?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
byteorder: make swab.h include asm/swab.h like a regular header
[linux-2.6/mini2440.git] / net / netfilter / nf_conntrack_netlink.c
blob00e8c27130ff6ad6fa345b860948ddb8dca2bf4e
1 /* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
7 * (C) 2005-2008 by Pablo Neira Ayuso <pablo@netfilter.org>
8 *
9 * Initial connection tracking via netlink development funded and
10 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 *
12 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 *
14 * This software may be used and distributed according to the terms
15 * of the GNU General Public License, incorporated herein by reference.
16 */
17
18 #include <linux/init.h>
19 #include <linux/module.h>
20 #include <linux/kernel.h>
21 #include <linux/rculist.h>
22 #include <linux/types.h>
23 #include <linux/timer.h>
24 #include <linux/skbuff.h>
25 #include <linux/errno.h>
26 #include <linux/netlink.h>
27 #include <linux/spinlock.h>
28 #include <linux/interrupt.h>
29 #include <linux/notifier.h>
30
31 #include <linux/netfilter.h>
32 #include <net/netlink.h>
33 #include <net/netfilter/nf_conntrack.h>
34 #include <net/netfilter/nf_conntrack_core.h>
35 #include <net/netfilter/nf_conntrack_expect.h>
36 #include <net/netfilter/nf_conntrack_helper.h>
37 #include <net/netfilter/nf_conntrack_l3proto.h>
38 #include <net/netfilter/nf_conntrack_l4proto.h>
39 #include <net/netfilter/nf_conntrack_tuple.h>
40 #include <net/netfilter/nf_conntrack_acct.h>
41 #ifdef CONFIG_NF_NAT_NEEDED
42 #include <net/netfilter/nf_nat_core.h>
43 #include <net/netfilter/nf_nat_protocol.h>
44 #endif
45
46 #include <linux/netfilter/nfnetlink.h>
47 #include <linux/netfilter/nfnetlink_conntrack.h>
48
49 MODULE_LICENSE("GPL");
50
51 static char __initdata version[] = "0.93";
52
53 static inline int
54 ctnetlink_dump_tuples_proto(struct sk_buff *skb,
55 const struct nf_conntrack_tuple *tuple,
56 struct nf_conntrack_l4proto *l4proto)
57 {
58 int ret = 0;
59 struct nlattr *nest_parms;
60
61 nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
62 if (!nest_parms)
63 goto nla_put_failure;
64 NLA_PUT_U8(skb, CTA_PROTO_NUM, tuple->dst.protonum);
65
66 if (likely(l4proto->tuple_to_nlattr))
67 ret = l4proto->tuple_to_nlattr(skb, tuple);
68
69 nla_nest_end(skb, nest_parms);
70
71 return ret;
72
73 nla_put_failure:
74 return -1;
75 }
76
77 static inline int
78 ctnetlink_dump_tuples_ip(struct sk_buff *skb,
79 const struct nf_conntrack_tuple *tuple,
80 struct nf_conntrack_l3proto *l3proto)
81 {
82 int ret = 0;
83 struct nlattr *nest_parms;
84
85 nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);
86 if (!nest_parms)
87 goto nla_put_failure;
88
89 if (likely(l3proto->tuple_to_nlattr))
90 ret = l3proto->tuple_to_nlattr(skb, tuple);
91
92 nla_nest_end(skb, nest_parms);
93
94 return ret;
95
96 nla_put_failure:
97 return -1;
98 }
99
100 static int
101 ctnetlink_dump_tuples(struct sk_buff *skb,
102 const struct nf_conntrack_tuple *tuple)
103 {
104 int ret;
105 struct nf_conntrack_l3proto *l3proto;
106 struct nf_conntrack_l4proto *l4proto;
107
108 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
109 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
110
111 if (unlikely(ret < 0))
112 return ret;
113
114 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
115 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
116
117 return ret;
118 }
119
120 static inline int
121 ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
122 {
123 NLA_PUT_BE32(skb, CTA_STATUS, htonl(ct->status));
124 return 0;
125
126 nla_put_failure:
127 return -1;
128 }
129
130 static inline int
131 ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
132 {
133 long timeout = (ct->timeout.expires - jiffies) / HZ;
134
135 if (timeout < 0)
136 timeout = 0;
137
138 NLA_PUT_BE32(skb, CTA_TIMEOUT, htonl(timeout));
139 return 0;
140
141 nla_put_failure:
142 return -1;
143 }
144
145 static inline int
146 ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
147 {
148 struct nf_conntrack_l4proto *l4proto;
149 struct nlattr *nest_proto;
150 int ret;
151
152 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
153 if (!l4proto->to_nlattr)
154 return 0;
155
156 nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
157 if (!nest_proto)
158 goto nla_put_failure;
159
160 ret = l4proto->to_nlattr(skb, nest_proto, ct);
161
162 nla_nest_end(skb, nest_proto);
163
164 return ret;
165
166 nla_put_failure:
167 return -1;
168 }
169
170 static inline int
171 ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
172 {
173 struct nlattr *nest_helper;
174 const struct nf_conn_help *help = nfct_help(ct);
175 struct nf_conntrack_helper *helper;
176
177 if (!help)
178 return 0;
179
180 helper = rcu_dereference(help->helper);
181 if (!helper)
182 goto out;
183
184 nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
185 if (!nest_helper)
186 goto nla_put_failure;
187 NLA_PUT_STRING(skb, CTA_HELP_NAME, helper->name);
188
189 if (helper->to_nlattr)
190 helper->to_nlattr(skb, ct);
191
192 nla_nest_end(skb, nest_helper);
193 out:
194 return 0;
195
196 nla_put_failure:
197 return -1;
198 }
199
200 static int
201 ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
202 enum ip_conntrack_dir dir)
203 {
204 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
205 struct nlattr *nest_count;
206 const struct nf_conn_counter *acct;
207
208 acct = nf_conn_acct_find(ct);
209 if (!acct)
210 return 0;
211
212 nest_count = nla_nest_start(skb, type | NLA_F_NESTED);
213 if (!nest_count)
214 goto nla_put_failure;
215
216 NLA_PUT_BE64(skb, CTA_COUNTERS_PACKETS,
217 cpu_to_be64(acct[dir].packets));
218 NLA_PUT_BE64(skb, CTA_COUNTERS_BYTES,
219 cpu_to_be64(acct[dir].bytes));
220
221 nla_nest_end(skb, nest_count);
222
223 return 0;
224
225 nla_put_failure:
226 return -1;
227 }
228
229 #ifdef CONFIG_NF_CONNTRACK_MARK
230 static inline int
231 ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
232 {
233 NLA_PUT_BE32(skb, CTA_MARK, htonl(ct->mark));
234 return 0;
235
236 nla_put_failure:
237 return -1;
238 }
239 #else
240 #define ctnetlink_dump_mark(a, b) (0)
241 #endif
242
243 #ifdef CONFIG_NF_CONNTRACK_SECMARK
244 static inline int
245 ctnetlink_dump_secmark(struct sk_buff *skb, const struct nf_conn *ct)
246 {
247 NLA_PUT_BE32(skb, CTA_SECMARK, htonl(ct->secmark));
248 return 0;
249
250 nla_put_failure:
251 return -1;
252 }
253 #else
254 #define ctnetlink_dump_secmark(a, b) (0)
255 #endif
256
257 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
258
259 static inline int
260 ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)
261 {
262 struct nlattr *nest_parms;
263
264 if (!(ct->status & IPS_EXPECTED))
265 return 0;
266
267 nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);
268 if (!nest_parms)
269 goto nla_put_failure;
270 if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
271 goto nla_put_failure;
272 nla_nest_end(skb, nest_parms);
273
274 return 0;
275
276 nla_put_failure:
277 return -1;
278 }
279
280 #ifdef CONFIG_NF_NAT_NEEDED
281 static int
282 dump_nat_seq_adj(struct sk_buff *skb, const struct nf_nat_seq *natseq, int type)
283 {
284 struct nlattr *nest_parms;
285
286 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
287 if (!nest_parms)
288 goto nla_put_failure;
289
290 NLA_PUT_BE32(skb, CTA_NAT_SEQ_CORRECTION_POS,
291 htonl(natseq->correction_pos));
292 NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
