?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[POWERPC] spufs: make mailbox functions handle multiple elements
[linux-2.6/openmoko-kernel/knife-kernel.git] / net / ipv4 / netfilter / ip_conntrack_netlink.c
blob53b6dffea6c2174fcf49f30e7844010c015a3772
1 /* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
5 * (C) 2002-2005 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
7 * (C) 2005-2006 by Pablo Neira Ayuso <pablo@eurodev.net>
8 *
9 * I've reworked this stuff to use attributes instead of conntrack
10 * structures. 5.44 am. I need more tea. --pablo 05/07/11.
11 *
12 * Initial connection tracking via netlink development funded and
13 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
14 *
15 * Further development of this code funded by Astaro AG (http://www.astaro.com)
16 *
17 * This software may be used and distributed according to the terms
18 * of the GNU General Public License, incorporated herein by reference.
19 */
20
21 #include <linux/init.h>
22 #include <linux/module.h>
23 #include <linux/kernel.h>
24 #include <linux/types.h>
25 #include <linux/timer.h>
26 #include <linux/skbuff.h>
27 #include <linux/errno.h>
28 #include <linux/netlink.h>
29 #include <linux/spinlock.h>
30 #include <linux/interrupt.h>
31 #include <linux/notifier.h>
32
33 #include <linux/netfilter.h>
34 #include <linux/netfilter_ipv4/ip_conntrack.h>
35 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
36 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
37 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
38 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
39
40 #include <linux/netfilter/nfnetlink.h>
41 #include <linux/netfilter/nfnetlink_conntrack.h>
42
43 MODULE_LICENSE("GPL");
44
45 static char __initdata version[] = "0.90";
46
47 #if 0
48 #define DEBUGP printk
49 #else
50 #define DEBUGP(format, args...)
51 #endif
52
53
54 static inline int
55 ctnetlink_dump_tuples_proto(struct sk_buff *skb,
56 const struct ip_conntrack_tuple *tuple,
57 struct ip_conntrack_protocol *proto)
58 {
59 int ret = 0;
60 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
61
62 NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
63
64 if (likely(proto->tuple_to_nfattr))
65 ret = proto->tuple_to_nfattr(skb, tuple);
66
67 NFA_NEST_END(skb, nest_parms);
68
69 return ret;
70
71 nfattr_failure:
72 return -1;
73 }
74
75 static inline int
76 ctnetlink_dump_tuples_ip(struct sk_buff *skb,
77 const struct ip_conntrack_tuple *tuple)
78 {
79 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
80
81 NFA_PUT(skb, CTA_IP_V4_SRC, sizeof(__be32), &tuple->src.ip);
82 NFA_PUT(skb, CTA_IP_V4_DST, sizeof(__be32), &tuple->dst.ip);
83
84 NFA_NEST_END(skb, nest_parms);
85
86 return 0;
87
88 nfattr_failure:
89 return -1;
90 }
91
92 static inline int
93 ctnetlink_dump_tuples(struct sk_buff *skb,
94 const struct ip_conntrack_tuple *tuple)
95 {
96 int ret;
97 struct ip_conntrack_protocol *proto;
98
99 ret = ctnetlink_dump_tuples_ip(skb, tuple);
100 if (unlikely(ret < 0))
101 return ret;
102
103 proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
104 ret = ctnetlink_dump_tuples_proto(skb, tuple, proto);
105 ip_conntrack_proto_put(proto);
106
107 return ret;
108 }
109
110 static inline int
111 ctnetlink_dump_status(struct sk_buff *skb, const struct ip_conntrack *ct)
112 {
113 __be32 status = htonl((u_int32_t) ct->status);
114 NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
115 return 0;
116
117 nfattr_failure:
118 return -1;
119 }
120
121 static inline int
122 ctnetlink_dump_timeout(struct sk_buff *skb, const struct ip_conntrack *ct)
123 {
124 long timeout_l = ct->timeout.expires - jiffies;
125 __be32 timeout;
126
127 if (timeout_l < 0)
128 timeout = 0;
129 else
130 timeout = htonl(timeout_l / HZ);
131
132 NFA_PUT(skb, CTA_TIMEOUT, sizeof(timeout), &timeout);
133 return 0;
134
135 nfattr_failure:
136 return -1;
137 }
138
139 static inline int
140 ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct ip_conntrack *ct)
141 {
142 struct ip_conntrack_protocol *proto = ip_conntrack_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
143
144 struct nfattr *nest_proto;
145 int ret;
146
147 if (!proto->to_nfattr) {
148 ip_conntrack_proto_put(proto);
149 return 0;
150 }
151
152 nest_proto = NFA_NEST(skb, CTA_PROTOINFO);
153
154 ret = proto->to_nfattr(skb, nest_proto, ct);
155
156 ip_conntrack_proto_put(proto);
157
158 NFA_NEST_END(skb, nest_proto);
159
160 return ret;
161
162 nfattr_failure:
163 return -1;
164 }
165
166 static inline int
167 ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct ip_conntrack *ct)
168 {
169 struct nfattr *nest_helper;
170
171 if (!ct->helper)
172 return 0;
173
174 nest_helper = NFA_NEST(skb, CTA_HELP);
175 NFA_PUT(skb, CTA_HELP_NAME, strlen(ct->helper->name), ct->helper->name);
176
177 if (ct->helper->to_nfattr)
178 ct->helper->to_nfattr(skb, ct);
179
180 NFA_NEST_END(skb, nest_helper);
181
182 return 0;
183
184 nfattr_failure:
185 return -1;
186 }
187
188 #ifdef CONFIG_IP_NF_CT_ACCT
189 static inline int
190 ctnetlink_dump_counters(struct sk_buff *skb, const struct ip_conntrack *ct,
191 enum ip_conntrack_dir dir)
192 {
193 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
194 struct nfattr *nest_count = NFA_NEST(skb, type);
