_to_secctx(ct
->secmark
, NULL
, &len
);
629 return nla_total_size(0) /* CTA_SECCTX */
630 + nla_total_size(sizeof(char) * len
); /* CTA_SECCTX_NAME */
636 static inline size_t ctnetlink_timestamp_size(const struct nf_conn
*ct
)
638 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
639 if (!nf_ct_ext_exist(ct
, NF_CT_EXT_TSTAMP
))
641 return nla_total_size(0) + 2 * nla_total_size_64bit(sizeof(uint64_t));
647 #ifdef CONFIG_NF_CONNTRACK_EVENTS
648 static size_t ctnetlink_nlmsg_size(const struct nf_conn
*ct
)
650 return NLMSG_ALIGN(sizeof(struct nfgenmsg
))
651 + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
652 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
653 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
654 + 3 * nla_total_size(sizeof(u_int8_t
)) /* CTA_PROTO_NUM */
655 + nla_total_size(sizeof(u_int32_t
)) /* CTA_ID */
656 + nla_total_size(sizeof(u_int32_t
)) /* CTA_STATUS */
657 + ctnetlink_acct_size(ct
)
658 + ctnetlink_timestamp_size(ct
)
659 + nla_total_size(sizeof(u_int32_t
)) /* CTA_TIMEOUT */
660 + nla_total_size(0) /* CTA_PROTOINFO */
661 + nla_total_size(0) /* CTA_HELP */
662 + nla_total_size(NF_CT_HELPER_NAME_LEN
) /* CTA_HELP_NAME */
663 + ctnetlink_secctx_size(ct
)
664 #if IS_ENABLED(CONFIG_NF_NAT)
665 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
666 + 6 * nla_total_size(sizeof(u_int32_t
)) /* CTA_NAT_SEQ_OFFSET */
668 #ifdef CONFIG_NF_CONNTRACK_MARK
669 + nla_total_size(sizeof(u_int32_t
)) /* CTA_MARK */
671 #ifdef CONFIG_NF_CONNTRACK_ZONES
672 + nla_total_size(sizeof(u_int16_t
)) /* CTA_ZONE|CTA_TUPLE_ZONE */
674 + ctnetlink_proto_size(ct
)
675 + ctnetlink_label_size(ct
)
680 ctnetlink_conntrack_event(unsigned int events
, struct nf_ct_event
*item
)
682 const struct nf_conntrack_zone
*zone
;
684 struct nlmsghdr
*nlh
;
685 struct nfgenmsg
*nfmsg
;
686 struct nlattr
*nest_parms
;
687 struct nf_conn
*ct
= item
->ct
;
690 unsigned int flags
= 0, group
;
693 if (events
& (1 << IPCT_DESTROY
)) {
694 type
= IPCTNL_MSG_CT_DELETE
;
695 group
= NFNLGRP_CONNTRACK_DESTROY
;
696 } else if (events
& ((1 << IPCT_NEW
) | (1 << IPCT_RELATED
))) {
697 type
= IPCTNL_MSG_CT_NEW
;
698 flags
= NLM_F_CREATE
|NLM_F_EXCL
;
699 group
= NFNLGRP_CONNTRACK_NEW
;
701 type
= IPCTNL_MSG_CT_NEW
;
702 group
= NFNLGRP_CONNTRACK_UPDATE
;
707 if (!item
->report
&& !nfnetlink_has_listeners(net
, group
))
710 skb
= nlmsg_new(ctnetlink_nlmsg_size(ct
), GFP_ATOMIC
);
714 type
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
, type
);
715 nlh
= nlmsg_put(skb
, item
->portid
, 0, type
, sizeof(*nfmsg
), flags
);
719 nfmsg
= nlmsg_data(nlh
);
720 nfmsg
->nfgen_family
= nf_ct_l3num(ct
);
721 nfmsg
->version
= NFNETLINK_V0
;
724 zone
= nf_ct_zone(ct
);
726 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_ORIG
);
728 goto nla_put_failure
;
729 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_ORIGINAL
)) < 0)
730 goto nla_put_failure
;
731 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
732 NF_CT_ZONE_DIR_ORIG
) < 0)
733 goto nla_put_failure
;
734 nla_nest_end(skb
, nest_parms
);
736 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_REPLY
);
738 goto nla_put_failure
;
739 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_REPLY
)) < 0)
740 goto nla_put_failure
;
741 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
742 NF_CT_ZONE_DIR_REPL
) < 0)
743 goto nla_put_failure
;
744 nla_nest_end(skb
, nest_parms
);
746 if (ctnetlink_dump_zone_id(skb
, CTA_ZONE
, zone
,
747 NF_CT_DEFAULT_ZONE_DIR
) < 0)
748 goto nla_put_failure
;
750 if (ctnetlink_dump_id(skb
, ct
) < 0)
751 goto nla_put_failure
;
753 if (ctnetlink_dump_status(skb
, ct
) < 0)
754 goto nla_put_failure
;
756 if (events
& (1 << IPCT_DESTROY
)) {
757 if (ctnetlink_dump_acct(skb
, ct
, type
) < 0 ||
758 ctnetlink_dump_timestamp(skb
, ct
) < 0)
759 goto nla_put_failure
;
761 if (ctnetlink_dump_timeout(skb
, ct
) < 0)
762 goto nla_put_failure
;
764 if (events
& (1 << IPCT_PROTOINFO
)
765 && ctnetlink_dump_protoinfo(skb
, ct
) < 0)
766 goto nla_put_failure
;
768 if ((events
& (1 << IPCT_HELPER
) || nfct_help(ct
))
769 && ctnetlink_dump_helpinfo(skb
, ct
) < 0)
770 goto nla_put_failure
;
772 #ifdef CONFIG_NF_CONNTRACK_SECMARK
773 if ((events
& (1 << IPCT_SECMARK
) || ct
->secmark
)
774 && ctnetlink_dump_secctx(skb
, ct
) < 0)
775 goto nla_put_failure
;
777 if (events
& (1 << IPCT_LABEL
) &&
778 ctnetlink_dump_labels(skb
, ct
) < 0)
779 goto nla_put_failure
;
781 if (events
& (1 << IPCT_RELATED
) &&
782 ctnetlink_dump_master(skb
, ct
) < 0)
783 goto nla_put_failure
;
785 if (events
& (1 << IPCT_SEQADJ
) &&
786 ctnetlink_dump_ct_seq_adj(skb
, ct
) < 0)
787 goto nla_put_failure
;
789 if (events
& (1 << IPCT_SYNPROXY
) &&
790 ctnetlink_dump_ct_synproxy(skb
, ct
) < 0)
791 goto nla_put_failure
;
794 #ifdef CONFIG_NF_CONNTRACK_MARK
795 if ((events
& (1 << IPCT_MARK
) || ct
->mark
)
796 && ctnetlink_dump_mark(skb
, ct
) < 0)
797 goto nla_put_failure
;
800 err
= nfnetlink_send(skb
, net
, item
->portid
, group
, item
->report
,
802 if (err
== -ENOBUFS
|| err
== -EAGAIN
)
808 nlmsg_cancel(skb
, nlh
);
812 if (nfnetlink_set_err(net
, 0, group
, -ENOBUFS
) > 0)
817 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
819 static int ctnetlink_done(struct netlink_callback
*cb
)
822 nf_ct_put((struct nf_conn
*)cb
->args
[1]);
827 struct ctnetlink_filter
{
835 static struct ctnetlink_filter
*
836 ctnetlink_alloc_filter(const struct nlattr
* const cda
[], u8 family
)
838 struct ctnetlink_filter
*filter
;
840 #ifndef CONFIG_NF_CONNTRACK_MARK
841 if (cda
[CTA_MARK
] && cda
[CTA_MARK_MASK
])
842 return ERR_PTR(-EOPNOTSUPP
);
845 filter
= kzalloc(sizeof(*filter
), GFP_KERNEL
);
847 return ERR_PTR(-ENOMEM
);
849 filter
->family
= family
;
851 #ifdef CONFIG_NF_CONNTRACK_MARK
852 if (cda
[CTA_MARK
] && cda
[CTA_MARK_MASK
]) {
853 filter
->mark
.val
= ntohl(nla_get_be32(cda
[CTA_MARK
]));
854 filter
->mark
.mask
= ntohl(nla_get_be32(cda
[CTA_MARK_MASK
]));
860 static int ctnetlink_start(struct netlink_callback
*cb
)
862 const struct nlattr
* const *cda
= cb
->data
;
863 struct ctnetlink_filter
*filter
= NULL
;
864 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
865 u8 family
= nfmsg
->nfgen_family
;
867 if (family
|| (cda
[CTA_MARK
] && cda
[CTA_MARK_MASK
])) {
868 filter
= ctnetlink_alloc_filter(cda
, family
);
870 return PTR_ERR(filter
);
877 static int ctnetlink_filter_match(struct nf_conn
*ct
, void *data
)
879 struct ctnetlink_filter
*filter
= data
;
884 /* Match entries of a given L3 protocol number.
885 * If it is not specified, ie. l3proto == 0,
886 * then match everything.
