projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[NETFILTER]: ctnetlink: change table dumping not to require an unique ID
[deliverable/linux.git] / net / netfilter / nf_conntrack_netlink.c
CommitLineData
c1d10adb
PNA		 1/* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
dc808fe2 5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
c1d10adb 6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
1cde6436 7 * (C) 2005-2006 by Pablo Neira Ayuso <pablo@eurodev.net>
c1d10adb
PNA		 8 *
9 * I've reworked this stuff to use attributes instead of conntrack
10 * structures. 5.44 am. I need more tea. --pablo 05/07/11.
11 *
12 * Initial connection tracking via netlink development funded and
13 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
14 *
15 * Further development of this code funded by Astaro AG (http://www.astaro.com)
16 *
17 * This software may be used and distributed according to the terms
18 * of the GNU General Public License, incorporated herein by reference.
19 *
20 * Derived from ip_conntrack_netlink.c: Port by Pablo Neira Ayuso (05/11/14)
21 */
22
23#include <linux/init.h>
24#include <linux/module.h>
25#include <linux/kernel.h>
26#include <linux/types.h>
27#include <linux/timer.h>
28#include <linux/skbuff.h>
29#include <linux/errno.h>
30#include <linux/netlink.h>
31#include <linux/spinlock.h>
32#include <linux/notifier.h>
33
34#include <linux/netfilter.h>
35#include <net/netfilter/nf_conntrack.h>
36#include <net/netfilter/nf_conntrack_core.h>
37#include <net/netfilter/nf_conntrack_helper.h>
38#include <net/netfilter/nf_conntrack_l3proto.h>
39#include <net/netfilter/nf_conntrack_protocol.h>
40#include <linux/netfilter_ipv4/ip_nat_protocol.h>
41
42#include <linux/netfilter/nfnetlink.h>
43#include <linux/netfilter/nfnetlink_conntrack.h>
44
45MODULE_LICENSE("GPL");
46
dc808fe2 47static char __initdata version[] = "0.93";
c1d10adb
PNA		 48
49#if 0
50#define DEBUGP printk
51#else
52#define DEBUGP(format, args...)
53#endif
54
55
56static inline int
57ctnetlink_dump_tuples_proto(struct sk_buff *skb,
1cde6436
PNA		 58 const struct nf_conntrack_tuple *tuple,
59 struct nf_conntrack_protocol *proto)
c1d10adb 60{
c1d10adb 61 int ret = 0;
1cde6436 62 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
c1d10adb
PNA		 63
64 NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
65
c1d10adb
PNA		 66 if (likely(proto->tuple_to_nfattr))
67 ret = proto->tuple_to_nfattr(skb, tuple);
68
1cde6436 69 NFA_NEST_END(skb, nest_parms);
c1d10adb
PNA		 70
71 return ret;
72
73nfattr_failure:
74 return -1;
75}
76
77static inline int
1cde6436
PNA		 78ctnetlink_dump_tuples_ip(struct sk_buff *skb,
79 const struct nf_conntrack_tuple *tuple,
80 struct nf_conntrack_l3proto *l3proto)
c1d10adb 81{
c1d10adb 82 int ret = 0;
1cde6436
PNA		 83 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
84
c1d10adb
PNA		 85 if (likely(l3proto->tuple_to_nfattr))
86 ret = l3proto->tuple_to_nfattr(skb, tuple);
1cde6436 87
c1d10adb
PNA		 88 NFA_NEST_END(skb, nest_parms);
89
1cde6436
PNA		 90 return ret;
91
92nfattr_failure:
93 return -1;
94}
95
96static inline int
97ctnetlink_dump_tuples(struct sk_buff *skb,
98 const struct nf_conntrack_tuple *tuple)
99{
100 int ret;
101 struct nf_conntrack_l3proto *l3proto;
102 struct nf_conntrack_protocol *proto;
103
104 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
105 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
c1d10adb
PNA		 106 nf_ct_l3proto_put(l3proto);
107
108 if (unlikely(ret < 0))
109 return ret;
110
1cde6436
PNA		 111 proto = nf_ct_proto_find_get(tuple->src.l3num, tuple->dst.protonum);
112 ret = ctnetlink_dump_tuples_proto(skb, tuple, proto);
113 nf_ct_proto_put(proto);
c1d10adb
PNA		 114
115 return ret;
c1d10adb
PNA		 116}
117
118static inline int
119ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
120{
121 u_int32_t status = htonl((u_int32_t) ct->status);
122 NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
123 return 0;
124
125nfattr_failure:
126 return -1;
127}
128
129static inline int
130ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
131{
132 long timeout_l = ct->timeout.expires - jiffies;
133 u_int32_t timeout;
134
135 if (timeout_l < 0)
136 timeout = 0;
137 else
138 timeout = htonl(timeout_l / HZ);
139
140 NFA_PUT(skb, CTA_TIMEOUT, sizeof(timeout), &timeout);
141 return 0;
142
143nfattr_failure:
144 return -1;
145}
146
147static inline int
148ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
149{
150 struct nf_conntrack_protocol *proto = nf_ct_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num, ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
151 struct nfattr *nest_proto;
152 int ret;
153
154 if (!proto->to_nfattr) {
155 nf_ct_proto_put(proto);
156 return 0;
157 }
158
159 nest_proto = NFA_NEST(skb, CTA_PROTOINFO);
160
161 ret = proto->to_nfattr(skb, nest_proto, ct);
162
163 nf_ct_proto_put(proto);
164
165 NFA_NEST_END(skb, nest_proto);
166
167 return ret;
168
169nfattr_failure:
170 return -1;
171}
172
173static inline int
174ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
175{
176 struct nfattr *nest_helper;
dc808fe2 177 const struct nf_conn_help *help = nfct_help(ct);
c1d10adb 178
dc808fe2 179 if (!help || !help->helper)
c1d10adb
PNA		 180 return 0;
181
182 nest_helper = NFA_NEST(skb, CTA_HELP);
dc808fe2 183 NFA_PUT(skb, CTA_HELP_NAME, strlen(help->helper->name), help->helper->name);
c1d10adb 184
dc808fe2
HW		 185 if (help->helper->to_nfattr)
186 help->helper->to_nfattr(skb, ct);
c1d10adb
PNA		 187
188 NFA_NEST_END(skb, nest_helper);
189
190 return 0;
191
192nfattr_failure:
193 return -1;
194}
195
196#ifdef CONFIG_NF_CT_ACCT
197static inline int
198ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
199 enum ip_conntrack_dir dir)
200{
201 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
202 struct nfattr *nest_count = NFA_NEST(skb, type);
203 u_int32_t tmp;
204
205 tmp = htonl(ct->counters[dir].packets);
206 NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(u_int32_t), &tmp);
207
208 tmp = htonl(ct->counters[dir].bytes);
209 NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(u_int32_t), &tmp);
210
211 NFA_NEST_END(skb, nest_count);
212
213 return 0;
214
215nfattr_failure:
216 return -1;
217}
218#else
219#define ctnetlink_dump_counters(a, b, c) (0)
220#endif
221
222#ifdef CONFIG_NF_CONNTRACK_MARK
223static inline int
224ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
