blob: 5f5386382f13d59860a1a1c226b0a0ba3dfaa688 [file] [log] [blame]
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001/* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
Harald Weltedc808fe2006-03-20 17:56:32 -08005 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08006 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02007 * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08008 *
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08009 * Initial connection tracking via netlink development funded and
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080010 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 *
12 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 *
14 * This software may be used and distributed according to the terms
15 * of the GNU General Public License, incorporated herein by reference.
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080016 */
17
18#include <linux/init.h>
19#include <linux/module.h>
20#include <linux/kernel.h>
Ingo Molnar711bbdd2008-05-17 08:26:25 +020021#include <linux/rculist.h>
Eric Dumazetea781f12009-03-25 21:05:46 +010022#include <linux/rculist_nulls.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080023#include <linux/types.h>
24#include <linux/timer.h>
Eric Paris1cc63242010-10-13 16:24:54 -040025#include <linux/security.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080026#include <linux/skbuff.h>
27#include <linux/errno.h>
28#include <linux/netlink.h>
29#include <linux/spinlock.h>
Yasuyuki Kozakai40a839f2006-06-27 03:00:35 -070030#include <linux/interrupt.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090031#include <linux/slab.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080032
33#include <linux/netfilter.h>
Arnaldo Carvalho de Melodc5fc572007-03-25 23:06:12 -070034#include <net/netlink.h>
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +010035#include <net/sock.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080036#include <net/netfilter/nf_conntrack.h>
37#include <net/netfilter/nf_conntrack_core.h>
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010038#include <net/netfilter/nf_conntrack_expect.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080039#include <net/netfilter/nf_conntrack_helper.h>
40#include <net/netfilter/nf_conntrack_l3proto.h>
Martin Josefsson605dcad2006-11-29 02:35:06 +010041#include <net/netfilter/nf_conntrack_l4proto.h>
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -080042#include <net/netfilter/nf_conntrack_tuple.h>
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -070043#include <net/netfilter/nf_conntrack_acct.h>
Patrick McHardyef00f892010-02-15 18:14:57 +010044#include <net/netfilter/nf_conntrack_zones.h>
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +010045#include <net/netfilter/nf_conntrack_timestamp.h>
Florian Westphalc539f012013-01-11 06:30:44 +000046#include <net/netfilter/nf_conntrack_labels.h>
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -080047#ifdef CONFIG_NF_NAT_NEEDED
48#include <net/netfilter/nf_nat_core.h>
Patrick McHardyc7232c92012-08-26 19:14:06 +020049#include <net/netfilter/nf_nat_l4proto.h>
Pablo Neira Ayuso8c88f872012-06-07 13:31:25 +020050#include <net/netfilter/nf_nat_helper.h>
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -080051#endif
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080052
53#include <linux/netfilter/nfnetlink.h>
54#include <linux/netfilter/nfnetlink_conntrack.h>
55
56MODULE_LICENSE("GPL");
57
Harald Weltedc808fe2006-03-20 17:56:32 -080058static char __initdata version[] = "0.93";
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080059
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080060static inline int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080061ctnetlink_dump_tuples_proto(struct sk_buff *skb,
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -080062 const struct nf_conntrack_tuple *tuple,
Martin Josefsson605dcad2006-11-29 02:35:06 +010063 struct nf_conntrack_l4proto *l4proto)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080064{
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080065 int ret = 0;
Patrick McHardydf6fb862007-09-28 14:37:03 -070066 struct nlattr *nest_parms;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080067
Patrick McHardydf6fb862007-09-28 14:37:03 -070068 nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
69 if (!nest_parms)
70 goto nla_put_failure;
David S. Millercc1eb432012-04-01 18:57:48 -040071 if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum))
72 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080073
Patrick McHardyfdf70832007-09-28 14:37:41 -070074 if (likely(l4proto->tuple_to_nlattr))
75 ret = l4proto->tuple_to_nlattr(skb, tuple);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080076
Patrick McHardydf6fb862007-09-28 14:37:03 -070077 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080078
79 return ret;
80
Patrick McHardydf6fb862007-09-28 14:37:03 -070081nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080082 return -1;
83}
84
85static inline int
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -080086ctnetlink_dump_tuples_ip(struct sk_buff *skb,
87 const struct nf_conntrack_tuple *tuple,
88 struct nf_conntrack_l3proto *l3proto)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080089{
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080090 int ret = 0;
Patrick McHardydf6fb862007-09-28 14:37:03 -070091 struct nlattr *nest_parms;
92
93 nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);
94 if (!nest_parms)
95 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -080096
Patrick McHardyfdf70832007-09-28 14:37:41 -070097 if (likely(l3proto->tuple_to_nlattr))
98 ret = l3proto->tuple_to_nlattr(skb, tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080099
Patrick McHardydf6fb862007-09-28 14:37:03 -0700100 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800101
102 return ret;
103
Patrick McHardydf6fb862007-09-28 14:37:03 -0700104nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800105 return -1;
106}
107
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800108static int
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800109ctnetlink_dump_tuples(struct sk_buff *skb,
110 const struct nf_conntrack_tuple *tuple)
111{
112 int ret;
113 struct nf_conntrack_l3proto *l3proto;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100114 struct nf_conntrack_l4proto *l4proto;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800115
Hans Schillstrom3b988ec2012-03-05 02:24:29 +0000116 rcu_read_lock();
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100117 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800118 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800119
Hans Schillstrom3b988ec2012-03-05 02:24:29 +0000120 if (ret >= 0) {
121 l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
122 tuple->dst.protonum);
123 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
124 }
125 rcu_read_unlock();
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800126 return ret;
127}
128
129static inline int
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800130ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
131{
David S. Millercc1eb432012-04-01 18:57:48 -0400132 if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status)))
133 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800134 return 0;
135
Patrick McHardydf6fb862007-09-28 14:37:03 -0700136nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800137 return -1;
138}
139
140static inline int
141ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
142{
Xi Wangc1216382011-12-30 10:40:17 -0500143 long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800144
Patrick McHardy77236b62007-12-17 22:29:45 -0800145 if (timeout < 0)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800146 timeout = 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800147
David S. Millercc1eb432012-04-01 18:57:48 -0400148 if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout)))
149 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800150 return 0;
151
Patrick McHardydf6fb862007-09-28 14:37:03 -0700152nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800153 return -1;
154}
155
156static inline int
Patrick McHardy440f0d52009-06-10 14:32:47 +0200157ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800158{