888 if (filter
->family
&& nf_ct_l3num(ct
) != filter
->family
)
891 #ifdef CONFIG_NF_CONNTRACK_MARK
892 if ((ct
->mark
& filter
->mark
.mask
) != filter
->mark
.val
)
904 ctnetlink_dump_table(struct sk_buff
*skb
, struct netlink_callback
*cb
)
906 struct net
*net
= sock_net(skb
->sk
);
907 struct nf_conn
*ct
, *last
;
908 struct nf_conntrack_tuple_hash
*h
;
909 struct hlist_nulls_node
*n
;
910 struct nf_conn
*nf_ct_evict
[8];
914 last
= (struct nf_conn
*)cb
->args
[1];
918 for (; cb
->args
[0] < nf_conntrack_htable_size
; cb
->args
[0]++) {
922 if (nf_ct_should_gc(nf_ct_evict
[i
]))
923 nf_ct_kill(nf_ct_evict
[i
]);
924 nf_ct_put(nf_ct_evict
[i
]);
927 lockp
= &nf_conntrack_locks
[cb
->args
[0] % CONNTRACK_LOCKS
];
928 nf_conntrack_lock(lockp
);
929 if (cb
->args
[0] >= nf_conntrack_htable_size
) {
933 hlist_nulls_for_each_entry(h
, n
, &nf_conntrack_hash
[cb
->args
[0]],
935 if (NF_CT_DIRECTION(h
) != IP_CT_DIR_ORIGINAL
)
937 ct
= nf_ct_tuplehash_to_ctrack(h
);
938 if (nf_ct_is_expired(ct
)) {
939 if (i
< ARRAY_SIZE(nf_ct_evict
) &&
940 atomic_inc_not_zero(&ct
->ct_general
.use
))
941 nf_ct_evict
[i
++] = ct
;
945 if (!net_eq(net
, nf_ct_net(ct
)))
953 if (!ctnetlink_filter_match(ct
, cb
->data
))
958 ctnetlink_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
960 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
964 nf_conntrack_get(&ct
->ct_general
);
965 cb
->args
[1] = (unsigned long)ct
;
979 /* nf ct hash resize happened, now clear the leftover. */
980 if ((struct nf_conn
*)cb
->args
[1] == last
)
988 if (nf_ct_should_gc(nf_ct_evict
[i
]))
989 nf_ct_kill(nf_ct_evict
[i
]);
990 nf_ct_put(nf_ct_evict
[i
]);
996 static int ipv4_nlattr_to_tuple(struct nlattr
*tb
[],
997 struct nf_conntrack_tuple
*t
)
999 if (!tb
[CTA_IP_V4_SRC
] || !tb
[CTA_IP_V4_DST
])
1002 t
->src
.u3
.ip
= nla_get_in_addr(tb
[CTA_IP_V4_SRC
]);
1003 t
->dst
.u3
.ip
= nla_get_in_addr(tb
[CTA_IP_V4_DST
]);
1008 static int ipv6_nlattr_to_tuple(struct nlattr
*tb
[],
1009 struct nf_conntrack_tuple
*t
)
1011 if (!tb
[CTA_IP_V6_SRC
] || !tb
[CTA_IP_V6_DST
])
1014 t
->src
.u3
.in6
= nla_get_in6_addr(tb
[CTA_IP_V6_SRC
]);
1015 t
->dst
.u3
.in6
= nla_get_in6_addr(tb
[CTA_IP_V6_DST
]);
1020 static int ctnetlink_parse_tuple_ip(struct nlattr
*attr
,
1021 struct nf_conntrack_tuple
*tuple
)
1023 struct nlattr
*tb
[CTA_IP_MAX
+1];
1026 ret
= nla_parse_nested_deprecated(tb
, CTA_IP_MAX
, attr
, NULL
, NULL
);
1030 ret
= nla_validate_nested_deprecated(attr
, CTA_IP_MAX
,
1031 cta_ip_nla_policy
, NULL
);
1035 switch (tuple
->src
.l3num
) {
1037 ret
= ipv4_nlattr_to_tuple(tb
, tuple
);
1040 ret
= ipv6_nlattr_to_tuple(tb
, tuple
);
1047 static const struct nla_policy proto_nla_policy
[CTA_PROTO_MAX
+1] = {
1048 [CTA_PROTO_NUM
] = { .type
= NLA_U8
},
1051 static int ctnetlink_parse_tuple_proto(struct nlattr
*attr
,
1052 struct nf_conntrack_tuple
*tuple
)
1054 const struct nf_conntrack_l4proto
*l4proto
;
1055 struct nlattr
*tb
[CTA_PROTO_MAX
+1];
1058 ret
= nla_parse_nested_deprecated(tb
, CTA_PROTO_MAX
, attr
,
1059 proto_nla_policy
, NULL
);
1063 if (!tb
[CTA_PROTO_NUM
])
1065 tuple
->dst
.protonum
= nla_get_u8(tb
[CTA_PROTO_NUM
]);
1068 l4proto
= nf_ct_l4proto_find(tuple
->dst
.protonum
);
1070 if (likely(l4proto
->nlattr_to_tuple
)) {
1071 ret
= nla_validate_nested_deprecated(attr
, CTA_PROTO_MAX
,
1072 l4proto
->nla_policy
,
1075 ret
= l4proto
->nlattr_to_tuple(tb
, tuple
);
1084 ctnetlink_parse_zone(const struct nlattr
*attr
,
1085 struct nf_conntrack_zone
*zone
)
1087 nf_ct_zone_init(zone
, NF_CT_DEFAULT_ZONE_ID
,
1088 NF_CT_DEFAULT_ZONE_DIR
, 0);
1089 #ifdef CONFIG_NF_CONNTRACK_ZONES
1091 zone
->id
= ntohs(nla_get_be16(attr
));
1100 ctnetlink_parse_tuple_zone(struct nlattr
*attr
, enum ctattr_type type
,
1101 struct nf_conntrack_zone
*zone
)
1105 if (zone
->id
!= NF_CT_DEFAULT_ZONE_ID
)
1108 ret
= ctnetlink_parse_zone(attr
, zone
);
1112 if (type
== CTA_TUPLE_REPLY
)
1113 zone
->dir
= NF_CT_ZONE_DIR_REPL
;
1115 zone
->dir
= NF_CT_ZONE_DIR_ORIG
;
1120 static const struct nla_policy tuple_nla_policy
[CTA_TUPLE_MAX
+1] = {
1121 [CTA_TUPLE_IP
] = { .type
= NLA_NESTED
},
1122 [CTA_TUPLE_PROTO
] = { .type
= NLA_NESTED
},
1123 [CTA_TUPLE_ZONE
] = { .type
= NLA_U16
},
1127 ctnetlink_parse_tuple(const struct nlattr
* const cda
[],
1128 struct nf_conntrack_tuple
*tuple
, u32 type
,
1129 u_int8_t l3num
, struct nf_conntrack_zone
*zone
)
1131 struct nlattr
*tb
[CTA_TUPLE_MAX
+1];
1134 memset(tuple
, 0, sizeof(*tuple
));
1136 err
= nla_parse_nested_deprecated(tb
, CTA_TUPLE_MAX
, cda
[type
],
1137 tuple_nla_policy
, NULL
);
1141 if (!tb
[CTA_TUPLE_IP
])
1144 tuple
->src
.l3num
= l3num
;
1146 err
= ctnetlink_parse_tuple_ip(tb
[CTA_TUPLE_IP
], tuple
);
1150 if (!tb
[CTA_TUPLE_PROTO
])
1153 err
= ctnetlink_parse_tuple_proto(tb
[CTA_TUPLE_PROTO
], tuple
);
1157 if (tb
[CTA_TUPLE_ZONE
]) {
1161 err
= ctnetlink_parse_tuple_zone(tb
[CTA_TUPLE_ZONE
],
1167 /* orig and expect tuples get DIR_ORIGINAL */
1168 if (type
== CTA_TUPLE_REPLY
)
1169 tuple
->dst
.dir
= IP_CT_DIR_REPLY
;
1171 tuple
->dst
.dir
= IP_CT_DIR_ORIGINAL
;
1176 static const struct nla_policy help_nla_policy
[CTA_HELP_MAX
+1] = {
1177 [CTA_HELP_NAME
] = { .type
= NLA_NUL_STRING
,
1178 .len
= NF_CT_HELPER_NAME_LEN
- 1 },
1181 static int ctnetlink_parse_help(const struct nlattr
*attr
, char **helper_name
,
1182 struct nlattr
**helpinfo
)
1185 struct nlattr
*tb
[CTA_HELP_MAX
+1];
1187 err
= nla_parse_nested_deprecated(tb
, CTA_HELP_MAX
, attr
,
1188 help_nla_policy
, NULL
);
1192 if (!tb
[CTA_HELP_NAME
])
1195 *helper_name
= nla_data(tb
[CTA_HELP_NAME
]);
1197 if (tb
[CTA_HELP_INFO
])
1198 *helpinfo
= tb
[CTA_HELP_INFO
];
1203 static const struct nla_policy ct_nla_policy
[CTA_MAX
+1] = {
1204 [CTA_TUPLE_ORIG
] = { .type
= NLA_NESTED
},
1205 [CTA_TUPLE_REPLY
] = { .type
= NLA_NESTED
},
1206 [CTA_STATUS
] = { .type
= NLA_U32
},
1207 [CTA_PROTOINFO
] = { .type
= NLA_NESTED
},
1208 [CTA_HELP
] = { .type
= NLA_NESTED
},
1209 [CTA_NAT_SRC
] = { .type
= NLA_NESTED
},
1210 [CTA_TIMEOUT
] = { .type
= NLA_U32
},
1211 [CTA_MARK
] = { .type
= NLA_U32
},
1212 [CTA_ID
] = { .type
= NLA_U32
},
1213 [CTA_NAT_DST
] = { .type
= NLA_NESTED
},
1214 [CTA_TUPLE_MASTER
] = { .type
= NLA_NESTED
},
1215 [CTA_NAT_SEQ_ADJ_ORIG
] = { .type
= NLA_NESTED
},
1216 [CTA_NAT_SEQ_ADJ_REPLY
] = { .type
= NLA_NESTED
},
1217 [CTA_ZONE
] = { .type
= NLA_U16
},
1218 [CTA_MARK_MASK
] = { .type
= NLA_U32
},
1219 [CTA_LABELS
] = { .type
= NLA_BINARY
,
1220 .len
= NF_CT_LABELS_MAX_SIZE
},
1221 [CTA_LABELS_MASK
] = { .type
= NLA_BINARY
,
1222 .len
= NF_CT_LABELS_MAX_SIZE
},
1225 static int ctnetlink_flush_iterate(struct nf_conn
*ct
, void *data
)
1227 if (test_bit(IPS_OFFLOAD_BIT
, &ct
->status
))
1230 return ctnetlink_filter_match(ct
, data
);
1233 static int ctnetlink_flush_conntrack(struct net
*net
,
1234 const struct nlattr
* const cda
[],
1235 u32 portid
, int report
, u8 family
)
1237 struct ctnetlink_filter
*filter
= NULL
;
1239 if (family
|| (cda
[CTA_MARK
] && cda
[CTA_MARK_MASK
])) {
1240 filter
= ctnetlink_alloc_filter(cda
, family
);
1242 return PTR_ERR(filter
);
1245 nf_ct_iterate_cleanup_net(net
, ctnetlink_flush_iterate
, filter
,
1252 static int ctnetlink_del_conntrack(struct net
*net
, struct sock
*ctnl
,
1253 struct sk_buff
*skb
,
1254 const struct nlmsghdr
*nlh
,
1255 const struct nlattr
* const cda
[],
1256 struct netlink_ext_ack
*extack
)
1258 struct nf_conntrack_tuple_hash
*h
;
1259 struct nf_conntrack_tuple tuple
;
1261 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
1262 struct nf_conntrack_zone zone
;
1265 err
= ctnetlink_parse_zone(cda
[CTA_ZONE
], &zone
);
1269 if (cda
[CTA_TUPLE_ORIG
])
1270 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_ORIG
,
1271 nfmsg
->nfgen_family
, &zone
);
1272 else if (cda
[CTA_TUPLE_REPLY
])
1273 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_REPLY
,
1274 nfmsg
->nfgen_family
, &zone
);
1276 u_int8_t u3
= nfmsg
->version
? nfmsg
->nfgen_family
: AF_UNSPEC
;
1278 return ctnetlink_flush_conntrack(net
, cda
,
1279 NETLINK_CB(skb
).portid
,
1280 nlmsg_report(nlh
), u3
);
1286 h
= nf_conntrack_find_get(net
, &zone
, &tuple
);
1290 ct
= nf_ct_tuplehash_to_ctrack(h
);
1292 if (test_bit(IPS_OFFLOAD_BIT
, &ct
->status
)) {
1298 __be32 id
= nla_get_be32(cda
[CTA_ID
]);
1300 if (id
!= (__force __be32
)nf_ct_get_id(ct
)) {
1306 nf_ct_delete(ct
, NETLINK_CB(skb
).portid
, nlmsg_report(nlh
));
1312 static int ctnetlink_get_conntrack(struct net
*net
, struct sock
*ctnl
,
1313 struct sk_buff
*skb
,
1314 const struct nlmsghdr
*nlh
,
1315 const struct nlattr
* const cda
[],
1316 struct netlink_ext_ack
*extack
)
1318 struct nf_conntrack_tuple_hash
*h
;