293 htonl(natseq->offset_before));
294 NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
295 htonl(natseq->offset_after));
296
297 nla_nest_end(skb, nest_parms);
298
299 return 0;
300
301 nla_put_failure:
302 return -1;
303 }
304
305 static inline int
306 ctnetlink_dump_nat_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
307 {
308 struct nf_nat_seq *natseq;
309 struct nf_conn_nat *nat = nfct_nat(ct);
310
311 if (!(ct->status & IPS_SEQ_ADJUST) || !nat)
312 return 0;
313
314 natseq = &nat->seq[IP_CT_DIR_ORIGINAL];
315 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_ORIG) == -1)
316 return -1;
317
318 natseq = &nat->seq[IP_CT_DIR_REPLY];
319 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_REPLY) == -1)
320 return -1;
321
322 return 0;
323 }
324 #else
325 #define ctnetlink_dump_nat_seq_adj(a, b) (0)
326 #endif
327
328 static inline int
329 ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
330 {
331 NLA_PUT_BE32(skb, CTA_ID, htonl((unsigned long)ct));
332 return 0;
333
334 nla_put_failure:
335 return -1;
336 }
337
338 static inline int
339 ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
340 {
341 NLA_PUT_BE32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use)));
342 return 0;
343
344 nla_put_failure:
345 return -1;
346 }
347
348 #define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
349
350 static int
351 ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
352 int event, int nowait,
353 const struct nf_conn *ct)
354 {
355 struct nlmsghdr *nlh;
356 struct nfgenmsg *nfmsg;
357 struct nlattr *nest_parms;
358 unsigned char *b = skb_tail_pointer(skb);
359
360 event |= NFNL_SUBSYS_CTNETLINK << 8;
361 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
362 nfmsg = NLMSG_DATA(nlh);
363
364 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
365 nfmsg->nfgen_family = nf_ct_l3num(ct);
366 nfmsg->version = NFNETLINK_V0;
367 nfmsg->res_id = 0;
368
369 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
370 if (!nest_parms)
371 goto nla_put_failure;
372 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
373 goto nla_put_failure;
374 nla_nest_end(skb, nest_parms);
375
376 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
377 if (!nest_parms)
378 goto nla_put_failure;
379 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
380 goto nla_put_failure;
381 nla_nest_end(skb, nest_parms);
382
383 if (ctnetlink_dump_status(skb, ct) < 0 ||
384 ctnetlink_dump_timeout(skb, ct) < 0 ||
385 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
386 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
387 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
388 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
389 ctnetlink_dump_mark(skb, ct) < 0 ||
390 ctnetlink_dump_secmark(skb, ct) < 0 ||
391 ctnetlink_dump_id(skb, ct) < 0 ||
392 ctnetlink_dump_use(skb, ct) < 0 ||
393 ctnetlink_dump_master(skb, ct) < 0 ||
394 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
395 goto nla_put_failure;
396
397 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
398 return skb->len;
399
400 nlmsg_failure:
401 nla_put_failure:
402 nlmsg_trim(skb, b);
403 return -1;
404 }
405
406 #ifdef CONFIG_NF_CONNTRACK_EVENTS
407 static int ctnetlink_conntrack_event(struct notifier_block *this,
408 unsigned long events, void *ptr)
409 {
410 struct nlmsghdr *nlh;
411 struct nfgenmsg *nfmsg;
412 struct nlattr *nest_parms;
413 struct nf_ct_event *item = (struct nf_ct_event *)ptr;
414 struct nf_conn *ct = item->ct;
415 struct sk_buff *skb;
416 unsigned int type;
417 sk_buff_data_t b;
418 unsigned int flags = 0, group;
419
420 /* ignore our fake conntrack entry */
421 if (ct == &nf_conntrack_untracked)
422 return NOTIFY_DONE;
423
424 if (events & IPCT_DESTROY) {
425 type = IPCTNL_MSG_CT_DELETE;
426 group = NFNLGRP_CONNTRACK_DESTROY;
427 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
428 type = IPCTNL_MSG_CT_NEW;
429 flags = NLM_F_CREATE|NLM_F_EXCL;
430 group = NFNLGRP_CONNTRACK_NEW;
431 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
432 type = IPCTNL_MSG_CT_NEW;
433 group = NFNLGRP_CONNTRACK_UPDATE;
434 } else
435 return NOTIFY_DONE;
436
437 if (!nfnetlink_has_listeners(group))
438 return NOTIFY_DONE;
439
440 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
441 if (!skb)
442 return NOTIFY_DONE;
443
444 b = skb->tail;
445
446 type |= NFNL_SUBSYS_CTNETLINK << 8;
447 nlh = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
448 nfmsg = NLMSG_DATA(nlh);
449
450 nlh->nlmsg_flags = flags;
451 nfmsg->nfgen_family = nf_ct_l3num(ct);
452 nfmsg->version = NFNETLINK_V0;
453 nfmsg->res_id = 0;
454
455 rcu_read_lock();
456 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
457 if (!nest_parms)
458 goto nla_put_failure;
459 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
460 goto nla_put_failure;
461 nla_nest_end(skb, nest_parms);
462
463 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
464 if (!nest_parms)
465 goto nla_put_failure;
466 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
467 goto nla_put_failure;
468 nla_nest_end(skb, nest_parms);
469
470 if (ctnetlink_dump_id(skb, ct) < 0)
471 goto nla_put_failure;
472
473 if (ctnetlink_dump_status(skb, ct) < 0)
474 goto nla_put_failure;
475
476 if (events & IPCT_DESTROY) {
477 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
478 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
479 goto nla_put_failure;
480 } else {
481 if (ctnetlink_dump_timeout(skb, ct) < 0)
482 goto nla_put_failure;
483
484 if (events & IPCT_PROTOINFO
485 && ctnetlink_dump_protoinfo(skb, ct) < 0)
486 goto nla_put_failure;
487
488 if ((events & IPCT_HELPER || nfct_help(ct))
489 && ctnetlink_dump_helpinfo(skb, ct) < 0)
490 goto nla_put_failure;
491
492 #ifdef CONFIG_NF_CONNTRACK_SECMARK
493 if ((events & IPCT_SECMARK || ct->secmark)
494 && ctnetlink_dump_secmark(skb, ct) < 0)
495 goto nla_put_failure;
496 #endif
497
498 if (events & IPCT_RELATED &&
499 ctnetlink_dump_master(skb, ct) < 0)
500 goto nla_put_failure;
501
502 if (events & IPCT_NATSEQADJ &&
503 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
504 goto nla_put_failure;
505 }
506
507 #ifdef CONFIG_NF_CONNTRACK_MARK
508 if ((events & IPCT_MARK || ct->mark)
509 && ctnetlink_dump_mark(skb, ct) < 0)
510 goto nla_put_failure;
511 #endif
512 rcu_read_unlock();
513
514 nlh->nlmsg_len = skb->tail - b;
515 nfnetlink_send(skb, item->pid, group, item->report);
516 return NOTIFY_DONE;
517
518 nla_put_failure:
519 rcu_read_unlock();
520 nlmsg_failure:
521 kfree_skb(skb);
522 return NOTIFY_DONE;
523 }
524 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
525
526 static int ctnetlink_done(struct netlink_callback *cb)
527 {
528 if (cb->args[1])
529 nf_ct_put((struct nf_conn *)cb->args[1]);
530 return 0;
531 }
532
533 static int
534 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
535 {
536 struct nf_conn *ct, *last;
537 struct nf_conntrack_tuple_hash *h;
538 struct hlist_node *n;
539 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
540 u_int8_t l3proto = nfmsg->nfgen_family;
541
542 rcu_read_lock();
543 last = (struct nf_conn *)cb->args[1];
544 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
545 restart:
546 hlist_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
547 hnode) {
548 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
549 continue;
550 ct = nf_ct_tuplehash_to_ctrack(h);
551 /* Dump entries of a given L3 protocol number.