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200159 struct nf_conntrack_l4proto *l4proto;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700160 struct nlattr *nest_proto;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800161 int ret;
162
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100163 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
164 if (!l4proto->to_nlattr)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800165 return 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800166
Patrick McHardydf6fb862007-09-28 14:37:03 -0700167 nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
168 if (!nest_proto)
169 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800170
Patrick McHardyfdf70832007-09-28 14:37:41 -0700171 ret = l4proto->to_nlattr(skb, nest_proto, ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800172
Patrick McHardydf6fb862007-09-28 14:37:03 -0700173 nla_nest_end(skb, nest_proto);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800174
175 return ret;
176
Patrick McHardydf6fb862007-09-28 14:37:03 -0700177nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800178 return -1;
179}
180
181static inline int
182ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
183{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700184 struct nlattr *nest_helper;
Harald Weltedc808fe2006-03-20 17:56:32 -0800185 const struct nf_conn_help *help = nfct_help(ct);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700186 struct nf_conntrack_helper *helper;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800187
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700188 if (!help)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800189 return 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800190
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700191 helper = rcu_dereference(help->helper);
192 if (!helper)
193 goto out;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800194
Patrick McHardydf6fb862007-09-28 14:37:03 -0700195 nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
196 if (!nest_helper)
197 goto nla_put_failure;
David S. Millercc1eb432012-04-01 18:57:48 -0400198 if (nla_put_string(skb, CTA_HELP_NAME, helper->name))
199 goto nla_put_failure;
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700200
Patrick McHardyfdf70832007-09-28 14:37:41 -0700201 if (helper->to_nlattr)
202 helper->to_nlattr(skb, ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800203
Patrick McHardydf6fb862007-09-28 14:37:03 -0700204 nla_nest_end(skb, nest_helper);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700205out:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800206 return 0;
207
Patrick McHardydf6fb862007-09-28 14:37:03 -0700208nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800209 return -1;
210}
211
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800212static int
Pablo Neira Ayuso80e60e62011-12-24 14:11:39 +0100213dump_counters(struct sk_buff *skb, u64 pkts, u64 bytes,
214 enum ip_conntrack_dir dir)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800215{
216 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700217 struct nlattr *nest_count;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800218
Patrick McHardydf6fb862007-09-28 14:37:03 -0700219 nest_count = nla_nest_start(skb, type | NLA_F_NESTED);
220 if (!nest_count)
221 goto nla_put_failure;
222
David S. Millercc1eb432012-04-01 18:57:48 -0400223 if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts)) ||
224 nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes)))
225 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800226
Patrick McHardydf6fb862007-09-28 14:37:03 -0700227 nla_nest_end(skb, nest_count);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800228
229 return 0;
230
Patrick McHardydf6fb862007-09-28 14:37:03 -0700231nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800232 return -1;
233}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800234
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100235static int
Pablo Neira Ayuso80e60e62011-12-24 14:11:39 +0100236ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
237 enum ip_conntrack_dir dir, int type)
238{
239 struct nf_conn_counter *acct;
240 u64 pkts, bytes;
241
242 acct = nf_conn_acct_find(ct);
243 if (!acct)
244 return 0;
245
246 if (type == IPCTNL_MSG_CT_GET_CTRZERO) {
247 pkts = atomic64_xchg(&acct[dir].packets, 0);
248 bytes = atomic64_xchg(&acct[dir].bytes, 0);
249 } else {
250 pkts = atomic64_read(&acct[dir].packets);
251 bytes = atomic64_read(&acct[dir].bytes);
252 }
253 return dump_counters(skb, pkts, bytes, dir);
254}
255
256static int
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100257ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)
258{
259 struct nlattr *nest_count;
260 const struct nf_conn_tstamp *tstamp;
261
262 tstamp = nf_conn_tstamp_find(ct);
263 if (!tstamp)
264 return 0;
265
266 nest_count = nla_nest_start(skb, CTA_TIMESTAMP | NLA_F_NESTED);
267 if (!nest_count)
268 goto nla_put_failure;
269
David S. Millercc1eb432012-04-01 18:57:48 -0400270 if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start)) ||
271 (tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP,
272 cpu_to_be64(tstamp->stop))))
273 goto nla_put_failure;
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100274 nla_nest_end(skb, nest_count);
275
276 return 0;
277
278nla_put_failure:
279 return -1;
280}
281
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800282#ifdef CONFIG_NF_CONNTRACK_MARK
283static inline int
284ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
285{
David S. Millercc1eb432012-04-01 18:57:48 -0400286 if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark)))
287 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800288 return 0;
289
Patrick McHardydf6fb862007-09-28 14:37:03 -0700290nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800291 return -1;
292}
293#else
294#define ctnetlink_dump_mark(a, b) (0)
295#endif
296
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800297#ifdef CONFIG_NF_CONNTRACK_SECMARK
298static inline int
Eric Paris1cc63242010-10-13 16:24:54 -0400299ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800300{
Eric Paris1cc63242010-10-13 16:24:54 -0400301 struct nlattr *nest_secctx;
302 int len, ret;
303 char *secctx;
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800304
Eric Paris1cc63242010-10-13 16:24:54 -0400305 ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
306 if (ret)
Pablo Neira Ayusocba85b52011-01-06 11:25:00 -0800307 return 0;
Eric Paris1cc63242010-10-13 16:24:54 -0400308
309 ret = -1;
310 nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
311 if (!nest_secctx)
312 goto nla_put_failure;
313
David S. Millercc1eb432012-04-01 18:57:48 -0400314 if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))
315 goto nla_put_failure;
Eric Paris1cc63242010-10-13 16:24:54 -0400316 nla_nest_end(skb, nest_secctx);
317
318 ret = 0;
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800319nla_put_failure:
Eric Paris1cc63242010-10-13 16:24:54 -0400320 security_release_secctx(secctx, len);
321 return ret;
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800322}
323#else
Eric Paris1cc63242010-10-13 16:24:54 -0400324#define ctnetlink_dump_secctx(a, b) (0)
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800325#endif
326
Florian Westphal0ceabd82013-01-11 06:30:45 +0000327#ifdef CONFIG_NF_CONNTRACK_LABELS
328static int ctnetlink_label_size(const struct nf_conn *ct)
329{
330 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
331
332 if (!labels)
333 return 0;
334 return nla_total_size(labels->words * sizeof(long));
335}
336
337static int
338ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
339{
340 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
341 unsigned int len, i;
342
343 if (!labels)
344 return 0;
345
346 len = labels->words * sizeof(long);
347 i = 0;
348 do {
349 if (labels->bits[i] != 0)
350 return nla_put(skb, CTA_LABELS, len, labels->bits);
351 i++;
352 } while (i < labels->words);
353
354 return 0;
355}
356#else
357#define ctnetlink_dump_labels(a, b) (0)
358#define ctnetlink_label_size(a) (0)
359#endif
360
Pablo Neira Ayuso0f417ce2007-12-17 22:28:19 -0800361#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
362
363static inline int
364ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)
365{
366 struct nlattr *nest_parms;