1319 struct nf_conntrack_tuple tuple
;
1321 struct sk_buff
*skb2
= NULL
;
1322 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
1323 u_int8_t u3
= nfmsg
->nfgen_family
;
1324 struct nf_conntrack_zone zone
;
1327 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1328 struct netlink_dump_control c
= {
1329 .start
= ctnetlink_start
,
1330 .dump
= ctnetlink_dump_table
,
1331 .done
= ctnetlink_done
,
1332 .data
= (void *)cda
,
1335 return netlink_dump_start(ctnl
, skb
, nlh
, &c
);
1338 err
= ctnetlink_parse_zone(cda
[CTA_ZONE
], &zone
);
1342 if (cda
[CTA_TUPLE_ORIG
])
1343 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_ORIG
,
1345 else if (cda
[CTA_TUPLE_REPLY
])
1346 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_REPLY
,
1354 h
= nf_conntrack_find_get(net
, &zone
, &tuple
);
1358 ct
= nf_ct_tuplehash_to_ctrack(h
);
1361 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
1368 err
= ctnetlink_fill_info(skb2
, NETLINK_CB(skb
).portid
, nlh
->nlmsg_seq
,
1369 NFNL_MSG_TYPE(nlh
->nlmsg_type
), ct
);
1375 err
= netlink_unicast(ctnl
, skb2
, NETLINK_CB(skb
).portid
, MSG_DONTWAIT
);
1384 /* this avoids a loop in nfnetlink. */
1385 return err
== -EAGAIN
? -ENOBUFS
: err
;
1388 static int ctnetlink_done_list(struct netlink_callback
*cb
)
1391 nf_ct_put((struct nf_conn
*)cb
->args
[1]);
1396 ctnetlink_dump_list(struct sk_buff
*skb
, struct netlink_callback
*cb
, bool dying
)
1398 struct nf_conn
*ct
, *last
;
1399 struct nf_conntrack_tuple_hash
*h
;
1400 struct hlist_nulls_node
*n
;
1401 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1402 u_int8_t l3proto
= nfmsg
->nfgen_family
;
1405 struct hlist_nulls_head
*list
;
1406 struct net
*net
= sock_net(skb
->sk
);
1411 last
= (struct nf_conn
*)cb
->args
[1];
1413 for (cpu
= cb
->args
[0]; cpu
< nr_cpu_ids
; cpu
++) {
1414 struct ct_pcpu
*pcpu
;
1416 if (!cpu_possible(cpu
))
1419 pcpu
= per_cpu_ptr(net
->ct
.pcpu_lists
, cpu
);
1420 spin_lock_bh(&pcpu
->lock
);
1421 list
= dying
? &pcpu
->dying
: &pcpu
->unconfirmed
;
1423 hlist_nulls_for_each_entry(h
, n
, list
, hnnode
) {
1424 ct
= nf_ct_tuplehash_to_ctrack(h
);
1425 if (l3proto
&& nf_ct_l3num(ct
) != l3proto
)
1433 res
= ctnetlink_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
1435 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
1439 if (!atomic_inc_not_zero(&ct
->ct_general
.use
))
1442 cb
->args
[1] = (unsigned long)ct
;
1443 spin_unlock_bh(&pcpu
->lock
);
1451 spin_unlock_bh(&pcpu
->lock
);
1462 ctnetlink_dump_dying(struct sk_buff
*skb
, struct netlink_callback
*cb
)
1464 return ctnetlink_dump_list(skb
, cb
, true);
1467 static int ctnetlink_get_ct_dying(struct net
*net
, struct sock
*ctnl
,
1468 struct sk_buff
*skb
,
1469 const struct nlmsghdr
*nlh
,
1470 const struct nlattr
* const cda
[],
1471 struct netlink_ext_ack
*extack
)
1473 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1474 struct netlink_dump_control c
= {
1475 .dump
= ctnetlink_dump_dying
,
1476 .done
= ctnetlink_done_list
,
1478 return netlink_dump_start(ctnl
, skb
, nlh
, &c
);
1485 ctnetlink_dump_unconfirmed(struct sk_buff
*skb
, struct netlink_callback
*cb
)
1487 return ctnetlink_dump_list(skb
, cb
, false);
1490 static int ctnetlink_get_ct_unconfirmed(struct net
*net
, struct sock
*ctnl
,
1491 struct sk_buff
*skb
,
1492 const struct nlmsghdr
*nlh
,
1493 const struct nlattr
* const cda
[],
1494 struct netlink_ext_ack
*extack
)
1496 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1497 struct netlink_dump_control c
= {
1498 .dump
= ctnetlink_dump_unconfirmed
,
1499 .done
= ctnetlink_done_list
,
1501 return netlink_dump_start(ctnl
, skb
, nlh
, &c
);
1507 #if IS_ENABLED(CONFIG_NF_NAT)
1509 ctnetlink_parse_nat_setup(struct nf_conn
*ct
,
1510 enum nf_nat_manip_type manip
,
1511 const struct nlattr
*attr
)
1513 struct nf_nat_hook
*nat_hook
;
1516 nat_hook
= rcu_dereference(nf_nat_hook
);
1518 #ifdef CONFIG_MODULES
1520 nfnl_unlock(NFNL_SUBSYS_CTNETLINK
);
1521 if (request_module("nf-nat") < 0) {
1522 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1526 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1528 nat_hook
= rcu_dereference(nf_nat_hook
);
1535 err
= nat_hook
->parse_nat_setup(ct
, manip
, attr
);
1536 if (err
== -EAGAIN
) {
1537 #ifdef CONFIG_MODULES
1539 nfnl_unlock(NFNL_SUBSYS_CTNETLINK
);
1540 if (request_module("nf-nat-%u", nf_ct_l3num(ct
)) < 0) {
1541 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1545 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1556 __ctnetlink_change_status(struct nf_conn
*ct
, unsigned long on
,
1561 /* Ignore these unchangable bits */
1562 on
&= ~IPS_UNCHANGEABLE_MASK
;
1563 off
&= ~IPS_UNCHANGEABLE_MASK
;
1565 for (bit
= 0; bit
< __IPS_MAX_BIT
; bit
++) {
1566 if (on
& (1 << bit
))
1567 set_bit(bit
, &ct
->status
);
1568 else if (off
& (1 << bit
))
1569 clear_bit(bit
, &ct
->status
);
1574 ctnetlink_change_status(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
1577 unsigned int status
= ntohl(nla_get_be32(cda
[CTA_STATUS
]));
1578 d
= ct
->status
^ status
;
1580 if (d
& (IPS_EXPECTED
|IPS_CONFIRMED
|IPS_DYING
))
1584 if (d
& IPS_SEEN_REPLY
&& !(status
& IPS_SEEN_REPLY
))
1585 /* SEEN_REPLY bit can only be set */
1588 if (d
& IPS_ASSURED
&& !(status
& IPS_ASSURED
))
1589 /* ASSURED bit can only be set */
1592 __ctnetlink_change_status(ct
, status
, 0);
1597 ctnetlink_setup_nat(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
1599 #if IS_ENABLED(CONFIG_NF_NAT)
1602 if (!cda
[CTA_NAT_DST
] && !cda
[CTA_NAT_SRC
])
1605 ret
= ctnetlink_parse_nat_setup(ct
, NF_NAT_MANIP_DST
,
1610 return ctnetlink_parse_nat_setup(ct
, NF_NAT_MANIP_SRC
,
1613 if (!cda
[CTA_NAT_DST
] && !cda
[CTA_NAT_SRC
])
1619 static int ctnetlink_change_helper(struct nf_conn
*ct
,
1620 const struct nlattr
* const cda
[])
1622 struct nf_conntrack_helper
*helper
;
1623 struct nf_conn_help
*help
= nfct_help(ct
);
1624 char *helpname
= NULL
;
1625 struct nlattr
*helpinfo
= NULL
;
1628 err
= ctnetlink_parse_help(cda
[CTA_HELP
], &helpname
, &helpinfo
);
1632 /* don't change helper of sibling connections */
1634 /* If we try to change the helper to the same thing twice,
1635 * treat the second attempt as a no-op instead of returning
1641 helper
= rcu_dereference(help
->helper
);
1642 if (helper
&& !strcmp(helper
->name
, helpname
))
1650 if (!strcmp(helpname
, "")) {
1651 if (help
&& help
->helper
) {
1652 /* we had a helper before ... */
1653 nf_ct_remove_expectations(ct
);
1654 RCU_INIT_POINTER(help
->helper
, NULL
);
1661 helper
= __nf_conntrack_helper_find(helpname
, nf_ct_l3num(ct
),
1662 nf_ct_protonum(ct
));
1663 if (helper
== NULL
) {
1669 if (help
->helper
== helper
) {
1670 /* update private helper data if allowed. */
1671 if (helper
->from_nlattr
)
1672 helper
->from_nlattr(helpinfo
, ct
);
1677 /* we cannot set a helper for an existing conntrack */
1685 static int ctnetlink_change_timeout(struct nf_conn
*ct
,
1686 const struct nlattr
* const cda
[])
1688 u64 timeout
= (u64
)ntohl(nla_get_be32(cda
[CTA_TIMEOUT
])) * HZ
;
1690 if (timeout
> INT_MAX
)
1692 ct
->timeout
= nfct_time_stamp
+ (u32
)timeout
;
1694 if (test_bit(IPS_DYING_BIT
, &ct
->status
))
1700 #if defined(CONFIG_NF_CONNTRACK_MARK)
1701 static void ctnetlink_change_mark(struct nf_conn
*ct
,
1702 const struct nlattr
* const cda
[])
1704 u32 mark
, newmark
, mask
= 0;
1706 if (cda
[CTA_MARK_MASK
])
1707 mask
= ~ntohl(nla_get_be32(cda
[CTA_MARK_MASK
]));
1709 mark
= ntohl(nla_get_be32(cda
[CTA_MARK
]));
1710 newmark
= (ct
->mark
& mask
) ^ mark
;
1711 if (newmark
!= ct
->mark
)
1716 static const struct nla_policy protoinfo_policy
[CTA_PROTOINFO_MAX
+1] = {
1717 [CTA_PROTOINFO_TCP
] = { .type
= NLA_NESTED
},
1718 [CTA_PROTOINFO_DCCP
] = { .type
= NLA_NESTED
},
1719 [CTA_PROTOINFO_SCTP
] = { .type
= NLA_NESTED
},
1722 static int ctnetlink_change_protoinfo(struct nf_conn
*ct
,
1723 const struct nlattr
* const cda
[])
1725 const struct nlattr
*attr
= cda
[CTA_PROTOINFO
];
1726 const struct nf_conntrack_l4proto
*l4proto
;
1727 struct nlattr
*tb
[CTA_PROTOINFO_MAX
+1];
1730 err
= nla_parse_nested_deprecated(tb
, CTA_PROTOINFO_MAX
, attr
,
1731 protoinfo_policy
, NULL
);
1735 l4proto
= nf_ct_l4proto_find(nf_ct_protonum(ct
));
1736 if (l4proto
->from_nlattr
)
1737 err
= l4proto
->from_nlattr(tb
, ct
);
1742 static const struct nla_policy seqadj_policy
[CTA_SEQADJ_MAX
+1] = {
1743 [CTA_SEQADJ_CORRECTION_POS
] = { .type
= NLA_U32
},
1744 [CTA_SEQADJ_OFFSET_BEFORE
] = { .type
= NLA_U32
},
1745 [CTA_SEQADJ_OFFSET_AFTER
] = { .type
= NLA_U32
},
1748 static int change_seq_adj(struct nf_ct_seqadj
*seq
,
1749 const struct nlattr
* const attr
)
1752 struct nlattr
*cda
[CTA_SEQADJ_MAX
+1];
1754 err
= nla_parse_nested_deprecated(cda
