]> bbs.cooldavid.org Git - net-next-2.6.git/blame - net/netfilter/nf_conntrack_netlink.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[NETLINK]: Ignore control messages directly in netlink_run_queue()
[net-next-2.6.git] / net / netfilter / nf_conntrack_netlink.c
CommitLineData
c1d10adb
PNA		 1/* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
dc808fe2 5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
c1d10adb 6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
1cde6436 7 * (C) 2005-2006 by Pablo Neira Ayuso <pablo@eurodev.net>
c1d10adb 8 *
601e68e1 9 * I've reworked this stuff to use attributes instead of conntrack
c1d10adb
PNA		 10 * structures. 5.44 am. I need more tea. --pablo 05/07/11.
11 *
601e68e1 12 * Initial connection tracking via netlink development funded and
c1d10adb
PNA		 13 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
14 *
15 * Further development of this code funded by Astaro AG (http://www.astaro.com)
16 *
17 * This software may be used and distributed according to the terms
18 * of the GNU General Public License, incorporated herein by reference.
19 *
20 * Derived from ip_conntrack_netlink.c: Port by Pablo Neira Ayuso (05/11/14)
21 */
22
23#include <linux/init.h>
24#include <linux/module.h>
25#include <linux/kernel.h>
26#include <linux/types.h>
27#include <linux/timer.h>
28#include <linux/skbuff.h>
29#include <linux/errno.h>
30#include <linux/netlink.h>
31#include <linux/spinlock.h>
40a839fd 32#include <linux/interrupt.h>
c1d10adb
PNA		 33#include <linux/notifier.h>
34
35#include <linux/netfilter.h>
dc5fc579 36#include <net/netlink.h>
c1d10adb
PNA		 37#include <net/netfilter/nf_conntrack.h>
38#include <net/netfilter/nf_conntrack_core.h>
77ab9cff 39#include <net/netfilter/nf_conntrack_expect.h>
c1d10adb
PNA		 40#include <net/netfilter/nf_conntrack_helper.h>
41#include <net/netfilter/nf_conntrack_l3proto.h>
605dcad6 42#include <net/netfilter/nf_conntrack_l4proto.h>
5b1158e9
JK		 43#include <net/netfilter/nf_conntrack_tuple.h>
44#ifdef CONFIG_NF_NAT_NEEDED
45#include <net/netfilter/nf_nat_core.h>
46#include <net/netfilter/nf_nat_protocol.h>
47#endif
c1d10adb
PNA		 48
49#include <linux/netfilter/nfnetlink.h>
50#include <linux/netfilter/nfnetlink_conntrack.h>
51
52MODULE_LICENSE("GPL");
53
dc808fe2 54static char __initdata version[] = "0.93";
c1d10adb 55
c1d10adb 56static inline int
601e68e1 57ctnetlink_dump_tuples_proto(struct sk_buff *skb,
1cde6436 58 const struct nf_conntrack_tuple *tuple,
605dcad6 59 struct nf_conntrack_l4proto *l4proto)
c1d10adb 60{
c1d10adb 61 int ret = 0;
1cde6436 62 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
c1d10adb
PNA		 63
64 NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
65
605dcad6
MJ		 66 if (likely(l4proto->tuple_to_nfattr))
67 ret = l4proto->tuple_to_nfattr(skb, tuple);
601e68e1 68
1cde6436 69 NFA_NEST_END(skb, nest_parms);
c1d10adb
PNA		 70
71 return ret;
72
73nfattr_failure:
74 return -1;
75}
76
77static inline int
1cde6436
PNA		 78ctnetlink_dump_tuples_ip(struct sk_buff *skb,
79 const struct nf_conntrack_tuple *tuple,
80 struct nf_conntrack_l3proto *l3proto)
c1d10adb 81{
c1d10adb 82 int ret = 0;
1cde6436
PNA		 83 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
84
c1d10adb
PNA		 85 if (likely(l3proto->tuple_to_nfattr))
86 ret = l3proto->tuple_to_nfattr(skb, tuple);
1cde6436 87
c1d10adb
PNA		 88 NFA_NEST_END(skb, nest_parms);
89
1cde6436
PNA		 90 return ret;
91
92nfattr_failure:
93 return -1;
94}
95
96static inline int
97ctnetlink_dump_tuples(struct sk_buff *skb,
98 const struct nf_conntrack_tuple *tuple)
99{
100 int ret;
101 struct nf_conntrack_l3proto *l3proto;
605dcad6 102 struct nf_conntrack_l4proto *l4proto;
1cde6436
PNA		 103
104 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
105 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
c1d10adb
PNA		 106 nf_ct_l3proto_put(l3proto);
107
108 if (unlikely(ret < 0))
109 return ret;
110
605dcad6
MJ		 111 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
112 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
113 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 114
115 return ret;
c1d10adb
PNA		 116}
117
118static inline int
119ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
120{
bff9a89b 121 __be32 status = htonl((u_int32_t) ct->status);
c1d10adb
PNA		 122 NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
123 return 0;
124
125nfattr_failure:
126 return -1;
127}
128
129static inline int
130ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
131{
132 long timeout_l = ct->timeout.expires - jiffies;
bff9a89b 133 __be32 timeout;
c1d10adb
PNA		 134
135 if (timeout_l < 0)
136 timeout = 0;
137 else
138 timeout = htonl(timeout_l / HZ);
601e68e1 139
c1d10adb
PNA		 140 NFA_PUT(skb, CTA_TIMEOUT, sizeof(timeout), &timeout);
141 return 0;
142
143nfattr_failure:
144 return -1;
145}
146
147static inline int
148ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
149{
605dcad6 150 struct nf_conntrack_l4proto *l4proto = nf_ct_l4proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num, ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
c1d10adb
PNA		 151 struct nfattr *nest_proto;
152 int ret;
153
605dcad6
MJ		 154 if (!l4proto->to_nfattr) {
155 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 156 return 0;
157 }
601e68e1 158
c1d10adb
PNA		 159 nest_proto = NFA_NEST(skb, CTA_PROTOINFO);
160
605dcad6 161 ret = l4proto->to_nfattr(skb, nest_proto, ct);
c1d10adb 162
605dcad6 163 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 164
165 NFA_NEST_END(skb, nest_proto);
166
167 return ret;
168
169nfattr_failure:
605dcad6 170 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 171 return -1;
172}
173
174static inline int
175ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
176{
177 struct nfattr *nest_helper;
dc808fe2 178 const struct nf_conn_help *help = nfct_help(ct);
c1d10adb 179
dc808fe2 180 if (!help || !help->helper)
c1d10adb 181 return 0;
601e68e1 182
c1d10adb 183 nest_helper = NFA_NEST(skb, CTA_HELP);
dc808fe2 184 NFA_PUT(skb, CTA_HELP_NAME, strlen(help->helper->name), help->helper->name);
c1d10adb 185
dc808fe2
HW		 186 if (help->helper->to_nfattr)
187 help->helper->to_nfattr(skb, ct);
c1d10adb
PNA		 188
189 NFA_NEST_END(skb, nest_helper);
190
191 return 0;
192
193nfattr_failure:
194 return -1;
195}
196
197#ifdef CONFIG_NF_CT_ACCT
198static inline int
199ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
200 enum ip_conntrack_dir dir)
201{
202 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
203 struct nfattr *nest_count = NFA_NEST(skb, type);
bff9a89b 204 __be32 tmp;
c1d10adb
PNA		 205
206 tmp = htonl(ct->counters[dir].packets);
207 NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(u_int32_t), &tmp);
208
209 tmp = htonl(ct->counters[dir].bytes);
210 NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(u_int32_t), &tmp);
211
212 NFA_NEST_END(skb, nest_count);
213
214 return 0;
215
216nfattr_failure:
217 return -1;
218}
219#else
220#define ctnetlink_dump_counters(a, b, c) (0)
221#endif
222