552 * If it is not specified, ie. l3proto == 0,
553 * then dump everything. */
554 if (l3proto && nf_ct_l3num(ct) != l3proto)
555 continue;
556 if (cb->args[1]) {
557 if (ct != last)
558 continue;
559 cb->args[1] = 0;
560 }
561 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
562 cb->nlh->nlmsg_seq,
563 IPCTNL_MSG_CT_NEW,
564 1, ct) < 0) {
565 if (!atomic_inc_not_zero(&ct->ct_general.use))
566 continue;
567 cb->args[1] = (unsigned long)ct;
568 goto out;
569 }
570
571 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
572 IPCTNL_MSG_CT_GET_CTRZERO) {
573 struct nf_conn_counter *acct;
574
575 acct = nf_conn_acct_find(ct);
576 if (acct)
577 memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));
578 }
579 }
580 if (cb->args[1]) {
581 cb->args[1] = 0;
582 goto restart;
583 }
584 }
585 out:
586 rcu_read_unlock();
587 if (last)
588 nf_ct_put(last);
589
590 return skb->len;
591 }
592
593 static inline int
594 ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)
595 {
596 struct nlattr *tb[CTA_IP_MAX+1];
597 struct nf_conntrack_l3proto *l3proto;
598 int ret = 0;
599
600 nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
601
602 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
603
604 if (likely(l3proto->nlattr_to_tuple)) {
605 ret = nla_validate_nested(attr, CTA_IP_MAX,
606 l3proto->nla_policy);
607 if (ret == 0)
608 ret = l3proto->nlattr_to_tuple(tb, tuple);
609 }
610
611 nf_ct_l3proto_put(l3proto);
612
613 return ret;
614 }
615
616 static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
617 [CTA_PROTO_NUM] = { .type = NLA_U8 },
618 };
619
620 static inline int
621 ctnetlink_parse_tuple_proto(struct nlattr *attr,
622 struct nf_conntrack_tuple *tuple)
623 {
624 struct nlattr *tb[CTA_PROTO_MAX+1];
625 struct nf_conntrack_l4proto *l4proto;
626 int ret = 0;
627
628 ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);
629 if (ret < 0)
630 return ret;
631
632 if (!tb[CTA_PROTO_NUM])
633 return -EINVAL;
634 tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);
635
636 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
637
638 if (likely(l4proto->nlattr_to_tuple)) {
639 ret = nla_validate_nested(attr, CTA_PROTO_MAX,
640 l4proto->nla_policy);
641 if (ret == 0)
642 ret = l4proto->nlattr_to_tuple(tb, tuple);
643 }
644
645 nf_ct_l4proto_put(l4proto);
646
647 return ret;
648 }
649
650 static int
651 ctnetlink_parse_tuple(struct nlattr *cda[], struct nf_conntrack_tuple *tuple,
652 enum ctattr_tuple type, u_int8_t l3num)
653 {
654 struct nlattr *tb[CTA_TUPLE_MAX+1];
655 int err;
656
657 memset(tuple, 0, sizeof(*tuple));
658
659 nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], NULL);
660
661 if (!tb[CTA_TUPLE_IP])
662 return -EINVAL;
663
664 tuple->src.l3num = l3num;
665
666 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
667 if (err < 0)
668 return err;
669
670 if (!tb[CTA_TUPLE_PROTO])
671 return -EINVAL;
672
673 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);
674 if (err < 0)
675 return err;
676
677 /* orig and expect tuples get DIR_ORIGINAL */
678 if (type == CTA_TUPLE_REPLY)
679 tuple->dst.dir = IP_CT_DIR_REPLY;
680 else
681 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
682
683 return 0;
684 }
685
686 static inline int
687 ctnetlink_parse_help(struct nlattr *attr, char **helper_name)
688 {
689 struct nlattr *tb[CTA_HELP_MAX+1];
690
691 nla_parse_nested(tb, CTA_HELP_MAX, attr, NULL);
692
693 if (!tb[CTA_HELP_NAME])
694 return -EINVAL;
695
696 *helper_name = nla_data(tb[CTA_HELP_NAME]);
697
698 return 0;
699 }
700
701 static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
702 [CTA_STATUS] = { .type = NLA_U32 },
703 [CTA_TIMEOUT] = { .type = NLA_U32 },
704 [CTA_MARK] = { .type = NLA_U32 },
705 [CTA_USE] = { .type = NLA_U32 },
706 [CTA_ID] = { .type = NLA_U32 },
707 };
708
709 static int
710 ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
711 struct nlmsghdr *nlh, struct nlattr *cda[])
712 {
713 struct nf_conntrack_tuple_hash *h;
714 struct nf_conntrack_tuple tuple;
715 struct nf_conn *ct;
716 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
717 u_int8_t u3 = nfmsg->nfgen_family;
718 int err = 0;
719
720 if (cda[CTA_TUPLE_ORIG])
721 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
722 else if (cda[CTA_TUPLE_REPLY])
723 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
724 else {
725 /* Flush the whole table */
726 nf_conntrack_flush(&init_net,
727 NETLINK_CB(skb).pid,
728 nlmsg_report(nlh));
729 return 0;
730 }
731
732 if (err < 0)
733 return err;
734
735 h = nf_conntrack_find_get(&init_net, &tuple);
736 if (!h)
737 return -ENOENT;
738
739 ct = nf_ct_tuplehash_to_ctrack(h);
740
741 if (cda[CTA_ID]) {
742 u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
743 if (id != (u32)(unsigned long)ct) {
744 nf_ct_put(ct);
745 return -ENOENT;
746 }
747 }
748
749 nf_conntrack_event_report(IPCT_DESTROY,
750 ct,
751 NETLINK_CB(skb).pid,
752 nlmsg_report(nlh));
753
754 /* death_by_timeout would report the event again */
755 set_bit(IPS_DYING_BIT, &ct->status);
756
757 nf_ct_kill(ct);
758 nf_ct_put(ct);
759
760 return 0;
761 }
762
763 static int
764 ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
765 struct nlmsghdr *nlh, struct nlattr *cda[])
766 {
767 struct nf_conntrack_tuple_hash *h;
768 struct nf_conntrack_tuple tuple;
769 struct nf_conn *ct;
770 struct sk_buff *skb2 = NULL;
771 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
772 u_int8_t u3 = nfmsg->nfgen_family;
773 int err = 0;
774
775 if (nlh->nlmsg_flags & NLM_F_DUMP)
776 return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
777 ctnetlink_done);
778
779 if (cda[CTA_TUPLE_ORIG])
780 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