195 __be32 tmp;
196
197 tmp = htonl(ct->counters[dir].packets);
198 NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(__be32), &tmp);
199
200 tmp = htonl(ct->counters[dir].bytes);
201 NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(__be32), &tmp);
202
203 NFA_NEST_END(skb, nest_count);
204
205 return 0;
206
207 nfattr_failure:
208 return -1;
209 }
210 #else
211 #define ctnetlink_dump_counters(a, b, c) (0)
212 #endif
213
214 #ifdef CONFIG_IP_NF_CONNTRACK_MARK
215 static inline int
216 ctnetlink_dump_mark(struct sk_buff *skb, const struct ip_conntrack *ct)
217 {
218 __be32 mark = htonl(ct->mark);
219
220 NFA_PUT(skb, CTA_MARK, sizeof(__be32), &mark);
221 return 0;
222
223 nfattr_failure:
224 return -1;
225 }
226 #else
227 #define ctnetlink_dump_mark(a, b) (0)
228 #endif
229
230 static inline int
231 ctnetlink_dump_id(struct sk_buff *skb, const struct ip_conntrack *ct)
232 {
233 __be32 id = htonl(ct->id);
234 NFA_PUT(skb, CTA_ID, sizeof(__be32), &id);
235 return 0;
236
237 nfattr_failure:
238 return -1;
239 }
240
241 static inline int
242 ctnetlink_dump_use(struct sk_buff *skb, const struct ip_conntrack *ct)
243 {
244 __be32 use = htonl(atomic_read(&ct->ct_general.use));
245
246 NFA_PUT(skb, CTA_USE, sizeof(__be32), &use);
247 return 0;
248
249 nfattr_failure:
250 return -1;
251 }
252
253 #define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
254
255 static int
256 ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
257 int event, int nowait,
258 const struct ip_conntrack *ct)
259 {
260 struct nlmsghdr *nlh;
261 struct nfgenmsg *nfmsg;
262 struct nfattr *nest_parms;
263 unsigned char *b;
264
265 b = skb->tail;
266
267 event |= NFNL_SUBSYS_CTNETLINK << 8;
268 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
269 nfmsg = NLMSG_DATA(nlh);
270
271 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
272 nfmsg->nfgen_family = AF_INET;
273 nfmsg->version = NFNETLINK_V0;
274 nfmsg->res_id = 0;
275
276 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
277 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
278 goto nfattr_failure;
279 NFA_NEST_END(skb, nest_parms);
280
281 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
282 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
283 goto nfattr_failure;
284 NFA_NEST_END(skb, nest_parms);
285
286 if (ctnetlink_dump_status(skb, ct) < 0 ||
287 ctnetlink_dump_timeout(skb, ct) < 0 ||
288 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
289 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
290 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
291 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
292 ctnetlink_dump_mark(skb, ct) < 0 ||
293 ctnetlink_dump_id(skb, ct) < 0 ||
294 ctnetlink_dump_use(skb, ct) < 0)
295 goto nfattr_failure;
296
297 nlh->nlmsg_len = skb->tail - b;
298 return skb->len;
299
300 nlmsg_failure:
301 nfattr_failure:
302 skb_trim(skb, b - skb->data);
303 return -1;
304 }
305
306 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
307 static int ctnetlink_conntrack_event(struct notifier_block *this,
308 unsigned long events, void *ptr)
309 {
310 struct nlmsghdr *nlh;
311 struct nfgenmsg *nfmsg;
312 struct nfattr *nest_parms;
313 struct ip_conntrack *ct = (struct ip_conntrack *)ptr;
314 struct sk_buff *skb;
315 unsigned int type;
316 unsigned char *b;
317 unsigned int flags = 0, group;
318
319 /* ignore our fake conntrack entry */
320 if (ct == &ip_conntrack_untracked)
321 return NOTIFY_DONE;
322
323 if (events & IPCT_DESTROY) {
324 type = IPCTNL_MSG_CT_DELETE;
325 group = NFNLGRP_CONNTRACK_DESTROY;
326 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
327 type = IPCTNL_MSG_CT_NEW;
328 flags = NLM_F_CREATE|NLM_F_EXCL;
329 /* dump everything */
330 events = ~0UL;
331 group = NFNLGRP_CONNTRACK_NEW;
332 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
333 type = IPCTNL_MSG_CT_NEW;
334 group = NFNLGRP_CONNTRACK_UPDATE;
335 } else
336 return NOTIFY_DONE;
337
338 if (!nfnetlink_has_listeners(group))
339 return NOTIFY_DONE;
340
341 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
342 if (!skb)
343 return NOTIFY_DONE;
344
345 b = skb->tail;
346
347 type |= NFNL_SUBSYS_CTNETLINK << 8;
348 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
349 nfmsg = NLMSG_DATA(nlh);
350
351 nlh->nlmsg_flags = flags;
352 nfmsg->nfgen_family = AF_INET;
353 nfmsg->version = NFNETLINK_V0;
354 nfmsg->res_id = 0;
355
356 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
357 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
358 goto nfattr_failure;
359 NFA_NEST_END(skb, nest_parms);
360
361 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
362 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
363 goto nfattr_failure;
364 NFA_NEST_END(skb, nest_parms);
365
366 /* NAT stuff is now a status flag */
367 if ((events & IPCT_STATUS || events & IPCT_NATINFO)
368 && ctnetlink_dump_status(skb, ct) < 0)
369 goto nfattr_failure;
370 if (events & IPCT_REFRESH
371 && ctnetlink_dump_timeout(skb, ct) < 0)
372 goto nfattr_failure;
373 if (events & IPCT_PROTOINFO
374 && ctnetlink_dump_protoinfo(skb, ct) < 0)
375 goto nfattr_failure;
376 if (events & IPCT_HELPINFO
377 && ctnetlink_dump_helpinfo(skb, ct) < 0)
378 goto nfattr_failure;
379