223#ifdef CONFIG_NF_CONNTRACK_MARK
224static inline int
225ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
226{
bff9a89b 227 __be32 mark = htonl(ct->mark);
c1d10adb
PNA		 228
229 NFA_PUT(skb, CTA_MARK, sizeof(u_int32_t), &mark);
230 return 0;
231
232nfattr_failure:
233 return -1;
234}
235#else
236#define ctnetlink_dump_mark(a, b) (0)
237#endif
238
239static inline int
240ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
241{
bff9a89b 242 __be32 id = htonl(ct->id);
c1d10adb
PNA		 243 NFA_PUT(skb, CTA_ID, sizeof(u_int32_t), &id);
244 return 0;
245
246nfattr_failure:
247 return -1;
248}
249
250static inline int
251ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
252{
bff9a89b 253 __be32 use = htonl(atomic_read(&ct->ct_general.use));
601e68e1 254
c1d10adb
PNA		 255 NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
256 return 0;
257
258nfattr_failure:
259 return -1;
260}
261
262#define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
263
264static int
265ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
601e68e1 266 int event, int nowait,
c1d10adb
PNA		 267 const struct nf_conn *ct)
268{
269 struct nlmsghdr *nlh;
270 struct nfgenmsg *nfmsg;
271 struct nfattr *nest_parms;
27a884dc 272 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA		 273
274 event |= NFNL_SUBSYS_CTNETLINK << 8;
275 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
276 nfmsg = NLMSG_DATA(nlh);
277
278 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
601e68e1 279 nfmsg->nfgen_family =
c1d10adb
PNA		 280 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
281 nfmsg->version = NFNETLINK_V0;
282 nfmsg->res_id = 0;
283
284 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
285 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
286 goto nfattr_failure;
287 NFA_NEST_END(skb, nest_parms);
601e68e1 288
c1d10adb
PNA		 289 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
290 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
291 goto nfattr_failure;
292 NFA_NEST_END(skb, nest_parms);
293
294 if (ctnetlink_dump_status(skb, ct) < 0 ||
295 ctnetlink_dump_timeout(skb, ct) < 0 ||
296 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
297 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
298 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
299 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
300 ctnetlink_dump_mark(skb, ct) < 0 ||
301 ctnetlink_dump_id(skb, ct) < 0 ||
302 ctnetlink_dump_use(skb, ct) < 0)
303 goto nfattr_failure;
304
27a884dc 305 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA		 306 return skb->len;
307
308nlmsg_failure:
309nfattr_failure:
dc5fc579 310 nlmsg_trim(skb, b);
c1d10adb
PNA		 311 return -1;
312}
313
314#ifdef CONFIG_NF_CONNTRACK_EVENTS
315static int ctnetlink_conntrack_event(struct notifier_block *this,
601e68e1 316 unsigned long events, void *ptr)
c1d10adb
PNA		 317{
318 struct nlmsghdr *nlh;
319 struct nfgenmsg *nfmsg;
320 struct nfattr *nest_parms;
321 struct nf_conn *ct = (struct nf_conn *)ptr;
322 struct sk_buff *skb;
323 unsigned int type;
27a884dc 324 sk_buff_data_t b;
c1d10adb
PNA		 325 unsigned int flags = 0, group;
326
327 /* ignore our fake conntrack entry */
328 if (ct == &nf_conntrack_untracked)
329 return NOTIFY_DONE;
330
331 if (events & IPCT_DESTROY) {
332 type = IPCTNL_MSG_CT_DELETE;
333 group = NFNLGRP_CONNTRACK_DESTROY;
334 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
335 type = IPCTNL_MSG_CT_NEW;
336 flags = NLM_F_CREATE|NLM_F_EXCL;
c1d10adb 337 group = NFNLGRP_CONNTRACK_NEW;
1a31526b 338 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
c1d10adb
PNA		 339 type = IPCTNL_MSG_CT_NEW;
340 group = NFNLGRP_CONNTRACK_UPDATE;
341 } else
342 return NOTIFY_DONE;
a2427692
PM		 343
344 if (!nfnetlink_has_listeners(group))
345 return NOTIFY_DONE;
346
c1d10adb
PNA		 347 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
348 if (!skb)
349 return NOTIFY_DONE;
350
351 b = skb->tail;
352
353 type |= NFNL_SUBSYS_CTNETLINK << 8;
354 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
355 nfmsg = NLMSG_DATA(nlh);
356
357 nlh->nlmsg_flags = flags;
358 nfmsg->nfgen_family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
359 nfmsg->version = NFNETLINK_V0;
360 nfmsg->res_id = 0;
361
362 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
363 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
364 goto nfattr_failure;
365 NFA_NEST_END(skb, nest_parms);
601e68e1 366
c1d10adb
PNA		 367 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
368 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
369 goto nfattr_failure;
370 NFA_NEST_END(skb, nest_parms);
c1d10adb 371
7b621c1e
PNA		 372 if (events & IPCT_DESTROY) {
373 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
374 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
375 goto nfattr_failure;
376 } else {
377 if (ctnetlink_dump_status(skb, ct) < 0)
378 goto nfattr_failure;
379
380 if (ctnetlink_dump_timeout(skb, ct) < 0)
381 goto nfattr_failure;
382
383 if (events & IPCT_PROTOINFO
384 && ctnetlink_dump_protoinfo(skb, ct) < 0)
601e68e1 385 goto nfattr_failure;
7b621c1e
PNA		 386
387 if ((events & IPCT_HELPER || nfct_help(ct))
388 && ctnetlink_dump_helpinfo(skb, ct) < 0)
601e68e1 389 goto nfattr_failure;
7b621c1e 390
40e0cb00 391#ifdef CONFIG_NF_CONNTRACK_MARK
7b621c1e
PNA		 392 if ((events & IPCT_MARK || ct->mark)
393 && ctnetlink_dump_mark(skb, ct) < 0)
601e68e1 394 goto nfattr_failure;
40e0cb00 395#endif
7b621c1e
PNA		 396
397 if (events & IPCT_COUNTER_FILLING &&
398 (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
399 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
400 goto nfattr_failure;
401 }
b9a37e0c 402
c1d10adb
PNA		 403 nlh->nlmsg_len = skb->tail - b;
404 nfnetlink_send(skb, 0, group, 0);
405 return NOTIFY_DONE;
406
407nlmsg_failure:
408nfattr_failure:
409 kfree_skb(skb);
410 return NOTIFY_DONE;
411}
412#endif /* CONFIG_NF_CONNTRACK_EVENTS */
413
414static int ctnetlink_done(struct netlink_callback *cb)
415{
89f2e218
PM		 416 if (cb->args[1])
417 nf_ct_put((struct nf_conn *)cb->args[1]);
c1d10adb
PNA		 418 return 0;
419}
420
87711cb8
PNA		 421#define L3PROTO(ct) ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num
422
c1d10adb
PNA		 423static int
424ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
425{
89f2e218 426 struct nf_conn *ct, *last;
c1d10adb
PNA		 427 struct nf_conntrack_tuple_hash *h;
428 struct list_head *i;
87711cb8
PNA		 429 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
430 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 431
c1d10adb 432 read_lock_bh(&nf_conntrack_lock);
d205dc40 433 last = (struct nf_conn *)cb->args[1];
89f2e218
PM		 434 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
435restart:
c1d10adb
PNA		 436 list_for_each_prev(i, &nf_conntrack_hash[cb->args[0]]) {
437 h = (struct nf_conntrack_tuple_hash *) i;
5b1158e9 438 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
c1d10adb
PNA		 439 continue;
440 ct = nf_ct_tuplehash_to_ctrack(h);
87711cb8
PNA		 441 /* Dump entries of a given L3 protocol number.
