]> bbs.cooldavid.org Git - net-next-2.6.git/blame - net/netfilter/nf_conntrack_netlink.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[NETLINK]: Directly return -EINTR from netlink_dump_start()
[net-next-2.6.git] / net / netfilter / nf_conntrack_netlink.c
CommitLineData
c1d10adb
PNA		 1/* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
dc808fe2 5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
c1d10adb 6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
1cde6436 7 * (C) 2005-2006 by Pablo Neira Ayuso <pablo@eurodev.net>
c1d10adb 8 *
601e68e1 9 * I've reworked this stuff to use attributes instead of conntrack
c1d10adb
PNA		 10 * structures. 5.44 am. I need more tea. --pablo 05/07/11.
11 *
601e68e1 12 * Initial connection tracking via netlink development funded and
c1d10adb
PNA		 13 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
14 *
15 * Further development of this code funded by Astaro AG (http://www.astaro.com)
16 *
17 * This software may be used and distributed according to the terms
18 * of the GNU General Public License, incorporated herein by reference.
19 *
20 * Derived from ip_conntrack_netlink.c: Port by Pablo Neira Ayuso (05/11/14)
21 */
22
23#include <linux/init.h>
24#include <linux/module.h>
25#include <linux/kernel.h>
26#include <linux/types.h>
27#include <linux/timer.h>
28#include <linux/skbuff.h>
29#include <linux/errno.h>
30#include <linux/netlink.h>
31#include <linux/spinlock.h>
40a839fd 32#include <linux/interrupt.h>
c1d10adb
PNA		 33#include <linux/notifier.h>
34
35#include <linux/netfilter.h>
dc5fc579 36#include <net/netlink.h>
c1d10adb
PNA		 37#include <net/netfilter/nf_conntrack.h>
38#include <net/netfilter/nf_conntrack_core.h>
77ab9cff 39#include <net/netfilter/nf_conntrack_expect.h>
c1d10adb
PNA		 40#include <net/netfilter/nf_conntrack_helper.h>
41#include <net/netfilter/nf_conntrack_l3proto.h>
605dcad6 42#include <net/netfilter/nf_conntrack_l4proto.h>
5b1158e9
JK		 43#include <net/netfilter/nf_conntrack_tuple.h>
44#ifdef CONFIG_NF_NAT_NEEDED
45#include <net/netfilter/nf_nat_core.h>
46#include <net/netfilter/nf_nat_protocol.h>
47#endif
c1d10adb
PNA		 48
49#include <linux/netfilter/nfnetlink.h>
50#include <linux/netfilter/nfnetlink_conntrack.h>
51
52MODULE_LICENSE("GPL");
53
dc808fe2 54static char __initdata version[] = "0.93";
c1d10adb 55
c1d10adb 56static inline int
601e68e1 57ctnetlink_dump_tuples_proto(struct sk_buff *skb,
1cde6436 58 const struct nf_conntrack_tuple *tuple,
605dcad6 59 struct nf_conntrack_l4proto *l4proto)
c1d10adb 60{
c1d10adb 61 int ret = 0;
1cde6436 62 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
c1d10adb
PNA		 63
64 NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
65
605dcad6
MJ		 66 if (likely(l4proto->tuple_to_nfattr))
67 ret = l4proto->tuple_to_nfattr(skb, tuple);
601e68e1 68
1cde6436 69 NFA_NEST_END(skb, nest_parms);
c1d10adb
PNA		 70
71 return ret;
72
73nfattr_failure:
74 return -1;
75}
76
77static inline int
1cde6436
PNA		 78ctnetlink_dump_tuples_ip(struct sk_buff *skb,
79 const struct nf_conntrack_tuple *tuple,
80 struct nf_conntrack_l3proto *l3proto)
c1d10adb 81{
c1d10adb 82 int ret = 0;
1cde6436
PNA		 83 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
84
c1d10adb
PNA		 85 if (likely(l3proto->tuple_to_nfattr))
86 ret = l3proto->tuple_to_nfattr(skb, tuple);
1cde6436 87
c1d10adb
PNA		 88 NFA_NEST_END(skb, nest_parms);
89
1cde6436
PNA		 90 return ret;
91
92nfattr_failure:
93 return -1;
94}
95
96static inline int
97ctnetlink_dump_tuples(struct sk_buff *skb,
98 const struct nf_conntrack_tuple *tuple)
99{
100 int ret;
101 struct nf_conntrack_l3proto *l3proto;
605dcad6 102 struct nf_conntrack_l4proto *l4proto;
1cde6436
PNA		 103
104 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
105 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
c1d10adb
PNA		 106 nf_ct_l3proto_put(l3proto);
107
108 if (unlikely(ret < 0))
109 return ret;
110
605dcad6
MJ		 111 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
112 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
113 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 114
115 return ret;
c1d10adb
PNA		 116}
117
118static inline int
119ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
120{
bff9a89b 121 __be32 status = htonl((u_int32_t) ct->status);
c1d10adb
PNA		 122 NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
123 return 0;
124
125nfattr_failure:
126 return -1;
127}
128
129static inline int
130ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
131{
132 long timeout_l = ct->timeout.expires - jiffies;
bff9a89b 133 __be32 timeout;
c1d10adb
PNA		 134
135 if (timeout_l < 0)
136 timeout = 0;
137 else
138 timeout = htonl(timeout_l / HZ);
601e68e1 139
c1d10adb
PNA		 140 NFA_PUT(skb, CTA_TIMEOUT, sizeof(timeout), &timeout);
141 return 0;
142
143nfattr_failure:
144 return -1;
145}
146
147static inline int
148ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
149{
605dcad6 150 struct nf_conntrack_l4proto *l4proto = nf_ct_l4proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num, ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
c1d10adb
PNA		 151 struct nfattr *nest_proto;
152 int ret;
153
605dcad6
MJ		 154 if (!l4proto->to_nfattr) {
155 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 156 return 0;
157 }
601e68e1 158
c1d10adb
PNA		 159 nest_proto = NFA_NEST(skb, CTA_PROTOINFO);
160
605dcad6 161 ret = l4proto->to_nfattr(skb, nest_proto, ct);
c1d10adb 162
605dcad6 163 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 164
165 NFA_NEST_END(skb, nest_proto);
166
167 return ret;
168
169nfattr_failure:
605dcad6 170 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 171 return -1;
172}
173
174static inline int
175ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
176{
177 struct nfattr *nest_helper;
dc808fe2 178 const struct nf_conn_help *help = nfct_help(ct);
c1d10adb 179
dc808fe2 180 if (!help || !help->helper)
c1d10adb 181 return 0;
601e68e1 182
c1d10adb 183 nest_helper = NFA_NEST(skb, CTA_HELP);
dc808fe2 184 NFA_PUT(skb, CTA_HELP_NAME, strlen(help->helper->name), help->helper->name);
c1d10adb 185
dc808fe2
HW		 186 if (help->helper->to_nfattr)
187 help->helper->to_nfattr(skb, ct);
c1d10adb
PNA		 188
189 NFA_NEST_END(skb, nest_helper);
190
191 return 0;
192
193nfattr_failure:
194 return -1;
195}
196
197#ifdef CONFIG_NF_CT_ACCT
198static inline int
199ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
200 enum ip_conntrack_dir dir)
201{
202 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
203 struct nfattr *nest_count = NFA_NEST(skb, type);
bff9a89b 204 __be32 tmp;
c1d10adb
PNA		 205
206 tmp = htonl(ct->counters[dir].packets);
207 NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(u_int32_t), &tmp);
208
209 tmp = htonl(ct->counters[dir].bytes);
210 NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(u_int32_t), &tmp);
211
212 NFA_NEST_END(skb, nest_count);
213
214 return 0;
215
216nfattr_failure:
217 return -1;
218}
219#else
220#define ctnetlink_dump_counters(a, b, c) (0)
221#endif
222