, CTA_SEQADJ_MAX
, attr
,
1755 seqadj_policy
, NULL
);
1759 if (!cda
[CTA_SEQADJ_CORRECTION_POS
])
1762 seq
->correction_pos
=
1763 ntohl(nla_get_be32(cda
[CTA_SEQADJ_CORRECTION_POS
]));
1765 if (!cda
[CTA_SEQADJ_OFFSET_BEFORE
])
1768 seq
->offset_before
=
1769 ntohl(nla_get_be32(cda
[CTA_SEQADJ_OFFSET_BEFORE
]));
1771 if (!cda
[CTA_SEQADJ_OFFSET_AFTER
])
1775 ntohl(nla_get_be32(cda
[CTA_SEQADJ_OFFSET_AFTER
]));
1781 ctnetlink_change_seq_adj(struct nf_conn
*ct
,
1782 const struct nlattr
* const cda
[])
1784 struct nf_conn_seqadj
*seqadj
= nfct_seqadj(ct
);
1790 spin_lock_bh(&ct
->lock
);
1791 if (cda
[CTA_SEQ_ADJ_ORIG
]) {
1792 ret
= change_seq_adj(&seqadj
->seq
[IP_CT_DIR_ORIGINAL
],
1793 cda
[CTA_SEQ_ADJ_ORIG
]);
1797 set_bit(IPS_SEQ_ADJUST_BIT
, &ct
->status
);
1800 if (cda
[CTA_SEQ_ADJ_REPLY
]) {
1801 ret
= change_seq_adj(&seqadj
->seq
[IP_CT_DIR_REPLY
],
1802 cda
[CTA_SEQ_ADJ_REPLY
]);
1806 set_bit(IPS_SEQ_ADJUST_BIT
, &ct
->status
);
1809 spin_unlock_bh(&ct
->lock
);
1812 spin_unlock_bh(&ct
->lock
);
1816 static const struct nla_policy synproxy_policy
[CTA_SYNPROXY_MAX
+ 1] = {
1817 [CTA_SYNPROXY_ISN
] = { .type
= NLA_U32
},
1818 [CTA_SYNPROXY_ITS
] = { .type
= NLA_U32
},
1819 [CTA_SYNPROXY_TSOFF
] = { .type
= NLA_U32
},
1822 static int ctnetlink_change_synproxy(struct nf_conn
*ct
,
1823 const struct nlattr
* const cda
[])
1825 struct nf_conn_synproxy
*synproxy
= nfct_synproxy(ct
);
1826 struct nlattr
*tb
[CTA_SYNPROXY_MAX
+ 1];
1832 err
= nla_parse_nested_deprecated(tb
, CTA_SYNPROXY_MAX
,
1833 cda
[CTA_SYNPROXY
], synproxy_policy
,
1838 if (!tb
[CTA_SYNPROXY_ISN
] ||
1839 !tb
[CTA_SYNPROXY_ITS
] ||
1840 !tb
[CTA_SYNPROXY_TSOFF
])
1843 synproxy
->isn
= ntohl(nla_get_be32(tb
[CTA_SYNPROXY_ISN
]));
1844 synproxy
->its
= ntohl(nla_get_be32(tb
[CTA_SYNPROXY_ITS
]));
1845 synproxy
->tsoff
= ntohl(nla_get_be32(tb
[CTA_SYNPROXY_TSOFF
]));
1851 ctnetlink_attach_labels(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
1853 #ifdef CONFIG_NF_CONNTRACK_LABELS
1854 size_t len
= nla_len(cda
[CTA_LABELS
]);
1855 const void *mask
= cda
[CTA_LABELS_MASK
];
1857 if (len
& (sizeof(u32
)-1)) /* must be multiple of u32 */
1861 if (nla_len(cda
[CTA_LABELS_MASK
]) == 0 ||
1862 nla_len(cda
[CTA_LABELS_MASK
]) != len
)
1864 mask
= nla_data(cda
[CTA_LABELS_MASK
]);
1869 return nf_connlabels_replace(ct
, nla_data(cda
[CTA_LABELS
]), mask
, len
);
1876 ctnetlink_change_conntrack(struct nf_conn
*ct
,
1877 const struct nlattr
* const cda
[])
1881 /* only allow NAT changes and master assignation for new conntracks */
1882 if (cda
[CTA_NAT_SRC
] || cda
[CTA_NAT_DST
] || cda
[CTA_TUPLE_MASTER
])
1885 if (cda
[CTA_HELP
]) {
1886 err
= ctnetlink_change_helper(ct
, cda
);
1891 if (cda
[CTA_TIMEOUT
]) {
1892 err
= ctnetlink_change_timeout(ct
, cda
);
1897 if (cda
[CTA_STATUS
]) {
1898 err
= ctnetlink_change_status(ct
, cda
);
1903 if (cda
[CTA_PROTOINFO
]) {
1904 err
= ctnetlink_change_protoinfo(ct
, cda
);
1909 #if defined(CONFIG_NF_CONNTRACK_MARK)
1911 ctnetlink_change_mark(ct
, cda
);
1914 if (cda
[CTA_SEQ_ADJ_ORIG
] || cda
[CTA_SEQ_ADJ_REPLY
]) {
1915 err
= ctnetlink_change_seq_adj(ct
, cda
);
1920 if (cda
[CTA_SYNPROXY
]) {
1921 err
= ctnetlink_change_synproxy(ct
, cda
);
1926 if (cda
[CTA_LABELS
]) {
1927 err
= ctnetlink_attach_labels(ct
, cda
);
1935 static struct nf_conn
*
1936 ctnetlink_create_conntrack(struct net
*net
,
1937 const struct nf_conntrack_zone
*zone
,
1938 const struct nlattr
* const cda
[],
1939 struct nf_conntrack_tuple
*otuple
,
1940 struct nf_conntrack_tuple
*rtuple
,
1945 struct nf_conntrack_helper
*helper
;
1946 struct nf_conn_tstamp
*tstamp
;
1949 ct
= nf_conntrack_alloc(net
, zone
, otuple
, rtuple
, GFP_ATOMIC
);
1951 return ERR_PTR(-ENOMEM
);
1953 if (!cda
[CTA_TIMEOUT
])
1956 timeout
= (u64
)ntohl(nla_get_be32(cda
[CTA_TIMEOUT
])) * HZ
;
1957 if (timeout
> INT_MAX
)
1959 ct
->timeout
= (u32
)timeout
+ nfct_time_stamp
;
1962 if (cda
[CTA_HELP
]) {
1963 char *helpname
= NULL
;
1964 struct nlattr
*helpinfo
= NULL
;
1966 err
= ctnetlink_parse_help(cda
[CTA_HELP
], &helpname
, &helpinfo
);
1970 helper
= __nf_conntrack_helper_find(helpname
, nf_ct_l3num(ct
),
1971 nf_ct_protonum(ct
));
1972 if (helper
== NULL
) {
1974 #ifdef CONFIG_MODULES
1975 if (request_module("nfct-helper-%s", helpname
) < 0) {
1981 helper
= __nf_conntrack_helper_find(helpname
,
1983 nf_ct_protonum(ct
));
1993 struct nf_conn_help
*help
;
1995 help
= nf_ct_helper_ext_add(ct
, GFP_ATOMIC
);
2000 /* set private helper data if allowed. */
2001 if (helper
->from_nlattr
)
2002 helper
->from_nlattr(helpinfo
, ct
);
2004 /* not in hash table yet so not strictly necessary */
2005 RCU_INIT_POINTER(help
->helper
, helper
);
2008 /* try an implicit helper assignation */
2009 err
= __nf_ct_try_assign_helper(ct
, NULL
, GFP_ATOMIC
);
2014 err
= ctnetlink_setup_nat(ct
, cda
);
2018 nf_ct_acct_ext_add(ct
, GFP_ATOMIC
);
2019 nf_ct_tstamp_ext_add(ct
, GFP_ATOMIC
);
2020 nf_ct_ecache_ext_add(ct
, 0, 0, GFP_ATOMIC
);
2021 nf_ct_labels_ext_add(ct
);
2022 nfct_seqadj_ext_add(ct
);
2023 nfct_synproxy_ext_add(ct
);
2025 /* we must add conntrack extensions before confirmation. */
2026 ct
->status
|= IPS_CONFIRMED
;
2028 if (cda
[CTA_STATUS
]) {
2029 err
= ctnetlink_change_status(ct
, cda
);
2034 if (cda
[CTA_SEQ_ADJ_ORIG
] || cda
[CTA_SEQ_ADJ_REPLY
]) {
2035 err
= ctnetlink_change_seq_adj(ct
, cda
);
2040 memset(&ct
->proto
, 0, sizeof(ct
->proto
));
2041 if (cda
[CTA_PROTOINFO
]) {
2042 err
= ctnetlink_change_protoinfo(ct
, cda
);
2047 if (cda
[CTA_SYNPROXY
]) {
2048 err
= ctnetlink_change_synproxy(ct
, cda
);
2053 #if defined(CONFIG_NF_CONNTRACK_MARK)
2055 ctnetlink_change_mark(ct
, cda
);
2058 /* setup master conntrack: this is a confirmed expectation */
2059 if (cda
[CTA_TUPLE_MASTER
]) {
2060 struct nf_conntrack_tuple master
;
2061 struct nf_conntrack_tuple_hash
*master_h
;
2062 struct nf_conn
*master_ct
;
2064 err
= ctnetlink_parse_tuple(cda
, &master
, CTA_TUPLE_MASTER
,
2069 master_h
= nf_conntrack_find_get(net
, zone
, &master
);
2070 if (master_h
== NULL
) {
2074 master_ct
= nf_ct_tuplehash_to_ctrack(master_h
);
2075 __set_bit(IPS_EXPECTED_BIT
, &ct
->status
);
2076 ct
->master
= master_ct
;
2078 tstamp
= nf_conn_tstamp_find(ct
);
2080 tstamp
->start
= ktime_get_real_ns();
2082 err
= nf_conntrack_hash_check_insert(ct
);
2093 nf_conntrack_free(ct
);
2094 return ERR_PTR(err
);
2097 static int ctnetlink_new_conntrack(struct net
*net
, struct sock
*ctnl
,
2098 struct sk_buff
*skb
,
2099 const struct nlmsghdr
*nlh
,
2100 const struct nlattr
* const cda
[],
2101 struct netlink_ext_ack
*extack
)
2103 struct nf_conntrack_tuple otuple
, rtuple
;
2104 struct nf_conntrack_tuple_hash
*h
= NULL
;
2105 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
2107 u_int8_t u3
= nfmsg
->nfgen_family
;
2108 struct nf_conntrack_zone zone
;
2111 err
= ctnetlink_parse_zone(cda
[CTA_ZONE
], &zone
);
2115 if (cda
[CTA_TUPLE_ORIG
]) {
2116 err
= ctnetlink_parse_tuple(cda
, &otuple
, CTA_TUPLE_ORIG
,
2122 if (cda
[CTA_TUPLE_REPLY
]) {
2123 err
= ctnetlink_parse_tuple(cda
, &rtuple
, CTA_TUPLE_REPLY
,
2129 if (cda
[CTA_TUPLE_ORIG
])
2130 h
= nf_conntrack_find_get(net
, &zone
, &otuple
);
2131 else if (cda
[CTA_TUPLE_REPLY
])
2132 h
= nf_conntrack_find_get(net
, &zone
, &rtuple
);
2136 if (nlh
->nlmsg_flags
& NLM_F_CREATE
) {
2137 enum ip_conntrack_events events
;
2139 if (!cda
[CTA_TUPLE_ORIG
] || !cda
[CTA_TUPLE_REPLY
])
2141 if (otuple
.dst
.protonum
!= rtuple
.dst
.protonum
)
2144 ct
= ctnetlink_create_conntrack(net
, &zone
, cda
, &otuple
,
2150 if (test_bit(IPS_EXPECTED_BIT
, &ct
->status
))
2151 events
= 1 << IPCT_RELATED
;
2153 events
= 1 << IPCT_NEW
;
2155 if (cda
[CTA_LABELS
] &&
2156 ctnetlink_attach_labels(ct
, cda
) == 0)
2157 events
|= (1 << IPCT_LABEL
);
2159 nf_conntrack_eventmask_report((1 << IPCT_REPLY
) |
2160 (1 << IPCT_ASSURED
) |
2161 (1 << IPCT_HELPER
) |
2162 (1 << IPCT_PROTOINFO
) |
2163 (1 << IPCT_SEQADJ
) |
2165 (1 << IPCT_SYNPROXY
) |
2167 ct
, NETLINK_CB(skb
).portid
,
2174 /* implicit 'else' */
2177 ct
= nf_ct_tuplehash_to_ctrack(h
);
2178 if (!(nlh
->nlmsg_flags
& NLM_F_EXCL
)) {
2179 err
= ctnetlink_change_conntrack(ct
, cda
);
2181 nf_conntrack_eventmask_report((1 << IPCT_REPLY
) |
2182 (1 << IPCT_ASSURED
) |
2183 (1 << IPCT_HELPER
) |
2185 (1 << IPCT_PROTOINFO
) |
2186 (1 << IPCT_SEQADJ
) |
2188 (1 << IPCT_SYNPROXY
),
2189 ct
, NETLINK_CB(skb
).portid
,
2199 ctnetlink_ct_stat_cpu_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
,
2200 __u16 cpu
, const struct ip_conntrack_stat
*st
)
2202 struct nlmsghdr
*nlh
;
2203 struct nfgenmsg
*nfmsg
;
2204 unsigned int flags
= portid
? NLM_F_MULTI
: 0, event
;