442 * If it is not specified, ie. l3proto == 0,
443 * then dump everything. */
444 if (l3proto && L3PROTO(ct) != l3proto)
445 continue;
d205dc40
PM		 446 if (cb->args[1]) {
447 if (ct != last)
89f2e218 448 continue;
d205dc40 449 cb->args[1] = 0;
89f2e218 450 }
c1d10adb 451 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
601e68e1 452 cb->nlh->nlmsg_seq,
c1d10adb 453 IPCTNL_MSG_CT_NEW,
89f2e218
PM		 454 1, ct) < 0) {
455 nf_conntrack_get(&ct->ct_general);
456 cb->args[1] = (unsigned long)ct;
c1d10adb 457 goto out;
89f2e218 458 }
01f34848
PNA		 459#ifdef CONFIG_NF_CT_ACCT
460 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
461 IPCTNL_MSG_CT_GET_CTRZERO)
462 memset(&ct->counters, 0, sizeof(ct->counters));
463#endif
89f2e218 464 }
d205dc40 465 if (cb->args[1]) {
89f2e218
PM		 466 cb->args[1] = 0;
467 goto restart;
c1d10adb
PNA		 468 }
469 }
89f2e218 470out:
c1d10adb 471 read_unlock_bh(&nf_conntrack_lock);
d205dc40
PM		 472 if (last)
473 nf_ct_put(last);
c1d10adb 474
c1d10adb
PNA		 475 return skb->len;
476}
477
c1d10adb
PNA		 478static inline int
479ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
480{
481 struct nfattr *tb[CTA_IP_MAX];
482 struct nf_conntrack_l3proto *l3proto;
483 int ret = 0;
484
c1d10adb
PNA		 485 nfattr_parse_nested(tb, CTA_IP_MAX, attr);
486
487 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
488
489 if (likely(l3proto->nfattr_to_tuple))
490 ret = l3proto->nfattr_to_tuple(tb, tuple);
491
492 nf_ct_l3proto_put(l3proto);
493
c1d10adb
PNA		 494 return ret;
495}
496
497static const size_t cta_min_proto[CTA_PROTO_MAX] = {
498 [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
499};
500
501static inline int
601e68e1 502ctnetlink_parse_tuple_proto(struct nfattr *attr,
c1d10adb
PNA		 503 struct nf_conntrack_tuple *tuple)
504{
505 struct nfattr *tb[CTA_PROTO_MAX];
605dcad6 506 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA		 507 int ret = 0;
508
c1d10adb
PNA		 509 nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
510
511 if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
512 return -EINVAL;
513
514 if (!tb[CTA_PROTO_NUM-1])
515 return -EINVAL;
516 tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
517
605dcad6 518 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
c1d10adb 519
605dcad6
MJ		 520 if (likely(l4proto->nfattr_to_tuple))
521 ret = l4proto->nfattr_to_tuple(tb, tuple);
c1d10adb 522
605dcad6 523 nf_ct_l4proto_put(l4proto);
601e68e1 524
c1d10adb
PNA		 525 return ret;
526}
527
528static inline int
529ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
530 enum ctattr_tuple type, u_int8_t l3num)
531{
532 struct nfattr *tb[CTA_TUPLE_MAX];
533 int err;
534
c1d10adb
PNA		 535 memset(tuple, 0, sizeof(*tuple));
536
537 nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
538
539 if (!tb[CTA_TUPLE_IP-1])
540 return -EINVAL;
541
542 tuple->src.l3num = l3num;
543
544 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP-1], tuple);
545 if (err < 0)
546 return err;
547
548 if (!tb[CTA_TUPLE_PROTO-1])
549 return -EINVAL;
550
551 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO-1], tuple);
552 if (err < 0)
553 return err;
554
555 /* orig and expect tuples get DIR_ORIGINAL */
556 if (type == CTA_TUPLE_REPLY)
557 tuple->dst.dir = IP_CT_DIR_REPLY;
558 else
559 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
560
c1d10adb
PNA		 561 return 0;
562}
563
5b1158e9 564#ifdef CONFIG_NF_NAT_NEEDED
c1d10adb
PNA		 565static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
566 [CTA_PROTONAT_PORT_MIN-1] = sizeof(u_int16_t),
567 [CTA_PROTONAT_PORT_MAX-1] = sizeof(u_int16_t),
568};
569
5b1158e9 570static int nfnetlink_parse_nat_proto(struct nfattr *attr,
c1d10adb 571 const struct nf_conn *ct,
5b1158e9 572 struct nf_nat_range *range)
c1d10adb
PNA		 573{
574 struct nfattr *tb[CTA_PROTONAT_MAX];
5b1158e9 575 struct nf_nat_protocol *npt;
c1d10adb 576
c1d10adb
PNA		 577 nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
578
579 if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
580 return -EINVAL;
581
5b1158e9 582 npt = nf_nat_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
c1d10adb
PNA		 583
584 if (!npt->nfattr_to_range) {
5b1158e9 585 nf_nat_proto_put(npt);
c1d10adb
PNA		 586 return 0;
587 }
588
589 /* nfattr_to_range returns 1 if it parsed, 0 if not, neg. on error */
590 if (npt->nfattr_to_range(tb, range) > 0)
591 range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
592
5b1158e9 593 nf_nat_proto_put(npt);
c1d10adb 594
c1d10adb
PNA		 595 return 0;
596}
597
598static const size_t cta_min_nat[CTA_NAT_MAX] = {
599 [CTA_NAT_MINIP-1] = sizeof(u_int32_t),
600 [CTA_NAT_MAXIP-1] = sizeof(u_int32_t),
601};
602
603static inline int
5b1158e9
JK		 604nfnetlink_parse_nat(struct nfattr *nat,
605 const struct nf_conn *ct, struct nf_nat_range *range)
c1d10adb
PNA		 606{
607 struct nfattr *tb[CTA_NAT_MAX];
608 int err;
609
c1d10adb 610 memset(range, 0, sizeof(*range));
601e68e1 611
3726add7 612 nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
c1d10adb
PNA		 613
614 if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
615 return -EINVAL;
616
617 if (tb[CTA_NAT_MINIP-1])
bff9a89b 618 range->min_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
c1d10adb
PNA		 619
620 if (!tb[CTA_NAT_MAXIP-1])
621 range->max_ip = range->min_ip;
622 else
bff9a89b 623 range->max_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