225{
226 u_int32_t mark = htonl(ct->mark);
227
228 NFA_PUT(skb, CTA_MARK, sizeof(u_int32_t), &mark);
229 return 0;
230
231nfattr_failure:
232 return -1;
233}
234#else
235#define ctnetlink_dump_mark(a, b) (0)
236#endif
237
238static inline int
239ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
240{
241 u_int32_t id = htonl(ct->id);
242 NFA_PUT(skb, CTA_ID, sizeof(u_int32_t), &id);
243 return 0;
244
245nfattr_failure:
246 return -1;
247}
248
249static inline int
250ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
251{
252 u_int32_t use = htonl(atomic_read(&ct->ct_general.use));
253
254 NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
255 return 0;
256
257nfattr_failure:
258 return -1;
259}
260
261#define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
262
263static int
264ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
265 int event, int nowait,
266 const struct nf_conn *ct)
267{
268 struct nlmsghdr *nlh;
269 struct nfgenmsg *nfmsg;
270 struct nfattr *nest_parms;
271 unsigned char *b;
272
273 b = skb->tail;
274
275 event |= NFNL_SUBSYS_CTNETLINK << 8;
276 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
277 nfmsg = NLMSG_DATA(nlh);
278
279 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
280 nfmsg->nfgen_family =
281 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
282 nfmsg->version = NFNETLINK_V0;
283 nfmsg->res_id = 0;
284
285 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
286 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
287 goto nfattr_failure;
288 NFA_NEST_END(skb, nest_parms);
289
290 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
291 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
292 goto nfattr_failure;
293 NFA_NEST_END(skb, nest_parms);
294
295 if (ctnetlink_dump_status(skb, ct) < 0 ||
296 ctnetlink_dump_timeout(skb, ct) < 0 ||
297 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
298 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
299 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
300 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
301 ctnetlink_dump_mark(skb, ct) < 0 ||
302 ctnetlink_dump_id(skb, ct) < 0 ||
303 ctnetlink_dump_use(skb, ct) < 0)
304 goto nfattr_failure;
305
306 nlh->nlmsg_len = skb->tail - b;
307 return skb->len;
308
309nlmsg_failure:
310nfattr_failure:
311 skb_trim(skb, b - skb->data);
312 return -1;
313}
314
315#ifdef CONFIG_NF_CONNTRACK_EVENTS
316static int ctnetlink_conntrack_event(struct notifier_block *this,
317 unsigned long events, void *ptr)
318{
319 struct nlmsghdr *nlh;
320 struct nfgenmsg *nfmsg;
321 struct nfattr *nest_parms;
322 struct nf_conn *ct = (struct nf_conn *)ptr;
323 struct sk_buff *skb;
324 unsigned int type;
325 unsigned char *b;
326 unsigned int flags = 0, group;
327
328 /* ignore our fake conntrack entry */
329 if (ct == &nf_conntrack_untracked)
330 return NOTIFY_DONE;
331
332 if (events & IPCT_DESTROY) {
333 type = IPCTNL_MSG_CT_DELETE;
334 group = NFNLGRP_CONNTRACK_DESTROY;
335 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
336 type = IPCTNL_MSG_CT_NEW;
337 flags = NLM_F_CREATE|NLM_F_EXCL;
338 /* dump everything */
339 events = ~0UL;
340 group = NFNLGRP_CONNTRACK_NEW;
341 } else if (events & (IPCT_STATUS |
342 IPCT_PROTOINFO |
343 IPCT_HELPER |
344 IPCT_HELPINFO |
345 IPCT_NATINFO)) {
346 type = IPCTNL_MSG_CT_NEW;
347 group = NFNLGRP_CONNTRACK_UPDATE;
348 } else
349 return NOTIFY_DONE;
a2427692
PM		 350
351 if (!nfnetlink_has_listeners(group))
352 return NOTIFY_DONE;
353
c1d10adb
PNA		 354 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
355 if (!skb)
356 return NOTIFY_DONE;
357
358 b = skb->tail;
359
360 type |= NFNL_SUBSYS_CTNETLINK << 8;
361 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
362 nfmsg = NLMSG_DATA(nlh);
363
364 nlh->nlmsg_flags = flags;
365 nfmsg->nfgen_family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
366 nfmsg->version = NFNETLINK_V0;
367 nfmsg->res_id = 0;
368
369 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
370 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
371 goto nfattr_failure;
372 NFA_NEST_END(skb, nest_parms);
373
374 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
375 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
376 goto nfattr_failure;
377 NFA_NEST_END(skb, nest_parms);
378
379 /* NAT stuff is now a status flag */
380 if ((events & IPCT_STATUS || events & IPCT_NATINFO)
381 && ctnetlink_dump_status(skb, ct) < 0)
382 goto nfattr_failure;
383 if (events & IPCT_REFRESH
384 && ctnetlink_dump_timeout(skb, ct) < 0)
385 goto nfattr_failure;
386 if (events & IPCT_PROTOINFO
387 && ctnetlink_dump_protoinfo(skb, ct) < 0)
388 goto nfattr_failure;
389 if (events & IPCT_HELPINFO
390 && ctnetlink_dump_helpinfo(skb, ct) < 0)
391 goto nfattr_failure;
392
393 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
394 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
395 goto nfattr_failure;
396
397 nlh->nlmsg_len = skb->tail - b;
398 nfnetlink_send(skb, 0, group, 0);
399 return NOTIFY_DONE;
400
401nlmsg_failure:
402nfattr_failure:
403 kfree_skb(skb);
404 return NOTIFY_DONE;
405}
406#endif /* CONFIG_NF_CONNTRACK_EVENTS */
407
408static int ctnetlink_done(struct netlink_callback *cb)
409{
89f2e218
PM		 410 if (cb->args[1])
411 nf_ct_put((struct nf_conn *)cb->args[1]);
c1d10adb
PNA		 412 DEBUGP("entered %s\n", __FUNCTION__);
413 return 0;
414}
415
87711cb8
PNA		 416#define L3PROTO(ct) ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num
417
c1d10adb
PNA		 418static int
419ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
420{
89f2e218 421 struct nf_conn *ct, *last;
c1d10adb
PNA		 422 struct nf_conntrack_tuple_hash *h;
423 struct list_head *i;
87711cb8
PNA		 424 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
425 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb
PNA		 426
427 DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__,
428 cb->args[0], *id);
429
430 read_lock_bh(&nf_conntrack_lock);
89f2e218
PM		 431 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
432restart:
433 last = (struct nf_conn *)cb->args[1];
c1d10adb
PNA		 434 list_for_each_prev(i, &nf_conntrack_hash[cb->args[0]]) {
435 h = (struct nf_conntrack_tuple_hash *) i;
436 if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
437 continue;
438 ct = nf_ct_tuplehash_to_ctrack(h);
87711cb8
PNA		 439 /* Dump entries of a given L3 protocol number.