223#ifdef CONFIG_NF_CONNTRACK_MARK
224static inline int
225ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
226{
bff9a89b 227 __be32 mark = htonl(ct->mark);
c1d10adb
PNA		 228
229 NFA_PUT(skb, CTA_MARK, sizeof(u_int32_t), &mark);
230 return 0;
231
232nfattr_failure:
233 return -1;
234}
235#else
236#define ctnetlink_dump_mark(a, b) (0)
237#endif
238
239static inline int
240ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
241{
bff9a89b 242 __be32 id = htonl(ct->id);
c1d10adb
PNA		 243 NFA_PUT(skb, CTA_ID, sizeof(u_int32_t), &id);
244 return 0;
245
246nfattr_failure:
247 return -1;
248}
249
250static inline int
251ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
252{
bff9a89b 253 __be32 use = htonl(atomic_read(&ct->ct_general.use));
601e68e1 254
c1d10adb
PNA		 255 NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
256 return 0;
257
258nfattr_failure:
259 return -1;
260}
261
262#define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
263
264static int
265ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
601e68e1 266 int event, int nowait,
c1d10adb
PNA		 267 const struct nf_conn *ct)
268{
269 struct nlmsghdr *nlh;
270 struct nfgenmsg *nfmsg;
271 struct nfattr *nest_parms;
27a884dc 272 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA		 273
274 event |= NFNL_SUBSYS_CTNETLINK << 8;
275 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
276 nfmsg = NLMSG_DATA(nlh);
277
278 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
601e68e1 279 nfmsg->nfgen_family =
c1d10adb
PNA		 280 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
281 nfmsg->version = NFNETLINK_V0;
282 nfmsg->res_id = 0;
283
284 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
285 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
286 goto nfattr_failure;
287 NFA_NEST_END(skb, nest_parms);
601e68e1 288
c1d10adb
PNA		 289 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
290 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
291 goto nfattr_failure;
292 NFA_NEST_END(skb, nest_parms);
293
294 if (ctnetlink_dump_status(skb, ct) < 0 ||
295 ctnetlink_dump_timeout(skb, ct) < 0 ||
296 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
297 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
298 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
299 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
300 ctnetlink_dump_mark(skb, ct) < 0 ||
301 ctnetlink_dump_id(skb, ct) < 0 ||
302 ctnetlink_dump_use(skb, ct) < 0)
303 goto nfattr_failure;
304
27a884dc 305 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA		 306 return skb->len;
307
308nlmsg_failure:
309nfattr_failure:
dc5fc579 310 nlmsg_trim(skb, b);
c1d10adb
PNA		 311 return -1;
312}
313
314#ifdef CONFIG_NF_CONNTRACK_EVENTS
315static int ctnetlink_conntrack_event(struct notifier_block *this,
601e68e1 316 unsigned long events, void *ptr)
c1d10adb
PNA		 317{
318 struct nlmsghdr *nlh;
319 struct nfgenmsg *nfmsg;
320 struct nfattr *nest_parms;
321 struct nf_conn *ct = (struct nf_conn *)ptr;
322 struct sk_buff *skb;
323 unsigned int type;
27a884dc 324 sk_buff_data_t b;
c1d10adb
PNA		 325 unsigned int flags = 0, group;
326
327 /* ignore our fake conntrack entry */
328 if (ct == &nf_conntrack_untracked)
329 return NOTIFY_DONE;
330
331 if (events & IPCT_DESTROY) {
332 type = IPCTNL_MSG_CT_DELETE;
333 group = NFNLGRP_CONNTRACK_DESTROY;
334 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
335 type = IPCTNL_MSG_CT_NEW;
336 flags = NLM_F_CREATE|NLM_F_EXCL;
c1d10adb 337 group = NFNLGRP_CONNTRACK_NEW;
1a31526b 338 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
c1d10adb
PNA		 339 type = IPCTNL_MSG_CT_NEW;
340 group = NFNLGRP_CONNTRACK_UPDATE;
341 } else
342 return NOTIFY_DONE;
a2427692
PM		 343
344 if (!nfnetlink_has_listeners(group))
345 return NOTIFY_DONE;
346
c1d10adb
PNA		 347 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
348 if (!skb)
349 return NOTIFY_DONE;
350
351 b = skb->tail;
352
353 type |= NFNL_SUBSYS_CTNETLINK << 8;
354 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
355 nfmsg = NLMSG_DATA(nlh);
356
357 nlh->nlmsg_flags = flags;
358 nfmsg->nfgen_family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
359 nfmsg->version = NFNETLINK_V0;
360 nfmsg->res_id = 0;
361
362 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
363 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
364 goto nfattr_failure;
365 NFA_NEST_END(skb, nest_parms);
601e68e1 366
c1d10adb
PNA		 367 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
368 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
369 goto nfattr_failure;
370 NFA_NEST_END(skb, nest_parms);
c1d10adb 371
7b621c1e
PNA		 372 if (events & IPCT_DESTROY) {
373 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
374 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
375 goto nfattr_failure;
376 } else {
377 if (ctnetlink_dump_status(skb, ct) < 0)
378 goto nfattr_failure;
379
380 if (ctnetlink_dump_timeout(skb, ct) < 0)
381 goto nfattr_failure;
382
383 if (events & IPCT_PROTOINFO
384 && ctnetlink_dump_protoinfo(skb, ct) < 0)
601e68e1 385 goto nfattr_failure;
7b621c1e
PNA		 386
387 if ((events & IPCT_HELPER || nfct_help(ct))
388 && ctnetlink_dump_helpinfo(skb, ct) < 0)
601e68e1 389 goto nfattr_failure;
7b621c1e 390
40e0cb00 391#ifdef CONFIG_NF_CONNTRACK_MARK
7b621c1e
PNA		 392 if ((events & IPCT_MARK || ct->mark)
393 && ctnetlink_dump_mark(skb, ct) < 0)
601e68e1 394 goto nfattr_failure;
40e0cb00 395#endif
7b621c1e
PNA		 396
397 if (events & IPCT_COUNTER_FILLING &&
398 (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
399 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
400 goto nfattr_failure;
401 }
b9a37e0c 402
c1d10adb
PNA		 403 nlh->nlmsg_len = skb->tail - b;
404 nfnetlink_send(skb, 0, group, 0);
405 return NOTIFY_DONE;
406
407nlmsg_failure:
408nfattr_failure:
409 kfree_skb(skb);
410 return NOTIFY_DONE;
411}
412#endif /* CONFIG_NF_CONNTRACK_EVENTS */
413
414static int ctnetlink_done(struct netlink_callback *cb)
415{
89f2e218
PM		 416 if (cb->args[1])
417 nf_ct_put((struct nf_conn *)cb->args[1]);
c1d10adb
PNA		 418 return 0;
419}
420
87711cb8
PNA		 421#define L3PROTO(ct) ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num
422
c1d10adb
PNA		 423static int
424ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
425{
89f2e218 426 struct nf_conn *ct, *last;
c1d10adb
PNA		 427 struct nf_conntrack_tuple_hash *h;
428 struct list_head *i;
87711cb8
PNA		 429 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
430 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 431
c1d10adb 432 read_lock_bh(&nf_conntrack_lock);
d205dc40 433 last = (struct nf_conn *)cb->args[1];
89f2e218
PM		 434 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
435restart:
c1d10adb
PNA		 436 list_for_each_prev(i, &nf_conntrack_hash[cb->args[0]]) {
437 h = (struct nf_conntrack_tuple_hash *) i;
5b1158e9 438 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
c1d10adb
PNA		 439 continue;
440 ct = nf_ct_tuplehash_to_ctrack(h);
87711cb8
PNA		 441 /* Dump entries of a given L3 protocol number.