781 else if (cda[CTA_TUPLE_REPLY])
782 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
783 else
784 return -EINVAL;
785
786 if (err < 0)
787 return err;
788
789 h = nf_conntrack_find_get(&init_net, &tuple);
790 if (!h)
791 return -ENOENT;
792
793 ct = nf_ct_tuplehash_to_ctrack(h);
794
795 err = -ENOMEM;
796 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
797 if (!skb2) {
798 nf_ct_put(ct);
799 return -ENOMEM;
800 }
801
802 rcu_read_lock();
803 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
804 IPCTNL_MSG_CT_NEW, 1, ct);
805 rcu_read_unlock();
806 nf_ct_put(ct);
807 if (err <= 0)
808 goto free;
809
810 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
811 if (err < 0)
812 goto out;
813
814 return 0;
815
816 free:
817 kfree_skb(skb2);
818 out:
819 return err;
820 }
821
822 #ifdef CONFIG_NF_NAT_NEEDED
823 static int
824 ctnetlink_parse_nat_setup(struct nf_conn *ct,
825 enum nf_nat_manip_type manip,
826 struct nlattr *attr)
827 {
828 typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;
829
830 parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);
831 if (!parse_nat_setup) {
832 #ifdef CONFIG_MODULES
833 rcu_read_unlock();
834 nfnl_unlock();
835 if (request_module("nf-nat-ipv4") < 0) {
836 nfnl_lock();
837 rcu_read_lock();
838 return -EOPNOTSUPP;
839 }
840 nfnl_lock();
841 rcu_read_lock();
842 if (nfnetlink_parse_nat_setup_hook)
843 return -EAGAIN;
844 #endif
845 return -EOPNOTSUPP;
846 }
847
848 return parse_nat_setup(ct, manip, attr);
849 }
850 #endif
851
852 static int
853 ctnetlink_change_status(struct nf_conn *ct, struct nlattr *cda[])
854 {
855 unsigned long d;
856 unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
857 d = ct->status ^ status;
858
859 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
860 /* unchangeable */
861 return -EBUSY;
862
863 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
864 /* SEEN_REPLY bit can only be set */
865 return -EBUSY;
866
867 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
868 /* ASSURED bit can only be set */
869 return -EBUSY;
870
871 /* Be careful here, modifying NAT bits can screw up things,
872 * so don't let users modify them directly if they don't pass
873 * nf_nat_range. */
874 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
875 return 0;
876 }
877
878 static int
879 ctnetlink_change_nat(struct nf_conn *ct, struct nlattr *cda[])
880 {
881 #ifdef CONFIG_NF_NAT_NEEDED
882 int ret;
883
884 if (cda[CTA_NAT_DST]) {
885 ret = ctnetlink_parse_nat_setup(ct,
886 IP_NAT_MANIP_DST,
887 cda[CTA_NAT_DST]);
888 if (ret < 0)
889 return ret;
890 }
891 if (cda[CTA_NAT_SRC]) {
892 ret = ctnetlink_parse_nat_setup(ct,
893 IP_NAT_MANIP_SRC,
894 cda[CTA_NAT_SRC]);
895 if (ret < 0)
896 return ret;
897 }
898 return 0;
899 #else
900 return -EOPNOTSUPP;
901 #endif
902 }
903
904 static inline int
905 ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
906 {
907 struct nf_conntrack_helper *helper;
908 struct nf_conn_help *help = nfct_help(ct);
909 char *helpname;
910 int err;
911
912 /* don't change helper of sibling connections */
913 if (ct->master)
914 return -EBUSY;
915
916 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
917 if (err < 0)
918 return err;
919
920 if (!strcmp(helpname, "")) {
921 if (help && help->helper) {
922 /* we had a helper before ... */
923 nf_ct_remove_expectations(ct);
924 rcu_assign_pointer(help->helper, NULL);
925 }
926
927 return 0;
928 }
929
930 helper = __nf_conntrack_helper_find_byname(helpname);
931 if (helper == NULL) {
932 #ifdef CONFIG_MODULES
933 spin_unlock_bh(&nf_conntrack_lock);
934
935 if (request_module("nfct-helper-%s", helpname) < 0) {
936 spin_lock_bh(&nf_conntrack_lock);
937 return -EOPNOTSUPP;
938 }
939
940 spin_lock_bh(&nf_conntrack_lock);
941 helper = __nf_conntrack_helper_find_byname(helpname);
942 if (helper)
943 return -EAGAIN;
944 #endif
945 return -EOPNOTSUPP;
946 }
947
948 if (help) {
949 if (help->helper == helper)
950 return 0;
951 if (help->helper)
952 return -EBUSY;
953 /* need to zero data of old helper */
954 memset(&help->help, 0, sizeof(help->help));
955 } else {
956 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
957 if (help == NULL)
958 return -ENOMEM;
959 }
960
961 rcu_assign_pointer(help->helper, helper);
962
963 return 0;
964 }
965
966 static inline int
967 ctnetlink_change_timeout(struct nf_conn *ct, struct nlattr *cda[])
968 {
969 u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
970
971 if (!del_timer(&ct->timeout))
972 return -ETIME;
973
974 ct->timeout.expires = jiffies + timeout * HZ;
975 add_timer(&ct->timeout);
976
977 return 0;
978 }
979
980 static inline int
981 ctnetlink_change_protoinfo(struct nf_conn *ct, struct nlattr *cda[])
982 {
983 struct nlattr *tb[CTA_PROTOINFO_MAX+1], *attr = cda[CTA_PROTOINFO];
984 struct nf_conntrack_l4proto *l4proto;
985 int err = 0;
986
987 nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, NULL);
988
989 l4proto = nf_ct_l4proto_find_get(nf_ct_l3num(ct), nf_ct_protonum(ct));
990 if (l4proto->from_nlattr)
991 err = l4proto->from_nlattr(tb, ct);
992 nf_ct_l4proto_put(l4proto);
993
994 return err;
995 }
996
997 #ifdef CONFIG_NF_NAT_NEEDED
998 static inline int
999 change_nat_seq_adj(struct nf_nat_seq *natseq, struct nlattr *attr)
1000 {
1001 struct nlattr *cda[CTA_NAT_SEQ_MAX+1];
1002
1003 nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, NULL);
1004
1005 if (!cda[CTA_NAT_SEQ_CORRECTION_POS])
1006 return -EINVAL;
1007
1008 natseq->correction_pos =
1009 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_CORRECTION_POS]));
1010
1011 if (!cda[CTA_NAT_SEQ_OFFSET_BEFORE])
1012 return -EINVAL;
1013
1014 natseq->offset_before =
1015 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_BEFORE]));