367
368 if (!(ct->status & IPS_EXPECTED))
369 return 0;
370
371 nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);
372 if (!nest_parms)
373 goto nla_put_failure;
374 if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
375 goto nla_put_failure;
376 nla_nest_end(skb, nest_parms);
377
378 return 0;
379
380nla_put_failure:
381 return -1;
382}
383
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800384#ifdef CONFIG_NF_NAT_NEEDED
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800385static int
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800386dump_nat_seq_adj(struct sk_buff *skb, const struct nf_nat_seq *natseq, int type)
387{
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800388 struct nlattr *nest_parms;
389
390 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
391 if (!nest_parms)
392 goto nla_put_failure;
393
David S. Millercc1eb432012-04-01 18:57:48 -0400394 if (nla_put_be32(skb, CTA_NAT_SEQ_CORRECTION_POS,
395 htonl(natseq->correction_pos)) ||
396 nla_put_be32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
397 htonl(natseq->offset_before)) ||
398 nla_put_be32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
399 htonl(natseq->offset_after)))
400 goto nla_put_failure;
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800401
402 nla_nest_end(skb, nest_parms);
403
404 return 0;
405
406nla_put_failure:
407 return -1;
408}
409
410static inline int
411ctnetlink_dump_nat_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
412{
413 struct nf_nat_seq *natseq;
414 struct nf_conn_nat *nat = nfct_nat(ct);
415
416 if (!(ct->status & IPS_SEQ_ADJUST) || !nat)
417 return 0;
418
419 natseq = &nat->seq[IP_CT_DIR_ORIGINAL];
420 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_ORIG) == -1)
421 return -1;
422
423 natseq = &nat->seq[IP_CT_DIR_REPLY];
424 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_REPLY) == -1)
425 return -1;
426
427 return 0;
428}
429#else
430#define ctnetlink_dump_nat_seq_adj(a, b) (0)
431#endif
432
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800433static inline int
434ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
435{
David S. Millercc1eb432012-04-01 18:57:48 -0400436 if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))
437 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800438 return 0;
439
Patrick McHardydf6fb862007-09-28 14:37:03 -0700440nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800441 return -1;
442}
443
444static inline int
445ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
446{
David S. Millercc1eb432012-04-01 18:57:48 -0400447 if (nla_put_be32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use))))
448 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800449 return 0;
450
Patrick McHardydf6fb862007-09-28 14:37:03 -0700451nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800452 return -1;
453}
454
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800455static int
Eric W. Biederman15e47302012-09-07 20:12:54 +0000456ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
Pablo Neira Ayuso80e60e62011-12-24 14:11:39 +0100457 struct nf_conn *ct)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800458{
459 struct nlmsghdr *nlh;
460 struct nfgenmsg *nfmsg;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700461 struct nlattr *nest_parms;
Eric W. Biederman15e47302012-09-07 20:12:54 +0000462 unsigned int flags = portid ? NLM_F_MULTI : 0, event;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800463
Pablo Neira Ayuso80e60e62011-12-24 14:11:39 +0100464 event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_NEW);
Eric W. Biederman15e47302012-09-07 20:12:54 +0000465 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200466 if (nlh == NULL)
467 goto nlmsg_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800468
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200469 nfmsg = nlmsg_data(nlh);
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200470 nfmsg->nfgen_family = nf_ct_l3num(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800471 nfmsg->version = NFNETLINK_V0;
472 nfmsg->res_id = 0;
473
Patrick McHardydf6fb862007-09-28 14:37:03 -0700474 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
475 if (!nest_parms)
476 goto nla_put_failure;
Pablo Neira Ayusof2f3e382009-06-02 20:03:35 +0200477 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700478 goto nla_put_failure;
479 nla_nest_end(skb, nest_parms);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800480
Patrick McHardydf6fb862007-09-28 14:37:03 -0700481 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
482 if (!nest_parms)
483 goto nla_put_failure;
Pablo Neira Ayusof2f3e382009-06-02 20:03:35 +0200484 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700485 goto nla_put_failure;
486 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800487
David S. Millercc1eb432012-04-01 18:57:48 -0400488 if (nf_ct_zone(ct) &&
489 nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
490 goto nla_put_failure;
Patrick McHardyef00f892010-02-15 18:14:57 +0100491
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800492 if (ctnetlink_dump_status(skb, ct) < 0 ||
493 ctnetlink_dump_timeout(skb, ct) < 0 ||
Pablo Neira Ayuso80e60e62011-12-24 14:11:39 +0100494 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL, type) < 0 ||
495 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY, type) < 0 ||
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100496 ctnetlink_dump_timestamp(skb, ct) < 0 ||
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800497 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
498 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
499 ctnetlink_dump_mark(skb, ct) < 0 ||
Eric Paris1cc63242010-10-13 16:24:54 -0400500 ctnetlink_dump_secctx(skb, ct) < 0 ||
Florian Westphal0ceabd82013-01-11 06:30:45 +0000501 ctnetlink_dump_labels(skb, ct) < 0 ||
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800502 ctnetlink_dump_id(skb, ct) < 0 ||
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800503 ctnetlink_dump_use(skb, ct) < 0 ||
Pablo Neira Ayuso0f417ce2007-12-17 22:28:19 -0800504 ctnetlink_dump_master(skb, ct) < 0 ||
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800505 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700506 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800507
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200508 nlmsg_end(skb, nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800509 return skb->len;
510
511nlmsg_failure:
Patrick McHardydf6fb862007-09-28 14:37:03 -0700512nla_put_failure:
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200513 nlmsg_cancel(skb, nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800514 return -1;
515}
516
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200517static inline size_t
518ctnetlink_proto_size(const struct nf_conn *ct)
Holger Eitzenberger2732c4e2009-03-25 21:50:59 +0100519{
520 struct nf_conntrack_l3proto *l3proto;
521 struct nf_conntrack_l4proto *l4proto;
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200522 size_t len = 0;
Holger Eitzenberger2732c4e2009-03-25 21:50:59 +0100523
524 rcu_read_lock();
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200525 l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
Holger Eitzenberger2732c4e2009-03-25 21:50:59 +0100526 len += l3proto->nla_size;
527
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200528 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
Holger Eitzenberger2732c4e2009-03-25 21:50:59 +0100529 len += l4proto->nla_size;
530 rcu_read_unlock();
531
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200532 return len;
533}
534
535static inline size_t
Jiri Pirkod26e6a02010-04-01 12:39:19 +0200536ctnetlink_counters_size(const struct nf_conn *ct)
537{
538 if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT))
539 return 0;
540 return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */
541 + 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */
542 + 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */
543 ;
544}
545
Pablo Neira Ayusocba85b52011-01-06 11:25:00 -0800546static inline int
547ctnetlink_secctx_size(const struct nf_conn *ct)
Eric Paris1cc63242010-10-13 16:24:54 -0400548{
Pablo Neira Ayusocba85b52011-01-06 11:25:00 -0800549#ifdef CONFIG_NF_CONNTRACK_SECMARK
550 int len, ret;
Eric Paris1cc63242010-10-13 16:24:54 -0400551