380 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
381 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
382 goto nfattr_failure;
383
384 if (events & IPCT_MARK
385 && ctnetlink_dump_mark(skb, ct) < 0)
386 goto nfattr_failure;
387
388 nlh->nlmsg_len = skb->tail - b;
389 nfnetlink_send(skb, 0, group, 0);
390 return NOTIFY_DONE;
391
392 nlmsg_failure:
393 nfattr_failure:
394 kfree_skb(skb);
395 return NOTIFY_DONE;
396 }
397 #endif /* CONFIG_IP_NF_CONNTRACK_EVENTS */
398
399 static int ctnetlink_done(struct netlink_callback *cb)
400 {
401 DEBUGP("entered %s\n", __FUNCTION__);
402 if (cb->args[1])
403 ip_conntrack_put((struct ip_conntrack *)cb->args[1]);
404 return 0;
405 }
406
407 static int
408 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
409 {
410 struct ip_conntrack *ct, *last;
411 struct ip_conntrack_tuple_hash *h;
412 struct list_head *i;
413
414 DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__,
415 cb->args[0], *id);
416
417 read_lock_bh(&ip_conntrack_lock);
418 last = (struct ip_conntrack *)cb->args[1];
419 for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++) {
420 restart:
421 list_for_each_prev(i, &ip_conntrack_hash[cb->args[0]]) {
422 h = (struct ip_conntrack_tuple_hash *) i;
423 if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
424 continue;
425 ct = tuplehash_to_ctrack(h);
426 if (cb->args[1]) {
427 if (ct != last)
428 continue;
429 cb->args[1] = 0;
430 }
431 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
432 cb->nlh->nlmsg_seq,
433 IPCTNL_MSG_CT_NEW,
434 1, ct) < 0) {
435 nf_conntrack_get(&ct->ct_general);
436 cb->args[1] = (unsigned long)ct;
437 goto out;
438 }
439 #ifdef CONFIG_NF_CT_ACCT
440 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
441 IPCTNL_MSG_CT_GET_CTRZERO)
442 memset(&ct->counters, 0, sizeof(ct->counters));
443 #endif
444 }
445 if (cb->args[1]) {
446 cb->args[1] = 0;
447 goto restart;
448 }
449 }
450 out:
451 read_unlock_bh(&ip_conntrack_lock);
452 if (last)
453 ip_conntrack_put(last);
454
455 DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
456 return skb->len;
457 }
458
459 static const size_t cta_min_ip[CTA_IP_MAX] = {
460 [CTA_IP_V4_SRC-1] = sizeof(__be32),
461 [CTA_IP_V4_DST-1] = sizeof(__be32),
462 };
463
464 static inline int
465 ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
466 {
467 struct nfattr *tb[CTA_IP_MAX];
468
469 DEBUGP("entered %s\n", __FUNCTION__);
470
471 nfattr_parse_nested(tb, CTA_IP_MAX, attr);
472
473 if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
474 return -EINVAL;
475
476 if (!tb[CTA_IP_V4_SRC-1])
477 return -EINVAL;
478 tuple->src.ip = *(__be32 *)NFA_DATA(tb[CTA_IP_V4_SRC-1]);
479
480 if (!tb[CTA_IP_V4_DST-1])
481 return -EINVAL;
482 tuple->dst.ip = *(__be32 *)NFA_DATA(tb[CTA_IP_V4_DST-1]);
483
484 DEBUGP("leaving\n");
485
486 return 0;
487 }
488
489 static const size_t cta_min_proto[CTA_PROTO_MAX] = {
490 [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
491 [CTA_PROTO_SRC_PORT-1] = sizeof(u_int16_t),
492 [CTA_PROTO_DST_PORT-1] = sizeof(u_int16_t),
493 [CTA_PROTO_ICMP_TYPE-1] = sizeof(u_int8_t),
494 [CTA_PROTO_ICMP_CODE-1] = sizeof(u_int8_t),
495 [CTA_PROTO_ICMP_ID-1] = sizeof(u_int16_t),
496 };
497
498 static inline int
499 ctnetlink_parse_tuple_proto(struct nfattr *attr,
500 struct ip_conntrack_tuple *tuple)
501 {
502 struct nfattr *tb[CTA_PROTO_MAX];
503 struct ip_conntrack_protocol *proto;
504 int ret = 0;
505
506 DEBUGP("entered %s\n", __FUNCTION__);
507
508 nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
509
510 if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
511 return -EINVAL;
512
513 if (!tb[CTA_PROTO_NUM-1])
514 return -EINVAL;
515 tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
516
517 proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
518
519 if (likely(proto->nfattr_to_tuple))
520 ret = proto->nfattr_to_tuple(tb, tuple);
521
522 ip_conntrack_proto_put(proto);
523
524 return ret;
525 }
526
527 static inline int
528 ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
529 enum ctattr_tuple type)
530 {
531 struct nfattr *tb[CTA_TUPLE_MAX];
532 int err;
533
534 DEBUGP("entered %s\n", __FUNCTION__);
535
536 memset(tuple, 0, sizeof(*tuple));
537
538 nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
539
540 if (!tb[CTA_TUPLE_IP-1])
541 return -EINVAL;
542
543 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP-1], tuple);
544 if (err < 0)
545 return err;
546
547 if (!tb[CTA_TUPLE_PROTO-1])
548 return -EINVAL;
549
550 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO-1], tuple);
551 if (err < 0)
552 return err;
553
554 /* orig and expect tuples get DIR_ORIGINAL */
555 if (type == CTA_TUPLE_REPLY)
556 tuple->dst.dir = IP_CT_DIR_REPLY;
557 else
558 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
559
560 DUMP_TUPLE(tuple);
561
562 DEBUGP("leaving\n");
563
564 return 0;
565 }
566
567 #ifdef CONFIG_IP_NF_NAT_NEEDED
568 static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
569 [CTA_PROTONAT_PORT_MIN-1] = sizeof(u_int16_t),
570 [CTA_PROTONAT_PORT_MAX-1] = sizeof(u_int16_t),
571 };
572
573 static int ctnetlink_parse_nat_proto(struct nfattr *attr,
574 const struct ip_conntrack *ct,
575 struct ip_nat_range *range)
576 {
577 struct nfattr *tb[CTA_PROTONAT_MAX];