2206 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
,
2207 IPCTNL_MSG_CT_GET_STATS_CPU
);
2208 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
2212 nfmsg
= nlmsg_data(nlh
);
2213 nfmsg
->nfgen_family
= AF_UNSPEC
;
2214 nfmsg
->version
= NFNETLINK_V0
;
2215 nfmsg
->res_id
= htons(cpu
);
2217 if (nla_put_be32(skb
, CTA_STATS_FOUND
, htonl(st
->found
)) ||
2218 nla_put_be32(skb
, CTA_STATS_INVALID
, htonl(st
->invalid
)) ||
2219 nla_put_be32(skb
, CTA_STATS_IGNORE
, htonl(st
->ignore
)) ||
2220 nla_put_be32(skb
, CTA_STATS_INSERT
, htonl(st
->insert
)) ||
2221 nla_put_be32(skb
, CTA_STATS_INSERT_FAILED
,
2222 htonl(st
->insert_failed
)) ||
2223 nla_put_be32(skb
, CTA_STATS_DROP
, htonl(st
->drop
)) ||
2224 nla_put_be32(skb
, CTA_STATS_EARLY_DROP
, htonl(st
->early_drop
)) ||
2225 nla_put_be32(skb
, CTA_STATS_ERROR
, htonl(st
->error
)) ||
2226 nla_put_be32(skb
, CTA_STATS_SEARCH_RESTART
,
2227 htonl(st
->search_restart
)))
2228 goto nla_put_failure
;
2230 nlmsg_end(skb
, nlh
);
2235 nlmsg_cancel(skb
, nlh
);
2240 ctnetlink_ct_stat_cpu_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
2243 struct net
*net
= sock_net(skb
->sk
);
2245 if (cb
->args
[0] == nr_cpu_ids
)
2248 for (cpu
= cb
->args
[0]; cpu
< nr_cpu_ids
; cpu
++) {
2249 const struct ip_conntrack_stat
*st
;
2251 if (!cpu_possible(cpu
))
2254 st
= per_cpu_ptr(net
->ct
.stat
, cpu
);
2255 if (ctnetlink_ct_stat_cpu_fill_info(skb
,
2256 NETLINK_CB(cb
->skb
).portid
,
2266 static int ctnetlink_stat_ct_cpu(struct net
*net
, struct sock
*ctnl
,
2267 struct sk_buff
*skb
,
2268 const struct nlmsghdr
*nlh
,
2269 const struct nlattr
* const cda
[],
2270 struct netlink_ext_ack
*extack
)
2272 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
2273 struct netlink_dump_control c
= {
2274 .dump
= ctnetlink_ct_stat_cpu_dump
,
2276 return netlink_dump_start(ctnl
, skb
, nlh
, &c
);
2283 ctnetlink_stat_ct_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
2286 struct nlmsghdr
*nlh
;
2287 struct nfgenmsg
*nfmsg
;
2288 unsigned int flags
= portid
? NLM_F_MULTI
: 0, event
;
2289 unsigned int nr_conntracks
= atomic_read(&net
->ct
.count
);
2291 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
, IPCTNL_MSG_CT_GET_STATS
);
2292 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
2296 nfmsg
= nlmsg_data(nlh
);
2297 nfmsg
->nfgen_family
= AF_UNSPEC
;
2298 nfmsg
->version
= NFNETLINK_V0
;
2301 if (nla_put_be32(skb
, CTA_STATS_GLOBAL_ENTRIES
, htonl(nr_conntracks
)))
2302 goto nla_put_failure
;
2304 if (nla_put_be32(skb
, CTA_STATS_GLOBAL_MAX_ENTRIES
, htonl(nf_conntrack_max
)))
2305 goto nla_put_failure
;
2307 nlmsg_end(skb
, nlh
);
2312 nlmsg_cancel(skb
, nlh
);
2316 static int ctnetlink_stat_ct(struct net
*net
, struct sock
*ctnl
,
2317 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
2318 const struct nlattr
* const cda
[],
2319 struct netlink_ext_ack
*extack
)
2321 struct sk_buff
*skb2
;
2324 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
2328 err
= ctnetlink_stat_ct_fill_info(skb2
, NETLINK_CB(skb
).portid
,
2330 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
2335 err
= netlink_unicast(ctnl
, skb2
, NETLINK_CB(skb
).portid
, MSG_DONTWAIT
);
2344 /* this avoids a loop in nfnetlink. */
2345 return err
== -EAGAIN
? -ENOBUFS
: err
;
2348 static const struct nla_policy exp_nla_policy
[CTA_EXPECT_MAX
+1] = {
2349 [CTA_EXPECT_MASTER
] = { .type
= NLA_NESTED
},
2350 [CTA_EXPECT_TUPLE
] = { .type
= NLA_NESTED
},
2351 [CTA_EXPECT_MASK
] = { .type
= NLA_NESTED
},
2352 [CTA_EXPECT_TIMEOUT
] = { .type
= NLA_U32
},
2353 [CTA_EXPECT_ID
] = { .type
= NLA_U32
},
2354 [CTA_EXPECT_HELP_NAME
] = { .type
= NLA_NUL_STRING
,
2355 .len
= NF_CT_HELPER_NAME_LEN
- 1 },
2356 [CTA_EXPECT_ZONE
] = { .type
= NLA_U16
},
2357 [CTA_EXPECT_FLAGS
] = { .type
= NLA_U32
},
2358 [CTA_EXPECT_CLASS
] = { .type
= NLA_U32
},
2359 [CTA_EXPECT_NAT
] = { .type
= NLA_NESTED
},
2360 [CTA_EXPECT_FN
] = { .type
= NLA_NUL_STRING
},
2363 static struct nf_conntrack_expect
*
2364 ctnetlink_alloc_expect(const struct nlattr
*const cda
[], struct nf_conn
*ct
,
2365 struct nf_conntrack_helper
*helper
,
2366 struct nf_conntrack_tuple
*tuple
,
2367 struct nf_conntrack_tuple
*mask
);
2369 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
2371 ctnetlink_glue_build_size(const struct nf_conn
*ct
)
2373 return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
2374 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
2375 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
2376 + 3 * nla_total_size(sizeof(u_int8_t
)) /* CTA_PROTO_NUM */
2377 + nla_total_size(sizeof(u_int32_t
)) /* CTA_ID */
2378 + nla_total_size(sizeof(u_int32_t
)) /* CTA_STATUS */
2379 + nla_total_size(sizeof(u_int32_t
)) /* CTA_TIMEOUT */
2380 + nla_total_size(0) /* CTA_PROTOINFO */
2381 + nla_total_size(0) /* CTA_HELP */
2382 + nla_total_size(NF_CT_HELPER_NAME_LEN
) /* CTA_HELP_NAME */
2383 + ctnetlink_secctx_size(ct
)
2384 #if IS_ENABLED(CONFIG_NF_NAT)
2385 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
2386 + 6 * nla_total_size(sizeof(u_int32_t
)) /* CTA_NAT_SEQ_OFFSET */
2388 #ifdef CONFIG_NF_CONNTRACK_MARK
2389 + nla_total_size(sizeof(u_int32_t
)) /* CTA_MARK */
2391 #ifdef CONFIG_NF_CONNTRACK_ZONES
2392 + nla_total_size(sizeof(u_int16_t
)) /* CTA_ZONE|CTA_TUPLE_ZONE */
2394 + ctnetlink_proto_size(ct
)
2398 static struct nf_conn
*ctnetlink_glue_get_ct(const struct sk_buff
*skb
,
2399 enum ip_conntrack_info
*ctinfo
)
2401 return nf_ct_get(skb
, ctinfo
);
2404 static int __ctnetlink_glue_build(struct sk_buff
*skb
, struct nf_conn
*ct
)
2406 const struct nf_conntrack_zone
*zone
;
2407 struct nlattr
*nest_parms
;
2409 zone
= nf_ct_zone(ct
);
2411 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_ORIG
);
2413 goto nla_put_failure
;
2414 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_ORIGINAL
)) < 0)
2415 goto nla_put_failure
;
2416 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
2417 NF_CT_ZONE_DIR_ORIG
) < 0)
2418 goto nla_put_failure
;
2419 nla_nest_end(skb
, nest_parms
);
2421 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_REPLY
);
2423 goto nla_put_failure
;
2424 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_REPLY
)) < 0)
2425 goto nla_put_failure
;
2426 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
2427 NF_CT_ZONE_DIR_REPL
) < 0)
2428 goto nla_put_failure
;
2429 nla_nest_end(skb
, nest_parms
);
2431 if (ctnetlink_dump_zone_id(skb
, CTA_ZONE
, zone
,
2432 NF_CT_DEFAULT_ZONE_DIR
) < 0)
2433 goto nla_put_failure
;
2435 if (ctnetlink_dump_id(skb
, ct
) < 0)
2436 goto nla_put_failure
;
2438 if (ctnetlink_dump_status(skb
, ct
) < 0)
2439 goto nla_put_failure
;
2441 if (ctnetlink_dump_timeout(skb
, ct
) < 0)
2442 goto nla_put_failure
;
2444 if (ctnetlink_dump_protoinfo(skb
, ct
) < 0)
2445 goto nla_put_failure
;
2447 if (ctnetlink_dump_helpinfo(skb
, ct
) < 0)
2448 goto nla_put_failure
;
2450 #ifdef CONFIG_NF_CONNTRACK_SECMARK
2451 if (ct
->secmark
&& ctnetlink_dump_secctx(skb
, ct
) < 0)
2452 goto nla_put_failure
;
2454 if (ct
->master
&& ctnetlink_dump_master(skb
, ct
) < 0)
2455 goto nla_put_failure
;
2457 if ((ct
->status
& IPS_SEQ_ADJUST
) &&
2458 ctnetlink_dump_ct_seq_adj(skb
, ct
) < 0)
2459 goto nla_put_failure
;
2461 if (ctnetlink_dump_ct_synproxy(skb
, ct
) < 0)
2462 goto nla_put_failure
;
2464 #ifdef CONFIG_NF_CONNTRACK_MARK
2465 if (ct
->mark
&& ctnetlink_dump_mark(skb
, ct
) < 0)
2466 goto nla_put_failure
;
2468 if (ctnetlink_dump_labels(skb
, ct
) < 0)
2469 goto nla_put_failure
;
2477 ctnetlink_glue_build(struct sk_buff
*skb
, struct nf_conn
*ct
,
2478 enum ip_conntrack_info ctinfo
,
2479 u_int16_t ct_attr
, u_int16_t ct_info_attr
)
2481 struct nlattr
*nest_parms
;
2483 nest_parms
= nla_nest_start(skb
, ct_attr
);
2485 goto nla_put_failure
;
2487 if (__ctnetlink_glue_build(skb
, ct
) < 0)
2488 goto nla_put_failure
;
2490 nla_nest_end(skb
, nest_parms
);
2492 if (nla_put_be32(skb
, ct_info_attr
, htonl(ctinfo
)))
2493 goto nla_put_failure
;
2502 ctnetlink_update_status(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
2504 unsigned int status
= ntohl(nla_get_be32(cda
[CTA_STATUS
]));
2505 unsigned long d
= ct
->status
^ status
;
2507 if (d
& IPS_SEEN_REPLY
&& !(status
& IPS_SEEN_REPLY
))
2508 /* SEEN_REPLY bit can only be set */
2511 if (d
& IPS_ASSURED
&& !(status
& IPS_ASSURED
))
2512 /* ASSURED bit can only be set */
2515 /* This check is less strict than ctnetlink_change_status()
2516 * because callers often flip IPS_EXPECTED bits when sending
2517 * an NFQA_CT attribute to the kernel. So ignore the
2518 * unchangeable bits but do not error out. Also user programs
2519 * are allowed to clear the bits that they are allowed to change.