Pablo Neira Ayusocba85b52011-01-06 11:25:00 -0800552 ret = security_secid_to_secctx(ct->secmark, NULL, &len);
553 if (ret)
554 return 0;
Eric Paris1cc63242010-10-13 16:24:54 -0400555
Pablo Neira Ayusocba85b52011-01-06 11:25:00 -0800556 return nla_total_size(0) /* CTA_SECCTX */
557 + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */
558#else
559 return 0;
Eric Paris1cc63242010-10-13 16:24:54 -0400560#endif
Pablo Neira Ayusocba85b52011-01-06 11:25:00 -0800561}
Eric Paris1cc63242010-10-13 16:24:54 -0400562
Jiri Pirkod26e6a02010-04-01 12:39:19 +0200563static inline size_t
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100564ctnetlink_timestamp_size(const struct nf_conn *ct)
565{
566#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
567 if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP))
568 return 0;
569 return nla_total_size(0) + 2 * nla_total_size(sizeof(uint64_t));
570#else
571 return 0;
572#endif
573}
574
575static inline size_t
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200576ctnetlink_nlmsg_size(const struct nf_conn *ct)
577{
578 return NLMSG_ALIGN(sizeof(struct nfgenmsg))
579 + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
580 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
581 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
582 + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
583 + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
584 + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */
Jiri Pirkod26e6a02010-04-01 12:39:19 +0200585 + ctnetlink_counters_size(ct)
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100586 + ctnetlink_timestamp_size(ct)
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200587 + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
588 + nla_total_size(0) /* CTA_PROTOINFO */
589 + nla_total_size(0) /* CTA_HELP */
590 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
Pablo Neira Ayusocba85b52011-01-06 11:25:00 -0800591 + ctnetlink_secctx_size(ct)
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200592#ifdef CONFIG_NF_NAT_NEEDED
593 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
594 + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
595#endif
596#ifdef CONFIG_NF_CONNTRACK_MARK
597 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
598#endif
599 + ctnetlink_proto_size(ct)
Florian Westphal0ceabd82013-01-11 06:30:45 +0000600 + ctnetlink_label_size(ct)
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200601 ;
Holger Eitzenberger2732c4e2009-03-25 21:50:59 +0100602}
603
Pablo Neira Ayuso8e36c4b2012-06-23 01:43:51 +0200604#ifdef CONFIG_NF_CONNTRACK_EVENTS
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +0200605static int
606ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800607{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +0100608 struct net *net;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800609 struct nlmsghdr *nlh;
610 struct nfgenmsg *nfmsg;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700611 struct nlattr *nest_parms;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +0100612 struct nf_conn *ct = item->ct;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800613 struct sk_buff *skb;
614 unsigned int type;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800615 unsigned int flags = 0, group;
Pablo Neira Ayusodd7669a2009-06-13 12:30:52 +0200616 int err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800617
618 /* ignore our fake conntrack entry */
Eric Dumazet5bfddbd2010-06-08 16:09:52 +0200619 if (nf_ct_is_untracked(ct))
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +0200620 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800621
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200622 if (events & (1 << IPCT_DESTROY)) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800623 type = IPCTNL_MSG_CT_DELETE;
624 group = NFNLGRP_CONNTRACK_DESTROY;
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200625 } else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800626 type = IPCTNL_MSG_CT_NEW;
627 flags = NLM_F_CREATE|NLM_F_EXCL;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800628 group = NFNLGRP_CONNTRACK_NEW;
Pablo Neira Ayuso17e6e4e2009-06-02 20:08:46 +0200629 } else if (events) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800630 type = IPCTNL_MSG_CT_NEW;
631 group = NFNLGRP_CONNTRACK_UPDATE;
632 } else
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +0200633 return 0;
Patrick McHardya2427692006-03-20 18:03:59 -0800634
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +0100635 net = nf_ct_net(ct);
636 if (!item->report && !nfnetlink_has_listeners(net, group))
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +0200637 return 0;
Patrick McHardya2427692006-03-20 18:03:59 -0800638
Pablo Neira Ayuso03b64f52009-06-02 20:08:27 +0200639 skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);
640 if (skb == NULL)
Pablo Neira Ayuso150ace02009-04-17 17:47:31 +0200641 goto errout;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800642
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800643 type |= NFNL_SUBSYS_CTNETLINK << 8;
Eric W. Biederman15e47302012-09-07 20:12:54 +0000644 nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200645 if (nlh == NULL)
646 goto nlmsg_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800647
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200648 nfmsg = nlmsg_data(nlh);
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200649 nfmsg->nfgen_family = nf_ct_l3num(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800650 nfmsg->version = NFNETLINK_V0;
651 nfmsg->res_id = 0;
652
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100653 rcu_read_lock();
Patrick McHardydf6fb862007-09-28 14:37:03 -0700654 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
655 if (!nest_parms)
656 goto nla_put_failure;
Pablo Neira Ayusof2f3e382009-06-02 20:03:35 +0200657 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700658 goto nla_put_failure;
659 nla_nest_end(skb, nest_parms);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800660
Patrick McHardydf6fb862007-09-28 14:37:03 -0700661 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
662 if (!nest_parms)
663 goto nla_put_failure;
Pablo Neira Ayusof2f3e382009-06-02 20:03:35 +0200664 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700665 goto nla_put_failure;
666 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800667
David S. Millercc1eb432012-04-01 18:57:48 -0400668 if (nf_ct_zone(ct) &&
669 nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
670 goto nla_put_failure;
Patrick McHardyef00f892010-02-15 18:14:57 +0100671
Eric Leblond1eedf692008-05-13 23:27:11 -0700672 if (ctnetlink_dump_id(skb, ct) < 0)
673 goto nla_put_failure;
674
Fabian Hugelshofere57dce62008-06-09 15:59:58 -0700675 if (ctnetlink_dump_status(skb, ct) < 0)
676 goto nla_put_failure;
677
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200678 if (events & (1 << IPCT_DESTROY)) {
Pablo Neira Ayuso80e60e62011-12-24 14:11:39 +0100679 if (ctnetlink_dump_counters(skb, ct,
680 IP_CT_DIR_ORIGINAL, type) < 0 ||
681 ctnetlink_dump_counters(skb, ct,
682 IP_CT_DIR_REPLY, type) < 0 ||
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +0100683 ctnetlink_dump_timestamp(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700684 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100685 } else {
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100686 if (ctnetlink_dump_timeout(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700687 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100688
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200689 if (events & (1 << IPCT_PROTOINFO)
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100690 && ctnetlink_dump_protoinfo(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700691 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100692
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200693 if ((events & (1 << IPCT_HELPER) || nfct_help(ct))
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100694 && ctnetlink_dump_helpinfo(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700695 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100696
Eric Parisff660c82010-10-19 18:17:32 -0400697#ifdef CONFIG_NF_CONNTRACK_SECMARK
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200698 if ((events & (1 << IPCT_SECMARK) || ct->secmark)