440 * If it is not specified, ie. l3proto == 0,
441 * then dump everything. */
442 if (l3proto && L3PROTO(ct) != l3proto)
443 continue;
89f2e218
PM		 444 if (last != NULL) {
445 if (ct == last) {
446 nf_ct_put(last);
447 cb->args[1] = 0;
448 last = NULL;
449 } else
450 continue;
451 }
c1d10adb
PNA		 452 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
453 cb->nlh->nlmsg_seq,
454 IPCTNL_MSG_CT_NEW,
89f2e218
PM		 455 1, ct) < 0) {
456 nf_conntrack_get(&ct->ct_general);
457 cb->args[1] = (unsigned long)ct;
c1d10adb 458 goto out;
89f2e218
PM		 459 }
460 }
461 if (last != NULL) {
462 nf_ct_put(last);
463 cb->args[1] = 0;
464 goto restart;
c1d10adb
PNA		 465 }
466 }
89f2e218 467out:
c1d10adb
PNA		 468 read_unlock_bh(&nf_conntrack_lock);
469
470 DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
471
472 return skb->len;
473}
474
475#ifdef CONFIG_NF_CT_ACCT
476static int
477ctnetlink_dump_table_w(struct sk_buff *skb, struct netlink_callback *cb)
478{
479 struct nf_conn *ct = NULL;
480 struct nf_conntrack_tuple_hash *h;
481 struct list_head *i;
482 u_int32_t *id = (u_int32_t *) &cb->args[1];
87711cb8
PNA		 483 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
484 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb
PNA		 485
486 DEBUGP("entered %s, last bucket=%u id=%u\n", __FUNCTION__,
487 cb->args[0], *id);
488
489 write_lock_bh(&nf_conntrack_lock);
490 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++, *id = 0) {
491 list_for_each_prev(i, &nf_conntrack_hash[cb->args[0]]) {
492 h = (struct nf_conntrack_tuple_hash *) i;
493 if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
494 continue;
495 ct = nf_ct_tuplehash_to_ctrack(h);
87711cb8
PNA		 496 if (l3proto && L3PROTO(ct) != l3proto)
497 continue;
c1d10adb
PNA		 498 if (ct->id <= *id)
499 continue;
500 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
501 cb->nlh->nlmsg_seq,
502 IPCTNL_MSG_CT_NEW,
503 1, ct) < 0)
504 goto out;
505 *id = ct->id;
506
507 memset(&ct->counters, 0, sizeof(ct->counters));
508 }
509 }
510out:
511 write_unlock_bh(&nf_conntrack_lock);
512
513 DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
514
515 return skb->len;
516}
517#endif
518
519static inline int
520ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
521{
522 struct nfattr *tb[CTA_IP_MAX];
523 struct nf_conntrack_l3proto *l3proto;
524 int ret = 0;
525
526 DEBUGP("entered %s\n", __FUNCTION__);
527
528 nfattr_parse_nested(tb, CTA_IP_MAX, attr);
529
530 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
531
532 if (likely(l3proto->nfattr_to_tuple))
533 ret = l3proto->nfattr_to_tuple(tb, tuple);
534
535 nf_ct_l3proto_put(l3proto);
536
537 DEBUGP("leaving\n");
538
539 return ret;
540}
541
542static const size_t cta_min_proto[CTA_PROTO_MAX] = {
543 [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
544};
545
546static inline int
547ctnetlink_parse_tuple_proto(struct nfattr *attr,
548 struct nf_conntrack_tuple *tuple)
549{
550 struct nfattr *tb[CTA_PROTO_MAX];
551 struct nf_conntrack_protocol *proto;
552 int ret = 0;
553
554 DEBUGP("entered %s\n", __FUNCTION__);
555
556 nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
557
558 if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
559 return -EINVAL;
560
561 if (!tb[CTA_PROTO_NUM-1])
562 return -EINVAL;
563 tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
564
565 proto = nf_ct_proto_find_get(tuple->src.l3num, tuple->dst.protonum);
566
567 if (likely(proto->nfattr_to_tuple))
568 ret = proto->nfattr_to_tuple(tb, tuple);
569
570 nf_ct_proto_put(proto);
571
572 return ret;
573}
574
575static inline int
576ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
577 enum ctattr_tuple type, u_int8_t l3num)
578{
579 struct nfattr *tb[CTA_TUPLE_MAX];
580 int err;
581
582 DEBUGP("entered %s\n", __FUNCTION__);
583
584 memset(tuple, 0, sizeof(*tuple));
585
586 nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
587
588 if (!tb[CTA_TUPLE_IP-1])
589 return -EINVAL;
590
591 tuple->src.l3num = l3num;
592
593 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP-1], tuple);
594 if (err < 0)
595 return err;
596
597 if (!tb[CTA_TUPLE_PROTO-1])
598 return -EINVAL;
599
600 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO-1], tuple);
601 if (err < 0)
602 return err;
603
604 /* orig and expect tuples get DIR_ORIGINAL */
605 if (type == CTA_TUPLE_REPLY)
606 tuple->dst.dir = IP_CT_DIR_REPLY;
607 else
608 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
609
610 NF_CT_DUMP_TUPLE(tuple);
611
612 DEBUGP("leaving\n");
613
614 return 0;
615}
616
617#ifdef CONFIG_IP_NF_NAT_NEEDED
618static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
619 [CTA_PROTONAT_PORT_MIN-1] = sizeof(u_int16_t),
620 [CTA_PROTONAT_PORT_MAX-1] = sizeof(u_int16_t),
621};
622
623static int ctnetlink_parse_nat_proto(struct nfattr *attr,
624 const struct nf_conn *ct,
625 struct ip_nat_range *range)
626{
627 struct nfattr *tb[CTA_PROTONAT_MAX];
628 struct ip_nat_protocol *npt;
629
630 DEBUGP("entered %s\n", __FUNCTION__);
631
632 nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
633
634 if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
635 return -EINVAL;
636
637 npt = ip_nat_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
638
639 if (!npt->nfattr_to_range) {
640 ip_nat_proto_put(npt);
641 return 0;
642 }
643
644 /* nfattr_to_range returns 1 if it parsed, 0 if not, neg. on error */
645 if (npt->nfattr_to_range(tb, range) > 0)