1016
1017 if (!cda[CTA_NAT_SEQ_OFFSET_AFTER])
1018 return -EINVAL;
1019
1020 natseq->offset_after =
1021 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_AFTER]));
1022
1023 return 0;
1024 }
1025
1026 static int
1027 ctnetlink_change_nat_seq_adj(struct nf_conn *ct, struct nlattr *cda[])
1028 {
1029 int ret = 0;
1030 struct nf_conn_nat *nat = nfct_nat(ct);
1031
1032 if (!nat)
1033 return 0;
1034
1035 if (cda[CTA_NAT_SEQ_ADJ_ORIG]) {
1036 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_ORIGINAL],
1037 cda[CTA_NAT_SEQ_ADJ_ORIG]);
1038 if (ret < 0)
1039 return ret;
1040
1041 ct->status |= IPS_SEQ_ADJUST;
1042 }
1043
1044 if (cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1045 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_REPLY],
1046 cda[CTA_NAT_SEQ_ADJ_REPLY]);
1047 if (ret < 0)
1048 return ret;
1049
1050 ct->status |= IPS_SEQ_ADJUST;
1051 }
1052
1053 return 0;
1054 }
1055 #endif
1056
1057 static int
1058 ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
1059 {
1060 int err;
1061
1062 if (cda[CTA_HELP]) {
1063 err = ctnetlink_change_helper(ct, cda);
1064 if (err < 0)
1065 return err;
1066 }
1067
1068 if (cda[CTA_TIMEOUT]) {
1069 err = ctnetlink_change_timeout(ct, cda);
1070 if (err < 0)
1071 return err;
1072 }
1073
1074 if (cda[CTA_STATUS]) {
1075 err = ctnetlink_change_status(ct, cda);
1076 if (err < 0)
1077 return err;
1078 }
1079
1080 if (cda[CTA_PROTOINFO]) {
1081 err = ctnetlink_change_protoinfo(ct, cda);
1082 if (err < 0)
1083 return err;
1084 }
1085
1086 #if defined(CONFIG_NF_CONNTRACK_MARK)
1087 if (cda[CTA_MARK])
1088 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1089 #endif
1090
1091 #ifdef CONFIG_NF_NAT_NEEDED
1092 if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1093 err = ctnetlink_change_nat_seq_adj(ct, cda);
1094 if (err < 0)
1095 return err;
1096 }
1097 #endif
1098
1099 return 0;
1100 }
1101
1102 static inline void
1103 ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
1104 {
1105 unsigned int events = 0;
1106
1107 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1108 events |= IPCT_RELATED;
1109 else
1110 events |= IPCT_NEW;
1111
1112 nf_conntrack_event_report(IPCT_STATUS |
1113 IPCT_HELPER |
1114 IPCT_REFRESH |
1115 IPCT_PROTOINFO |
1116 IPCT_NATSEQADJ |
1117 IPCT_MARK |
1118 events,
1119 ct,
1120 pid,
1121 report);
1122 }
1123
1124 static int
1125 ctnetlink_create_conntrack(struct nlattr *cda[],
1126 struct nf_conntrack_tuple *otuple,
1127 struct nf_conntrack_tuple *rtuple,
1128 struct nf_conn *master_ct,
1129 u32 pid,
1130 int report)
1131 {
1132 struct nf_conn *ct;
1133 int err = -EINVAL;
1134 struct nf_conntrack_helper *helper;
1135
1136 ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
1137 if (ct == NULL || IS_ERR(ct))
1138 return -ENOMEM;
1139
1140 if (!cda[CTA_TIMEOUT])
1141 goto err;
1142 ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
1143
1144 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
1145 ct->status |= IPS_CONFIRMED;
1146
1147 rcu_read_lock();
1148 if (cda[CTA_HELP]) {
1149 char *helpname;
1150
1151 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
1152 if (err < 0) {
1153 rcu_read_unlock();
1154 goto err;
1155 }
1156
1157 helper = __nf_conntrack_helper_find_byname(helpname);
1158 if (helper == NULL) {
1159 rcu_read_unlock();
1160 #ifdef CONFIG_MODULES
1161 if (request_module("nfct-helper-%s", helpname) < 0) {
1162 err = -EOPNOTSUPP;
1163 goto err;
1164 }
1165
1166 rcu_read_lock();
1167 helper = __nf_conntrack_helper_find_byname(helpname);
1168 if (helper) {
1169 rcu_read_unlock();
1170 err = -EAGAIN;
1171 goto err;
1172 }
1173 rcu_read_unlock();
1174 #endif
1175 err = -EOPNOTSUPP;
1176 goto err;
1177 } else {
1178 struct nf_conn_help *help;
1179
1180 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1181 if (help == NULL) {
1182 rcu_read_unlock();
1183 err = -ENOMEM;
1184 goto err;
1185 }
1186
1187 /* not in hash table yet so not strictly necessary */
1188 rcu_assign_pointer(help->helper, helper);
1189 }
1190 } else {
1191 /* try an implicit helper assignation */
1192 err = __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
1193 if (err < 0) {
1194 rcu_read_unlock();
1195 goto err;
1196 }
1197 }
1198
1199 if (cda[CTA_STATUS]) {
1200 err = ctnetlink_change_status(ct, cda);
1201 if (err < 0) {
1202 rcu_read_unlock();
1203 goto err;
1204 }
1205 }
1206
1207 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
1208 err = ctnetlink_change_nat(ct, cda);
1209 if (err < 0) {
1210 rcu_read_unlock();
1211 goto err;
1212 }
1213 }
1214
1215 if (cda[CTA_PROTOINFO]) {
1216 err = ctnetlink_change_protoinfo(ct, cda);
1217 if (err < 0) {
1218 rcu_read_unlock();
1219 goto err;
1220 }
1221 }
1222
1223 nf_ct_acct_ext_add(ct, GFP_ATOMIC);
1224
1225 #if defined(CONFIG_NF_CONNTRACK_MARK)
1226 if (cda[CTA_MARK])
1227 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1228 #endif
1229
1230 /* setup master conntrack: this is a confirmed expectation */
1231 if (master_ct) {
1232 __set_bit(IPS_EXPECTED_BIT, &ct->status);
1233 ct->master = master_ct;
1234 }
1235
1236 nf_conntrack_get(&ct->ct_general);
1237 add_timer(&ct->timeout);
1238 nf_conntrack_hash_insert(ct);
1239 rcu_read_unlock();
1240 ctnetlink_event_report(ct, pid, report);
1241 nf_ct_put(ct);
1242
1243 return 0;
1244
1245 err:
1246 nf_conntrack_free(ct);
1247 return err;
1248 }
1249
1250 static int
1251 ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
1252 struct nlmsghdr *nlh, struct nlattr *cda[])
1253 {
1254 struct nf_conntrack_tuple otuple, rtuple;
1255 struct nf_conntrack_tuple_hash *h = NULL;
1256 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1257 u_int8_t u3 = nfmsg->nfgen_family;
1258 int err = 0;
1259