Eric Paris1cc63242010-10-13 16:24:54 -0400699 && ctnetlink_dump_secctx(skb, ct) < 0)
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800700 goto nla_put_failure;
Eric Parisff660c82010-10-19 18:17:32 -0400701#endif
Florian Westphal0ceabd82013-01-11 06:30:45 +0000702 if (events & (1 << IPCT_LABEL) &&
703 ctnetlink_dump_labels(skb, ct) < 0)
704 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100705
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200706 if (events & (1 << IPCT_RELATED) &&
Pablo Neira Ayuso0f417ce2007-12-17 22:28:19 -0800707 ctnetlink_dump_master(skb, ct) < 0)
708 goto nla_put_failure;
709
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200710 if (events & (1 << IPCT_NATSEQADJ) &&
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800711 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
712 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100713 }
Pablo Neira Ayusob9a37e02006-08-22 00:31:49 -0700714
Eric Leblonda83099a2008-01-31 04:44:27 -0800715#ifdef CONFIG_NF_CONNTRACK_MARK
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +0200716 if ((events & (1 << IPCT_MARK) || ct->mark)
Eric Leblonda83099a2008-01-31 04:44:27 -0800717 && ctnetlink_dump_mark(skb, ct) < 0)
718 goto nla_put_failure;
719#endif
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100720 rcu_read_unlock();
Eric Leblonda83099a2008-01-31 04:44:27 -0800721
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200722 nlmsg_end(skb, nlh);
Eric W. Biederman15e47302012-09-07 20:12:54 +0000723 err = nfnetlink_send(skb, net, item->portid, group, item->report,
Alexey Dobriyancd8c20b2010-01-13 16:02:14 +0100724 GFP_ATOMIC);
Pablo Neira Ayusodd7669a2009-06-13 12:30:52 +0200725 if (err == -ENOBUFS || err == -EAGAIN)
726 return -ENOBUFS;
727
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +0200728 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800729
Patrick McHardydf6fb862007-09-28 14:37:03 -0700730nla_put_failure:
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100731 rcu_read_unlock();
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200732 nlmsg_cancel(skb, nlh);
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100733nlmsg_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800734 kfree_skb(skb);
Pablo Neira Ayuso150ace02009-04-17 17:47:31 +0200735errout:
Pablo Neira Ayuso37b7ef72010-03-16 13:30:21 +0000736 if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)
737 return -ENOBUFS;
738
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +0200739 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800740}
741#endif /* CONFIG_NF_CONNTRACK_EVENTS */
742
743static int ctnetlink_done(struct netlink_callback *cb)
744{
Patrick McHardy89f2e212006-05-29 18:24:58 -0700745 if (cb->args[1])
746 nf_ct_put((struct nf_conn *)cb->args[1]);
Pablo Neira Ayuso0f298a22012-02-24 14:41:50 +0000747 if (cb->data)
748 kfree(cb->data);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800749 return 0;
750}
751
Pablo Neira Ayuso0f298a22012-02-24 14:41:50 +0000752struct ctnetlink_dump_filter {
753 struct {
754 u_int32_t val;
755 u_int32_t mask;
756 } mark;
757};
758
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800759static int
760ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
761{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +0100762 struct net *net = sock_net(skb->sk);
Patrick McHardy89f2e212006-05-29 18:24:58 -0700763 struct nf_conn *ct, *last;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800764 struct nf_conntrack_tuple_hash *h;
Eric Dumazetea781f12009-03-25 21:05:46 +0100765 struct hlist_nulls_node *n;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200766 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
Pablo Neira Ayuso87711cb2006-01-05 12:19:23 -0800767 u_int8_t l3proto = nfmsg->nfgen_family;
Hans Schillstrom3b988ec2012-03-05 02:24:29 +0000768 int res;
Pablo Neira Ayuso0f298a22012-02-24 14:41:50 +0000769#ifdef CONFIG_NF_CONNTRACK_MARK
770 const struct ctnetlink_dump_filter *filter = cb->data;
771#endif
Hans Schillstrom3b988ec2012-03-05 02:24:29 +0000772
Stephen Hemminger13ee6ac2011-01-11 23:54:42 +0100773 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardyd205dc42006-08-17 18:12:38 -0700774 last = (struct nf_conn *)cb->args[1];
Patrick McHardy9ab99d52010-02-10 14:17:10 +0100775 for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
Patrick McHardy89f2e212006-05-29 18:24:58 -0700776restart:
Stephen Hemminger13ee6ac2011-01-11 23:54:42 +0100777 hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],
Eric Dumazetea781f12009-03-25 21:05:46 +0100778 hnnode) {
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800779 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800780 continue;
781 ct = nf_ct_tuplehash_to_ctrack(h);
Pablo Neira Ayuso87711cb2006-01-05 12:19:23 -0800782 /* Dump entries of a given L3 protocol number.
783 * If it is not specified, ie. l3proto == 0,
784 * then dump everything. */
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200785 if (l3proto && nf_ct_l3num(ct) != l3proto)
Stephen Hemminger13ee6ac2011-01-11 23:54:42 +0100786 continue;
Patrick McHardyd205dc42006-08-17 18:12:38 -0700787 if (cb->args[1]) {
788 if (ct != last)
Stephen Hemminger13ee6ac2011-01-11 23:54:42 +0100789 continue;
Patrick McHardyd205dc42006-08-17 18:12:38 -0700790 cb->args[1] = 0;
Patrick McHardy89f2e212006-05-29 18:24:58 -0700791 }
Pablo Neira Ayuso0f298a22012-02-24 14:41:50 +0000792#ifdef CONFIG_NF_CONNTRACK_MARK
793 if (filter && !((ct->mark & filter->mark.mask) ==
794 filter->mark.val)) {
795 continue;
796 }
797#endif
Hans Schillstrom3b988ec2012-03-05 02:24:29 +0000798 rcu_read_lock();
799 res =
Eric W. Biederman15e47302012-09-07 20:12:54 +0000800 ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
Hans Schillstrom3b988ec2012-03-05 02:24:29 +0000801 cb->nlh->nlmsg_seq,
802 NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
803 ct);
804 rcu_read_unlock();
805 if (res < 0) {
Pablo Neira Ayusoc71caf42011-01-24 19:01:07 +0100806 nf_conntrack_get(&ct->ct_general);
Patrick McHardy89f2e212006-05-29 18:24:58 -0700807 cb->args[1] = (unsigned long)ct;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800808 goto out;
Patrick McHardy89f2e212006-05-29 18:24:58 -0700809 }
810 }
Patrick McHardyd205dc42006-08-17 18:12:38 -0700811 if (cb->args[1]) {
Patrick McHardy89f2e212006-05-29 18:24:58 -0700812 cb->args[1] = 0;
813 goto restart;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800814 }
815 }
Patrick McHardy89f2e212006-05-29 18:24:58 -0700816out:
Stephen Hemminger13ee6ac2011-01-11 23:54:42 +0100817 spin_unlock_bh(&nf_conntrack_lock);
Patrick McHardyd205dc42006-08-17 18:12:38 -0700818 if (last)
819 nf_ct_put(last);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800820
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800821 return skb->len;
822}
823
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800824static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700825ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800826{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700827 struct nlattr *tb[CTA_IP_MAX+1];
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800828 struct nf_conntrack_l3proto *l3proto;
829 int ret = 0;
830
Patrick McHardydf6fb862007-09-28 14:37:03 -0700831 nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800832
Florian Westphalcd915662009-03-18 17:28:37 +0100833 rcu_read_lock();
834 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800835
Patrick McHardyf73e9242007-09-28 14:39:55 -0700836 if (likely(l3proto->nlattr_to_tuple)) {
837 ret = nla_validate_nested(attr, CTA_IP_MAX,
838 l3proto->nla_policy);
839 if (ret == 0)
840 ret = l3proto->nlattr_to_tuple(tb, tuple);
841 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800842
Florian Westphalcd915662009-03-18 17:28:37 +0100843 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800844
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800845 return ret;
846}
847
Patrick McHardyf73e9242007-09-28 14:39:55 -0700848static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
849 [CTA_PROTO_NUM] = { .type = NLA_U8 },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800850};
851
852static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700853ctnetlink_parse_tuple_proto(struct nlattr *attr,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800854 struct nf_conntrack_tuple *tuple)