2521 __ctnetlink_change_status(ct
, status
, ~status
);
2526 ctnetlink_glue_parse_ct(const struct nlattr
*cda
[], struct nf_conn
*ct
)
2530 if (cda
[CTA_TIMEOUT
]) {
2531 err
= ctnetlink_change_timeout(ct
, cda
);
2535 if (cda
[CTA_STATUS
]) {
2536 err
= ctnetlink_update_status(ct
, cda
);
2540 if (cda
[CTA_HELP
]) {
2541 err
= ctnetlink_change_helper(ct
, cda
);
2545 if (cda
[CTA_LABELS
]) {
2546 err
= ctnetlink_attach_labels(ct
, cda
);
2550 #if defined(CONFIG_NF_CONNTRACK_MARK)
2551 if (cda
[CTA_MARK
]) {
2552 ctnetlink_change_mark(ct
, cda
);
2559 ctnetlink_glue_parse(const struct nlattr
*attr
, struct nf_conn
*ct
)
2561 struct nlattr
*cda
[CTA_MAX
+1];
2564 ret
= nla_parse_nested_deprecated(cda
, CTA_MAX
, attr
, ct_nla_policy
,
2569 return ctnetlink_glue_parse_ct((const struct nlattr
**)cda
, ct
);
2572 static int ctnetlink_glue_exp_parse(const struct nlattr
* const *cda
,
2573 const struct nf_conn
*ct
,
2574 struct nf_conntrack_tuple
*tuple
,
2575 struct nf_conntrack_tuple
*mask
)
2579 err
= ctnetlink_parse_tuple(cda
, tuple
, CTA_EXPECT_TUPLE
,
2580 nf_ct_l3num(ct
), NULL
);
2584 return ctnetlink_parse_tuple(cda
, mask
, CTA_EXPECT_MASK
,
2585 nf_ct_l3num(ct
), NULL
);
2589 ctnetlink_glue_attach_expect(const struct nlattr
*attr
, struct nf_conn
*ct
,
2590 u32 portid
, u32 report
)
2592 struct nlattr
*cda
[CTA_EXPECT_MAX
+1];
2593 struct nf_conntrack_tuple tuple
, mask
;
2594 struct nf_conntrack_helper
*helper
= NULL
;
2595 struct nf_conntrack_expect
*exp
;
2598 err
= nla_parse_nested_deprecated(cda
, CTA_EXPECT_MAX
, attr
,
2599 exp_nla_policy
, NULL
);
2603 err
= ctnetlink_glue_exp_parse((const struct nlattr
* const *)cda
,
2608 if (cda
[CTA_EXPECT_HELP_NAME
]) {
2609 const char *helpname
= nla_data(cda
[CTA_EXPECT_HELP_NAME
]);
2611 helper
= __nf_conntrack_helper_find(helpname
, nf_ct_l3num(ct
),
2612 nf_ct_protonum(ct
));
2617 exp
= ctnetlink_alloc_expect((const struct nlattr
* const *)cda
, ct
,
2618 helper
, &tuple
, &mask
);
2620 return PTR_ERR(exp
);
2622 err
= nf_ct_expect_related_report(exp
, portid
, report
, 0);
2623 nf_ct_expect_put(exp
);
2627 static void ctnetlink_glue_seqadj(struct sk_buff
*skb
, struct nf_conn
*ct
,
2628 enum ip_conntrack_info ctinfo
, int diff
)
2630 if (!(ct
->status
& IPS_NAT_MASK
))
2633 nf_ct_tcp_seqadj_set(skb
, ct
, ctinfo
, diff
);
2636 static struct nfnl_ct_hook ctnetlink_glue_hook
= {
2637 .get_ct
= ctnetlink_glue_get_ct
,
2638 .build_size
= ctnetlink_glue_build_size
,
2639 .build
= ctnetlink_glue_build
,
2640 .parse
= ctnetlink_glue_parse
,
2641 .attach_expect
= ctnetlink_glue_attach_expect
,
2642 .seq_adjust
= ctnetlink_glue_seqadj
,
2644 #endif /* CONFIG_NETFILTER_NETLINK_GLUE_CT */
2646 /***********************************************************************
2648 ***********************************************************************/
2650 static int ctnetlink_exp_dump_tuple(struct sk_buff
*skb
,
2651 const struct nf_conntrack_tuple
*tuple
,
2654 struct nlattr
*nest_parms
;
2656 nest_parms
= nla_nest_start(skb
, type
);
2658 goto nla_put_failure
;
2659 if (ctnetlink_dump_tuples(skb
, tuple
) < 0)
2660 goto nla_put_failure
;
2661 nla_nest_end(skb
, nest_parms
);
2669 static int ctnetlink_exp_dump_mask(struct sk_buff
*skb
,
2670 const struct nf_conntrack_tuple
*tuple
,
2671 const struct nf_conntrack_tuple_mask
*mask
)
2673 const struct nf_conntrack_l4proto
*l4proto
;
2674 struct nf_conntrack_tuple m
;
2675 struct nlattr
*nest_parms
;
2678 memset(&m
, 0xFF, sizeof(m
));
2679 memcpy(&m
.src
.u3
, &mask
->src
.u3
, sizeof(m
.src
.u3
));
2680 m
.src
.u
.all
= mask
->src
.u
.all
;
2681 m
.dst
.protonum
= tuple
->dst
.protonum
;
2683 nest_parms
= nla_nest_start(skb
, CTA_EXPECT_MASK
);
2685 goto nla_put_failure
;
2688 ret
= ctnetlink_dump_tuples_ip(skb
, &m
);
2690 l4proto
= nf_ct_l4proto_find(tuple
->dst
.protonum
);
2691 ret
= ctnetlink_dump_tuples_proto(skb
, &m
, l4proto
);
2695 if (unlikely(ret
< 0))
2696 goto nla_put_failure
;
2698 nla_nest_end(skb
, nest_parms
);
2706 static const union nf_inet_addr any_addr
;
2708 static __be32
nf_expect_get_id(const struct nf_conntrack_expect
*exp
)
2710 static __read_mostly siphash_key_t exp_id_seed
;
2711 unsigned long a
, b
, c
, d
;
2713 net_get_random_once(&exp_id_seed
, sizeof(exp_id_seed
));
2715 a
= (unsigned long)exp
;
2716 b
= (unsigned long)exp
->helper
;
2717 c
= (unsigned long)exp
->master
;
2718 d
= (unsigned long)siphash(&exp
->tuple
, sizeof(exp
->tuple
), &exp_id_seed
);
2721 return (__force __be32
)siphash_4u64((u64
)a
, (u64
)b
, (u64
)c
, (u64
)d
, &exp_id_seed
);
2723 return (__force __be32
)siphash_4u32((u32
)a
, (u32
)b
, (u32
)c
, (u32
)d
, &exp_id_seed
);
2728 ctnetlink_exp_dump_expect(struct sk_buff
*skb
,
2729 const struct nf_conntrack_expect
*exp
)
2731 struct nf_conn
*master
= exp
->master
;
2732 long timeout
= ((long)exp
->timeout
.expires
- (long)jiffies
) / HZ
;
2733 struct nf_conn_help
*help
;
2734 #if IS_ENABLED(CONFIG_NF_NAT)
2735 struct nlattr
*nest_parms
;
2736 struct nf_conntrack_tuple nat_tuple
= {};
2738 struct nf_ct_helper_expectfn
*expfn
;
2743 if (ctnetlink_exp_dump_tuple(skb
, &exp
->tuple
, CTA_EXPECT_TUPLE
) < 0)
2744 goto nla_put_failure
;
2745 if (ctnetlink_exp_dump_mask(skb
, &exp
->tuple
, &exp
->mask
) < 0)
2746 goto nla_put_failure
;
2747 if (ctnetlink_exp_dump_tuple(skb
,
2748 &master
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
,
2749 CTA_EXPECT_MASTER
) < 0)
2750 goto nla_put_failure
;
2752 #if IS_ENABLED(CONFIG_NF_NAT)
2753 if (!nf_inet_addr_cmp(&exp
->saved_addr
, &any_addr
) ||
2754 exp
->saved_proto
.all
) {
2755 nest_parms
= nla_nest_start(skb
, CTA_EXPECT_NAT
);
2757 goto nla_put_failure
;
2759 if (nla_put_be32(skb
, CTA_EXPECT_NAT_DIR
, htonl(exp
->dir
)))
2760 goto nla_put_failure
;
2762 nat_tuple
.src
.l3num
= nf_ct_l3num(master
);
2763 nat_tuple
.src
.u3
= exp
->saved_addr
;
2764 nat_tuple
.dst
.protonum
= nf_ct_protonum(master
);
2765 nat_tuple
.src
.u
= exp
->saved_proto
;
2767 if (ctnetlink_exp_dump_tuple(skb
, &nat_tuple
,
2768 CTA_EXPECT_NAT_TUPLE
) < 0)
2769 goto nla_put_failure
;
2770 nla_nest_end(skb
, nest_parms
);
2773 if (nla_put_be32(skb
, CTA_EXPECT_TIMEOUT
, htonl(timeout
)) ||
2774 nla_put_be32(skb
, CTA_EXPECT_ID
, nf_expect_get_id(exp
)) ||
2775 nla_put_be32(skb
, CTA_EXPECT_FLAGS
, htonl(exp
->flags
)) ||
2776 nla_put_be32(skb
, CTA_EXPECT_CLASS
, htonl(exp
->class)))
2777 goto nla_put_failure
;
2778 help
= nfct_help(master
);
2780 struct nf_conntrack_helper
*helper
;
2782 helper
= rcu_dereference(help
->helper
);
2784 nla_put_string(skb
, CTA_EXPECT_HELP_NAME
, helper
->name
))
2785 goto nla_put_failure
;
2787 expfn
= nf_ct_helper_expectfn_find_by_symbol(exp
->expectfn
);
2788 if (expfn
!= NULL
&&
2789 nla_put_string(skb
, CTA_EXPECT_FN
, expfn
->name
))
2790 goto nla_put_failure
;
2799 ctnetlink_exp_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
,
2800 int event
, const struct nf_conntrack_expect
*exp
)
2802 struct nlmsghdr
*nlh
;
2803 struct nfgenmsg
*nfmsg
;
2804 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
2806 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP
, event
);
2807 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
2811 nfmsg
= nlmsg_data(nlh
);
2812 nfmsg
->nfgen_family
= exp
->tuple
.src
.l3num
;
2813 nfmsg
->version
= NFNETLINK_V0
;
2816 if (ctnetlink_exp_dump_expect(skb
, exp
) < 0)
2817 goto nla_put_failure
;
2819 nlmsg_end(skb
, nlh
);
2824 nlmsg_cancel(skb
, nlh
);
2828 #ifdef CONFIG_NF_CONNTRACK_EVENTS
2830 ctnetlink_expect_event(unsigned int events
, struct nf_exp_event
*item
)
2832 struct nf_conntrack_expect
*exp
= item
->exp
;
2833 struct net
*net
= nf_ct_exp_net(exp
);
2834 struct nlmsghdr
*nlh
;
2835 struct nfgenmsg
*nfmsg
;
2836 struct sk_buff
*skb
;
2837 unsigned int type
, group
;
2840 if (events
& (1 << IPEXP_DESTROY
)) {
2841 type
= IPCTNL_MSG_EXP_DELETE
;
2842 group
= NFNLGRP_CONNTRACK_EXP_DESTROY
;
2843 } else if (events
& (1 << IPEXP_NEW
)) {
2844 type
= IPCTNL_MSG_EXP_NEW
;
2845 flags
= NLM_F_CREATE
|NLM_F_EXCL
;
2846 group
= NFNLGRP_CONNTRACK_EXP_NEW
;
2850 if (!item
->report
&& !nfnetlink_has_listeners(net
, group
))
2853 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_ATOMIC
);
2857 type
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP
, type
);
2858 nlh
= nlmsg_put(skb
, item
->portid
, 0, type
, sizeof(*nfmsg
), flags
);
2862 nfmsg
= nlmsg_data(nlh
);
2863 nfmsg
->nfgen_family
= exp
->tuple
.src
.l3num
;
2864 nfmsg
->version
= NFNETLINK_V0
;
2867 if (ctnetlink_exp_dump_expect(skb
, exp
) < 0)
2868 goto nla_put_failure
;
2870 nlmsg_end(skb
, nlh
);
2871 nfnetlink_send(skb
, net
, item
->portid
, group
, item
->report
, GFP_ATOMIC
);
2875 nlmsg_cancel(skb
, nlh
);
2879 nfnetlink_set_err(net