646 range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
647
648 ip_nat_proto_put(npt);
649
650 DEBUGP("leaving\n");
651 return 0;
652}
653
654static const size_t cta_min_nat[CTA_NAT_MAX] = {
655 [CTA_NAT_MINIP-1] = sizeof(u_int32_t),
656 [CTA_NAT_MAXIP-1] = sizeof(u_int32_t),
657};
658
659static inline int
3726add7 660ctnetlink_parse_nat(struct nfattr *nat,
c1d10adb
PNA		 661 const struct nf_conn *ct, struct ip_nat_range *range)
662{
663 struct nfattr *tb[CTA_NAT_MAX];
664 int err;
665
666 DEBUGP("entered %s\n", __FUNCTION__);
667
668 memset(range, 0, sizeof(*range));
669
3726add7 670 nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
c1d10adb
PNA		 671
672 if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
673 return -EINVAL;
674
675 if (tb[CTA_NAT_MINIP-1])
676 range->min_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
677
678 if (!tb[CTA_NAT_MAXIP-1])
679 range->max_ip = range->min_ip;
680 else
681 range->max_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
682
683 if (range->min_ip)
684 range->flags |= IP_NAT_RANGE_MAP_IPS;
685
686 if (!tb[CTA_NAT_PROTO-1])
687 return 0;
688
689 err = ctnetlink_parse_nat_proto(tb[CTA_NAT_PROTO-1], ct, range);
690 if (err < 0)
691 return err;
692
693 DEBUGP("leaving\n");
694 return 0;
695}
696#endif
697
698static inline int
699ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
700{
701 struct nfattr *tb[CTA_HELP_MAX];
702
703 DEBUGP("entered %s\n", __FUNCTION__);
704
705 nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
706
707 if (!tb[CTA_HELP_NAME-1])
708 return -EINVAL;
709
710 *helper_name = NFA_DATA(tb[CTA_HELP_NAME-1]);
711
712 return 0;
713}
714
715static const size_t cta_min[CTA_MAX] = {
716 [CTA_STATUS-1] = sizeof(u_int32_t),
717 [CTA_TIMEOUT-1] = sizeof(u_int32_t),
718 [CTA_MARK-1] = sizeof(u_int32_t),
719 [CTA_USE-1] = sizeof(u_int32_t),
720 [CTA_ID-1] = sizeof(u_int32_t)
721};
722
723static int
724ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
725 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
726{
727 struct nf_conntrack_tuple_hash *h;
728 struct nf_conntrack_tuple tuple;
729 struct nf_conn *ct;
730 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
731 u_int8_t u3 = nfmsg->nfgen_family;
732 int err = 0;
733
734 DEBUGP("entered %s\n", __FUNCTION__);
735
736 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
737 return -EINVAL;
738
739 if (cda[CTA_TUPLE_ORIG-1])
740 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
741 else if (cda[CTA_TUPLE_REPLY-1])
742 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
743 else {
744 /* Flush the whole table */
745 nf_conntrack_flush();
746 return 0;
747 }
748
749 if (err < 0)
750 return err;
751
752 h = nf_conntrack_find_get(&tuple, NULL);
753 if (!h) {
754 DEBUGP("tuple not found in conntrack hash\n");
755 return -ENOENT;
756 }
757
758 ct = nf_ct_tuplehash_to_ctrack(h);
759
760 if (cda[CTA_ID-1]) {
761 u_int32_t id = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_ID-1]));
762 if (ct->id != id) {
763 nf_ct_put(ct);
764 return -ENOENT;
765 }
766 }
767 if (del_timer(&ct->timeout))
768 ct->timeout.function((unsigned long)ct);
769
770 nf_ct_put(ct);
771 DEBUGP("leaving\n");
772
773 return 0;
774}
775
776static int
777ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
778 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
779{
780 struct nf_conntrack_tuple_hash *h;
781 struct nf_conntrack_tuple tuple;
782 struct nf_conn *ct;
783 struct sk_buff *skb2 = NULL;
784 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
785 u_int8_t u3 = nfmsg->nfgen_family;
786 int err = 0;
787
788 DEBUGP("entered %s\n", __FUNCTION__);
789
790 if (nlh->nlmsg_flags & NLM_F_DUMP) {
791 u32 rlen;
792
c1d10adb
PNA		 793 if (NFNL_MSG_TYPE(nlh->nlmsg_type) ==
794 IPCTNL_MSG_CT_GET_CTRZERO) {
795#ifdef CONFIG_NF_CT_ACCT
796 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
797 ctnetlink_dump_table_w,
798 ctnetlink_done)) != 0)
799 return -EINVAL;
800#else
801 return -ENOTSUPP;
802#endif
803 } else {
804 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
805 ctnetlink_dump_table,
806 ctnetlink_done)) != 0)
807 return -EINVAL;
808 }
809
810 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
811 if (rlen > skb->len)
812 rlen = skb->len;
813 skb_pull(skb, rlen);
814 return 0;
815 }
816
817 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
818 return -EINVAL;
819
820 if (cda[CTA_TUPLE_ORIG-1])
821 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
822 else if (cda[CTA_TUPLE_REPLY-1])
823 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
824 else
825 return -EINVAL;
826
827 if (err < 0)
828 return err;
829
830 h = nf_conntrack_find_get(&tuple, NULL);
831 if (!h) {
832 DEBUGP("tuple not found in conntrack hash");
833 return -ENOENT;
834 }
835 DEBUGP("tuple found\n");
836 ct = nf_ct_tuplehash_to_ctrack(h);
837
838 err = -ENOMEM;
839 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
840 if (!skb2) {
841 nf_ct_put(ct);
842 return -ENOMEM;
843 }
844 NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
845
846 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
847 IPCTNL_MSG_CT_NEW, 1, ct);
848 nf_ct_put(ct);
849 if (err <= 0)
850 goto free;
851
852 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
853 if (err < 0)
854 goto out;
855
856 DEBUGP("leaving\n");
857 return 0;
858
859free:
860 kfree_skb(skb2);
861out:
862 return err;
863}
864
865static inline int