442 * If it is not specified, ie. l3proto == 0,
443 * then dump everything. */
444 if (l3proto && L3PROTO(ct) != l3proto)
445 continue;
d205dc40
PM		 446 if (cb->args[1]) {
447 if (ct != last)
89f2e218 448 continue;
d205dc40 449 cb->args[1] = 0;
89f2e218 450 }
c1d10adb 451 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
601e68e1 452 cb->nlh->nlmsg_seq,
c1d10adb 453 IPCTNL_MSG_CT_NEW,
89f2e218
PM		 454 1, ct) < 0) {
455 nf_conntrack_get(&ct->ct_general);
456 cb->args[1] = (unsigned long)ct;
c1d10adb 457 goto out;
89f2e218 458 }
01f34848
PNA		 459#ifdef CONFIG_NF_CT_ACCT
460 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
461 IPCTNL_MSG_CT_GET_CTRZERO)
462 memset(&ct->counters, 0, sizeof(ct->counters));
463#endif
89f2e218 464 }
d205dc40 465 if (cb->args[1]) {
89f2e218
PM		 466 cb->args[1] = 0;
467 goto restart;
c1d10adb
PNA		 468 }
469 }
89f2e218 470out:
c1d10adb 471 read_unlock_bh(&nf_conntrack_lock);
d205dc40
PM		 472 if (last)
473 nf_ct_put(last);
c1d10adb 474
c1d10adb
PNA		 475 return skb->len;
476}
477
c1d10adb
PNA		 478static inline int
479ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
480{
481 struct nfattr *tb[CTA_IP_MAX];
482 struct nf_conntrack_l3proto *l3proto;
483 int ret = 0;
484
c1d10adb
PNA		 485 nfattr_parse_nested(tb, CTA_IP_MAX, attr);
486
487 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
488
489 if (likely(l3proto->nfattr_to_tuple))
490 ret = l3proto->nfattr_to_tuple(tb, tuple);
491
492 nf_ct_l3proto_put(l3proto);
493
c1d10adb
PNA		 494 return ret;
495}
496
497static const size_t cta_min_proto[CTA_PROTO_MAX] = {
498 [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
499};
500
501static inline int
601e68e1 502ctnetlink_parse_tuple_proto(struct nfattr *attr,
c1d10adb
PNA		 503 struct nf_conntrack_tuple *tuple)
504{
505 struct nfattr *tb[CTA_PROTO_MAX];
605dcad6 506 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA		 507 int ret = 0;
508
c1d10adb
PNA		 509 nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
510
511 if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
512 return -EINVAL;
513
514 if (!tb[CTA_PROTO_NUM-1])
515 return -EINVAL;
516 tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
517
605dcad6 518 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
c1d10adb 519
605dcad6
MJ		 520 if (likely(l4proto->nfattr_to_tuple))
521 ret = l4proto->nfattr_to_tuple(tb, tuple);
c1d10adb 522
605dcad6 523 nf_ct_l4proto_put(l4proto);
601e68e1 524
c1d10adb
PNA		 525 return ret;
526}
527
528static inline int
529ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
530 enum ctattr_tuple type, u_int8_t l3num)
531{
532 struct nfattr *tb[CTA_TUPLE_MAX];
533 int err;
534
c1d10adb
PNA		 535 memset(tuple, 0, sizeof(*tuple));
536
537 nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
538
539 if (!tb[CTA_TUPLE_IP-1])
540 return -EINVAL;
541
542 tuple->src.l3num = l3num;
543
544 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP-1], tuple);
545 if (err < 0)
546 return err;
547
548 if (!tb[CTA_TUPLE_PROTO-1])
549 return -EINVAL;
550
551 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO-1], tuple);
552 if (err < 0)
553 return err;
554
555 /* orig and expect tuples get DIR_ORIGINAL */
556 if (type == CTA_TUPLE_REPLY)
557 tuple->dst.dir = IP_CT_DIR_REPLY;
558 else
559 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
560
c1d10adb
PNA		 561 return 0;
562}
563
5b1158e9 564#ifdef CONFIG_NF_NAT_NEEDED
c1d10adb
PNA		 565static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
566 [CTA_PROTONAT_PORT_MIN-1] = sizeof(u_int16_t),
567 [CTA_PROTONAT_PORT_MAX-1] = sizeof(u_int16_t),
568};
569
5b1158e9 570static int nfnetlink_parse_nat_proto(struct nfattr *attr,
c1d10adb 571 const struct nf_conn *ct,
5b1158e9 572 struct nf_nat_range *range)
c1d10adb
PNA		 573{
574 struct nfattr *tb[CTA_PROTONAT_MAX];
5b1158e9 575 struct nf_nat_protocol *npt;
c1d10adb 576
c1d10adb
PNA		 577 nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
578
579 if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
580 return -EINVAL;
581
5b1158e9 582 npt = nf_nat_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
c1d10adb
PNA		 583
584 if (!npt->nfattr_to_range) {
5b1158e9 585 nf_nat_proto_put(npt);
c1d10adb
PNA		 586 return 0;
587 }
588
589 /* nfattr_to_range returns 1 if it parsed, 0 if not, neg. on error */
590 if (npt->nfattr_to_range(tb, range) > 0)
591 range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
592
5b1158e9 593 nf_nat_proto_put(npt);
c1d10adb 594
c1d10adb
PNA		 595 return 0;
596}
597
598static const size_t cta_min_nat[CTA_NAT_MAX] = {
599 [CTA_NAT_MINIP-1] = sizeof(u_int32_t),
600 [CTA_NAT_MAXIP-1] = sizeof(u_int32_t),
601};
602
603static inline int
5b1158e9
JK		 604nfnetlink_parse_nat(struct nfattr *nat,
605 const struct nf_conn *ct, struct nf_nat_range *range)
c1d10adb
PNA		 606{
607 struct nfattr *tb[CTA_NAT_MAX];
608 int err;
609
c1d10adb 610 memset(range, 0, sizeof(*range));
601e68e1 611
3726add7 612 nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
c1d10adb
PNA		 613
614 if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
615 return -EINVAL;
616
617 if (tb[CTA_NAT_MINIP-1])
bff9a89b 618 range->min_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
c1d10adb
PNA		 619
620 if (!tb[CTA_NAT_MAXIP-1])