, 0, 0, -ENOBUFS
);
2883 static int ctnetlink_exp_done(struct netlink_callback
*cb
)
2886 nf_ct_expect_put((struct nf_conntrack_expect
*)cb
->args
[1]);
2891 ctnetlink_exp_dump_table(struct sk_buff
*skb
, struct netlink_callback
*cb
)
2893 struct net
*net
= sock_net(skb
->sk
);
2894 struct nf_conntrack_expect
*exp
, *last
;
2895 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
2896 u_int8_t l3proto
= nfmsg
->nfgen_family
;
2899 last
= (struct nf_conntrack_expect
*)cb
->args
[1];
2900 for (; cb
->args
[0] < nf_ct_expect_hsize
; cb
->args
[0]++) {
2902 hlist_for_each_entry_rcu(exp
, &nf_ct_expect_hash
[cb
->args
[0]],
2904 if (l3proto
&& exp
->tuple
.src
.l3num
!= l3proto
)
2907 if (!net_eq(nf_ct_net(exp
->master
), net
))
2915 if (ctnetlink_exp_fill_info(skb
,
2916 NETLINK_CB(cb
->skb
).portid
,
2920 if (!refcount_inc_not_zero(&exp
->use
))
2922 cb
->args
[1] = (unsigned long)exp
;
2934 nf_ct_expect_put(last
);
2940 ctnetlink_exp_ct_dump_table(struct sk_buff
*skb
, struct netlink_callback
*cb
)
2942 struct nf_conntrack_expect
*exp
, *last
;
2943 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
2944 struct nf_conn
*ct
= cb
->data
;
2945 struct nf_conn_help
*help
= nfct_help(ct
);
2946 u_int8_t l3proto
= nfmsg
->nfgen_family
;
2952 last
= (struct nf_conntrack_expect
*)cb
->args
[1];
2954 hlist_for_each_entry_rcu(exp
, &help
->expectations
, lnode
) {
2955 if (l3proto
&& exp
->tuple
.src
.l3num
!= l3proto
)
2962 if (ctnetlink_exp_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
2966 if (!refcount_inc_not_zero(&exp
->use
))
2968 cb
->args
[1] = (unsigned long)exp
;
2980 nf_ct_expect_put(last
);
2985 static int ctnetlink_dump_exp_ct(struct net
*net
, struct sock
*ctnl
,
2986 struct sk_buff
*skb
,
2987 const struct nlmsghdr
*nlh
,
2988 const struct nlattr
* const cda
[],
2989 struct netlink_ext_ack
*extack
)
2992 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
2993 u_int8_t u3
= nfmsg
->nfgen_family
;
2994 struct nf_conntrack_tuple tuple
;
2995 struct nf_conntrack_tuple_hash
*h
;
2997 struct nf_conntrack_zone zone
;
2998 struct netlink_dump_control c
= {
2999 .dump
= ctnetlink_exp_ct_dump_table
,
3000 .done
= ctnetlink_exp_done
,
3003 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_MASTER
,
3008 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3012 h
= nf_conntrack_find_get(net
, &zone
, &tuple
);
3016 ct
= nf_ct_tuplehash_to_ctrack(h
);
3017 /* No expectation linked to this connection tracking. */
3018 if (!nfct_help(ct
)) {
3025 err
= netlink_dump_start(ctnl
, skb
, nlh
, &c
);
3031 static int ctnetlink_get_expect(struct net
*net
, struct sock
*ctnl
,
3032 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
3033 const struct nlattr
* const cda
[],
3034 struct netlink_ext_ack
*extack
)
3036 struct nf_conntrack_tuple tuple
;
3037 struct nf_conntrack_expect
*exp
;
3038 struct sk_buff
*skb2
;
3039 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3040 u_int8_t u3
= nfmsg
->nfgen_family
;
3041 struct nf_conntrack_zone zone
;
3044 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3045 if (cda
[CTA_EXPECT_MASTER
])
3046 return ctnetlink_dump_exp_ct(net
, ctnl
, skb
, nlh
, cda
,
3049 struct netlink_dump_control c
= {
3050 .dump
= ctnetlink_exp_dump_table
,
3051 .done
= ctnetlink_exp_done
,
3053 return netlink_dump_start(ctnl
, skb
, nlh
, &c
);
3057 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3061 if (cda
[CTA_EXPECT_TUPLE
])
3062 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3064 else if (cda
[CTA_EXPECT_MASTER
])
3065 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_MASTER
,
3073 exp
= nf_ct_expect_find_get(net
, &zone
, &tuple
);
3077 if (cda
[CTA_EXPECT_ID
]) {
3078 __be32 id
= nla_get_be32(cda
[CTA_EXPECT_ID
]);
3080 if (id
!= nf_expect_get_id(exp
)) {
3081 nf_ct_expect_put(exp
);
3087 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
3089 nf_ct_expect_put(exp
);
3094 err
= ctnetlink_exp_fill_info(skb2
, NETLINK_CB(skb
).portid
,
3095 nlh
->nlmsg_seq
, IPCTNL_MSG_EXP_NEW
, exp
);
3097 nf_ct_expect_put(exp
);
3101 err
= netlink_unicast(ctnl
, skb2
, NETLINK_CB(skb
).portid
, MSG_DONTWAIT
);
3110 /* this avoids a loop in nfnetlink. */
3111 return err
== -EAGAIN
? -ENOBUFS
: err
;
3114 static bool expect_iter_name(struct nf_conntrack_expect
*exp
, void *data
)
3116 const struct nf_conn_help
*m_help
;
3117 const char *name
= data
;
3119 m_help
= nfct_help(exp
->master
);
3121 return strcmp(m_help
->helper
->name
, name
) == 0;
3124 static bool expect_iter_all(struct nf_conntrack_expect
*exp
, void *data
)
3129 static int ctnetlink_del_expect(struct net
*net
, struct sock
*ctnl
,
3130 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
3131 const struct nlattr
* const cda
[],
3132 struct netlink_ext_ack
*extack
)
3134 struct nf_conntrack_expect
*exp
;
3135 struct nf_conntrack_tuple tuple
;
3136 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3137 u_int8_t u3
= nfmsg
->nfgen_family
;
3138 struct nf_conntrack_zone zone
;
3141 if (cda
[CTA_EXPECT_TUPLE
]) {
3142 /* delete a single expect by tuple */
3143 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3147 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3152 /* bump usage count to 2 */
3153 exp
= nf_ct_expect_find_get(net
, &zone
, &tuple
);
3157 if (cda
[CTA_EXPECT_ID
]) {
3158 __be32 id
= nla_get_be32(cda
[CTA_EXPECT_ID
]);
3159 if (ntohl(id
) != (u32
)(unsigned long)exp
) {
3160 nf_ct_expect_put(exp
);
3165 /* after list removal, usage count == 1 */
3166 spin_lock_bh(&nf_conntrack_expect_lock
);
3167 if (del_timer(&exp
->timeout
)) {
3168 nf_ct_unlink_expect_report(exp
, NETLINK_CB(skb
).portid
,
3170 nf_ct_expect_put(exp
);
3172 spin_unlock_bh(&nf_conntrack_expect_lock
);
3173 /* have to put what we 'get' above.
3174 * after this line usage count == 0 */
3175 nf_ct_expect_put(exp
);
3176 } else if (cda
[CTA_EXPECT_HELP_NAME
]) {
3177 char *name
= nla_data(cda
[CTA_EXPECT_HELP_NAME
]);
3179 nf_ct_expect_iterate_net(net
, expect_iter_name
, name
,
3180 NETLINK_CB(skb
).portid
,
3183 /* This basically means we have to flush everything*/
3184 nf_ct_expect_iterate_net(net
, expect_iter_all
, NULL
,
3185 NETLINK_CB(skb
).portid
,
3192 ctnetlink_change_expect(struct nf_conntrack_expect
*x
,
3193 const struct nlattr
* const cda
[])
3195 if (cda
[CTA_EXPECT_TIMEOUT
]) {
3196 if (!del_timer(&x
->timeout
))
3199 x
->timeout
.expires
= jiffies
+
3200 ntohl(nla_get_be32(cda
[CTA_EXPECT_TIMEOUT
])) * HZ
;
3201 add_timer(&x
->timeout
);
3206 static const struct nla_policy exp_nat_nla_policy
[CTA_EXPECT_NAT_MAX
+1] = {
3207 [CTA_EXPECT_NAT_DIR
] = { .type
= NLA_U32
},
3208 [CTA_EXPECT_NAT_TUPLE
] = { .type
= NLA_NESTED
},
3212 ctnetlink_parse_expect_nat(const struct nlattr
*attr
,
3213 struct nf_conntrack_expect
*exp
,
3216 #if IS_ENABLED(CONFIG_NF_NAT)
3217 struct nlattr
*tb
[CTA_EXPECT_NAT_MAX
+1];
3218 struct nf_conntrack_tuple nat_tuple
= {};
3221 err
= nla_parse_nested_deprecated(tb
, CTA_EXPECT_NAT_MAX
, attr
,
3222 exp_nat_nla_policy
, NULL
);
3226 if (!tb
[CTA_EXPECT_NAT_DIR
] || !tb
[CTA_EXPECT_NAT_TUPLE
])
3229 err
= ctnetlink_parse_tuple((const struct nlattr
* const *)tb
,
3230 &nat_tuple
, CTA_EXPECT_NAT_TUPLE
,
3235 exp
->saved_addr
= nat_tuple
.src
.u3
;
3236 exp
->saved_proto
= nat_tuple
.src
.u
;
3237 exp
->dir
= ntohl(nla_get_be32(tb
[CTA_EXPECT_NAT_DIR
]));
3245 static struct nf_conntrack_expect
*
3246 ctnetlink_alloc_expect(const struct nlattr
* const cda
[], struct nf_conn
*ct
,
3247 struct nf_conntrack_helper
*helper
,
3248 struct nf_conntrack_tuple
*tuple
,
3249 struct nf_conntrack_tuple
*mask
)
3251 u_int32_t
class = 0;
3252 struct nf_conntrack_expect
*exp
;
3253 struct nf_conn_help
*help
;
3256 help
= nfct_help(ct
);
3258 return ERR_PTR(-EOPNOTSUPP
);
3260 if (cda
[CTA_EXPECT_CLASS
] && helper
) {
3261 class = ntohl(nla_get_be32(cda
[CTA_EXPECT_CLASS
]));
3262 if (class > helper
->expect_class_max
)
3263 return ERR_PTR(-EINVAL
);
3265 exp
= nf_ct_expect_alloc(ct
);
3267 return ERR_PTR(-ENOMEM
);
3269 if (cda
[CTA_EXPECT_FLAGS
]) {
3270 exp
->flags
= ntohl(nla_get_be32(cda
[CTA_EXPECT_FLAGS
]));
3271 exp
->flags
&= ~NF_CT_EXPECT_USERSPACE
;
3275 if (cda
[CTA_EXPECT_FN
]) {
3276 const char *name
= nla_data(cda
[CTA_EXPECT_FN
]);
3277 struct nf_ct_helper_expectfn
*expfn
;
3279 expfn
= nf_ct_helper_expectfn_find_by_name(name
);
3280 if (expfn
== NULL
) {
3284 exp
->expectfn
= expfn
->expectfn
;
3286 exp
->expectfn
= NULL
;
3290 exp
->helper
= helper
;
3291 exp
->tuple
= *tuple
;
3292 exp
->mask
.src
.u3
= mask
->src
.u3
;
3293 exp
->mask
.src
.u
.all
= mask
->src
.u
.all
;
3295 if (cda
[CTA_EXPECT_NAT
]) {
3296 err
= ctnetlink_parse_expect_nat(cda
[CTA_EXPECT_NAT
],
3297 exp
, nf_ct_l3num(ct
));