866ctnetlink_change_status(struct nf_conn *ct, struct nfattr *cda[])
867{
868 unsigned long d;
869 unsigned status = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_STATUS-1]));
870 d = ct->status ^ status;
871
872 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
873 /* unchangeable */
874 return -EINVAL;
875
876 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
877 /* SEEN_REPLY bit can only be set */
878 return -EINVAL;
879
880
881 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
882 /* ASSURED bit can only be set */
883 return -EINVAL;
884
3726add7 885 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
c1d10adb
PNA		 886#ifndef CONFIG_IP_NF_NAT_NEEDED
887 return -EINVAL;
888#else
c1d10adb
PNA		 889 struct ip_nat_range range;
890
3726add7
PM		 891 if (cda[CTA_NAT_DST-1]) {
892 if (ctnetlink_parse_nat(cda[CTA_NAT_DST-1], ct,
893 &range) < 0)
894 return -EINVAL;
895 if (ip_nat_initialized(ct,
896 HOOK2MANIP(NF_IP_PRE_ROUTING)))
897 return -EEXIST;
898 ip_nat_setup_info(ct, &range, hooknum);
899 }
900 if (cda[CTA_NAT_SRC-1]) {
901 if (ctnetlink_parse_nat(cda[CTA_NAT_SRC-1], ct,
902 &range) < 0)
903 return -EINVAL;
904 if (ip_nat_initialized(ct,
905 HOOK2MANIP(NF_IP_POST_ROUTING)))
906 return -EEXIST;
907 ip_nat_setup_info(ct, &range, hooknum);
908 }
c1d10adb
PNA		 909#endif
910 }
911
912 /* Be careful here, modifying NAT bits can screw up things,
913 * so don't let users modify them directly if they don't pass
914 * ip_nat_range. */
915 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
916 return 0;
917}
918
919
920static inline int
921ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
922{
923 struct nf_conntrack_helper *helper;
dc808fe2 924 struct nf_conn_help *help = nfct_help(ct);
c1d10adb
PNA		 925 char *helpname;
926 int err;
927
928 DEBUGP("entered %s\n", __FUNCTION__);
929
dc808fe2
HW		 930 if (!help) {
931 /* FIXME: we need to reallocate and rehash */
932 return -EBUSY;
933 }
934
c1d10adb
PNA		 935 /* don't change helper of sibling connections */
936 if (ct->master)
937 return -EINVAL;
938
939 err = ctnetlink_parse_help(cda[CTA_HELP-1], &helpname);
940 if (err < 0)
941 return err;
942
943 helper = __nf_conntrack_helper_find_byname(helpname);
944 if (!helper) {
945 if (!strcmp(helpname, ""))
946 helper = NULL;
947 else
948 return -EINVAL;
949 }
950
dc808fe2 951 if (help->helper) {
c1d10adb
PNA		 952 if (!helper) {
953 /* we had a helper before ... */
954 nf_ct_remove_expectations(ct);
dc808fe2 955 help->helper = NULL;
c1d10adb
PNA		 956 } else {
957 /* need to zero data of old helper */
dc808fe2 958 memset(&help->help, 0, sizeof(help->help));
c1d10adb
PNA		 959 }
960 }
961
dc808fe2 962 help->helper = helper;
c1d10adb
PNA		 963
964 return 0;
965}
966
967static inline int
968ctnetlink_change_timeout(struct nf_conn *ct, struct nfattr *cda[])
969{
970 u_int32_t timeout = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_TIMEOUT-1]));
971
972 if (!del_timer(&ct->timeout))
973 return -ETIME;
974
975 ct->timeout.expires = jiffies + timeout * HZ;
976 add_timer(&ct->timeout);
977
978 return 0;
979}
980
981static inline int
982ctnetlink_change_protoinfo(struct nf_conn *ct, struct nfattr *cda[])
983{
984 struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
985 struct nf_conntrack_protocol *proto;
986 u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
987 u_int16_t l3num = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
988 int err = 0;
989
990 nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr);
991
992 proto = nf_ct_proto_find_get(l3num, npt);
993
994 if (proto->from_nfattr)
995 err = proto->from_nfattr(tb, ct);
996 nf_ct_proto_put(proto);
997
998 return err;
999}
1000
1001static int
1002ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
1003{
1004 int err;
1005
1006 DEBUGP("entered %s\n", __FUNCTION__);
1007
1008 if (cda[CTA_HELP-1]) {
1009 err = ctnetlink_change_helper(ct, cda);
1010 if (err < 0)
1011 return err;
1012 }
1013
1014 if (cda[CTA_TIMEOUT-1]) {
1015 err = ctnetlink_change_timeout(ct, cda);
1016 if (err < 0)
1017 return err;
1018 }
1019
1020 if (cda[CTA_STATUS-1]) {
1021 err = ctnetlink_change_status(ct, cda);
1022 if (err < 0)
1023 return err;
1024 }
1025
1026 if (cda[CTA_PROTOINFO-1]) {
1027 err = ctnetlink_change_protoinfo(ct, cda);
1028 if (err < 0)
1029 return err;
1030 }
1031
bcd1e830 1032#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb
PNA		 1033 if (cda[CTA_MARK-1])
1034 ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
1035#endif
1036
1037 DEBUGP("all done\n");
1038 return 0;
1039}
1040
1041static int
1042ctnetlink_create_conntrack(struct nfattr *cda[],
1043 struct nf_conntrack_tuple *otuple,
1044 struct nf_conntrack_tuple *rtuple)
1045{
1046 struct nf_conn *ct;
1047 int err = -EINVAL;
1048
1049 DEBUGP("entered %s\n", __FUNCTION__);
1050
1051 ct = nf_conntrack_alloc(otuple, rtuple);
1052 if (ct == NULL || IS_ERR(ct))
1053 return -ENOMEM;
1054
1055 if (!cda[CTA_TIMEOUT-1])
1056 goto err;
1057 ct->timeout.expires = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_TIMEOUT-1]));
1058
1059 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
1060 ct->status |= IPS_CONFIRMED;
1061
1062 err = ctnetlink_change_status(ct, cda);
1063 if (err < 0)
1064 goto err;
1065
1066 if (cda[CTA_PROTOINFO-1]) {
1067 err = ctnetlink_change_protoinfo(ct, cda);
1068 if (err < 0)
1069 return err;
1070 }
1071
bcd1e830 1072#if defined(CONFIG_NF_CONNTRACK_MARK)