c1d10adb
PNA		 624
625 if (range->min_ip)
626 range->flags |= IP_NAT_RANGE_MAP_IPS;
627
628 if (!tb[CTA_NAT_PROTO-1])
629 return 0;
630
5b1158e9 631 err = nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO-1], ct, range);
c1d10adb
PNA		 632 if (err < 0)
633 return err;
634
c1d10adb
PNA		 635 return 0;
636}
637#endif
638
639static inline int
640ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
641{
642 struct nfattr *tb[CTA_HELP_MAX];
643
c1d10adb
PNA		 644 nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
645
646 if (!tb[CTA_HELP_NAME-1])
647 return -EINVAL;
648
649 *helper_name = NFA_DATA(tb[CTA_HELP_NAME-1]);
650
651 return 0;
652}
653
654static const size_t cta_min[CTA_MAX] = {
655 [CTA_STATUS-1] = sizeof(u_int32_t),
656 [CTA_TIMEOUT-1] = sizeof(u_int32_t),
657 [CTA_MARK-1] = sizeof(u_int32_t),
658 [CTA_USE-1] = sizeof(u_int32_t),
659 [CTA_ID-1] = sizeof(u_int32_t)
660};
661
662static int
601e68e1 663ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
c1d10adb
PNA		 664 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
665{
666 struct nf_conntrack_tuple_hash *h;
667 struct nf_conntrack_tuple tuple;
668 struct nf_conn *ct;
669 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
670 u_int8_t u3 = nfmsg->nfgen_family;
671 int err = 0;
672
c1d10adb
PNA		 673 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
674 return -EINVAL;
675
676 if (cda[CTA_TUPLE_ORIG-1])
677 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
678 else if (cda[CTA_TUPLE_REPLY-1])
679 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
680 else {
681 /* Flush the whole table */
682 nf_conntrack_flush();
683 return 0;
684 }
685
686 if (err < 0)
687 return err;
688
689 h = nf_conntrack_find_get(&tuple, NULL);
9ea8cfd6 690 if (!h)
c1d10adb 691 return -ENOENT;
c1d10adb
PNA		 692
693 ct = nf_ct_tuplehash_to_ctrack(h);
601e68e1 694
c1d10adb 695 if (cda[CTA_ID-1]) {
bff9a89b 696 u_int32_t id = ntohl(*(__be32 *)NFA_DATA(cda[CTA_ID-1]));
c1d10adb
PNA		 697 if (ct->id != id) {
698 nf_ct_put(ct);
699 return -ENOENT;
700 }
601e68e1 701 }
c1d10adb
PNA		 702 if (del_timer(&ct->timeout))
703 ct->timeout.function((unsigned long)ct);
704
705 nf_ct_put(ct);
c1d10adb
PNA		 706
707 return 0;
708}
709
710static int
601e68e1 711ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
c1d10adb
PNA		 712 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
713{
714 struct nf_conntrack_tuple_hash *h;
715 struct nf_conntrack_tuple tuple;
716 struct nf_conn *ct;
717 struct sk_buff *skb2 = NULL;
718 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
719 u_int8_t u3 = nfmsg->nfgen_family;
720 int err = 0;
721
c1d10adb
PNA		 722 if (nlh->nlmsg_flags & NLM_F_DUMP) {
723 u32 rlen;
724
01f34848
PNA		 725#ifndef CONFIG_NF_CT_ACCT
726 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO)
c1d10adb
PNA		 727 return -ENOTSUPP;
728#endif
01f34848
PNA		 729 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
730 ctnetlink_dump_table,
731 ctnetlink_done)) != 0)
c1d10adb 732 return -EINVAL;
c1d10adb
PNA		 733
734 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
735 if (rlen > skb->len)
736 rlen = skb->len;
737 skb_pull(skb, rlen);
738 return 0;
739 }
740
741 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
742 return -EINVAL;
743
744 if (cda[CTA_TUPLE_ORIG-1])
745 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
746 else if (cda[CTA_TUPLE_REPLY-1])
747 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
748 else
749 return -EINVAL;
750
751 if (err < 0)
752 return err;
753
754 h = nf_conntrack_find_get(&tuple, NULL);
9ea8cfd6 755 if (!h)
c1d10adb 756 return -ENOENT;
9ea8cfd6 757
c1d10adb
PNA		 758 ct = nf_ct_tuplehash_to_ctrack(h);
759
760 err = -ENOMEM;
761 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
762 if (!skb2) {
763 nf_ct_put(ct);
764 return -ENOMEM;
765 }
c1d10adb 766
601e68e1 767 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
c1d10adb
PNA		 768 IPCTNL_MSG_CT_NEW, 1, ct);
769 nf_ct_put(ct);
770 if (err <= 0)
771 goto free;
772
773 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
774 if (err < 0)
775 goto out;
776
c1d10adb
PNA		 777 return 0;
778
779free:
780 kfree_skb(skb2);
781out:
782 return err;
783}
784
785static inline int
786ctnetlink_change_status(struct nf_conn *ct, struct nfattr *cda[])
787{
788 unsigned long d;
bff9a89b 789 unsigned int status = ntohl(*(__be32 *)NFA_DATA(cda[CTA_STATUS-1]));
c1d10adb
PNA		 790 d = ct->status ^ status;
791
792 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
793 /* unchangeable */
794 return -EINVAL;
601e68e1 795
c1d10adb
PNA		 796 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
797 /* SEEN_REPLY bit can only be set */
798 return -EINVAL;
799
601e68e1 800
c1d10adb
PNA		 801 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
802 /* ASSURED bit can only be set */
803 return -EINVAL;
804
3726add7 805 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
5b1158e9 806#ifndef CONFIG_NF_NAT_NEEDED
c1d10adb
PNA		 807 return -EINVAL;
808#else
5b1158e9 809 struct nf_nat_range range;
c1d10adb 810
3726add7 811 if (cda[CTA_NAT_DST-1]) {
5b1158e9 812 if (nfnetlink_parse_nat(cda[CTA_NAT_DST-1], ct,
3726add7
PM		 813 &range) < 0)
814 return -EINVAL;
5b1158e9 815 if (nf_nat_initialized(ct,
3726add7
PM		 816 HOOK2MANIP(NF_IP_PRE_ROUTING)))
817 return -EEXIST;
5b1158e9 818 nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING);