578 struct ip_nat_protocol *npt;
579
580 DEBUGP("entered %s\n", __FUNCTION__);
581
582 nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
583
584 if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
585 return -EINVAL;
586
587 npt = ip_nat_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
588
589 if (!npt->nfattr_to_range) {
590 ip_nat_proto_put(npt);
591 return 0;
592 }
593
594 /* nfattr_to_range returns 1 if it parsed, 0 if not, neg. on error */
595 if (npt->nfattr_to_range(tb, range) > 0)
596 range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
597
598 ip_nat_proto_put(npt);
599
600 DEBUGP("leaving\n");
601 return 0;
602 }
603
604 static const size_t cta_min_nat[CTA_NAT_MAX] = {
605 [CTA_NAT_MINIP-1] = sizeof(__be32),
606 [CTA_NAT_MAXIP-1] = sizeof(__be32),
607 };
608
609 static inline int
610 ctnetlink_parse_nat(struct nfattr *nat,
611 const struct ip_conntrack *ct, struct ip_nat_range *range)
612 {
613 struct nfattr *tb[CTA_NAT_MAX];
614 int err;
615
616 DEBUGP("entered %s\n", __FUNCTION__);
617
618 memset(range, 0, sizeof(*range));
619
620 nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
621
622 if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
623 return -EINVAL;
624
625 if (tb[CTA_NAT_MINIP-1])
626 range->min_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
627
628 if (!tb[CTA_NAT_MAXIP-1])
629 range->max_ip = range->min_ip;
630 else
631 range->max_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
632
633 if (range->min_ip)
634 range->flags |= IP_NAT_RANGE_MAP_IPS;
635
636 if (!tb[CTA_NAT_PROTO-1])
637 return 0;
638
639 err = ctnetlink_parse_nat_proto(tb[CTA_NAT_PROTO-1], ct, range);
640 if (err < 0)
641 return err;
642
643 DEBUGP("leaving\n");
644 return 0;
645 }
646 #endif
647
648 static inline int
649 ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
650 {
651 struct nfattr *tb[CTA_HELP_MAX];
652
653 DEBUGP("entered %s\n", __FUNCTION__);
654
655 nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
656
657 if (!tb[CTA_HELP_NAME-1])
658 return -EINVAL;
659
660 *helper_name = NFA_DATA(tb[CTA_HELP_NAME-1]);
661
662 return 0;
663 }
664
665 static const size_t cta_min[CTA_MAX] = {
666 [CTA_STATUS-1] = sizeof(__be32),
667 [CTA_TIMEOUT-1] = sizeof(__be32),
668 [CTA_MARK-1] = sizeof(__be32),
669 [CTA_USE-1] = sizeof(__be32),
670 [CTA_ID-1] = sizeof(__be32)
671 };
672
673 static int
674 ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
675 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
676 {
677 struct ip_conntrack_tuple_hash *h;
678 struct ip_conntrack_tuple tuple;
679 struct ip_conntrack *ct;
680 int err = 0;
681
682 DEBUGP("entered %s\n", __FUNCTION__);
683
684 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
685 return -EINVAL;
686
687 if (cda[CTA_TUPLE_ORIG-1])
688 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
689 else if (cda[CTA_TUPLE_REPLY-1])
690 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY);
691 else {
692 /* Flush the whole table */
693 ip_conntrack_flush();
694 return 0;
695 }
696
697 if (err < 0)
698 return err;
699
700 h = ip_conntrack_find_get(&tuple, NULL);
701 if (!h) {
702 DEBUGP("tuple not found in conntrack hash\n");
703 return -ENOENT;
704 }
705
706 ct = tuplehash_to_ctrack(h);
707
708 if (cda[CTA_ID-1]) {
709 u_int32_t id = ntohl(*(__be32 *)NFA_DATA(cda[CTA_ID-1]));
710 if (ct->id != id) {
711 ip_conntrack_put(ct);
712 return -ENOENT;
713 }
714 }
715 if (del_timer(&ct->timeout))
716 ct->timeout.function((unsigned long)ct);
717
718 ip_conntrack_put(ct);
719 DEBUGP("leaving\n");
720
721 return 0;
722 }
723
724 static int
725 ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
726 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
727 {
728 struct ip_conntrack_tuple_hash *h;
729 struct ip_conntrack_tuple tuple;
730 struct ip_conntrack *ct;
731 struct sk_buff *skb2 = NULL;
732 int err = 0;
733
734 DEBUGP("entered %s\n", __FUNCTION__);
735
736 if (nlh->nlmsg_flags & NLM_F_DUMP) {
737 struct nfgenmsg *msg = NLMSG_DATA(nlh);
738 u32 rlen;
739
740 if (msg->nfgen_family != AF_INET)
741 return -EAFNOSUPPORT;
742
743 #ifndef CONFIG_IP_NF_CT_ACCT
744 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO)
745 return -ENOTSUPP;
746 #endif
747 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
748 ctnetlink_dump_table,
749 ctnetlink_done)) != 0)
750 return -EINVAL;
751
752 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
753 if (rlen > skb->len)
754 rlen = skb->len;
755 skb_pull(skb, rlen);
756 return 0;
757 }
758
759 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
760 return -EINVAL;
761
762 if (cda[CTA_TUPLE_ORIG-1])
763 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG);
764 else if (cda[CTA_TUPLE_REPLY-1])
765 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY);
766 else
767 return -EINVAL;
768
769 if (err < 0)
770 return err;
771
772 h = ip_conntrack_find_get(&tuple, NULL);
773 if (!h) {
774 DEBUGP("tuple not found in conntrack hash");
775 return -ENOENT;
776 }
777 DEBUGP("tuple found\n");
778 ct = tuplehash_to_ctrack(h);
779
780 err = -ENOMEM;
781 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
782 if (!skb2) {
783 ip_conntrack_put(ct);
784 return -ENOMEM;
785 }
786 NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