1260 if (cda[CTA_TUPLE_ORIG]) {
1261 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1262 if (err < 0)
1263 return err;
1264 }
1265
1266 if (cda[CTA_TUPLE_REPLY]) {
1267 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1268 if (err < 0)
1269 return err;
1270 }
1271
1272 spin_lock_bh(&nf_conntrack_lock);
1273 if (cda[CTA_TUPLE_ORIG])
1274 h = __nf_conntrack_find(&init_net, &otuple);
1275 else if (cda[CTA_TUPLE_REPLY])
1276 h = __nf_conntrack_find(&init_net, &rtuple);
1277
1278 if (h == NULL) {
1279 struct nf_conntrack_tuple master;
1280 struct nf_conntrack_tuple_hash *master_h = NULL;
1281 struct nf_conn *master_ct = NULL;
1282
1283 if (cda[CTA_TUPLE_MASTER]) {
1284 err = ctnetlink_parse_tuple(cda,
1285 &master,
1286 CTA_TUPLE_MASTER,
1287 u3);
1288 if (err < 0)
1289 goto out_unlock;
1290
1291 master_h = __nf_conntrack_find(&init_net, &master);
1292 if (master_h == NULL) {
1293 err = -ENOENT;
1294 goto out_unlock;
1295 }
1296 master_ct = nf_ct_tuplehash_to_ctrack(master_h);
1297 nf_conntrack_get(&master_ct->ct_general);
1298 }
1299
1300 err = -ENOENT;
1301 if (nlh->nlmsg_flags & NLM_F_CREATE)
1302 err = ctnetlink_create_conntrack(cda,
1303 &otuple,
1304 &rtuple,
1305 master_ct,
1306 NETLINK_CB(skb).pid,
1307 nlmsg_report(nlh));
1308 spin_unlock_bh(&nf_conntrack_lock);
1309 if (err < 0 && master_ct)
1310 nf_ct_put(master_ct);
1311
1312 return err;
1313 }
1314 /* implicit 'else' */
1315
1316 /* We manipulate the conntrack inside the global conntrack table lock,
1317 * so there's no need to increase the refcount */
1318 err = -EEXIST;
1319 if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
1320 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
1321
1322 /* we only allow nat config for new conntracks */
1323 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
1324 err = -EOPNOTSUPP;
1325 goto out_unlock;
1326 }
1327 /* can't link an existing conntrack to a master */
1328 if (cda[CTA_TUPLE_MASTER]) {
1329 err = -EOPNOTSUPP;
1330 goto out_unlock;
1331 }
1332
1333 err = ctnetlink_change_conntrack(ct, cda);
1334 if (err == 0) {
1335 nf_conntrack_get(&ct->ct_general);
1336 spin_unlock_bh(&nf_conntrack_lock);
1337 ctnetlink_event_report(ct,
1338 NETLINK_CB(skb).pid,
1339 nlmsg_report(nlh));
1340 nf_ct_put(ct);
1341 } else
1342 spin_unlock_bh(&nf_conntrack_lock);
1343
1344 return err;
1345 }
1346
1347 out_unlock:
1348 spin_unlock_bh(&nf_conntrack_lock);
1349 return err;
1350 }
1351
1352 /***********************************************************************
1353 * EXPECT
1354 ***********************************************************************/
1355
1356 static inline int
1357 ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1358 const struct nf_conntrack_tuple *tuple,
1359 enum ctattr_expect type)
1360 {
1361 struct nlattr *nest_parms;
1362
1363 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
1364 if (!nest_parms)
1365 goto nla_put_failure;
1366 if (ctnetlink_dump_tuples(skb, tuple) < 0)
1367 goto nla_put_failure;
1368 nla_nest_end(skb, nest_parms);
1369
1370 return 0;
1371
1372 nla_put_failure:
1373 return -1;
1374 }
1375
1376 static inline int
1377 ctnetlink_exp_dump_mask(struct sk_buff *skb,
1378 const struct nf_conntrack_tuple *tuple,
1379 const struct nf_conntrack_tuple_mask *mask)
1380 {
1381 int ret;
1382 struct nf_conntrack_l3proto *l3proto;
1383 struct nf_conntrack_l4proto *l4proto;
1384 struct nf_conntrack_tuple m;
1385 struct nlattr *nest_parms;
1386
1387 memset(&m, 0xFF, sizeof(m));
1388 m.src.u.all = mask->src.u.all;
1389 memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
1390
1391 nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
1392 if (!nest_parms)
1393 goto nla_put_failure;
1394
1395 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
1396 ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
1397
1398 if (unlikely(ret < 0))
1399 goto nla_put_failure;
1400
1401 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
1402 ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
1403 if (unlikely(ret < 0))
1404 goto nla_put_failure;
1405
1406 nla_nest_end(skb, nest_parms);
1407
1408 return 0;
1409
1410 nla_put_failure:
1411 return -1;
1412 }
1413
1414 static int
1415 ctnetlink_exp_dump_expect(struct sk_buff *skb,
1416 const struct nf_conntrack_expect *exp)
1417 {
1418 struct nf_conn *master = exp->master;
1419 long timeout = (exp->timeout.expires - jiffies) / HZ;
1420
1421 if (timeout < 0)
1422 timeout = 0;
1423
1424 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1425 goto nla_put_failure;
1426 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
1427 goto nla_put_failure;
1428 if (ctnetlink_exp_dump_tuple(skb,
1429 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1430 CTA_EXPECT_MASTER) < 0)
1431 goto nla_put_failure;
1432
1433 NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
1434 NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
1435
1436 return 0;
1437
1438 nla_put_failure:
1439 return -1;
1440 }
1441
1442 static int
1443 ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1444 int event,
1445 int nowait,
1446 const struct nf_conntrack_expect *exp)
1447 {
1448 struct nlmsghdr *nlh;
1449 struct nfgenmsg *nfmsg;
1450 unsigned char *b = skb_tail_pointer(skb);
1451
1452 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1453 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1454 nfmsg = NLMSG_DATA(nlh);
1455
1456 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1457 nfmsg->nfgen_family = exp->tuple.src.l3num;
1458 nfmsg->version = NFNETLINK_V0;
1459 nfmsg->res_id = 0;
1460
1461 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1462 goto nla_put_failure;
1463
1464 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1465 return skb->len;