621 range->max_ip = range->min_ip;
622 else
bff9a89b 623 range->max_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
c1d10adb
PNA		 624
625 if (range->min_ip)
626 range->flags |= IP_NAT_RANGE_MAP_IPS;
627
628 if (!tb[CTA_NAT_PROTO-1])
629 return 0;
630
5b1158e9 631 err = nfnetlink_parse_nat_proto(tb[CTA_NAT_PROTO-1], ct, range);
c1d10adb
PNA		 632 if (err < 0)
633 return err;
634
c1d10adb
PNA		 635 return 0;
636}
637#endif
638
639static inline int
640ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
641{
642 struct nfattr *tb[CTA_HELP_MAX];
643
c1d10adb
PNA		 644 nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
645
646 if (!tb[CTA_HELP_NAME-1])
647 return -EINVAL;
648
649 *helper_name = NFA_DATA(tb[CTA_HELP_NAME-1]);
650
651 return 0;
652}
653
654static const size_t cta_min[CTA_MAX] = {
655 [CTA_STATUS-1] = sizeof(u_int32_t),
656 [CTA_TIMEOUT-1] = sizeof(u_int32_t),
657 [CTA_MARK-1] = sizeof(u_int32_t),
658 [CTA_USE-1] = sizeof(u_int32_t),
659 [CTA_ID-1] = sizeof(u_int32_t)
660};
661
662static int
601e68e1 663ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 664 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 665{
666 struct nf_conntrack_tuple_hash *h;
667 struct nf_conntrack_tuple tuple;
668 struct nf_conn *ct;
669 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
670 u_int8_t u3 = nfmsg->nfgen_family;
671 int err = 0;
672
c1d10adb
PNA		 673 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
674 return -EINVAL;
675
676 if (cda[CTA_TUPLE_ORIG-1])
677 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
678 else if (cda[CTA_TUPLE_REPLY-1])
679 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
680 else {
681 /* Flush the whole table */
682 nf_conntrack_flush();
683 return 0;
684 }
685
686 if (err < 0)
687 return err;
688
689 h = nf_conntrack_find_get(&tuple, NULL);
9ea8cfd6 690 if (!h)
c1d10adb 691 return -ENOENT;
c1d10adb
PNA		 692
693 ct = nf_ct_tuplehash_to_ctrack(h);
601e68e1 694
c1d10adb 695 if (cda[CTA_ID-1]) {
bff9a89b 696 u_int32_t id = ntohl(*(__be32 *)NFA_DATA(cda[CTA_ID-1]));
c1d10adb
PNA		 697 if (ct->id != id) {
698 nf_ct_put(ct);
699 return -ENOENT;
700 }
601e68e1 701 }
c1d10adb
PNA		 702 if (del_timer(&ct->timeout))
703 ct->timeout.function((unsigned long)ct);
704
705 nf_ct_put(ct);
c1d10adb
PNA		 706
707 return 0;
708}
709
710static int
601e68e1 711ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 712 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 713{
714 struct nf_conntrack_tuple_hash *h;
715 struct nf_conntrack_tuple tuple;
716 struct nf_conn *ct;
717 struct sk_buff *skb2 = NULL;
718 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
719 u_int8_t u3 = nfmsg->nfgen_family;
720 int err = 0;
721
c1d10adb 722 if (nlh->nlmsg_flags & NLM_F_DUMP) {
01f34848
PNA		 723#ifndef CONFIG_NF_CT_ACCT
724 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO)
c1d10adb
PNA		 725 return -ENOTSUPP;
726#endif
c702e804
TG		 727 return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
728 ctnetlink_done);
c1d10adb
PNA		 729 }
730
731 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
732 return -EINVAL;
733
734 if (cda[CTA_TUPLE_ORIG-1])
735 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
736 else if (cda[CTA_TUPLE_REPLY-1])
737 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
738 else
739 return -EINVAL;
740
741 if (err < 0)
742 return err;
743
744 h = nf_conntrack_find_get(&tuple, NULL);
9ea8cfd6 745 if (!h)
c1d10adb 746 return -ENOENT;
9ea8cfd6 747
c1d10adb
PNA		 748 ct = nf_ct_tuplehash_to_ctrack(h);
749
750 err = -ENOMEM;
751 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
752 if (!skb2) {
753 nf_ct_put(ct);
754 return -ENOMEM;
755 }
c1d10adb 756
601e68e1 757 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
c1d10adb
PNA		 758 IPCTNL_MSG_CT_NEW, 1, ct);
759 nf_ct_put(ct);
760 if (err <= 0)
761 goto free;
762
763 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
764 if (err < 0)
765 goto out;
766
c1d10adb
PNA		 767 return 0;
768
769free:
770 kfree_skb(skb2);
771out:
772 return err;
773}
774
775static inline int
776ctnetlink_change_status(struct nf_conn *ct, struct nfattr *cda[])
777{
778 unsigned long d;
bff9a89b 779 unsigned int status = ntohl(*(__be32 *)NFA_DATA(cda[CTA_STATUS-1]));
c1d10adb
PNA		 780 d = ct->status ^ status;
781
782 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
783 /* unchangeable */
784 return -EINVAL;
601e68e1 785
c1d10adb
PNA		 786 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
787 /* SEEN_REPLY bit can only be set */
788 return -EINVAL;
789
601e68e1 790
c1d10adb
PNA		 791 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
792 /* ASSURED bit can only be set */
793 return -EINVAL;
794
3726add7 795 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
5b1158e9 796#ifndef CONFIG_NF_NAT_NEEDED
c1d10adb
PNA		 797 return -EINVAL;
798#else
5b1158e9 799 struct nf_nat_range range;
c1d10adb 800
3726add7 801 if (cda[CTA_NAT_DST-1]) {
5b1158e9 802 if (nfnetlink_parse_nat(cda[CTA_NAT_DST-1], ct,
3726add7
PM		 803 &range) < 0)
804 return -EINVAL;
5b1158e9 805 if (nf_nat_initialized(ct,
3726add7
PM		 806 HOOK2MANIP(NF_IP_PRE_ROUTING)))
807 return -EEXIST;
5b1158e9 808 nf_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING);
3726add7
PM		 809 }