787
788 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
789 IPCTNL_MSG_CT_NEW, 1, ct);
790 ip_conntrack_put(ct);
791 if (err <= 0)
792 goto free;
793
794 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
795 if (err < 0)
796 goto out;
797
798 DEBUGP("leaving\n");
799 return 0;
800
801 free:
802 kfree_skb(skb2);
803 out:
804 return err;
805 }
806
807 static inline int
808 ctnetlink_change_status(struct ip_conntrack *ct, struct nfattr *cda[])
809 {
810 unsigned long d;
811 unsigned status = ntohl(*(__be32 *)NFA_DATA(cda[CTA_STATUS-1]));
812 d = ct->status ^ status;
813
814 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
815 /* unchangeable */
816 return -EINVAL;
817
818 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
819 /* SEEN_REPLY bit can only be set */
820 return -EINVAL;
821
822
823 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
824 /* ASSURED bit can only be set */
825 return -EINVAL;
826
827 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
828 #ifndef CONFIG_IP_NF_NAT_NEEDED
829 return -EINVAL;
830 #else
831 struct ip_nat_range range;
832
833 if (cda[CTA_NAT_DST-1]) {
834 if (ctnetlink_parse_nat(cda[CTA_NAT_DST-1], ct,
835 &range) < 0)
836 return -EINVAL;
837 if (ip_nat_initialized(ct,
838 HOOK2MANIP(NF_IP_PRE_ROUTING)))
839 return -EEXIST;
840 ip_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING);
841 }
842 if (cda[CTA_NAT_SRC-1]) {
843 if (ctnetlink_parse_nat(cda[CTA_NAT_SRC-1], ct,
844 &range) < 0)
845 return -EINVAL;
846 if (ip_nat_initialized(ct,
847 HOOK2MANIP(NF_IP_POST_ROUTING)))
848 return -EEXIST;
849 ip_nat_setup_info(ct, &range, NF_IP_POST_ROUTING);
850 }
851 #endif
852 }
853
854 /* Be careful here, modifying NAT bits can screw up things,
855 * so don't let users modify them directly if they don't pass
856 * ip_nat_range. */
857 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
858 return 0;
859 }
860
861
862 static inline int
863 ctnetlink_change_helper(struct ip_conntrack *ct, struct nfattr *cda[])
864 {
865 struct ip_conntrack_helper *helper;
866 char *helpname;
867 int err;
868
869 DEBUGP("entered %s\n", __FUNCTION__);
870
871 /* don't change helper of sibling connections */
872 if (ct->master)
873 return -EINVAL;
874
875 err = ctnetlink_parse_help(cda[CTA_HELP-1], &helpname);
876 if (err < 0)
877 return err;
878
879 helper = __ip_conntrack_helper_find_byname(helpname);
880 if (!helper) {
881 if (!strcmp(helpname, ""))
882 helper = NULL;
883 else
884 return -EINVAL;
885 }
886
887 if (ct->helper) {
888 if (!helper) {
889 /* we had a helper before ... */
890 ip_ct_remove_expectations(ct);
891 ct->helper = NULL;
892 } else {
893 /* need to zero data of old helper */
894 memset(&ct->help, 0, sizeof(ct->help));
895 }
896 }
897
898 ct->helper = helper;
899
900 return 0;
901 }
902
903 static inline int
904 ctnetlink_change_timeout(struct ip_conntrack *ct, struct nfattr *cda[])
905 {
906 u_int32_t timeout = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
907
908 if (!del_timer(&ct->timeout))
909 return -ETIME;
910
911 ct->timeout.expires = jiffies + timeout * HZ;
912 add_timer(&ct->timeout);
913
914 return 0;
915 }
916
917 static inline int
918 ctnetlink_change_protoinfo(struct ip_conntrack *ct, struct nfattr *cda[])
919 {
920 struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
921 struct ip_conntrack_protocol *proto;
922 u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
923 int err = 0;
924
925 nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr);
926
927 proto = ip_conntrack_proto_find_get(npt);
928
929 if (proto->from_nfattr)
930 err = proto->from_nfattr(tb, ct);
931 ip_conntrack_proto_put(proto);
932
933 return err;
934 }
935
936 static int
937 ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
938 {
939 int err;
940
941 DEBUGP("entered %s\n", __FUNCTION__);
942
943 if (cda[CTA_HELP-1]) {
944 err = ctnetlink_change_helper(ct, cda);
945 if (err < 0)
946 return err;
947 }
948
949 if (cda[CTA_TIMEOUT-1]) {
950 err = ctnetlink_change_timeout(ct, cda);
951 if (err < 0)
952 return err;
953 }
954
955 if (cda[CTA_STATUS-1]) {
956 err = ctnetlink_change_status(ct, cda);
957 if (err < 0)
958 return err;
959 }
960
961 if (cda[CTA_PROTOINFO-1]) {
962 err = ctnetlink_change_protoinfo(ct, cda);
963 if (err < 0)
964 return err;
965 }
966
967 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
968 if (cda[CTA_MARK-1])
969 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
970 #endif
971
972 DEBUGP("all done\n");
973 return 0;
974 }
975
976 static int
977 ctnetlink_create_conntrack(struct nfattr *cda[],
978 struct ip_conntrack_tuple *otuple,
979 struct ip_conntrack_tuple *rtuple)
980 {
981 struct ip_conntrack *ct;
982 int err = -EINVAL;
983
984 DEBUGP("entered %s\n", __FUNCTION__);
985
986 ct = ip_conntrack_alloc(otuple, rtuple);
987 if (ct == NULL || IS_ERR(ct))
988 return -ENOMEM;
989
990 if (!cda[CTA_TIMEOUT-1])
991 goto err;
992 ct->timeout.expires = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
993
994 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
995 ct->status |= IPS_CONFIRMED;
996
997 err = ctnetlink_change_status(ct, cda);
998 if (err < 0)
999 goto err;
1000
1001 if (cda[CTA_PROTOINFO-1]) {
1002 err = ctnetlink_change_protoinfo(ct, cda);