3303 nf_ct_expect_put(exp
);
3304 return ERR_PTR(err
);
3308 ctnetlink_create_expect(struct net
*net
,
3309 const struct nf_conntrack_zone
*zone
,
3310 const struct nlattr
* const cda
[],
3311 u_int8_t u3
, u32 portid
, int report
)
3313 struct nf_conntrack_tuple tuple
, mask
, master_tuple
;
3314 struct nf_conntrack_tuple_hash
*h
= NULL
;
3315 struct nf_conntrack_helper
*helper
= NULL
;
3316 struct nf_conntrack_expect
*exp
;
3320 /* caller guarantees that those three CTA_EXPECT_* exist */
3321 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3325 err
= ctnetlink_parse_tuple(cda
, &mask
, CTA_EXPECT_MASK
,
3329 err
= ctnetlink_parse_tuple(cda
, &master_tuple
, CTA_EXPECT_MASTER
,
3334 /* Look for master conntrack of this expectation */
3335 h
= nf_conntrack_find_get(net
, zone
, &master_tuple
);
3338 ct
= nf_ct_tuplehash_to_ctrack(h
);
3341 if (cda
[CTA_EXPECT_HELP_NAME
]) {
3342 const char *helpname
= nla_data(cda
[CTA_EXPECT_HELP_NAME
]);
3344 helper
= __nf_conntrack_helper_find(helpname
, u3
,
3345 nf_ct_protonum(ct
));
3346 if (helper
== NULL
) {
3348 #ifdef CONFIG_MODULES
3349 if (request_module("nfct-helper-%s", helpname
) < 0) {
3354 helper
= __nf_conntrack_helper_find(helpname
, u3
,
3355 nf_ct_protonum(ct
));
3367 exp
= ctnetlink_alloc_expect(cda
, ct
, helper
, &tuple
, &mask
);
3373 err
= nf_ct_expect_related_report(exp
, portid
, report
, 0);
3374 nf_ct_expect_put(exp
);
3382 static int ctnetlink_new_expect(struct net
*net
, struct sock
*ctnl
,
3383 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
3384 const struct nlattr
* const cda
[],
3385 struct netlink_ext_ack
*extack
)
3387 struct nf_conntrack_tuple tuple
;
3388 struct nf_conntrack_expect
*exp
;
3389 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3390 u_int8_t u3
= nfmsg
->nfgen_family
;
3391 struct nf_conntrack_zone zone
;
3394 if (!cda
[CTA_EXPECT_TUPLE
]
3395 || !cda
[CTA_EXPECT_MASK
]
3396 || !cda
[CTA_EXPECT_MASTER
])
3399 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3403 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3408 spin_lock_bh(&nf_conntrack_expect_lock
);
3409 exp
= __nf_ct_expect_find(net
, &zone
, &tuple
);
3411 spin_unlock_bh(&nf_conntrack_expect_lock
);
3413 if (nlh
->nlmsg_flags
& NLM_F_CREATE
) {
3414 err
= ctnetlink_create_expect(net
, &zone
, cda
, u3
,
3415 NETLINK_CB(skb
).portid
,
3422 if (!(nlh
->nlmsg_flags
& NLM_F_EXCL
))
3423 err
= ctnetlink_change_expect(exp
, cda
);
3424 spin_unlock_bh(&nf_conntrack_expect_lock
);
3430 ctnetlink_exp_stat_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, int cpu
,
3431 const struct ip_conntrack_stat
*st
)
3433 struct nlmsghdr
*nlh
;
3434 struct nfgenmsg
*nfmsg
;
3435 unsigned int flags
= portid
? NLM_F_MULTI
: 0, event
;
3437 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
,
3438 IPCTNL_MSG_EXP_GET_STATS_CPU
);
3439 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
3443 nfmsg
= nlmsg_data(nlh
);
3444 nfmsg
->nfgen_family
= AF_UNSPEC
;
3445 nfmsg
->version
= NFNETLINK_V0
;
3446 nfmsg
->res_id
= htons(cpu
);
3448 if (nla_put_be32(skb
, CTA_STATS_EXP_NEW
, htonl(st
->expect_new
)) ||
3449 nla_put_be32(skb
, CTA_STATS_EXP_CREATE
, htonl(st
->expect_create
)) ||
3450 nla_put_be32(skb
, CTA_STATS_EXP_DELETE
, htonl(st
->expect_delete
)))
3451 goto nla_put_failure
;
3453 nlmsg_end(skb
, nlh
);
3458 nlmsg_cancel(skb
, nlh
);
3463 ctnetlink_exp_stat_cpu_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3466 struct net
*net
= sock_net(skb
->sk
);
3468 if (cb
->args
[0] == nr_cpu_ids
)
3471 for (cpu
= cb
->args
[0]; cpu
< nr_cpu_ids
; cpu
++) {
3472 const struct ip_conntrack_stat
*st
;
3474 if (!cpu_possible(cpu
))
3477 st
= per_cpu_ptr(net
->ct
.stat
, cpu
);
3478 if (ctnetlink_exp_stat_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
3488 static int ctnetlink_stat_exp_cpu(struct net
*net
, struct sock
*ctnl
,
3489 struct sk_buff
*skb
,
3490 const struct nlmsghdr
*nlh
,
3491 const struct nlattr
* const cda
[],
3492 struct netlink_ext_ack
*extack
)
3494 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3495 struct netlink_dump_control c
= {
3496 .dump
= ctnetlink_exp_stat_cpu_dump
,
3498 return netlink_dump_start(ctnl
, skb
, nlh
, &c
);
3504 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3505 static struct nf_ct_event_notifier ctnl_notifier
= {
3506 .fcn
= ctnetlink_conntrack_event
,
3509 static struct nf_exp_event_notifier ctnl_notifier_exp
= {
3510 .fcn
= ctnetlink_expect_event
,
3514 static const struct nfnl_callback ctnl_cb
[IPCTNL_MSG_MAX
] = {
3515 [IPCTNL_MSG_CT_NEW
] = { .call
= ctnetlink_new_conntrack
,
3516 .attr_count
= CTA_MAX
,
3517 .policy
= ct_nla_policy
},
3518 [IPCTNL_MSG_CT_GET
] = { .call
= ctnetlink_get_conntrack
,
3519 .attr_count
= CTA_MAX
,
3520 .policy
= ct_nla_policy
},
3521 [IPCTNL_MSG_CT_DELETE
] = { .call
= ctnetlink_del_conntrack
,
3522 .attr_count
= CTA_MAX
,
3523 .policy
= ct_nla_policy
},
3524 [IPCTNL_MSG_CT_GET_CTRZERO
] = { .call
= ctnetlink_get_conntrack
,
3525 .attr_count
= CTA_MAX
,
3526 .policy
= ct_nla_policy
},
3527 [IPCTNL_MSG_CT_GET_STATS_CPU
] = { .call
= ctnetlink_stat_ct_cpu
},
3528 [IPCTNL_MSG_CT_GET_STATS
] = { .call
= ctnetlink_stat_ct
},
3529 [IPCTNL_MSG_CT_GET_DYING
] = { .call
= ctnetlink_get_ct_dying
},
3530 [IPCTNL_MSG_CT_GET_UNCONFIRMED
] = { .call
= ctnetlink_get_ct_unconfirmed
},
3533 static const struct nfnl_callback ctnl_exp_cb
[IPCTNL_MSG_EXP_MAX
] = {
3534 [IPCTNL_MSG_EXP_GET
] = { .call
= ctnetlink_get_expect
,
3535 .attr_count
= CTA_EXPECT_MAX
,
3536 .policy
= exp_nla_policy
},
3537 [IPCTNL_MSG_EXP_NEW
] = { .call
= ctnetlink_new_expect
,
3538 .attr_count
= CTA_EXPECT_MAX
,
3539 .policy
= exp_nla_policy
},
3540 [IPCTNL_MSG_EXP_DELETE
] = { .call
= ctnetlink_del_expect
,
3541 .attr_count
= CTA_EXPECT_MAX
,
3542 .policy
= exp_nla_policy
},
3543 [IPCTNL_MSG_EXP_GET_STATS_CPU
] = { .call
= ctnetlink_stat_exp_cpu
},
3546 static const struct nfnetlink_subsystem ctnl_subsys
= {
3547 .name
= "conntrack",
3548 .subsys_id
= NFNL_SUBSYS_CTNETLINK
,
3549 .cb_count
= IPCTNL_MSG_MAX
,
3553 static const struct nfnetlink_subsystem ctnl_exp_subsys
= {
3554 .name
= "conntrack_expect",
3555 .subsys_id
= NFNL_SUBSYS_CTNETLINK_EXP
,
3556 .cb_count
= IPCTNL_MSG_EXP_MAX
,
3560 MODULE_ALIAS("ip_conntrack_netlink");
3561 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK
);
3562 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP
);
3564 static int __net_init
ctnetlink_net_init(struct net
*net
)
3566 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3569 ret
= nf_conntrack_register_notifier(net
, &ctnl_notifier
);
3571 pr_err("ctnetlink_init: cannot register notifier.\n");
3575 ret
= nf_ct_expect_register_notifier(net
, &ctnl_notifier_exp
);
3577 pr_err("ctnetlink_init: cannot expect register notifier.\n");
3578 goto err_unreg_notifier
;
3583 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3585 nf_conntrack_unregister_notifier(net
, &ctnl_notifier
);
3591 static void ctnetlink_net_exit(struct net
*net
)
3593 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3594 nf_ct_expect_unregister_notifier(net
, &ctnl_notifier_exp
);
3595 nf_conntrack_unregister_notifier(net
, &ctnl_notifier
);
3599 static void __net_exit
ctnetlink_net_exit_batch(struct list_head
*net_exit_list
)
3603 list_for_each_entry(net
, net_exit_list
, exit_list
)
3604 ctnetlink_net_exit(net
);
3606 /* wait for other cpus until they are done with ctnl_notifiers */
3610 static struct pernet_operations ctnetlink_net_ops
= {
3611 .init
= ctnetlink_net_init
,
3612 .exit_batch
= ctnetlink_net_exit_batch
,
3615 static int __init
ctnetlink_init(void)
3619 ret
= nfnetlink_subsys_register(&ctnl_subsys
);
3621 pr_err("ctnetlink_init: cannot register with nfnetlink.\n");
3625 ret
= nfnetlink_subsys_register(&ctnl_exp_subsys
);
3627 pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n");
3628 goto err_unreg_subsys
;
3631 ret
= register_pernet_subsys(&ctnetlink_net_ops
);
3633 pr_err("ctnetlink_init: cannot register pernet operations\n");
3634 goto err_unreg_exp_subsys
;
3636 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
3637 /* setup interaction between nf_queue and nf_conntrack_netlink. */
3638 RCU_INIT_POINTER(nfnl_ct_hook
, &ctnetlink_glue_hook
);
3642 err_unreg_exp_subsys
:
3643 nfnetlink_subsys_unregister(&ctnl_exp_subsys
);
3645 nfnetlink_subsys_unregister(&ctnl_subsys
);
3650 static void __exit
ctnetlink_exit(void)
3652 unregister_pernet_subsys(&ctnetlink_net_ops
);
3653 nfnetlink_subsys_unregister(&ctnl_exp_subsys
);
3654 nfnetlink_subsys_unregister(&ctnl_subsys
);
3655 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
3656 RCU_INIT_POINTER(nfnl_ct_hook
, NULL
);
3661 module_init(ctnetlink_init
);
3662 module_exit(ctnetlink_exit
);