810 if (cda[CTA_NAT_SRC-1]) {
5b1158e9 811 if (nfnetlink_parse_nat(cda[CTA_NAT_SRC-1], ct,
3726add7
PM		 812 &range) < 0)
813 return -EINVAL;
5b1158e9 814 if (nf_nat_initialized(ct,
3726add7
PM		 815 HOOK2MANIP(NF_IP_POST_ROUTING)))
816 return -EEXIST;
5b1158e9 817 nf_nat_setup_info(ct, &range, NF_IP_POST_ROUTING);
3726add7 818 }
c1d10adb
PNA		 819#endif
820 }
821
822 /* Be careful here, modifying NAT bits can screw up things,
823 * so don't let users modify them directly if they don't pass
5b1158e9 824 * nf_nat_range. */
c1d10adb
PNA		 825 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
826 return 0;
827}
828
829
830static inline int
831ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
832{
833 struct nf_conntrack_helper *helper;
dc808fe2 834 struct nf_conn_help *help = nfct_help(ct);
c1d10adb
PNA		 835 char *helpname;
836 int err;
837
dc808fe2
HW		 838 if (!help) {
839 /* FIXME: we need to reallocate and rehash */
840 return -EBUSY;
841 }
842
c1d10adb
PNA		 843 /* don't change helper of sibling connections */
844 if (ct->master)
845 return -EINVAL;
846
847 err = ctnetlink_parse_help(cda[CTA_HELP-1], &helpname);
848 if (err < 0)
849 return err;
850
851 helper = __nf_conntrack_helper_find_byname(helpname);
852 if (!helper) {
853 if (!strcmp(helpname, ""))
854 helper = NULL;
855 else
856 return -EINVAL;
857 }
858
dc808fe2 859 if (help->helper) {
c1d10adb
PNA		 860 if (!helper) {
861 /* we had a helper before ... */
862 nf_ct_remove_expectations(ct);
dc808fe2 863 help->helper = NULL;
c1d10adb
PNA		 864 } else {
865 /* need to zero data of old helper */
dc808fe2 866 memset(&help->help, 0, sizeof(help->help));
c1d10adb
PNA		 867 }
868 }
601e68e1 869
dc808fe2 870 help->helper = helper;
c1d10adb
PNA		 871
872 return 0;
873}
874
875static inline int
876ctnetlink_change_timeout(struct nf_conn *ct, struct nfattr *cda[])
877{
bff9a89b 878 u_int32_t timeout = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
601e68e1 879
c1d10adb
PNA		 880 if (!del_timer(&ct->timeout))
881 return -ETIME;
882
883 ct->timeout.expires = jiffies + timeout * HZ;
884 add_timer(&ct->timeout);
885
886 return 0;
887}
888
889static inline int
890ctnetlink_change_protoinfo(struct nf_conn *ct, struct nfattr *cda[])
891{
892 struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
605dcad6 893 struct nf_conntrack_l4proto *l4proto;
c1d10adb
PNA		 894 u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
895 u_int16_t l3num = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
896 int err = 0;
897
898 nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr);
899
605dcad6 900 l4proto = nf_ct_l4proto_find_get(l3num, npt);
c1d10adb 901
605dcad6
MJ		 902 if (l4proto->from_nfattr)
903 err = l4proto->from_nfattr(tb, ct);
904 nf_ct_l4proto_put(l4proto);
c1d10adb
PNA		 905
906 return err;
907}
908
909static int
910ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
911{
912 int err;
913
c1d10adb
PNA		 914 if (cda[CTA_HELP-1]) {
915 err = ctnetlink_change_helper(ct, cda);
916 if (err < 0)
917 return err;
918 }
919
920 if (cda[CTA_TIMEOUT-1]) {
921 err = ctnetlink_change_timeout(ct, cda);
922 if (err < 0)
923 return err;
924 }
925
926 if (cda[CTA_STATUS-1]) {
927 err = ctnetlink_change_status(ct, cda);
928 if (err < 0)
929 return err;
930 }
931
932 if (cda[CTA_PROTOINFO-1]) {
933 err = ctnetlink_change_protoinfo(ct, cda);
934 if (err < 0)
935 return err;
936 }
937
bcd1e830 938#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb 939 if (cda[CTA_MARK-1])
bff9a89b 940 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
c1d10adb
PNA		 941#endif
942
c1d10adb
PNA		 943 return 0;
944}
945
946static int
601e68e1 947ctnetlink_create_conntrack(struct nfattr *cda[],
c1d10adb
PNA		 948 struct nf_conntrack_tuple *otuple,
949 struct nf_conntrack_tuple *rtuple)
950{
951 struct nf_conn *ct;
952 int err = -EINVAL;
dafc741c 953 struct nf_conn_help *help;
c1d10adb 954
c1d10adb
PNA		 955 ct = nf_conntrack_alloc(otuple, rtuple);
956 if (ct == NULL || IS_ERR(ct))
601e68e1 957 return -ENOMEM;
c1d10adb
PNA		 958
959 if (!cda[CTA_TIMEOUT-1])
960 goto err;
bff9a89b 961 ct->timeout.expires = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
c1d10adb
PNA		 962
963 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
964 ct->status |= IPS_CONFIRMED;
965
bbb3357d
PNA		 966 if (cda[CTA_STATUS-1]) {
967 err = ctnetlink_change_status(ct, cda);
968 if (err < 0)
969 goto err;
970 }
c1d10adb
PNA		 971
972 if (cda[CTA_PROTOINFO-1]) {
973 err = ctnetlink_change_protoinfo(ct, cda);
974 if (err < 0)
c54ea3b9 975 goto err;
c1d10adb
PNA		 976 }
977
bcd1e830 978#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb 979 if (cda[CTA_MARK-1])
bff9a89b 980 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
c1d10adb
PNA		 981#endif
982
dafc741c
YK		 983 help = nfct_help(ct);
984 if (help)
985 help->helper = nf_ct_helper_find_get(rtuple);
986
c1d10adb
PNA		 987 add_timer(&ct->timeout);
988 nf_conntrack_hash_insert(ct);
989
dafc741c
YK		 990 if (help && help->helper)
991 nf_ct_helper_put(help->helper);
992
c1d10adb
PNA		 993 return 0;
994
601e68e1 995err:
c1d10adb
PNA		 996 nf_conntrack_free(ct);
997 return err;
998}
999
601e68e1
YH		 1000static int
1001ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1002 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1003{