3726add7
PM		 819 }
820 if (cda[CTA_NAT_SRC-1]) {
5b1158e9 821 if (nfnetlink_parse_nat(cda[CTA_NAT_SRC-1], ct,
3726add7
PM		 822 &range) < 0)
823 return -EINVAL;
5b1158e9 824 if (nf_nat_initialized(ct,
3726add7
PM		 825 HOOK2MANIP(NF_IP_POST_ROUTING)))
826 return -EEXIST;
5b1158e9 827 nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING);
3726add7 828 }
c1d10adb
PNA		 829#endif
830 }
831
832 /* Be careful here, modifying NAT bits can screw up things,
833 * so don't let users modify them directly if they don't pass
5b1158e9 834 * nf_nat_range. */
c1d10adb
PNA		 835 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
836 return 0;
837}
838
839
840static inline int
841ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
842{
843 struct nf_conntrack_helper *helper;
dc808fe2 844 struct nf_conn_help *help = nfct_help(ct);
c1d10adb
PNA		 845 char *helpname;
846 int err;
847
dc808fe2
HW		 848 if (!help) {
849 /* FIXME: we need to reallocate and rehash */
850 return -EBUSY;
851 }
852
c1d10adb
PNA		 853 /* don't change helper of sibling connections */
854 if (ct->master)
855 return -EINVAL;
856
857 err = ctnetlink_parse_help(cda[CTA_HELP-1], &helpname);
858 if (err < 0)
859 return err;
860
861 helper = __nf_conntrack_helper_find_byname(helpname);
862 if (!helper) {
863 if (!strcmp(helpname, ""))
864 helper = NULL;
865 else
866 return -EINVAL;
867 }
868
dc808fe2 869 if (help->helper) {
c1d10adb
PNA		 870 if (!helper) {
871 /* we had a helper before ... */
872 nf_ct_remove_expectations(ct);
dc808fe2 873 help->helper = NULL;
c1d10adb
PNA		 874 } else {
875 /* need to zero data of old helper */
dc808fe2 876 memset(&help->help, 0, sizeof(help->help));
c1d10adb
PNA		 877 }
878 }
601e68e1 879
dc808fe2 880 help->helper = helper;
c1d10adb
PNA		 881
882 return 0;
883}
884
885static inline int
886ctnetlink_change_timeout(struct nf_conn *ct, struct nfattr *cda[])
887{
bff9a89b 888 u_int32_t timeout = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
601e68e1 889
c1d10adb
PNA		 890 if (!del_timer(&ct->timeout))
891 return -ETIME;
892
893 ct->timeout.expires = jiffies + timeout * HZ;
894 add_timer(&ct->timeout);
895
896 return 0;
897}
898
899static inline int
900ctnetlink_change_protoinfo(struct nf_conn *ct, struct nfattr *cda[])
901{
902 struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
605dcad6 903 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA		 904 u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
905 u_int16_t l3num = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
906 int err = 0;
907
908 nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr);
909
605dcad6 910 l4proto = nf_ct_l4proto_find_get(l3num, npt);
c1d10adb 911
605dcad6
MJ		 912 if (l4proto->from_nfattr)
913 err = l4proto->from_nfattr(tb, ct);
914 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 915
916 return err;
917}
918
919static int
920ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
921{
922 int err;
923
c1d10adb
PNA		 924 if (cda[CTA_HELP-1]) {
925 err = ctnetlink_change_helper(ct, cda);
926 if (err < 0)
927 return err;
928 }
929
930 if (cda[CTA_TIMEOUT-1]) {
931 err = ctnetlink_change_timeout(ct, cda);
932 if (err < 0)
933 return err;
934 }
935
936 if (cda[CTA_STATUS-1]) {
937 err = ctnetlink_change_status(ct, cda);
938 if (err < 0)
939 return err;
940 }
941
942 if (cda[CTA_PROTOINFO-1]) {
943 err = ctnetlink_change_protoinfo(ct, cda);
944 if (err < 0)
945 return err;
946 }
947
bcd1e830 948#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb 949 if (cda[CTA_MARK-1])
bff9a89b 950 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
c1d10adb
PNA		 951#endif
952
c1d10adb
PNA		 953 return 0;
954}
955
956static int
601e68e1 957ctnetlink_create_conntrack(struct nfattr *cda[],
c1d10adb
PNA		 958 struct nf_conntrack_tuple *otuple,
959 struct nf_conntrack_tuple *rtuple)
960{
961 struct nf_conn *ct;
962 int err = -EINVAL;
dafc741c 963 struct nf_conn_help *help;
c1d10adb 964
c1d10adb
PNA		 965 ct = nf_conntrack_alloc(otuple, rtuple);
966 if (ct == NULL || IS_ERR(ct))
601e68e1 967 return -ENOMEM;
c1d10adb
PNA		 968
969 if (!cda[CTA_TIMEOUT-1])
970 goto err;
bff9a89b 971 ct->timeout.expires = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
c1d10adb
PNA		 972
973 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
974 ct->status |= IPS_CONFIRMED;
975
bbb3357d
PNA		 976 if (cda[CTA_STATUS-1]) {
977 err = ctnetlink_change_status(ct, cda);
978 if (err < 0)
979 goto err;
980 }
c1d10adb
PNA		 981
982 if (cda[CTA_PROTOINFO-1]) {
983 err = ctnetlink_change_protoinfo(ct, cda);
984 if (err < 0)
c54ea3b9 985 goto err;
c1d10adb
PNA		 986 }
987
bcd1e830 988#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb 989 if (cda[CTA_MARK-1])
bff9a89b 990 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
c1d10adb
PNA		 991#endif
992
dafc741c
YK		 993 help = nfct_help(ct);
994 if (help)
995 help->helper = nf_ct_helper_find_get(rtuple);
996
c1d10adb
PNA		 997 add_timer(&ct->timeout);
998 nf_conntrack_hash_insert(ct);
999
dafc741c
YK		 1000 if (help && help->helper)
1001 nf_ct_helper_put(help->helper);
1002
c1d10adb
PNA		 1003 return 0;
1004
601e68e1 1005err:
c1d10adb
PNA		 1006 nf_conntrack_free(ct);
1007 return err;
1008}
1009
601e68e1
YH		 1010static int
1011ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
c1d10adb
PNA		 1012 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1013{