855{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700856 struct nlattr *tb[CTA_PROTO_MAX+1];
Martin Josefsson605dcad2006-11-29 02:35:06 +0100857 struct nf_conntrack_l4proto *l4proto;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800858 int ret = 0;
859
Patrick McHardyf73e9242007-09-28 14:39:55 -0700860 ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);
861 if (ret < 0)
862 return ret;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800863
Patrick McHardydf6fb862007-09-28 14:37:03 -0700864 if (!tb[CTA_PROTO_NUM])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800865 return -EINVAL;
Patrick McHardy77236b62007-12-17 22:29:45 -0800866 tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800867
Florian Westphalcd915662009-03-18 17:28:37 +0100868 rcu_read_lock();
869 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800870
Patrick McHardyf73e9242007-09-28 14:39:55 -0700871 if (likely(l4proto->nlattr_to_tuple)) {
872 ret = nla_validate_nested(attr, CTA_PROTO_MAX,
873 l4proto->nla_policy);
874 if (ret == 0)
875 ret = l4proto->nlattr_to_tuple(tb, tuple);
876 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800877
Florian Westphalcd915662009-03-18 17:28:37 +0100878 rcu_read_unlock();
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800879
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800880 return ret;
881}
882
Patrick McHardyd0b02682010-02-10 15:38:33 +0100883static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
884 [CTA_TUPLE_IP] = { .type = NLA_NESTED },
885 [CTA_TUPLE_PROTO] = { .type = NLA_NESTED },
886};
887
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800888static int
Patrick McHardy39938322009-08-25 16:07:58 +0200889ctnetlink_parse_tuple(const struct nlattr * const cda[],
890 struct nf_conntrack_tuple *tuple,
Patrick McHardya00f1f32011-02-01 17:26:37 +0100891 enum ctattr_type type, u_int8_t l3num)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800892{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700893 struct nlattr *tb[CTA_TUPLE_MAX+1];
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800894 int err;
895
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800896 memset(tuple, 0, sizeof(*tuple));
897
Patrick McHardyd0b02682010-02-10 15:38:33 +0100898 nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800899
Patrick McHardydf6fb862007-09-28 14:37:03 -0700900 if (!tb[CTA_TUPLE_IP])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800901 return -EINVAL;
902
903 tuple->src.l3num = l3num;
904
Patrick McHardydf6fb862007-09-28 14:37:03 -0700905 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800906 if (err < 0)
907 return err;
908
Patrick McHardydf6fb862007-09-28 14:37:03 -0700909 if (!tb[CTA_TUPLE_PROTO])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800910 return -EINVAL;
911
Patrick McHardydf6fb862007-09-28 14:37:03 -0700912 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800913 if (err < 0)
914 return err;
915
916 /* orig and expect tuples get DIR_ORIGINAL */
917 if (type == CTA_TUPLE_REPLY)
918 tuple->dst.dir = IP_CT_DIR_REPLY;
919 else
920 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
921
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800922 return 0;
923}
924
Patrick McHardyef00f892010-02-15 18:14:57 +0100925static int
926ctnetlink_parse_zone(const struct nlattr *attr, u16 *zone)
927{
928 if (attr)
929#ifdef CONFIG_NF_CONNTRACK_ZONES
930 *zone = ntohs(nla_get_be16(attr));
931#else
932 return -EOPNOTSUPP;
933#endif
934 else
935 *zone = 0;
936
937 return 0;
938}
939
Patrick McHardyd0b02682010-02-10 15:38:33 +0100940static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = {
Florian Westphal6d1fafc2012-11-22 01:32:46 +0000941 [CTA_HELP_NAME] = { .type = NLA_NUL_STRING,
942 .len = NF_CT_HELPER_NAME_LEN - 1 },
Patrick McHardyd0b02682010-02-10 15:38:33 +0100943};
944
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800945static inline int
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +0200946ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,
947 struct nlattr **helpinfo)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800948{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700949 struct nlattr *tb[CTA_HELP_MAX+1];
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800950
Patrick McHardyd0b02682010-02-10 15:38:33 +0100951 nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800952
Patrick McHardydf6fb862007-09-28 14:37:03 -0700953 if (!tb[CTA_HELP_NAME])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800954 return -EINVAL;
955
Patrick McHardydf6fb862007-09-28 14:37:03 -0700956 *helper_name = nla_data(tb[CTA_HELP_NAME]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800957
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +0200958 if (tb[CTA_HELP_INFO])
959 *helpinfo = tb[CTA_HELP_INFO];
960
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800961 return 0;
962}
963
Patrick McHardyf73e9242007-09-28 14:39:55 -0700964static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
Patrick McHardyd0b02682010-02-10 15:38:33 +0100965 [CTA_TUPLE_ORIG] = { .type = NLA_NESTED },
966 [CTA_TUPLE_REPLY] = { .type = NLA_NESTED },
Patrick McHardyf73e9242007-09-28 14:39:55 -0700967 [CTA_STATUS] = { .type = NLA_U32 },
Patrick McHardyd0b02682010-02-10 15:38:33 +0100968 [CTA_PROTOINFO] = { .type = NLA_NESTED },
969 [CTA_HELP] = { .type = NLA_NESTED },
970 [CTA_NAT_SRC] = { .type = NLA_NESTED },
Patrick McHardyf73e9242007-09-28 14:39:55 -0700971 [CTA_TIMEOUT] = { .type = NLA_U32 },
972 [CTA_MARK] = { .type = NLA_U32 },
Patrick McHardyf73e9242007-09-28 14:39:55 -0700973 [CTA_ID] = { .type = NLA_U32 },
Patrick McHardyd0b02682010-02-10 15:38:33 +0100974 [CTA_NAT_DST] = { .type = NLA_NESTED },
975 [CTA_TUPLE_MASTER] = { .type = NLA_NESTED },
Florian Westphal6d1fafc2012-11-22 01:32:46 +0000976 [CTA_NAT_SEQ_ADJ_ORIG] = { .type = NLA_NESTED },
977 [CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED },
Patrick McHardyef00f892010-02-15 18:14:57 +0100978 [CTA_ZONE] = { .type = NLA_U16 },
Pablo Neira Ayuso0f298a22012-02-24 14:41:50 +0000979 [CTA_MARK_MASK] = { .type = NLA_U32 },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800980};
981
982static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800983ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardy39938322009-08-25 16:07:58 +0200984 const struct nlmsghdr *nlh,
985 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800986{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +0100987 struct net *net = sock_net(ctnl);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800988 struct nf_conntrack_tuple_hash *h;
989 struct nf_conntrack_tuple tuple;
990 struct nf_conn *ct;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +0200991 struct nfgenmsg *nfmsg = nlmsg_data(nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800992 u_int8_t u3 = nfmsg->nfgen_family;
Patrick McHardyef00f892010-02-15 18:14:57 +0100993 u16 zone;
994 int err;
995
996 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
997 if (err < 0)
998 return err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800999
Patrick McHardydf6fb862007-09-28 14:37:03 -07001000 if (cda[CTA_TUPLE_ORIG])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001001 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
Patrick McHardydf6fb862007-09-28 14:37:03 -07001002 else if (cda[CTA_TUPLE_REPLY])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001003 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
1004 else {
1005 /* Flush the whole table */
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01001006 nf_conntrack_flush_report(net,
Eric W. Biederman15e47302012-09-07 20:12:54 +00001007 NETLINK_CB(skb).portid,
Pablo Neira Ayuso274d3832009-06-02 20:08:38 +02001008 nlmsg_report(nlh));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001009 return 0;
1010 }
1011
1012 if (err < 0)
1013 return err;
1014
Patrick McHardyef00f892010-02-15 18:14:57 +01001015 h = nf_conntrack_find_get(net, zone, &tuple);
Pablo Neira Ayuso9ea8cfd2006-10-12 14:09:16 -07001016 if (!h)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001017 return -ENOENT;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001018
1019 ct = nf_ct_tuplehash_to_ctrack(h);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001020
Patrick McHardydf6fb862007-09-28 14:37:03 -07001021 if (cda[CTA_ID]) {