c1d10adb
PNA		 1073 if (cda[CTA_MARK-1])
1074 ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
1075#endif
1076
c1d10adb
PNA		 1077 add_timer(&ct->timeout);
1078 nf_conntrack_hash_insert(ct);
1079
c1d10adb
PNA		 1080 DEBUGP("conntrack with id %u inserted\n", ct->id);
1081 return 0;
1082
1083err:
1084 nf_conntrack_free(ct);
1085 return err;
1086}
1087
1088static int
1089ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
1090 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1091{
1092 struct nf_conntrack_tuple otuple, rtuple;
1093 struct nf_conntrack_tuple_hash *h = NULL;
1094 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1095 u_int8_t u3 = nfmsg->nfgen_family;
1096 int err = 0;
1097
1098 DEBUGP("entered %s\n", __FUNCTION__);
1099
1100 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
1101 return -EINVAL;
1102
1103 if (cda[CTA_TUPLE_ORIG-1]) {
1104 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1105 if (err < 0)
1106 return err;
1107 }
1108
1109 if (cda[CTA_TUPLE_REPLY-1]) {
1110 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1111 if (err < 0)
1112 return err;
1113 }
1114
1115 write_lock_bh(&nf_conntrack_lock);
1116 if (cda[CTA_TUPLE_ORIG-1])
1117 h = __nf_conntrack_find(&otuple, NULL);
1118 else if (cda[CTA_TUPLE_REPLY-1])
1119 h = __nf_conntrack_find(&rtuple, NULL);
1120
1121 if (h == NULL) {
1122 write_unlock_bh(&nf_conntrack_lock);
1123 DEBUGP("no such conntrack, create new\n");
1124 err = -ENOENT;
1125 if (nlh->nlmsg_flags & NLM_F_CREATE)
1126 err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
1127 return err;
1128 }
1129 /* implicit 'else' */
1130
1131 /* we only allow nat config for new conntracks */
3726add7 1132 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
c1d10adb
PNA		 1133 err = -EINVAL;
1134 goto out_unlock;
1135 }
1136
1137 /* We manipulate the conntrack inside the global conntrack table lock,
1138 * so there's no need to increase the refcount */
1139 DEBUGP("conntrack found\n");
1140 err = -EEXIST;
1141 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1142 err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
1143
1144out_unlock:
1145 write_unlock_bh(&nf_conntrack_lock);
1146 return err;
1147}
1148
1149/***********************************************************************
1150 * EXPECT
1151 ***********************************************************************/
1152
1153static inline int
1154ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1155 const struct nf_conntrack_tuple *tuple,
1156 enum ctattr_expect type)
1157{
1158 struct nfattr *nest_parms = NFA_NEST(skb, type);
1159
1160 if (ctnetlink_dump_tuples(skb, tuple) < 0)
1161 goto nfattr_failure;
1162
1163 NFA_NEST_END(skb, nest_parms);
1164
1165 return 0;
1166
1167nfattr_failure:
1168 return -1;
1169}
1170
1cde6436
PNA		 1171static inline int
1172ctnetlink_exp_dump_mask(struct sk_buff *skb,
1173 const struct nf_conntrack_tuple *tuple,
1174 const struct nf_conntrack_tuple *mask)
1175{
1176 int ret;
1177 struct nf_conntrack_l3proto *l3proto;
1178 struct nf_conntrack_protocol *proto;
1179 struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
1180
1181 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
1182 ret = ctnetlink_dump_tuples_ip(skb, mask, l3proto);
1183 nf_ct_l3proto_put(l3proto);
1184
1185 if (unlikely(ret < 0))
1186 goto nfattr_failure;
1187
1188 proto = nf_ct_proto_find_get(tuple->src.l3num, tuple->dst.protonum);
1189 ret = ctnetlink_dump_tuples_proto(skb, mask, proto);
1190 nf_ct_proto_put(proto);
1191 if (unlikely(ret < 0))
1192 goto nfattr_failure;
1193
1194 NFA_NEST_END(skb, nest_parms);
1195
1196 return 0;
1197
1198nfattr_failure:
1199 return -1;
1200}
1201
c1d10adb
PNA		 1202static inline int
1203ctnetlink_exp_dump_expect(struct sk_buff *skb,
1204 const struct nf_conntrack_expect *exp)
1205{
1206 struct nf_conn *master = exp->master;
1207 u_int32_t timeout = htonl((exp->timeout.expires - jiffies) / HZ);
1208 u_int32_t id = htonl(exp->id);
1209
1210 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1211 goto nfattr_failure;
1cde6436 1212 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
c1d10adb
PNA		 1213 goto nfattr_failure;
1214 if (ctnetlink_exp_dump_tuple(skb,
1215 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1216 CTA_EXPECT_MASTER) < 0)
1217 goto nfattr_failure;
1218
1219 NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(timeout), &timeout);
1220 NFA_PUT(skb, CTA_EXPECT_ID, sizeof(u_int32_t), &id);
1221
1222 return 0;
1223
1224nfattr_failure:
1225 return -1;
1226}
1227
1228static int
1229ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1230 int event,
1231 int nowait,
1232 const struct nf_conntrack_expect *exp)
1233{
1234 struct nlmsghdr *nlh;
1235 struct nfgenmsg *nfmsg;
1236 unsigned char *b;
1237
1238 b = skb->tail;
1239
1240 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1241 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1242 nfmsg = NLMSG_DATA(nlh);
1243
1244 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1245 nfmsg->nfgen_family = exp->tuple.src.l3num;
1246 nfmsg->version = NFNETLINK_V0;
1247 nfmsg->res_id = 0;
1248
1249 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1250 goto nfattr_failure;
1251
1252 nlh->nlmsg_len = skb->tail - b;
1253 return skb->len;
1254
1255nlmsg_failure:
1256nfattr_failure:
1257 skb_trim(skb, b - skb->data);
1258 return -1;
1259}
1260
1261#ifdef CONFIG_NF_CONNTRACK_EVENTS