1014 struct nf_conntrack_tuple otuple, rtuple;
1015 struct nf_conntrack_tuple_hash *h = NULL;
1016 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1017 u_int8_t u3 = nfmsg->nfgen_family;
1018 int err = 0;
1019
c1d10adb
PNA		 1020 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
1021 return -EINVAL;
1022
1023 if (cda[CTA_TUPLE_ORIG-1]) {
1024 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1025 if (err < 0)
1026 return err;
1027 }
1028
1029 if (cda[CTA_TUPLE_REPLY-1]) {
1030 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1031 if (err < 0)
1032 return err;
1033 }
1034
1035 write_lock_bh(&nf_conntrack_lock);
1036 if (cda[CTA_TUPLE_ORIG-1])
1037 h = __nf_conntrack_find(&otuple, NULL);
1038 else if (cda[CTA_TUPLE_REPLY-1])
1039 h = __nf_conntrack_find(&rtuple, NULL);
1040
1041 if (h == NULL) {
1042 write_unlock_bh(&nf_conntrack_lock);
c1d10adb
PNA		 1043 err = -ENOENT;
1044 if (nlh->nlmsg_flags & NLM_F_CREATE)
1045 err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
1046 return err;
1047 }
1048 /* implicit 'else' */
1049
1050 /* we only allow nat config for new conntracks */
3726add7 1051 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
c1d10adb
PNA		 1052 err = -EINVAL;
1053 goto out_unlock;
1054 }
1055
1056 /* We manipulate the conntrack inside the global conntrack table lock,
1057 * so there's no need to increase the refcount */
c1d10adb
PNA		 1058 err = -EEXIST;
1059 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1060 err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
1061
1062out_unlock:
1063 write_unlock_bh(&nf_conntrack_lock);
1064 return err;
1065}
1066
601e68e1
YH		 1067/***********************************************************************
1068 * EXPECT
1069 ***********************************************************************/
c1d10adb
PNA		 1070
1071static inline int
1072ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1073 const struct nf_conntrack_tuple *tuple,
1074 enum ctattr_expect type)
1075{
1076 struct nfattr *nest_parms = NFA_NEST(skb, type);
601e68e1 1077
c1d10adb
PNA		 1078 if (ctnetlink_dump_tuples(skb, tuple) < 0)
1079 goto nfattr_failure;
1080
1081 NFA_NEST_END(skb, nest_parms);
1082
1083 return 0;
1084
1085nfattr_failure:
1086 return -1;
601e68e1 1087}
c1d10adb 1088
1cde6436
PNA		 1089static inline int
1090ctnetlink_exp_dump_mask(struct sk_buff *skb,
1091 const struct nf_conntrack_tuple *tuple,
1092 const struct nf_conntrack_tuple *mask)
1093{
1094 int ret;
1095 struct nf_conntrack_l3proto *l3proto;
605dcad6 1096 struct nf_conntrack_l4proto *l4proto;
1cde6436
PNA		 1097 struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
1098
1099 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
1100 ret = ctnetlink_dump_tuples_ip(skb, mask, l3proto);
1101 nf_ct_l3proto_put(l3proto);
1102
1103 if (unlikely(ret < 0))
1104 goto nfattr_failure;
1105
605dcad6
MJ		 1106 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
1107 ret = ctnetlink_dump_tuples_proto(skb, mask, l4proto);
1108 nf_ct_l4proto_put(l4proto);
1cde6436
PNA		 1109 if (unlikely(ret < 0))
1110 goto nfattr_failure;
1111
1112 NFA_NEST_END(skb, nest_parms);
1113
1114 return 0;
1115
1116nfattr_failure:
1117 return -1;
1118}
1119
c1d10adb
PNA		 1120static inline int
1121ctnetlink_exp_dump_expect(struct sk_buff *skb,
601e68e1 1122 const struct nf_conntrack_expect *exp)
c1d10adb
PNA		 1123{
1124 struct nf_conn *master = exp->master;
bff9a89b
PM		 1125 __be32 timeout = htonl((exp->timeout.expires - jiffies) / HZ);
1126 __be32 id = htonl(exp->id);
c1d10adb
PNA		 1127
1128 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1129 goto nfattr_failure;
1cde6436 1130 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
c1d10adb
PNA		 1131 goto nfattr_failure;
1132 if (ctnetlink_exp_dump_tuple(skb,
1133 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1134 CTA_EXPECT_MASTER) < 0)
1135 goto nfattr_failure;
601e68e1 1136
c1d10adb
PNA		 1137 NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(timeout), &timeout);
1138 NFA_PUT(skb, CTA_EXPECT_ID, sizeof(u_int32_t), &id);
1139
1140 return 0;
601e68e1 1141
c1d10adb
PNA		 1142nfattr_failure:
1143 return -1;
1144}
1145
1146static int
1147ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
601e68e1
YH		 1148 int event,
1149 int nowait,
c1d10adb
PNA		 1150 const struct nf_conntrack_expect *exp)
1151{
1152 struct nlmsghdr *nlh;
1153 struct nfgenmsg *nfmsg;
27a884dc 1154 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA		 1155
1156 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1157 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1158 nfmsg = NLMSG_DATA(nlh);
1159
1160 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1161 nfmsg->nfgen_family = exp->tuple.src.l3num;
1162 nfmsg->version = NFNETLINK_V0;
1163 nfmsg->res_id = 0;
1164
1165 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1166 goto nfattr_failure;
1167
27a884dc 1168 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA		 1169 return skb->len;
1170
1171nlmsg_failure:
1172nfattr_failure:
dc5fc579 1173 nlmsg_trim(skb, b);
c1d10adb
PNA		 1174 return -1;
1175}
1176
1177#ifdef CONFIG_NF_CONNTRACK_EVENTS
1178static int ctnetlink_expect_event(struct notifier_block *this,
1179 unsigned long events, void *ptr)
1180{
1181 struct nlmsghdr *nlh;
1182 struct nfgenmsg *nfmsg;
1183 struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