Patrick McHardy77236b62007-12-17 22:29:45 -08001022 u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
Patrick McHardy7f85f912007-09-28 14:41:27 -07001023 if (id != (u32)(unsigned long)ct) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001024 nf_ct_put(ct);
1025 return -ENOENT;
1026 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001027 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001028
Pablo Neira Ayusoa16a1642012-03-16 02:00:34 +00001029 if (del_timer(&ct->timeout)) {
1030 if (nf_conntrack_event_report(IPCT_DESTROY, ct,
Eric W. Biederman15e47302012-09-07 20:12:54 +00001031 NETLINK_CB(skb).portid,
Pablo Neira Ayusoa16a1642012-03-16 02:00:34 +00001032 nlmsg_report(nlh)) < 0) {
1033 nf_ct_delete_from_lists(ct);
1034 /* we failed to report the event, try later */
Pablo Neira Ayuso04dac012012-11-27 21:30:52 +01001035 nf_ct_dying_timeout(ct);
Pablo Neira Ayusoa16a1642012-03-16 02:00:34 +00001036 nf_ct_put(ct);
1037 return 0;
1038 }
1039 /* death_by_timeout would report the event again */
1040 set_bit(IPS_DYING_BIT, &ct->status);
Pablo Neira Ayusodd7669a2009-06-13 12:30:52 +02001041 nf_ct_delete_from_lists(ct);
Pablo Neira Ayusodd7669a2009-06-13 12:30:52 +02001042 nf_ct_put(ct);
Pablo Neira Ayusodd7669a2009-06-13 12:30:52 +02001043 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001044 nf_ct_put(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001045
1046 return 0;
1047}
1048
1049static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001050ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardy39938322009-08-25 16:07:58 +02001051 const struct nlmsghdr *nlh,
1052 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001053{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01001054 struct net *net = sock_net(ctnl);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001055 struct nf_conntrack_tuple_hash *h;
1056 struct nf_conntrack_tuple tuple;
1057 struct nf_conn *ct;
1058 struct sk_buff *skb2 = NULL;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02001059 struct nfgenmsg *nfmsg = nlmsg_data(nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001060 u_int8_t u3 = nfmsg->nfgen_family;
Patrick McHardyef00f892010-02-15 18:14:57 +01001061 u16 zone;
1062 int err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001063
Pablo Neira Ayuso80d326f2012-02-24 14:30:15 +00001064 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1065 struct netlink_dump_control c = {
1066 .dump = ctnetlink_dump_table,
1067 .done = ctnetlink_done,
1068 };
Pablo Neira Ayuso0f298a22012-02-24 14:41:50 +00001069#ifdef CONFIG_NF_CONNTRACK_MARK
1070 if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
1071 struct ctnetlink_dump_filter *filter;
1072
1073 filter = kzalloc(sizeof(struct ctnetlink_dump_filter),
1074 GFP_ATOMIC);
1075 if (filter == NULL)
1076 return -ENOMEM;
1077
1078 filter->mark.val = ntohl(nla_get_be32(cda[CTA_MARK]));
1079 filter->mark.mask =
1080 ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
1081 c.data = filter;
1082 }
1083#endif
Pablo Neira Ayuso80d326f2012-02-24 14:30:15 +00001084 return netlink_dump_start(ctnl, skb, nlh, &c);
1085 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001086
Patrick McHardyef00f892010-02-15 18:14:57 +01001087 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
1088 if (err < 0)
1089 return err;
1090
Patrick McHardydf6fb862007-09-28 14:37:03 -07001091 if (cda[CTA_TUPLE_ORIG])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001092 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
Patrick McHardydf6fb862007-09-28 14:37:03 -07001093 else if (cda[CTA_TUPLE_REPLY])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001094 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
1095 else
1096 return -EINVAL;
1097
1098 if (err < 0)
1099 return err;
1100
Patrick McHardyef00f892010-02-15 18:14:57 +01001101 h = nf_conntrack_find_get(net, zone, &tuple);
Pablo Neira Ayuso9ea8cfd2006-10-12 14:09:16 -07001102 if (!h)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001103 return -ENOENT;
Pablo Neira Ayuso9ea8cfd2006-10-12 14:09:16 -07001104
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001105 ct = nf_ct_tuplehash_to_ctrack(h);
1106
1107 err = -ENOMEM;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02001108 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1109 if (skb2 == NULL) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001110 nf_ct_put(ct);
1111 return -ENOMEM;
1112 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001113
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001114 rcu_read_lock();
Eric W. Biederman15e47302012-09-07 20:12:54 +00001115 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
Pablo Neira Ayuso80e60e62011-12-24 14:11:39 +01001116 NFNL_MSG_TYPE(nlh->nlmsg_type), ct);
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001117 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001118 nf_ct_put(ct);
1119 if (err <= 0)
1120 goto free;
1121
Eric W. Biederman15e47302012-09-07 20:12:54 +00001122 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001123 if (err < 0)
1124 goto out;
1125
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001126 return 0;
1127
1128free:
1129 kfree_skb(skb2);
1130out:
Pablo Neira Ayusof31e8d492011-01-13 14:19:55 +01001131 /* this avoids a loop in nfnetlink. */
1132 return err == -EAGAIN ? -ENOBUFS : err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001133}
1134
Pablo Neira Ayusod871bef2012-11-27 14:49:42 +01001135static int ctnetlink_done_list(struct netlink_callback *cb)
1136{
1137 if (cb->args[1])
1138 nf_ct_put((struct nf_conn *)cb->args[1]);
1139 return 0;
1140}
1141
1142static int
1143ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb,
1144 struct hlist_nulls_head *list)
1145{
1146 struct nf_conn *ct, *last;
1147 struct nf_conntrack_tuple_hash *h;
1148 struct hlist_nulls_node *n;
1149 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1150 u_int8_t l3proto = nfmsg->nfgen_family;
1151 int res;
1152
1153 if (cb->args[2])
1154 return 0;
1155
1156 spin_lock_bh(&nf_conntrack_lock);
1157 last = (struct nf_conn *)cb->args[1];
1158restart:
1159 hlist_nulls_for_each_entry(h, n, list, hnnode) {
1160 ct = nf_ct_tuplehash_to_ctrack(h);
1161 if (l3proto && nf_ct_l3num(ct) != l3proto)
1162 continue;
1163 if (cb->args[1]) {
1164 if (ct != last)
1165 continue;
1166 cb->args[1] = 0;
1167 }
1168 rcu_read_lock();
1169 res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
1170 cb->nlh->nlmsg_seq,
1171 NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
1172 ct);
1173 rcu_read_unlock();
1174 if (res < 0) {
1175 nf_conntrack_get(&ct->ct_general);
1176 cb->args[1] = (unsigned long)ct;
1177 goto out;
1178 }
1179 }
1180 if (cb->args[1]) {
1181 cb->args[1] = 0;
1182 goto restart;
1183 } else
1184 cb->args[2] = 1;
1185out:
1186 spin_unlock_bh(&nf_conntrack_lock);
1187 if (last)
1188 nf_ct_put(last);
1189
1190 return skb->len;
1191}
1192
1193static int
1194ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb)
1195{
1196 struct net *net = sock_net(skb->sk);
1197
1198 return ctnetlink_dump_list(skb, cb, &net->ct.dying);
1199}
1200
1201static int
1202ctnetlink_get_ct_dying(struct sock *ctnl, struct sk_buff *skb,
1203 const struct nlmsghdr *nlh,
1204 const struct nlattr * const cda[])
1205{
1206 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1207 struct netlink_dump_control c = {
1208 .dump = ctnetlink_dump_dying,
1209 .done = ctnetlink_done_list,
1210 };
1211 return netlink_dump_start(ctnl, skb, nlh, &c);
1212 }
1213
1214 return -EOPNOTSUPP;
1215}
1216
1217static int
1218ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb)
1219{
1220 struct net *net = sock_net(skb->sk);
1221
1222 return ctnetlink_dump_list(skb, cb, &net->ct.unconfirmed);
1223}
1224
1225static int
1226ctnetlink_get_ct_unconfirmed(struct sock *ctnl, struct sk_buff *skb,
1227 const struct nlmsghdr *nlh,
1228 const struct nlattr * const cda[])
1229{
1230 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1231 struct netlink_dump_control c = {
1232 .dump = ctnetlink_dump_unconfirmed,
1233 .done = ctnetlink_done_list,
1234 };
1235 return netlink_dump_start(ctnl, skb, nlh, &c);
1236 }
1237
1238 return -EOPNOTSUPP;
1239}
1240
Pablo Neira Ayuso67671842008-10-20 03:34:27 -07001241#ifdef CONFIG_NF_NAT_NEEDED
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -08001242static int