1003 if (err < 0)
1004 return err;
1005 }
1006
1007 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
1008 if (cda[CTA_MARK-1])
1009 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
1010 #endif
1011
1012 ct->helper = ip_conntrack_helper_find_get(rtuple);
1013
1014 add_timer(&ct->timeout);
1015 ip_conntrack_hash_insert(ct);
1016
1017 if (ct->helper)
1018 ip_conntrack_helper_put(ct->helper);
1019
1020 DEBUGP("conntrack with id %u inserted\n", ct->id);
1021 return 0;
1022
1023 err:
1024 ip_conntrack_free(ct);
1025 return err;
1026 }
1027
1028 static int
1029 ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
1030 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1031 {
1032 struct ip_conntrack_tuple otuple, rtuple;
1033 struct ip_conntrack_tuple_hash *h = NULL;
1034 int err = 0;
1035
1036 DEBUGP("entered %s\n", __FUNCTION__);
1037
1038 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
1039 return -EINVAL;
1040
1041 if (cda[CTA_TUPLE_ORIG-1]) {
1042 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG);
1043 if (err < 0)
1044 return err;
1045 }
1046
1047 if (cda[CTA_TUPLE_REPLY-1]) {
1048 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY);
1049 if (err < 0)
1050 return err;
1051 }
1052
1053 write_lock_bh(&ip_conntrack_lock);
1054 if (cda[CTA_TUPLE_ORIG-1])
1055 h = __ip_conntrack_find(&otuple, NULL);
1056 else if (cda[CTA_TUPLE_REPLY-1])
1057 h = __ip_conntrack_find(&rtuple, NULL);
1058
1059 if (h == NULL) {
1060 write_unlock_bh(&ip_conntrack_lock);
1061 DEBUGP("no such conntrack, create new\n");
1062 err = -ENOENT;
1063 if (nlh->nlmsg_flags & NLM_F_CREATE)
1064 err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
1065 return err;
1066 }
1067 /* implicit 'else' */
1068
1069 /* we only allow nat config for new conntracks */
1070 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
1071 err = -EINVAL;
1072 goto out_unlock;
1073 }
1074
1075 /* We manipulate the conntrack inside the global conntrack table lock,
1076 * so there's no need to increase the refcount */
1077 DEBUGP("conntrack found\n");
1078 err = -EEXIST;
1079 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1080 err = ctnetlink_change_conntrack(tuplehash_to_ctrack(h), cda);
1081
1082 out_unlock:
1083 write_unlock_bh(&ip_conntrack_lock);
1084 return err;
1085 }
1086
1087 /***********************************************************************
1088 * EXPECT
1089 ***********************************************************************/
1090
1091 static inline int
1092 ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1093 const struct ip_conntrack_tuple *tuple,
1094 enum ctattr_expect type)
1095 {
1096 struct nfattr *nest_parms = NFA_NEST(skb, type);
1097
1098 if (ctnetlink_dump_tuples(skb, tuple) < 0)
1099 goto nfattr_failure;
1100
1101 NFA_NEST_END(skb, nest_parms);
1102
1103 return 0;
1104
1105 nfattr_failure:
1106 return -1;
1107 }
1108
1109 static inline int
1110 ctnetlink_exp_dump_mask(struct sk_buff *skb,
1111 const struct ip_conntrack_tuple *tuple,
1112 const struct ip_conntrack_tuple *mask)
1113 {
1114 int ret;
1115 struct ip_conntrack_protocol *proto;
1116 struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
1117
1118 ret = ctnetlink_dump_tuples_ip(skb, mask);
1119 if (unlikely(ret < 0))
1120 goto nfattr_failure;
1121
1122 proto = ip_conntrack_proto_find_get(tuple->dst.protonum);
1123 ret = ctnetlink_dump_tuples_proto(skb, mask, proto);
1124 ip_conntrack_proto_put(proto);
1125 if (unlikely(ret < 0))
1126 goto nfattr_failure;
1127
1128 NFA_NEST_END(skb, nest_parms);
1129
1130 return 0;
1131
1132 nfattr_failure:
1133 return -1;
1134 }
1135
1136 static inline int
1137 ctnetlink_exp_dump_expect(struct sk_buff *skb,
1138 const struct ip_conntrack_expect *exp)
1139 {
1140 struct ip_conntrack *master = exp->master;
1141 __be32 timeout = htonl((exp->timeout.expires - jiffies) / HZ);
1142 __be32 id = htonl(exp->id);
1143
1144 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1145 goto nfattr_failure;
1146 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
1147 goto nfattr_failure;
1148 if (ctnetlink_exp_dump_tuple(skb,
1149 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1150 CTA_EXPECT_MASTER) < 0)
1151 goto nfattr_failure;
1152
1153 NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(__be32), &timeout);
1154 NFA_PUT(skb, CTA_EXPECT_ID, sizeof(__be32), &id);
1155
1156 return 0;
1157
1158 nfattr_failure:
1159 return -1;
1160 }
1161
1162 static int
1163 ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1164 int event,
1165 int nowait,
1166 const struct ip_conntrack_expect *exp)
1167 {
1168 struct nlmsghdr *nlh;
1169 struct nfgenmsg *nfmsg;
1170 unsigned char *b;
1171
1172 b = skb->tail;
1173
1174 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1175 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1176 nfmsg = NLMSG_DATA(nlh);
1177
1178 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1179 nfmsg->nfgen_family = AF_INET;
1180 nfmsg->version = NFNETLINK_V0;
1181 nfmsg->res_id = 0;
1182
1183 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1184 goto nfattr_failure;
1185
1186 nlh->nlmsg_len = skb->tail - b;
1187 return skb->len;
1188
1189 nlmsg_failure:
1190 nfattr_failure:
1191 skb_trim(skb, b - skb->data);