1184 struct sk_buff *skb;
1185 unsigned int type;
27a884dc 1186 sk_buff_data_t b;
c1d10adb
PNA		 1187 int flags = 0;
1188
1189 if (events & IPEXP_NEW) {
1190 type = IPCTNL_MSG_EXP_NEW;
1191 flags = NLM_F_CREATE|NLM_F_EXCL;
1192 } else
1193 return NOTIFY_DONE;
1194
b3a27bfb
PNA		 1195 if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
1196 return NOTIFY_DONE;
1197
c1d10adb
PNA		 1198 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1199 if (!skb)
1200 return NOTIFY_DONE;
1201
1202 b = skb->tail;
1203
b633ad5f 1204 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
c1d10adb
PNA		 1205 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
1206 nfmsg = NLMSG_DATA(nlh);
1207
1208 nlh->nlmsg_flags = flags;
1209 nfmsg->nfgen_family = exp->tuple.src.l3num;
1210 nfmsg->version = NFNETLINK_V0;
1211 nfmsg->res_id = 0;
1212
1213 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1214 goto nfattr_failure;
1215
1216 nlh->nlmsg_len = skb->tail - b;
1217 nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
1218 return NOTIFY_DONE;
1219
1220nlmsg_failure:
1221nfattr_failure:
1222 kfree_skb(skb);
1223 return NOTIFY_DONE;
1224}
1225#endif
1226
1227static int
1228ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1229{
1230 struct nf_conntrack_expect *exp = NULL;
1231 struct list_head *i;
1232 u_int32_t *id = (u_int32_t *) &cb->args[0];
87711cb8
PNA		 1233 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
1234 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 1235
c1d10adb
PNA		 1236 read_lock_bh(&nf_conntrack_lock);
1237 list_for_each_prev(i, &nf_conntrack_expect_list) {
1238 exp = (struct nf_conntrack_expect *) i;
87711cb8
PNA		 1239 if (l3proto && exp->tuple.src.l3num != l3proto)
1240 continue;
c1d10adb
PNA		 1241 if (exp->id <= *id)
1242 continue;
1243 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1244 cb->nlh->nlmsg_seq,
1245 IPCTNL_MSG_EXP_NEW,
1246 1, exp) < 0)
1247 goto out;
1248 *id = exp->id;
1249 }
601e68e1 1250out:
c1d10adb
PNA		 1251 read_unlock_bh(&nf_conntrack_lock);
1252
c1d10adb
PNA		 1253 return skb->len;
1254}
1255
1256static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
1257 [CTA_EXPECT_TIMEOUT-1] = sizeof(u_int32_t),
1258 [CTA_EXPECT_ID-1] = sizeof(u_int32_t)
1259};
1260
1261static int
601e68e1 1262ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
c1d10adb
PNA		 1263 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1264{
1265 struct nf_conntrack_tuple tuple;
1266 struct nf_conntrack_expect *exp;
1267 struct sk_buff *skb2;
1268 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1269 u_int8_t u3 = nfmsg->nfgen_family;
1270 int err = 0;
1271
c1d10adb
PNA		 1272 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1273 return -EINVAL;
1274
1275 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1276 u32 rlen;
1277
c1d10adb 1278 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
601e68e1 1279 ctnetlink_exp_dump_table,
c1d10adb
PNA		 1280 ctnetlink_done)) != 0)
1281 return -EINVAL;
1282 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
1283 if (rlen > skb->len)
1284 rlen = skb->len;
1285 skb_pull(skb, rlen);
1286 return 0;
1287 }
1288
1289 if (cda[CTA_EXPECT_MASTER-1])
1290 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1291 else
1292 return -EINVAL;
1293
1294 if (err < 0)
1295 return err;
1296
468ec44b 1297 exp = nf_conntrack_expect_find_get(&tuple);
c1d10adb
PNA		 1298 if (!exp)
1299 return -ENOENT;
1300
1301 if (cda[CTA_EXPECT_ID-1]) {
bff9a89b 1302 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
c1d10adb
PNA		 1303 if (exp->id != ntohl(id)) {
1304 nf_conntrack_expect_put(exp);
1305 return -ENOENT;
1306 }
601e68e1 1307 }
c1d10adb
PNA		 1308
1309 err = -ENOMEM;
1310 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1311 if (!skb2)
1312 goto out;
4e9b8269 1313
601e68e1 1314 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
c1d10adb
PNA		 1315 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1316 1, exp);
1317 if (err <= 0)
1318 goto free;
1319
1320 nf_conntrack_expect_put(exp);
1321
1322 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1323
1324free:
1325 kfree_skb(skb2);
1326out:
1327 nf_conntrack_expect_put(exp);
1328 return err;
1329}
1330
1331static int
601e68e1 1332ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
c1d10adb
PNA		 1333 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1334{
1335 struct nf_conntrack_expect *exp, *tmp;
1336 struct nf_conntrack_tuple tuple;
1337 struct nf_conntrack_helper *h;
1338 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1339 u_int8_t u3 = nfmsg->nfgen_family;
1340 int err;
1341
1342 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1343 return -EINVAL;
1344
1345 if (cda[CTA_EXPECT_TUPLE-1]) {
1346 /* delete a single expect by tuple */
1347 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1348 if (err < 0)
1349 return err;
1350
1351 /* bump usage count to 2 */
468ec44b 1352 exp = nf_conntrack_expect_find_get(&tuple);
c1d10adb
PNA		 1353 if (!exp)
1354 return -ENOENT;
1355
1356 if (cda[CTA_EXPECT_ID-1]) {
bff9a89b 1357 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
c1d10adb
PNA		 1358 if (exp->id != ntohl(id)) {
1359 nf_conntrack_expect_put(exp);
1360 return -ENOENT;
1361 }
1362 }
1363
1364 /* after list removal, usage count == 1 */
1365 nf_conntrack_unexpect_related(exp);
601e68e1 1366 /* have to put what we 'get' above.