1004 struct nf_conntrack_tuple otuple, rtuple;
1005 struct nf_conntrack_tuple_hash *h = NULL;
1006 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1007 u_int8_t u3 = nfmsg->nfgen_family;
1008 int err = 0;
1009
c1d10adb
PNA		 1010 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
1011 return -EINVAL;
1012
1013 if (cda[CTA_TUPLE_ORIG-1]) {
1014 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1015 if (err < 0)
1016 return err;
1017 }
1018
1019 if (cda[CTA_TUPLE_REPLY-1]) {
1020 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1021 if (err < 0)
1022 return err;
1023 }
1024
1025 write_lock_bh(&nf_conntrack_lock);
1026 if (cda[CTA_TUPLE_ORIG-1])
1027 h = __nf_conntrack_find(&otuple, NULL);
1028 else if (cda[CTA_TUPLE_REPLY-1])
1029 h = __nf_conntrack_find(&rtuple, NULL);
1030
1031 if (h == NULL) {
1032 write_unlock_bh(&nf_conntrack_lock);
c1d10adb
PNA		 1033 err = -ENOENT;
1034 if (nlh->nlmsg_flags & NLM_F_CREATE)
1035 err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
1036 return err;
1037 }
1038 /* implicit 'else' */
1039
1040 /* we only allow nat config for new conntracks */
3726add7 1041 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
c1d10adb
PNA		 1042 err = -EINVAL;
1043 goto out_unlock;
1044 }
1045
1046 /* We manipulate the conntrack inside the global conntrack table lock,
1047 * so there's no need to increase the refcount */
c1d10adb
PNA		 1048 err = -EEXIST;
1049 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1050 err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
1051
1052out_unlock:
1053 write_unlock_bh(&nf_conntrack_lock);
1054 return err;
1055}
1056
601e68e1
YH		 1057/***********************************************************************
1058 * EXPECT
1059 ***********************************************************************/
c1d10adb
PNA		 1060
1061static inline int
1062ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1063 const struct nf_conntrack_tuple *tuple,
1064 enum ctattr_expect type)
1065{
1066 struct nfattr *nest_parms = NFA_NEST(skb, type);
601e68e1 1067
c1d10adb
PNA		 1068 if (ctnetlink_dump_tuples(skb, tuple) < 0)
1069 goto nfattr_failure;
1070
1071 NFA_NEST_END(skb, nest_parms);
1072
1073 return 0;
1074
1075nfattr_failure:
1076 return -1;
601e68e1 1077}
c1d10adb 1078
1cde6436
PNA		 1079static inline int
1080ctnetlink_exp_dump_mask(struct sk_buff *skb,
1081 const struct nf_conntrack_tuple *tuple,
1082 const struct nf_conntrack_tuple *mask)
1083{
1084 int ret;
1085 struct nf_conntrack_l3proto *l3proto;
605dcad6 1086 struct nf_conntrack_l4proto *l4proto;
1cde6436
PNA		 1087 struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
1088
1089 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
1090 ret = ctnetlink_dump_tuples_ip(skb, mask, l3proto);
1091 nf_ct_l3proto_put(l3proto);
1092
1093 if (unlikely(ret < 0))
1094 goto nfattr_failure;
1095
605dcad6
MJ		 1096 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
1097 ret = ctnetlink_dump_tuples_proto(skb, mask, l4proto);
1098 nf_ct_l4proto_put(l4proto);
1cde6436
PNA		 1099 if (unlikely(ret < 0))
1100 goto nfattr_failure;
1101
1102 NFA_NEST_END(skb, nest_parms);
1103
1104 return 0;
1105
1106nfattr_failure:
1107 return -1;
1108}
1109
c1d10adb
PNA		 1110static inline int
1111ctnetlink_exp_dump_expect(struct sk_buff *skb,
601e68e1 1112 const struct nf_conntrack_expect *exp)
c1d10adb
PNA		 1113{
1114 struct nf_conn *master = exp->master;
bff9a89b
PM		 1115 __be32 timeout = htonl((exp->timeout.expires - jiffies) / HZ);
1116 __be32 id = htonl(exp->id);
c1d10adb
PNA		 1117
1118 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1119 goto nfattr_failure;
1cde6436 1120 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
c1d10adb
PNA		 1121 goto nfattr_failure;
1122 if (ctnetlink_exp_dump_tuple(skb,
1123 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1124 CTA_EXPECT_MASTER) < 0)
1125 goto nfattr_failure;
601e68e1 1126
c1d10adb
PNA		 1127 NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(timeout), &timeout);
1128 NFA_PUT(skb, CTA_EXPECT_ID, sizeof(u_int32_t), &id);
1129
1130 return 0;
601e68e1 1131
c1d10adb
PNA		 1132nfattr_failure:
1133 return -1;
1134}
1135
1136static int
1137ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
601e68e1
YH		 1138 int event,
1139 int nowait,
c1d10adb
PNA		 1140 const struct nf_conntrack_expect *exp)
1141{
1142 struct nlmsghdr *nlh;
1143 struct nfgenmsg *nfmsg;
27a884dc 1144 unsigned char *b = skb_tail_pointer(skb);
c1d10adb
PNA		 1145
1146 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1147 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1148 nfmsg = NLMSG_DATA(nlh);
1149
1150 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1151 nfmsg->nfgen_family = exp->tuple.src.l3num;
1152 nfmsg->version = NFNETLINK_V0;
1153 nfmsg->res_id = 0;
1154
1155 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1156 goto nfattr_failure;
1157
27a884dc 1158 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
c1d10adb
PNA		 1159 return skb->len;
1160
1161nlmsg_failure:
1162nfattr_failure:
dc5fc579 1163 nlmsg_trim(skb, b);
c1d10adb
PNA		 1164 return -1;
1165}
1166
1167#ifdef CONFIG_NF_CONNTRACK_EVENTS
1168static int ctnetlink_expect_event(struct notifier_block *this,