1262static int ctnetlink_expect_event(struct notifier_block *this,
1263 unsigned long events, void *ptr)
1264{
1265 struct nlmsghdr *nlh;
1266 struct nfgenmsg *nfmsg;
1267 struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
1268 struct sk_buff *skb;
1269 unsigned int type;
1270 unsigned char *b;
1271 int flags = 0;
1272
1273 if (events & IPEXP_NEW) {
1274 type = IPCTNL_MSG_EXP_NEW;
1275 flags = NLM_F_CREATE|NLM_F_EXCL;
1276 } else
1277 return NOTIFY_DONE;
1278
1279 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1280 if (!skb)
1281 return NOTIFY_DONE;
1282
1283 b = skb->tail;
1284
b633ad5f 1285 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
c1d10adb
PNA		 1286 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
1287 nfmsg = NLMSG_DATA(nlh);
1288
1289 nlh->nlmsg_flags = flags;
1290 nfmsg->nfgen_family = exp->tuple.src.l3num;
1291 nfmsg->version = NFNETLINK_V0;
1292 nfmsg->res_id = 0;
1293
1294 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1295 goto nfattr_failure;
1296
1297 nlh->nlmsg_len = skb->tail - b;
1298 nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
1299 return NOTIFY_DONE;
1300
1301nlmsg_failure:
1302nfattr_failure:
1303 kfree_skb(skb);
1304 return NOTIFY_DONE;
1305}
1306#endif
1307
1308static int
1309ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1310{
1311 struct nf_conntrack_expect *exp = NULL;
1312 struct list_head *i;
1313 u_int32_t *id = (u_int32_t *) &cb->args[0];
87711cb8
PNA		 1314 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
1315 u_int8_t l3proto = nfmsg->nfgen_family;
c1d10adb
PNA		 1316
1317 DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
1318
1319 read_lock_bh(&nf_conntrack_lock);
1320 list_for_each_prev(i, &nf_conntrack_expect_list) {
1321 exp = (struct nf_conntrack_expect *) i;
87711cb8
PNA		 1322 if (l3proto && exp->tuple.src.l3num != l3proto)
1323 continue;
c1d10adb
PNA		 1324 if (exp->id <= *id)
1325 continue;
1326 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1327 cb->nlh->nlmsg_seq,
1328 IPCTNL_MSG_EXP_NEW,
1329 1, exp) < 0)
1330 goto out;
1331 *id = exp->id;
1332 }
1333out:
1334 read_unlock_bh(&nf_conntrack_lock);
1335
1336 DEBUGP("leaving, last id=%llu\n", *id);
1337
1338 return skb->len;
1339}
1340
1341static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
1342 [CTA_EXPECT_TIMEOUT-1] = sizeof(u_int32_t),
1343 [CTA_EXPECT_ID-1] = sizeof(u_int32_t)
1344};
1345
1346static int
1347ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
1348 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1349{
1350 struct nf_conntrack_tuple tuple;
1351 struct nf_conntrack_expect *exp;
1352 struct sk_buff *skb2;
1353 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1354 u_int8_t u3 = nfmsg->nfgen_family;
1355 int err = 0;
1356
1357 DEBUGP("entered %s\n", __FUNCTION__);
1358
1359 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1360 return -EINVAL;
1361
1362 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1363 u32 rlen;
1364
c1d10adb
PNA		 1365 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
1366 ctnetlink_exp_dump_table,
1367 ctnetlink_done)) != 0)
1368 return -EINVAL;
1369 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
1370 if (rlen > skb->len)
1371 rlen = skb->len;
1372 skb_pull(skb, rlen);
1373 return 0;
1374 }
1375
1376 if (cda[CTA_EXPECT_MASTER-1])
1377 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1378 else
1379 return -EINVAL;
1380
1381 if (err < 0)
1382 return err;
1383
1384 exp = nf_conntrack_expect_find(&tuple);
1385 if (!exp)
1386 return -ENOENT;
1387
1388 if (cda[CTA_EXPECT_ID-1]) {
1389 u_int32_t id = *(u_int32_t *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
1390 if (exp->id != ntohl(id)) {
1391 nf_conntrack_expect_put(exp);
1392 return -ENOENT;
1393 }
1394 }
1395
1396 err = -ENOMEM;
1397 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1398 if (!skb2)
1399 goto out;
1400 NETLINK_CB(skb2).dst_pid = NETLINK_CB(skb).pid;
1401
1402 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
1403 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1404 1, exp);
1405 if (err <= 0)
1406 goto free;
1407
1408 nf_conntrack_expect_put(exp);
1409
1410 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1411
1412free:
1413 kfree_skb(skb2);
1414out:
1415 nf_conntrack_expect_put(exp);
1416 return err;
1417}
1418
1419static int
1420ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
1421 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1422{
1423 struct nf_conntrack_expect *exp, *tmp;
1424 struct nf_conntrack_tuple tuple;
1425 struct nf_conntrack_helper *h;
1426 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1427 u_int8_t u3 = nfmsg->nfgen_family;
1428 int err;
1429
1430 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1431 return -EINVAL;
1432
1433 if (cda[CTA_EXPECT_TUPLE-1]) {
1434 /* delete a single expect by tuple */
1435 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1436 if (err < 0)
1437 return err;
1438
1439 /* bump usage count to 2 */
1440 exp = nf_conntrack_expect_find(&tuple);
1441 if (!exp)
1442 return -ENOENT;
1443
1444 if (cda[CTA_EXPECT_ID-1]) {
1445 u_int32_t id =
1446 *(u_int32_t *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
1447 if (exp->id != ntohl(id)) {
1448 nf_conntrack_expect_put(exp);
1449 return -ENOENT;
1450 }
1451 }
1452
1453 /* after list removal, usage count == 1 */
1454 nf_conntrack_unexpect_related(exp);
1455 /* have to put what we 'get' above.