1466
1467 nlmsg_failure:
1468 nla_put_failure:
1469 nlmsg_trim(skb, b);
1470 return -1;
1471 }
1472
1473 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1474 static int ctnetlink_expect_event(struct notifier_block *this,
1475 unsigned long events, void *ptr)
1476 {
1477 struct nlmsghdr *nlh;
1478 struct nfgenmsg *nfmsg;
1479 struct nf_exp_event *item = (struct nf_exp_event *)ptr;
1480 struct nf_conntrack_expect *exp = item->exp;
1481 struct sk_buff *skb;
1482 unsigned int type;
1483 sk_buff_data_t b;
1484 int flags = 0;
1485
1486 if (events & IPEXP_NEW) {
1487 type = IPCTNL_MSG_EXP_NEW;
1488 flags = NLM_F_CREATE|NLM_F_EXCL;
1489 } else
1490 return NOTIFY_DONE;
1491
1492 if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
1493 return NOTIFY_DONE;
1494
1495 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1496 if (!skb)
1497 return NOTIFY_DONE;
1498
1499 b = skb->tail;
1500
1501 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1502 nlh = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
1503 nfmsg = NLMSG_DATA(nlh);
1504
1505 nlh->nlmsg_flags = flags;
1506 nfmsg->nfgen_family = exp->tuple.src.l3num;
1507 nfmsg->version = NFNETLINK_V0;
1508 nfmsg->res_id = 0;
1509
1510 rcu_read_lock();
1511 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1512 goto nla_put_failure;
1513 rcu_read_unlock();
1514
1515 nlh->nlmsg_len = skb->tail - b;
1516 nfnetlink_send(skb, item->pid, NFNLGRP_CONNTRACK_EXP_NEW, item->report);
1517 return NOTIFY_DONE;
1518
1519 nla_put_failure:
1520 rcu_read_unlock();
1521 nlmsg_failure:
1522 kfree_skb(skb);
1523 return NOTIFY_DONE;
1524 }
1525 #endif
1526 static int ctnetlink_exp_done(struct netlink_callback *cb)
1527 {
1528 if (cb->args[1])
1529 nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
1530 return 0;
1531 }
1532
1533 static int
1534 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1535 {
1536 struct net *net = &init_net;
1537 struct nf_conntrack_expect *exp, *last;
1538 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
1539 struct hlist_node *n;
1540 u_int8_t l3proto = nfmsg->nfgen_family;
1541
1542 rcu_read_lock();
1543 last = (struct nf_conntrack_expect *)cb->args[1];
1544 for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
1545 restart:
1546 hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
1547 hnode) {
1548 if (l3proto && exp->tuple.src.l3num != l3proto)
1549 continue;
1550 if (cb->args[1]) {
1551 if (exp != last)
1552 continue;
1553 cb->args[1] = 0;
1554 }
1555 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1556 cb->nlh->nlmsg_seq,
1557 IPCTNL_MSG_EXP_NEW,
1558 1, exp) < 0) {
1559 if (!atomic_inc_not_zero(&exp->use))
1560 continue;
1561 cb->args[1] = (unsigned long)exp;
1562 goto out;
1563 }
1564 }
1565 if (cb->args[1]) {
1566 cb->args[1] = 0;
1567 goto restart;
1568 }
1569 }
1570 out:
1571 rcu_read_unlock();
1572 if (last)
1573 nf_ct_expect_put(last);
1574
1575 return skb->len;
1576 }
1577
1578 static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
1579 [CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1580 [CTA_EXPECT_ID] = { .type = NLA_U32 },
1581 };
1582
1583 static int
1584 ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
1585 struct nlmsghdr *nlh, struct nlattr *cda[])
1586 {
1587 struct nf_conntrack_tuple tuple;
1588 struct nf_conntrack_expect *exp;
1589 struct sk_buff *skb2;
1590 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1591 u_int8_t u3 = nfmsg->nfgen_family;
1592 int err = 0;
1593
1594 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1595 return netlink_dump_start(ctnl, skb, nlh,
1596 ctnetlink_exp_dump_table,
1597 ctnetlink_exp_done);
1598 }
1599
1600 if (cda[CTA_EXPECT_MASTER])
1601 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1602 else
1603 return -EINVAL;
1604
1605 if (err < 0)
1606 return err;
1607
1608 exp = nf_ct_expect_find_get(&init_net, &tuple);
1609 if (!exp)
1610 return -ENOENT;
1611
1612 if (cda[CTA_EXPECT_ID]) {
1613 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
1614 if (ntohl(id) != (u32)(unsigned long)exp) {
1615 nf_ct_expect_put(exp);
1616 return -ENOENT;
1617 }
1618 }
1619
1620 err = -ENOMEM;
1621 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1622 if (!skb2)
1623 goto out;
1624
1625 rcu_read_lock();
1626 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
1627 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1628 1, exp);
1629 rcu_read_unlock();
1630 if (err <= 0)
1631 goto free;
1632
1633 nf_ct_expect_put(exp);
1634
1635 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1636
1637 free:
1638 kfree_skb(skb2);
1639 out:
1640 nf_ct_expect_put(exp);
1641 return err;
1642 }
1643
1644 static int
1645 ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
1646 struct nlmsghdr *nlh, struct nlattr *cda[])
1647 {
1648 struct nf_conntrack_expect *exp;
1649 struct nf_conntrack_tuple tuple;
1650 struct nf_conntrack_helper *h;
1651 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1652 struct hlist_node *n, *next;
1653 u_int8_t u3 = nfmsg->nfgen_family;
1654 unsigned int i;
1655 int err;
1656
1657 if (cda[CTA_EXPECT_TUPLE]) {
1658 /* delete a single expect by tuple */
1659 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1660 if (err < 0)
1661 return err;
1662
1663 /* bump usage count to 2 */
1664 exp = nf_ct_expect_find_get(&init_net, &tuple);
1665 if (!exp)
1666 return -ENOENT;
1667
1668 if (cda[CTA_EXPECT_ID]) {
1669 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
1670 if (ntohl(id) != (u32)(unsigned long)exp) {
1671 nf_ct_expect_put(exp);
1672 return -ENOENT;
1673 }
1674 }
1675
1676 /* after list removal, usage count == 1 */
1677 nf_ct_unexpect_related(exp);
1678 /* have to put what we 'get' above.