1192 return -1;
1193 }
1194
1195 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
1196 static int ctnetlink_expect_event(struct notifier_block *this,
1197 unsigned long events, void *ptr)
1198 {
1199 struct nlmsghdr *nlh;
1200 struct nfgenmsg *nfmsg;
1201 struct ip_conntrack_expect *exp = (struct ip_conntrack_expect *)ptr;
1202 struct sk_buff *skb;
1203 unsigned int type;
1204 unsigned char *b;
1205 int flags = 0;
1206
1207 if (events & IPEXP_NEW) {
1208 type = IPCTNL_MSG_EXP_NEW;
1209 flags = NLM_F_CREATE|NLM_F_EXCL;
1210 } else
1211 return NOTIFY_DONE;
1212
1213 if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
1214 return NOTIFY_DONE;
1215
1216 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1217 if (!skb)
1218 return NOTIFY_DONE;
1219
1220 b = skb->tail;
1221
1222 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1223 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
1224 nfmsg = NLMSG_DATA(nlh);
1225
1226 nlh->nlmsg_flags = flags;
1227 nfmsg->nfgen_family = AF_INET;
1228 nfmsg->version = NFNETLINK_V0;
1229 nfmsg->res_id = 0;
1230
1231 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1232 goto nfattr_failure;
1233
1234 nlh->nlmsg_len = skb->tail - b;
1235 nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
1236 return NOTIFY_DONE;
1237
1238 nlmsg_failure:
1239 nfattr_failure:
1240 kfree_skb(skb);
1241 return NOTIFY_DONE;
1242 }
1243 #endif
1244
1245 static int
1246 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1247 {
1248 struct ip_conntrack_expect *exp = NULL;
1249 struct list_head *i;
1250 u_int32_t *id = (u_int32_t *) &cb->args[0];
1251
1252 DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
1253
1254 read_lock_bh(&ip_conntrack_lock);
1255 list_for_each_prev(i, &ip_conntrack_expect_list) {
1256 exp = (struct ip_conntrack_expect *) i;
1257 if (exp->id <= *id)
1258 continue;
1259 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1260 cb->nlh->nlmsg_seq,
1261 IPCTNL_MSG_EXP_NEW,
1262 1, exp) < 0)
1263 goto out;
1264 *id = exp->id;
1265 }
1266 out:
1267 read_unlock_bh(&ip_conntrack_lock);
1268
1269 DEBUGP("leaving, last id=%llu\n", *id);
1270
1271 return skb->len;
1272 }
1273
1274 static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
1275 [CTA_EXPECT_TIMEOUT-1] = sizeof(__be32),
1276 [CTA_EXPECT_ID-1] = sizeof(__be32)
1277 };
1278
1279 static int
1280 ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
1281 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1282 {
1283 struct ip_conntrack_tuple tuple;
1284 struct ip_conntrack_expect *exp;
1285 struct sk_buff *skb2;
1286 int err = 0;
1287
1288 DEBUGP("entered %s\n", __FUNCTION__);
1289
1290 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1291 return -EINVAL;
1292
1293 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1294 struct nfgenmsg *msg = NLMSG_DATA(nlh);
1295 u32 rlen;
1296
1297 if (msg->nfgen_family != AF_INET)
1298 return -EAFNOSUPPORT;
1299
1300 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
1301 ctnetlink_exp_dump_table,
1302 ctnetlink_done)) != 0)
1303 return -EINVAL;
1304 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
1305 if (rlen > skb->len)
1306 rlen = skb->len;
1307 skb_pull(skb, rlen);
1308 return 0;
1309 }
1310
1311 if (cda[CTA_EXPECT_MASTER-1])
1312 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER);
1313 else
1314 return -EINVAL;
1315
1316 if (err < 0)
1317 return err;
1318
1319 exp = ip_conntrack_expect_find(&tuple);
1320 if (!exp)
1321 return -ENOENT;
1322
1323 if (cda[CTA_EXPECT_ID-1]) {
1324 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
1325 if (exp->id != ntohl(id)) {
1326 ip_conntrack_expect_put(exp);
1327 return -ENOENT;
1328 }
1329 }
1330
1331 err = -ENOMEM;
1332 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1333 if (!skb2)
1334 goto out;
1335 NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
1336
1337 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
1338 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1339 1, exp);
1340 if (err <= 0)
1341 goto free;
1342
1343 ip_conntrack_expect_put(exp);
1344
1345 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1346
1347 free:
1348 kfree_skb(skb2);
1349 out:
1350 ip_conntrack_expect_put(exp);
1351 return err;
1352 }
1353
1354 static int
1355 ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
1356 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1357 {
1358 struct ip_conntrack_expect *exp, *tmp;
1359 struct ip_conntrack_tuple tuple;
1360 struct ip_conntrack_helper *h;
1361 int err;
1362
1363 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1364 return -EINVAL;
1365
1366 if (cda[CTA_EXPECT_TUPLE-1]) {
1367 /* delete a single expect by tuple */
1368 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
1369 if (err < 0)
1370 return err;
1371
1372 /* bump usage count to 2 */
1373 exp = ip_conntrack_expect_find(&tuple);
1374 if (!exp)
1375 return -ENOENT;
1376
1377 if (cda[CTA_EXPECT_ID-1]) {
1378 __be32 id =
1379 *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
1380 if (exp->id != ntohl(id)) {
1381 ip_conntrack_expect_put(exp);
1382 return -ENOENT;
1383 }
1384 }
1385
1386 /* after list removal, usage count == 1 */
1387 ip_conntrack_unexpect_related(exp);
1388 /* have to put what we 'get' above.