1169 unsigned long events, void *ptr)
1170{
1171 struct nlmsghdr *nlh;
1172 struct nfgenmsg *nfmsg;
1173 struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
1174 struct sk_buff *skb;
1175 unsigned int type;
27a884dc 1176 sk_buff_data_t b;
c1d10adb
PNA		 1177 int flags = 0;
1178
1179 if (events & IPEXP_NEW) {
1180 type = IPCTNL_MSG_EXP_NEW;
1181 flags = NLM_F_CREATE|NLM_F_EXCL;
1182 } else
1183 return NOTIFY_DONE;
1184
b3a27bfb
PNA		 1185 if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
1186 return NOTIFY_DONE;
1187
c1d10adb
PNA		 1188 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1189 if (!skb)
1190 return NOTIFY_DONE;
1191
1192 b = skb->tail;
1193
b633ad5f 1194 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
c1d10adb
PNA		 1195 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
1196 nfmsg = NLMSG_DATA(nlh);
1197
1198 nlh->nlmsg_flags = flags;
1199 nfmsg->nfgen_family = exp->tuple.src.l3num;
1200 nfmsg->version = NFNETLINK_V0;
1201 nfmsg->res_id = 0;
1202
1203 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1204 goto nfattr_failure;
1205
1206 nlh->nlmsg_len = skb->tail - b;
1207 nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
1208 return NOTIFY_DONE;
1209
1210nlmsg_failure:
1211nfattr_failure:
1212 kfree_skb(skb);
1213 return NOTIFY_DONE;
1214}
1215#endif
1216
1217static int
1218ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1219{
1220 struct nf_conntrack_expect *exp = NULL;
1221 struct list_head *i;
1222 u_int32_t *id = (u_int32_t *) &cb->args[0];
87711cb8
PNA		 1223 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
1224 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb 1225
c1d10adb
PNA		 1226 read_lock_bh(&nf_conntrack_lock);
1227 list_for_each_prev(i, &nf_conntrack_expect_list) {
1228 exp = (struct nf_conntrack_expect *) i;
87711cb8
PNA		 1229 if (l3proto && exp->tuple.src.l3num != l3proto)
1230 continue;
c1d10adb
PNA		 1231 if (exp->id <= *id)
1232 continue;
1233 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1234 cb->nlh->nlmsg_seq,
1235 IPCTNL_MSG_EXP_NEW,
1236 1, exp) < 0)
1237 goto out;
1238 *id = exp->id;
1239 }
601e68e1 1240out:
c1d10adb
PNA		 1241 read_unlock_bh(&nf_conntrack_lock);
1242
c1d10adb
PNA		 1243 return skb->len;
1244}
1245
1246static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
1247 [CTA_EXPECT_TIMEOUT-1] = sizeof(u_int32_t),
1248 [CTA_EXPECT_ID-1] = sizeof(u_int32_t)
1249};
1250
1251static int
601e68e1 1252ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1253 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1254{
1255 struct nf_conntrack_tuple tuple;
1256 struct nf_conntrack_expect *exp;
1257 struct sk_buff *skb2;
1258 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1259 u_int8_t u3 = nfmsg->nfgen_family;
1260 int err = 0;
1261
c1d10adb
PNA		 1262 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1263 return -EINVAL;
1264
1265 if (nlh->nlmsg_flags & NLM_F_DUMP) {
c702e804
TG		 1266 return netlink_dump_start(ctnl, skb, nlh,
1267 ctnetlink_exp_dump_table,
1268 ctnetlink_done);
c1d10adb
PNA		 1269 }
1270
1271 if (cda[CTA_EXPECT_MASTER-1])
1272 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1273 else
1274 return -EINVAL;
1275
1276 if (err < 0)
1277 return err;
1278
468ec44b 1279 exp = nf_conntrack_expect_find_get(&tuple);
c1d10adb
PNA		 1280 if (!exp)
1281 return -ENOENT;
1282
1283 if (cda[CTA_EXPECT_ID-1]) {
bff9a89b 1284 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
c1d10adb
PNA		 1285 if (exp->id != ntohl(id)) {
1286 nf_conntrack_expect_put(exp);
1287 return -ENOENT;
1288 }
601e68e1 1289 }
c1d10adb
PNA		 1290
1291 err = -ENOMEM;
1292 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1293 if (!skb2)
1294 goto out;
4e9b8269 1295
601e68e1 1296 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
c1d10adb
PNA		 1297 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1298 1, exp);
1299 if (err <= 0)
1300 goto free;
1301
1302 nf_conntrack_expect_put(exp);
1303
1304 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1305
1306free:
1307 kfree_skb(skb2);
1308out:
1309 nf_conntrack_expect_put(exp);
1310 return err;
1311}
1312
1313static int
601e68e1 1314ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1315 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1316{
1317 struct nf_conntrack_expect *exp, *tmp;
1318 struct nf_conntrack_tuple tuple;
1319 struct nf_conntrack_helper *h;
1320 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1321 u_int8_t u3 = nfmsg->nfgen_family;
1322 int err;
1323
1324 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1325 return -EINVAL;
1326
1327 if (cda[CTA_EXPECT_TUPLE-1]) {
1328 /* delete a single expect by tuple */
1329 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1330 if (err < 0)
1331 return err;
1332
1333 /* bump usage count to 2 */
468ec44b 1334 exp = nf_conntrack_expect_find_get(&tuple);
c1d10adb
PNA		 1335 if (!exp)
1336 return -ENOENT;
1337
1338 if (cda[CTA_EXPECT_ID-1]) {
bff9a89b 1339 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
c1d10adb
PNA		 1340 if (exp->id != ntohl(id)) {
1341 nf_conntrack_expect_put(exp);
1342 return -ENOENT;
1343 }
1344 }
1345
1346 /* after list removal, usage count == 1 */
1347 nf_conntrack_unexpect_related(exp);
601e68e1 1348 /* have to put what we 'get' above.