c1d10adb
PNA		 1367 * after this line usage count == 0 */
1368 nf_conntrack_expect_put(exp);
1369 } else if (cda[CTA_EXPECT_HELP_NAME-1]) {
1370 char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
1371
1372 /* delete all expectations for this helper */
1373 write_lock_bh(&nf_conntrack_lock);
1374 h = __nf_conntrack_helper_find_byname(name);
1375 if (!h) {
1376 write_unlock_bh(&nf_conntrack_lock);
1377 return -EINVAL;
1378 }
1379 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1380 list) {
dc808fe2
HW		 1381 struct nf_conn_help *m_help = nfct_help(exp->master);
1382 if (m_help->helper == h
c1d10adb
PNA		 1383 && del_timer(&exp->timeout)) {
1384 nf_ct_unlink_expect(exp);
1385 nf_conntrack_expect_put(exp);
1386 }
1387 }
1388 write_unlock_bh(&nf_conntrack_lock);
1389 } else {
1390 /* This basically means we have to flush everything*/
1391 write_lock_bh(&nf_conntrack_lock);
1392 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1393 list) {
1394 if (del_timer(&exp->timeout)) {
1395 nf_ct_unlink_expect(exp);
1396 nf_conntrack_expect_put(exp);
1397 }
1398 }
1399 write_unlock_bh(&nf_conntrack_lock);
1400 }
1401
1402 return 0;
1403}
1404static int
1405ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nfattr *cda[])
1406{
1407 return -EOPNOTSUPP;
1408}
1409
1410static int
1411ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
1412{
1413 struct nf_conntrack_tuple tuple, mask, master_tuple;
1414 struct nf_conntrack_tuple_hash *h = NULL;
1415 struct nf_conntrack_expect *exp;
1416 struct nf_conn *ct;
dc808fe2 1417 struct nf_conn_help *help;
c1d10adb
PNA		 1418 int err = 0;
1419
c1d10adb
PNA		 1420 /* caller guarantees that those three CTA_EXPECT_* exist */
1421 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1422 if (err < 0)
1423 return err;
1424 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1425 if (err < 0)
1426 return err;
1427 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1428 if (err < 0)
1429 return err;
1430
1431 /* Look for master conntrack of this expectation */
1432 h = nf_conntrack_find_get(&master_tuple, NULL);
1433 if (!h)
1434 return -ENOENT;
1435 ct = nf_ct_tuplehash_to_ctrack(h);
dc808fe2 1436 help = nfct_help(ct);
c1d10adb 1437
dc808fe2 1438 if (!help || !help->helper) {
c1d10adb
PNA		 1439 /* such conntrack hasn't got any helper, abort */
1440 err = -EINVAL;
1441 goto out;
1442 }
1443
1444 exp = nf_conntrack_expect_alloc(ct);
1445 if (!exp) {
1446 err = -ENOMEM;
1447 goto out;
1448 }
601e68e1 1449
c1d10adb
PNA		 1450 exp->expectfn = NULL;
1451 exp->flags = 0;
1452 exp->master = ct;
9457d851 1453 exp->helper = NULL;
c1d10adb
PNA		 1454 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
1455 memcpy(&exp->mask, &mask, sizeof(struct nf_conntrack_tuple));
1456
1457 err = nf_conntrack_expect_related(exp);
1458 nf_conntrack_expect_put(exp);
1459
601e68e1 1460out:
c1d10adb
PNA		 1461 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1462 return err;
1463}
1464
1465static int
1466ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
1467 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1468{
1469 struct nf_conntrack_tuple tuple;
1470 struct nf_conntrack_expect *exp;
1471 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1472 u_int8_t u3 = nfmsg->nfgen_family;
1473 int err = 0;
1474
c1d10adb
PNA		 1475 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1476 return -EINVAL;
1477
1478 if (!cda[CTA_EXPECT_TUPLE-1]
1479 || !cda[CTA_EXPECT_MASK-1]
1480 || !cda[CTA_EXPECT_MASTER-1])
1481 return -EINVAL;
1482
1483 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1484 if (err < 0)
1485 return err;
1486
1487 write_lock_bh(&nf_conntrack_lock);
1488 exp = __nf_conntrack_expect_find(&tuple);
1489
1490 if (!exp) {
1491 write_unlock_bh(&nf_conntrack_lock);
1492 err = -ENOENT;
1493 if (nlh->nlmsg_flags & NLM_F_CREATE)
1494 err = ctnetlink_create_expect(cda, u3);
1495 return err;
1496 }
1497
1498 err = -EEXIST;
1499 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1500 err = ctnetlink_change_expect(exp, cda);
1501 write_unlock_bh(&nf_conntrack_lock);
1502
c1d10adb
PNA		 1503 return err;
1504}
1505
1506#ifdef CONFIG_NF_CONNTRACK_EVENTS
1507static struct notifier_block ctnl_notifier = {
1508 .notifier_call = ctnetlink_conntrack_event,
1509};
1510
1511static struct notifier_block ctnl_notifier_exp = {
1512 .notifier_call = ctnetlink_expect_event,
1513};
1514#endif
1515
1516static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1517 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1518 .attr_count = CTA_MAX, },
1519 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1520 .attr_count = CTA_MAX, },
1521 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1522 .attr_count = CTA_MAX, },
1523 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1524 .attr_count = CTA_MAX, },
1525};
1526
1527static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1528 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1529 .attr_count = CTA_EXPECT_MAX, },
1530 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1531 .attr_count = CTA_EXPECT_MAX, },
1532 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1533 .attr_count = CTA_EXPECT_MAX, },
1534};
1535
1536static struct nfnetlink_subsystem ctnl_subsys = {
1537 .name = "conntrack",
1538 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1539 .cb_count = IPCTNL_MSG_MAX,
1540 .cb = ctnl_cb,
1541};
1542
1543static struct nfnetlink_subsystem ctnl_exp_subsys = {
1544 .name = "conntrack_expect",
1545 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1546 .cb_count = IPCTNL_MSG_EXP_MAX,
1547 .cb = ctnl_exp_cb,
1548};
1549
d2483dde 1550MODULE_ALIAS("ip_conntrack_netlink");
c1d10adb 1551MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
34f9a2e4 1552MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
c1d10adb
PNA		 1553
1554static int __init ctnetlink_init(void)
1555{
1556 int ret;
1557
1558 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1559 ret = nfnetlink_subsys_register(&ctnl_subsys);
1560 if (ret < 0) {
1561 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1562 goto err_out;
1563 }
1564
1565 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1566 if (ret < 0) {
1567 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1568 goto err_unreg_subsys;
1569 }
1570
1571#ifdef CONFIG_NF_CONNTRACK_EVENTS
1572 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1573 if (ret < 0) {
1574 printk("ctnetlink_init: cannot register notifier.\n");
1575 goto err_unreg_exp_subsys;
1576 }
1577
1578 ret = nf_conntrack_expect_register_notifier(&ctnl_notifier_exp);
1579 if (ret < 0) {
1580 printk("ctnetlink_init: cannot expect register notifier.\n");
1581 goto err_unreg_notifier;
1582 }
1583#endif
1584
1585 return 0;
1586
1587#ifdef CONFIG_NF_CONNTRACK_EVENTS
1588err_unreg_notifier:
1589 nf_conntrack_unregister_notifier(&ctnl_notifier);
1590err_unreg_exp_subsys:
1591 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1592#endif
1593err_unreg_subsys:
1594 nfnetlink_subsys_unregister(&ctnl_subsys);
1595err_out:
1596 return ret;
1597}
1598
1599static void __exit ctnetlink_exit(void)
1600{
1601 printk("ctnetlink: unregistering from nfnetlink.\n");
1602
1603#ifdef CONFIG_NF_CONNTRACK_EVENTS
e64a70be 1604 nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
c1d10adb
PNA		 1605 nf_conntrack_unregister_notifier(&ctnl_notifier);
1606#endif
1607
1608 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1609 nfnetlink_subsys_unregister(&ctnl_subsys);
1610 return;
1611}
1612
1613module_init(ctnetlink_init);
1614module_exit(ctnetlink_exit);
Clone of davem's net-next-2.6 tree