1389 * after this line usage count == 0 */
1390 ip_conntrack_expect_put(exp);
1391 } else if (cda[CTA_EXPECT_HELP_NAME-1]) {
1392 char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
1393
1394 /* delete all expectations for this helper */
1395 write_lock_bh(&ip_conntrack_lock);
1396 h = __ip_conntrack_helper_find_byname(name);
1397 if (!h) {
1398 write_unlock_bh(&ip_conntrack_lock);
1399 return -EINVAL;
1400 }
1401 list_for_each_entry_safe(exp, tmp, &ip_conntrack_expect_list,
1402 list) {
1403 if (exp->master->helper == h
1404 && del_timer(&exp->timeout)) {
1405 ip_ct_unlink_expect(exp);
1406 ip_conntrack_expect_put(exp);
1407 }
1408 }
1409 write_unlock_bh(&ip_conntrack_lock);
1410 } else {
1411 /* This basically means we have to flush everything*/
1412 write_lock_bh(&ip_conntrack_lock);
1413 list_for_each_entry_safe(exp, tmp, &ip_conntrack_expect_list,
1414 list) {
1415 if (del_timer(&exp->timeout)) {
1416 ip_ct_unlink_expect(exp);
1417 ip_conntrack_expect_put(exp);
1418 }
1419 }
1420 write_unlock_bh(&ip_conntrack_lock);
1421 }
1422
1423 return 0;
1424 }
1425 static int
1426 ctnetlink_change_expect(struct ip_conntrack_expect *x, struct nfattr *cda[])
1427 {
1428 return -EOPNOTSUPP;
1429 }
1430
1431 static int
1432 ctnetlink_create_expect(struct nfattr *cda[])
1433 {
1434 struct ip_conntrack_tuple tuple, mask, master_tuple;
1435 struct ip_conntrack_tuple_hash *h = NULL;
1436 struct ip_conntrack_expect *exp;
1437 struct ip_conntrack *ct;
1438 int err = 0;
1439
1440 DEBUGP("entered %s\n", __FUNCTION__);
1441
1442 /* caller guarantees that those three CTA_EXPECT_* exist */
1443 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
1444 if (err < 0)
1445 return err;
1446 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK);
1447 if (err < 0)
1448 return err;
1449 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER);
1450 if (err < 0)
1451 return err;
1452
1453 /* Look for master conntrack of this expectation */
1454 h = ip_conntrack_find_get(&master_tuple, NULL);
1455 if (!h)
1456 return -ENOENT;
1457 ct = tuplehash_to_ctrack(h);
1458
1459 if (!ct->helper) {
1460 /* such conntrack hasn't got any helper, abort */
1461 err = -EINVAL;
1462 goto out;
1463 }
1464
1465 exp = ip_conntrack_expect_alloc(ct);
1466 if (!exp) {
1467 err = -ENOMEM;
1468 goto out;
1469 }
1470
1471 exp->expectfn = NULL;
1472 exp->flags = 0;
1473 exp->master = ct;
1474 memcpy(&exp->tuple, &tuple, sizeof(struct ip_conntrack_tuple));
1475 memcpy(&exp->mask, &mask, sizeof(struct ip_conntrack_tuple));
1476
1477 err = ip_conntrack_expect_related(exp);
1478 ip_conntrack_expect_put(exp);
1479
1480 out:
1481 ip_conntrack_put(tuplehash_to_ctrack(h));
1482 return err;
1483 }
1484
1485 static int
1486 ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
1487 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1488 {
1489 struct ip_conntrack_tuple tuple;
1490 struct ip_conntrack_expect *exp;
1491 int err = 0;
1492
1493 DEBUGP("entered %s\n", __FUNCTION__);
1494
1495 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1496 return -EINVAL;
1497
1498 if (!cda[CTA_EXPECT_TUPLE-1]
1499 || !cda[CTA_EXPECT_MASK-1]
1500 || !cda[CTA_EXPECT_MASTER-1])
1501 return -EINVAL;
1502
1503 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
1504 if (err < 0)
1505 return err;
1506
1507 write_lock_bh(&ip_conntrack_lock);
1508 exp = __ip_conntrack_expect_find(&tuple);
1509
1510 if (!exp) {
1511 write_unlock_bh(&ip_conntrack_lock);
1512 err = -ENOENT;
1513 if (nlh->nlmsg_flags & NLM_F_CREATE)
1514 err = ctnetlink_create_expect(cda);
1515 return err;
1516 }
1517
1518 err = -EEXIST;
1519 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1520 err = ctnetlink_change_expect(exp, cda);
1521 write_unlock_bh(&ip_conntrack_lock);
1522
1523 DEBUGP("leaving\n");
1524
1525 return err;
1526 }
1527
1528 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
1529 static struct notifier_block ctnl_notifier = {
1530 .notifier_call = ctnetlink_conntrack_event,
1531 };
1532
1533 static struct notifier_block ctnl_notifier_exp = {
1534 .notifier_call = ctnetlink_expect_event,
1535 };
1536 #endif
1537
1538 static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1539 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1540 .attr_count = CTA_MAX, },
1541 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1542 .attr_count = CTA_MAX, },
1543 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1544 .attr_count = CTA_MAX, },
1545 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1546 .attr_count = CTA_MAX, },
1547 };
1548
1549 static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1550 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1551 .attr_count = CTA_EXPECT_MAX, },
1552 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1553 .attr_count = CTA_EXPECT_MAX, },
1554 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1555 .attr_count = CTA_EXPECT_MAX, },
1556 };
1557
1558 static struct nfnetlink_subsystem ctnl_subsys = {
1559 .name = "conntrack",
1560 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1561 .cb_count = IPCTNL_MSG_MAX,
1562 .cb = ctnl_cb,
1563 };
1564
1565 static struct nfnetlink_subsystem ctnl_exp_subsys = {
1566 .name = "conntrack_expect",
1567 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1568 .cb_count = IPCTNL_MSG_EXP_MAX,
1569 .cb = ctnl_exp_cb,
1570 };
1571
1572 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
1573 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
1574
1575 static int __init ctnetlink_init(void)
1576 {
1577 int ret;
1578
1579 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1580 ret = nfnetlink_subsys_register(&ctnl_subsys);
1581 if (ret < 0) {
1582 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1583 goto err_out;
1584 }
1585
1586 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1587 if (ret < 0) {
1588 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1589 goto err_unreg_subsys;
1590 }
1591
1592 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
1593 ret = ip_conntrack_register_notifier(&ctnl_notifier);
1594 if (ret < 0) {
1595 printk("ctnetlink_init: cannot register notifier.\n");
1596 goto err_unreg_exp_subsys;
1597 }
1598
1599 ret = ip_conntrack_expect_register_notifier(&ctnl_notifier_exp);
1600 if (ret < 0) {
1601 printk("ctnetlink_init: cannot expect register notifier.\n");
1602 goto err_unreg_notifier;
1603 }
1604 #endif
1605
1606 return 0;
1607
1608 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
1609 err_unreg_notifier:
1610 ip_conntrack_unregister_notifier(&ctnl_notifier);
1611 err_unreg_exp_subsys:
1612 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1613 #endif
1614 err_unreg_subsys:
1615 nfnetlink_subsys_unregister(&ctnl_subsys);
1616 err_out:
1617 return ret;
1618 }
1619
1620 static void __exit ctnetlink_exit(void)
1621 {
1622 printk("ctnetlink: unregistering from nfnetlink.\n");
1623
1624 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
1625 ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
1626 ip_conntrack_unregister_notifier(&ctnl_notifier);
1627 #endif
1628
1629 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1630 nfnetlink_subsys_unregister(&ctnl_subsys);
1631 return;
1632 }
1633
1634 module_init(ctnetlink_init);
1635 module_exit(ctnetlink_exit);
Community contributions to the Openmoko Kernel