c1d10adb
PNA		 1349 * after this line usage count == 0 */
1350 nf_conntrack_expect_put(exp);
1351 } else if (cda[CTA_EXPECT_HELP_NAME-1]) {
1352 char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
1353
1354 /* delete all expectations for this helper */
1355 write_lock_bh(&nf_conntrack_lock);
1356 h = __nf_conntrack_helper_find_byname(name);
1357 if (!h) {
1358 write_unlock_bh(&nf_conntrack_lock);
1359 return -EINVAL;
1360 }
1361 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1362 list) {
dc808fe2
HW		 1363 struct nf_conn_help *m_help = nfct_help(exp->master);
1364 if (m_help->helper == h
c1d10adb
PNA		 1365 && del_timer(&exp->timeout)) {
1366 nf_ct_unlink_expect(exp);
1367 nf_conntrack_expect_put(exp);
1368 }
1369 }
1370 write_unlock_bh(&nf_conntrack_lock);
1371 } else {
1372 /* This basically means we have to flush everything*/
1373 write_lock_bh(&nf_conntrack_lock);
1374 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1375 list) {
1376 if (del_timer(&exp->timeout)) {
1377 nf_ct_unlink_expect(exp);
1378 nf_conntrack_expect_put(exp);
1379 }
1380 }
1381 write_unlock_bh(&nf_conntrack_lock);
1382 }
1383
1384 return 0;
1385}
1386static int
1387ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nfattr *cda[])
1388{
1389 return -EOPNOTSUPP;
1390}
1391
1392static int
1393ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
1394{
1395 struct nf_conntrack_tuple tuple, mask, master_tuple;
1396 struct nf_conntrack_tuple_hash *h = NULL;
1397 struct nf_conntrack_expect *exp;
1398 struct nf_conn *ct;
dc808fe2 1399 struct nf_conn_help *help;
c1d10adb
PNA		 1400 int err = 0;
1401
c1d10adb
PNA		 1402 /* caller guarantees that those three CTA_EXPECT_* exist */
1403 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1404 if (err < 0)
1405 return err;
1406 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1407 if (err < 0)
1408 return err;
1409 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1410 if (err < 0)
1411 return err;
1412
1413 /* Look for master conntrack of this expectation */
1414 h = nf_conntrack_find_get(&master_tuple, NULL);
1415 if (!h)
1416 return -ENOENT;
1417 ct = nf_ct_tuplehash_to_ctrack(h);
dc808fe2 1418 help = nfct_help(ct);
c1d10adb 1419
dc808fe2 1420 if (!help || !help->helper) {
c1d10adb
PNA		 1421 /* such conntrack hasn't got any helper, abort */
1422 err = -EINVAL;
1423 goto out;
1424 }
1425
1426 exp = nf_conntrack_expect_alloc(ct);
1427 if (!exp) {
1428 err = -ENOMEM;
1429 goto out;
1430 }
601e68e1 1431
c1d10adb
PNA		 1432 exp->expectfn = NULL;
1433 exp->flags = 0;
1434 exp->master = ct;
9457d851 1435 exp->helper = NULL;
c1d10adb
PNA		 1436 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
1437 memcpy(&exp->mask, &mask, sizeof(struct nf_conntrack_tuple));
1438
1439 err = nf_conntrack_expect_related(exp);
1440 nf_conntrack_expect_put(exp);
1441
601e68e1 1442out:
c1d10adb
PNA		 1443 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1444 return err;
1445}
1446
1447static int
1448ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
1d00a4eb 1449 struct nlmsghdr *nlh, struct nfattr *cda[])
c1d10adb
PNA		 1450{
1451 struct nf_conntrack_tuple tuple;
1452 struct nf_conntrack_expect *exp;
1453 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1454 u_int8_t u3 = nfmsg->nfgen_family;
1455 int err = 0;
1456
c1d10adb
PNA		 1457 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1458 return -EINVAL;
1459
1460 if (!cda[CTA_EXPECT_TUPLE-1]
1461 || !cda[CTA_EXPECT_MASK-1]
1462 || !cda[CTA_EXPECT_MASTER-1])
1463 return -EINVAL;
1464
1465 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1466 if (err < 0)
1467 return err;
1468
1469 write_lock_bh(&nf_conntrack_lock);
1470 exp = __nf_conntrack_expect_find(&tuple);
1471
1472 if (!exp) {
1473 write_unlock_bh(&nf_conntrack_lock);
1474 err = -ENOENT;
1475 if (nlh->nlmsg_flags & NLM_F_CREATE)
1476 err = ctnetlink_create_expect(cda, u3);
1477 return err;
1478 }
1479
1480 err = -EEXIST;
1481 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1482 err = ctnetlink_change_expect(exp, cda);
1483 write_unlock_bh(&nf_conntrack_lock);
1484
c1d10adb
PNA		 1485 return err;
1486}
1487
1488#ifdef CONFIG_NF_CONNTRACK_EVENTS
1489static struct notifier_block ctnl_notifier = {
1490 .notifier_call = ctnetlink_conntrack_event,
1491};
1492
1493static struct notifier_block ctnl_notifier_exp = {
1494 .notifier_call = ctnetlink_expect_event,
1495};
1496#endif
1497
1498static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1499 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1500 .attr_count = CTA_MAX, },
1501 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1502 .attr_count = CTA_MAX, },
1503 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1504 .attr_count = CTA_MAX, },
1505 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1506 .attr_count = CTA_MAX, },
1507};
1508
1509static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1510 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1511 .attr_count = CTA_EXPECT_MAX, },
1512 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1513 .attr_count = CTA_EXPECT_MAX, },
1514 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1515 .attr_count = CTA_EXPECT_MAX, },
1516};
1517
1518static struct nfnetlink_subsystem ctnl_subsys = {
1519 .name = "conntrack",
1520 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1521 .cb_count = IPCTNL_MSG_MAX,
1522 .cb = ctnl_cb,
1523};
1524
1525static struct nfnetlink_subsystem ctnl_exp_subsys = {
1526 .name = "conntrack_expect",
1527 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1528 .cb_count = IPCTNL_MSG_EXP_MAX,
1529 .cb = ctnl_exp_cb,
1530};
1531
d2483dde 1532MODULE_ALIAS("ip_conntrack_netlink");
c1d10adb 1533MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
34f9a2e4 1534MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
c1d10adb
PNA		 1535
1536static int __init ctnetlink_init(void)
1537{
1538 int ret;
1539
1540 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1541 ret = nfnetlink_subsys_register(&ctnl_subsys);
1542 if (ret < 0) {
1543 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1544 goto err_out;
1545 }
1546
1547 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1548 if (ret < 0) {
1549 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1550 goto err_unreg_subsys;
1551 }
1552
1553#ifdef CONFIG_NF_CONNTRACK_EVENTS
1554 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1555 if (ret < 0) {
1556 printk("ctnetlink_init: cannot register notifier.\n");
1557 goto err_unreg_exp_subsys;
1558 }
1559
1560 ret = nf_conntrack_expect_register_notifier(&ctnl_notifier_exp);
1561 if (ret < 0) {
1562 printk("ctnetlink_init: cannot expect register notifier.\n");
1563 goto err_unreg_notifier;
1564 }
1565#endif
1566
1567 return 0;
1568
1569#ifdef CONFIG_NF_CONNTRACK_EVENTS
1570err_unreg_notifier:
1571 nf_conntrack_unregister_notifier(&ctnl_notifier);
1572err_unreg_exp_subsys:
1573 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1574#endif
1575err_unreg_subsys:
1576 nfnetlink_subsys_unregister(&ctnl_subsys);
1577err_out:
1578 return ret;
1579}
1580
1581static void __exit ctnetlink_exit(void)
1582{
1583 printk("ctnetlink: unregistering from nfnetlink.\n");
1584
1585#ifdef CONFIG_NF_CONNTRACK_EVENTS
e64a70be 1586 nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
c1d10adb
PNA		 1587 nf_conntrack_unregister_notifier(&ctnl_notifier);
1588#endif
1589
1590 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1591 nfnetlink_subsys_unregister(&ctnl_subsys);
1592 return;
1593}
1594
1595module_init(ctnetlink_init);
1596module_exit(ctnetlink_exit);
Clone of davem's net-next-2.6 tree