1456 * after this line usage count == 0 */
1457 nf_conntrack_expect_put(exp);
1458 } else if (cda[CTA_EXPECT_HELP_NAME-1]) {
1459 char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
1460
1461 /* delete all expectations for this helper */
1462 write_lock_bh(&nf_conntrack_lock);
1463 h = __nf_conntrack_helper_find_byname(name);
1464 if (!h) {
1465 write_unlock_bh(&nf_conntrack_lock);
1466 return -EINVAL;
1467 }
1468 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1469 list) {
dc808fe2
HW		 1470 struct nf_conn_help *m_help = nfct_help(exp->master);
1471 if (m_help->helper == h
c1d10adb
PNA		 1472 && del_timer(&exp->timeout)) {
1473 nf_ct_unlink_expect(exp);
1474 nf_conntrack_expect_put(exp);
1475 }
1476 }
1477 write_unlock_bh(&nf_conntrack_lock);
1478 } else {
1479 /* This basically means we have to flush everything*/
1480 write_lock_bh(&nf_conntrack_lock);
1481 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1482 list) {
1483 if (del_timer(&exp->timeout)) {
1484 nf_ct_unlink_expect(exp);
1485 nf_conntrack_expect_put(exp);
1486 }
1487 }
1488 write_unlock_bh(&nf_conntrack_lock);
1489 }
1490
1491 return 0;
1492}
1493static int
1494ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nfattr *cda[])
1495{
1496 return -EOPNOTSUPP;
1497}
1498
1499static int
1500ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
1501{
1502 struct nf_conntrack_tuple tuple, mask, master_tuple;
1503 struct nf_conntrack_tuple_hash *h = NULL;
1504 struct nf_conntrack_expect *exp;
1505 struct nf_conn *ct;
dc808fe2 1506 struct nf_conn_help *help;
c1d10adb
PNA		 1507 int err = 0;
1508
1509 DEBUGP("entered %s\n", __FUNCTION__);
1510
1511 /* caller guarantees that those three CTA_EXPECT_* exist */
1512 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1513 if (err < 0)
1514 return err;
1515 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1516 if (err < 0)
1517 return err;
1518 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1519 if (err < 0)
1520 return err;
1521
1522 /* Look for master conntrack of this expectation */
1523 h = nf_conntrack_find_get(&master_tuple, NULL);
1524 if (!h)
1525 return -ENOENT;
1526 ct = nf_ct_tuplehash_to_ctrack(h);
dc808fe2 1527 help = nfct_help(ct);
c1d10adb 1528
dc808fe2 1529 if (!help || !help->helper) {
c1d10adb
PNA		 1530 /* such conntrack hasn't got any helper, abort */
1531 err = -EINVAL;
1532 goto out;
1533 }
1534
1535 exp = nf_conntrack_expect_alloc(ct);
1536 if (!exp) {
1537 err = -ENOMEM;
1538 goto out;
1539 }
1540
1541 exp->expectfn = NULL;
1542 exp->flags = 0;
1543 exp->master = ct;
1544 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
1545 memcpy(&exp->mask, &mask, sizeof(struct nf_conntrack_tuple));
1546
1547 err = nf_conntrack_expect_related(exp);
1548 nf_conntrack_expect_put(exp);
1549
1550out:
1551 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1552 return err;
1553}
1554
1555static int
1556ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
1557 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1558{
1559 struct nf_conntrack_tuple tuple;
1560 struct nf_conntrack_expect *exp;
1561 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1562 u_int8_t u3 = nfmsg->nfgen_family;
1563 int err = 0;
1564
1565 DEBUGP("entered %s\n", __FUNCTION__);
1566
1567 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1568 return -EINVAL;
1569
1570 if (!cda[CTA_EXPECT_TUPLE-1]
1571 || !cda[CTA_EXPECT_MASK-1]
1572 || !cda[CTA_EXPECT_MASTER-1])
1573 return -EINVAL;
1574
1575 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1576 if (err < 0)
1577 return err;
1578
1579 write_lock_bh(&nf_conntrack_lock);
1580 exp = __nf_conntrack_expect_find(&tuple);
1581
1582 if (!exp) {
1583 write_unlock_bh(&nf_conntrack_lock);
1584 err = -ENOENT;
1585 if (nlh->nlmsg_flags & NLM_F_CREATE)
1586 err = ctnetlink_create_expect(cda, u3);
1587 return err;
1588 }
1589
1590 err = -EEXIST;
1591 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1592 err = ctnetlink_change_expect(exp, cda);
1593 write_unlock_bh(&nf_conntrack_lock);
1594
1595 DEBUGP("leaving\n");
1596
1597 return err;
1598}
1599
1600#ifdef CONFIG_NF_CONNTRACK_EVENTS
1601static struct notifier_block ctnl_notifier = {
1602 .notifier_call = ctnetlink_conntrack_event,
1603};
1604
1605static struct notifier_block ctnl_notifier_exp = {
1606 .notifier_call = ctnetlink_expect_event,
1607};
1608#endif
1609
1610static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1611 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1612 .attr_count = CTA_MAX, },
1613 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1614 .attr_count = CTA_MAX, },
1615 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1616 .attr_count = CTA_MAX, },
1617 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1618 .attr_count = CTA_MAX, },
1619};
1620
1621static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1622 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1623 .attr_count = CTA_EXPECT_MAX, },
1624 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1625 .attr_count = CTA_EXPECT_MAX, },
1626 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1627 .attr_count = CTA_EXPECT_MAX, },
1628};
1629
1630static struct nfnetlink_subsystem ctnl_subsys = {
1631 .name = "conntrack",
1632 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1633 .cb_count = IPCTNL_MSG_MAX,
1634 .cb = ctnl_cb,
1635};
1636
1637static struct nfnetlink_subsystem ctnl_exp_subsys = {
1638 .name = "conntrack_expect",
1639 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1640 .cb_count = IPCTNL_MSG_EXP_MAX,
1641 .cb = ctnl_exp_cb,
1642};
1643
1644MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
34f9a2e4 1645MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
c1d10adb
PNA		 1646
1647static int __init ctnetlink_init(void)
1648{
1649 int ret;
1650
1651 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1652 ret = nfnetlink_subsys_register(&ctnl_subsys);
1653 if (ret < 0) {
1654 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1655 goto err_out;
1656 }
1657
1658 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1659 if (ret < 0) {
1660 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1661 goto err_unreg_subsys;
1662 }
1663
1664#ifdef CONFIG_NF_CONNTRACK_EVENTS
1665 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1666 if (ret < 0) {
1667 printk("ctnetlink_init: cannot register notifier.\n");
1668 goto err_unreg_exp_subsys;
1669 }
1670
1671 ret = nf_conntrack_expect_register_notifier(&ctnl_notifier_exp);
1672 if (ret < 0) {
1673 printk("ctnetlink_init: cannot expect register notifier.\n");
1674 goto err_unreg_notifier;
1675 }
1676#endif
1677
1678 return 0;
1679
1680#ifdef CONFIG_NF_CONNTRACK_EVENTS
1681err_unreg_notifier:
1682 nf_conntrack_unregister_notifier(&ctnl_notifier);
1683err_unreg_exp_subsys:
1684 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1685#endif
1686err_unreg_subsys:
1687 nfnetlink_subsys_unregister(&ctnl_subsys);
1688err_out:
1689 return ret;
1690}
1691
1692static void __exit ctnetlink_exit(void)
1693{
1694 printk("ctnetlink: unregistering from nfnetlink.\n");
1695
1696#ifdef CONFIG_NF_CONNTRACK_EVENTS
e64a70be 1697 nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
c1d10adb
PNA		 1698 nf_conntrack_unregister_notifier(&ctnl_notifier);
1699#endif
1700
1701 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1702 nfnetlink_subsys_unregister(&ctnl_subsys);
1703 return;
1704}
1705
1706module_init(ctnetlink_init);
1707module_exit(ctnetlink_exit);
Linux kernel - Deliverables
This page took 0.257496 seconds and 5 git commands to generate.