1679 * after this line usage count == 0 */
1680 nf_ct_expect_put(exp);
1681 } else if (cda[CTA_EXPECT_HELP_NAME]) {
1682 char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
1683 struct nf_conn_help *m_help;
1684
1685 /* delete all expectations for this helper */
1686 spin_lock_bh(&nf_conntrack_lock);
1687 h = __nf_conntrack_helper_find_byname(name);
1688 if (!h) {
1689 spin_unlock_bh(&nf_conntrack_lock);
1690 return -EOPNOTSUPP;
1691 }
1692 for (i = 0; i < nf_ct_expect_hsize; i++) {
1693 hlist_for_each_entry_safe(exp, n, next,
1694 &init_net.ct.expect_hash[i],
1695 hnode) {
1696 m_help = nfct_help(exp->master);
1697 if (m_help->helper == h
1698 && del_timer(&exp->timeout)) {
1699 nf_ct_unlink_expect(exp);
1700 nf_ct_expect_put(exp);
1701 }
1702 }
1703 }
1704 spin_unlock_bh(&nf_conntrack_lock);
1705 } else {
1706 /* This basically means we have to flush everything*/
1707 spin_lock_bh(&nf_conntrack_lock);
1708 for (i = 0; i < nf_ct_expect_hsize; i++) {
1709 hlist_for_each_entry_safe(exp, n, next,
1710 &init_net.ct.expect_hash[i],
1711 hnode) {
1712 if (del_timer(&exp->timeout)) {
1713 nf_ct_unlink_expect(exp);
1714 nf_ct_expect_put(exp);
1715 }
1716 }
1717 }
1718 spin_unlock_bh(&nf_conntrack_lock);
1719 }
1720
1721 return 0;
1722 }
1723 static int
1724 ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nlattr *cda[])
1725 {
1726 return -EOPNOTSUPP;
1727 }
1728
1729 static int
1730 ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)
1731 {
1732 struct nf_conntrack_tuple tuple, mask, master_tuple;
1733 struct nf_conntrack_tuple_hash *h = NULL;
1734 struct nf_conntrack_expect *exp;
1735 struct nf_conn *ct;
1736 struct nf_conn_help *help;
1737 int err = 0;
1738
1739 /* caller guarantees that those three CTA_EXPECT_* exist */
1740 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1741 if (err < 0)
1742 return err;
1743 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1744 if (err < 0)
1745 return err;
1746 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1747 if (err < 0)
1748 return err;
1749
1750 /* Look for master conntrack of this expectation */
1751 h = nf_conntrack_find_get(&init_net, &master_tuple);
1752 if (!h)
1753 return -ENOENT;
1754 ct = nf_ct_tuplehash_to_ctrack(h);
1755 help = nfct_help(ct);
1756
1757 if (!help || !help->helper) {
1758 /* such conntrack hasn't got any helper, abort */
1759 err = -EOPNOTSUPP;
1760 goto out;
1761 }
1762
1763 exp = nf_ct_expect_alloc(ct);
1764 if (!exp) {
1765 err = -ENOMEM;
1766 goto out;
1767 }
1768
1769 exp->expectfn = NULL;
1770 exp->flags = 0;
1771 exp->master = ct;
1772 exp->helper = NULL;
1773 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
1774 memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
1775 exp->mask.src.u.all = mask.src.u.all;
1776
1777 err = nf_ct_expect_related_report(exp, pid, report);
1778 nf_ct_expect_put(exp);
1779
1780 out:
1781 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1782 return err;
1783 }
1784
1785 static int
1786 ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
1787 struct nlmsghdr *nlh, struct nlattr *cda[])
1788 {
1789 struct nf_conntrack_tuple tuple;
1790 struct nf_conntrack_expect *exp;
1791 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1792 u_int8_t u3 = nfmsg->nfgen_family;
1793 int err = 0;
1794
1795 if (!cda[CTA_EXPECT_TUPLE]
1796 || !cda[CTA_EXPECT_MASK]
1797 || !cda[CTA_EXPECT_MASTER])
1798 return -EINVAL;
1799
1800 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1801 if (err < 0)
1802 return err;
1803
1804 spin_lock_bh(&nf_conntrack_lock);
1805 exp = __nf_ct_expect_find(&init_net, &tuple);
1806
1807 if (!exp) {
1808 spin_unlock_bh(&nf_conntrack_lock);
1809 err = -ENOENT;
1810 if (nlh->nlmsg_flags & NLM_F_CREATE) {
1811 err = ctnetlink_create_expect(cda,
1812 u3,
1813 NETLINK_CB(skb).pid,
1814 nlmsg_report(nlh));
1815 }
1816 return err;
1817 }
1818
1819 err = -EEXIST;
1820 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1821 err = ctnetlink_change_expect(exp, cda);
1822 spin_unlock_bh(&nf_conntrack_lock);
1823
1824 return err;
1825 }
1826
1827 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1828 static struct notifier_block ctnl_notifier = {
1829 .notifier_call = ctnetlink_conntrack_event,
1830 };
1831
1832 static struct notifier_block ctnl_notifier_exp = {
1833 .notifier_call = ctnetlink_expect_event,
1834 };
1835 #endif
1836
1837 static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1838 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1839 .attr_count = CTA_MAX,
1840 .policy = ct_nla_policy },
1841 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1842 .attr_count = CTA_MAX,
1843 .policy = ct_nla_policy },
1844 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1845 .attr_count = CTA_MAX,
1846 .policy = ct_nla_policy },
1847 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1848 .attr_count = CTA_MAX,
1849 .policy = ct_nla_policy },
1850 };
1851
1852 static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1853 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1854 .attr_count = CTA_EXPECT_MAX,
1855 .policy = exp_nla_policy },
1856 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1857 .attr_count = CTA_EXPECT_MAX,
1858 .policy = exp_nla_policy },
1859 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1860 .attr_count = CTA_EXPECT_MAX,
1861 .policy = exp_nla_policy },
1862 };
1863
1864 static const struct nfnetlink_subsystem ctnl_subsys = {
1865 .name = "conntrack",
1866 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1867 .cb_count = IPCTNL_MSG_MAX,
1868 .cb = ctnl_cb,
1869 };
1870
1871 static const struct nfnetlink_subsystem ctnl_exp_subsys = {
1872 .name = "conntrack_expect",
1873 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1874 .cb_count = IPCTNL_MSG_EXP_MAX,
1875 .cb = ctnl_exp_cb,
1876 };
1877
1878 MODULE_ALIAS("ip_conntrack_netlink");
1879 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
1880 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
1881
1882 static int __init ctnetlink_init(void)
1883 {
1884 int ret;
1885
1886 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1887 ret = nfnetlink_subsys_register(&ctnl_subsys);
1888 if (ret < 0) {
1889 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1890 goto err_out;
1891 }
1892
1893 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1894 if (ret < 0) {
1895 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1896 goto err_unreg_subsys;
1897 }
1898
1899 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1900 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1901 if (ret < 0) {
1902 printk("ctnetlink_init: cannot register notifier.\n");
1903 goto err_unreg_exp_subsys;
1904 }
1905
1906 ret = nf_ct_expect_register_notifier(&ctnl_notifier_exp);
1907 if (ret < 0) {
1908 printk("ctnetlink_init: cannot expect register notifier.\n");
1909 goto err_unreg_notifier;
1910 }
1911 #endif
1912
1913 return 0;
1914
1915 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1916 err_unreg_notifier:
1917 nf_conntrack_unregister_notifier(&ctnl_notifier);
1918 err_unreg_exp_subsys:
1919 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1920 #endif
1921 err_unreg_subsys:
1922 nfnetlink_subsys_unregister(&ctnl_subsys);
1923 err_out:
1924 return ret;
1925 }
1926
1927 static void __exit ctnetlink_exit(void)
1928 {
1929 printk("ctnetlink: unregistering from nfnetlink.\n");
1930
1931 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1932 nf_ct_expect_unregister_notifier(&ctnl_notifier_exp);
1933 nf_conntrack_unregister_notifier(&ctnl_notifier);
1934 #endif
1935
1936 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1937 nfnetlink_subsys_unregister(&ctnl_subsys);
1938 return;
1939 }
1940
1941 module_init(ctnetlink_init);
1942 module_exit(ctnetlink_exit);
Support for the Chinese Samsung S3C2440 based development boards