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001243ctnetlink_parse_nat_setup(struct nf_conn *ct,
1244 enum nf_nat_manip_type manip,
Patrick McHardy39938322009-08-25 16:07:58 +02001245 const struct nlattr *attr)
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001246{
1247 typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;
Patrick McHardyc7232c92012-08-26 19:14:06 +02001248 int err;
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001249
1250 parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);
1251 if (!parse_nat_setup) {
Johannes Berg95a5afc2008-10-16 15:24:51 -07001252#ifdef CONFIG_MODULES
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001253 rcu_read_unlock();
1254 nfnl_unlock();
Patrick McHardyc7232c92012-08-26 19:14:06 +02001255 if (request_module("nf-nat") < 0) {
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001256 nfnl_lock();
1257 rcu_read_lock();
1258 return -EOPNOTSUPP;
1259 }
1260 nfnl_lock();
1261 rcu_read_lock();
1262 if (nfnetlink_parse_nat_setup_hook)
1263 return -EAGAIN;
1264#endif
1265 return -EOPNOTSUPP;
1266 }
1267
Patrick McHardyc7232c92012-08-26 19:14:06 +02001268 err = parse_nat_setup(ct, manip, attr);
1269 if (err == -EAGAIN) {
1270#ifdef CONFIG_MODULES
1271 rcu_read_unlock();
Patrick McHardyc7232c92012-08-26 19:14:06 +02001272 nfnl_unlock();
1273 if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {
1274 nfnl_lock();
Patrick McHardyc7232c92012-08-26 19:14:06 +02001275 rcu_read_lock();
1276 return -EOPNOTSUPP;
1277 }
1278 nfnl_lock();
Patrick McHardyc7232c92012-08-26 19:14:06 +02001279 rcu_read_lock();
1280#else
1281 err = -EOPNOTSUPP;
1282#endif
1283 }
1284 return err;
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001285}
Pablo Neira Ayuso67671842008-10-20 03:34:27 -07001286#endif
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001287
1288static int
Patrick McHardy39938322009-08-25 16:07:58 +02001289ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001290{
1291 unsigned long d;
Patrick McHardy77236b62007-12-17 22:29:45 -08001292 unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001293 d = ct->status ^ status;
1294
1295 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
1296 /* unchangeable */
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07001297 return -EBUSY;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001298
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001299 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
1300 /* SEEN_REPLY bit can only be set */
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07001301 return -EBUSY;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001302
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001303 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
1304 /* ASSURED bit can only be set */
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07001305 return -EBUSY;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001306
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001307 /* Be careful here, modifying NAT bits can screw up things,
1308 * so don't let users modify them directly if they don't pass
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -08001309 * nf_nat_range. */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001310 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
1311 return 0;
1312}
1313
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001314static int
Patrick McHardy39938322009-08-25 16:07:58 +02001315ctnetlink_change_nat(struct nf_conn *ct, const struct nlattr * const cda[])
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001316{
1317#ifdef CONFIG_NF_NAT_NEEDED
1318 int ret;
1319
1320 if (cda[CTA_NAT_DST]) {
1321 ret = ctnetlink_parse_nat_setup(ct,
Patrick McHardycbc9f2f2011-12-23 13:59:49 +01001322 NF_NAT_MANIP_DST,
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001323 cda[CTA_NAT_DST]);
1324 if (ret < 0)
1325 return ret;
1326 }
1327 if (cda[CTA_NAT_SRC]) {
1328 ret = ctnetlink_parse_nat_setup(ct,
Patrick McHardycbc9f2f2011-12-23 13:59:49 +01001329 NF_NAT_MANIP_SRC,
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001330 cda[CTA_NAT_SRC]);
1331 if (ret < 0)
1332 return ret;
1333 }
1334 return 0;
1335#else
1336 return -EOPNOTSUPP;
1337#endif
1338}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001339
1340static inline int
Patrick McHardy39938322009-08-25 16:07:58 +02001341ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001342{
1343 struct nf_conntrack_helper *helper;
Harald Weltedc808fe2006-03-20 17:56:32 -08001344 struct nf_conn_help *help = nfct_help(ct);
Pablo Neira Ayuso29fe1b42009-04-22 02:26:37 -07001345 char *helpname = NULL;
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +02001346 struct nlattr *helpinfo = NULL;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001347 int err;
1348
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001349 /* don't change helper of sibling connections */
1350 if (ct->master)
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07001351 return -EBUSY;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001352
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +02001353 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001354 if (err < 0)
1355 return err;
1356
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -07001357 if (!strcmp(helpname, "")) {
1358 if (help && help->helper) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001359 /* we had a helper before ... */
1360 nf_ct_remove_expectations(ct);
Stephen Hemmingera9b3cd72011-08-01 16:19:00 +00001361 RCU_INIT_POINTER(help->helper, NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001362 }
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -07001363
1364 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001365 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001366
Patrick McHardy794e6872010-02-03 13:41:29 +01001367 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
1368 nf_ct_protonum(ct));
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001369 if (helper == NULL) {
1370#ifdef CONFIG_MODULES
1371 spin_unlock_bh(&nf_conntrack_lock);
1372
1373 if (request_module("nfct-helper-%s", helpname) < 0) {
1374 spin_lock_bh(&nf_conntrack_lock);
1375 return -EOPNOTSUPP;
1376 }
1377
1378 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardy794e6872010-02-03 13:41:29 +01001379 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
1380 nf_ct_protonum(ct));
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001381 if (helper)
1382 return -EAGAIN;
1383#endif
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07001384 return -EOPNOTSUPP;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001385 }
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -07001386
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001387 if (help) {
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +02001388 if (help->helper == helper) {
1389 /* update private helper data if allowed. */
Pablo Neira Ayuso7be54ca2012-09-21 16:52:08 +02001390 if (helper->from_nlattr)
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +02001391 helper->from_nlattr(helpinfo, ct);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001392 return 0;
Pablo Neira Ayusofd7462d2012-06-18 17:29:53 +02001393 } else
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001394 return -EBUSY;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001395 }
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -07001396
Pablo Neira Ayusofd7462d2012-06-18 17:29:53 +02001397 /* we cannot set a helper for an existing conntrack */
1398 return -EOPNOTSUPP;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001399}
1400
1401static inline int
Patrick McHardy39938322009-08-25 16:07:58 +02001402ctnetlink_change_timeout(struct nf_conn *ct, const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001403{
Patrick McHardy77236b62007-12-17 22:29:45 -08001404 u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001405
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001406 if (!del_timer(&ct->timeout))
1407 return -ETIME;
1408
1409 ct->timeout.expires = jiffies + timeout * HZ;
1410 add_timer(&ct->timeout);
1411
1412 return 0;
1413}
1414
Patrick McHardyd0b02682010-02-10 15:38:33 +01001415static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = {
1416 [CTA_PROTOINFO_TCP] = { .type = NLA_NESTED },
1417 [CTA_PROTOINFO_DCCP] = { .type = NLA_NESTED },
1418 [CTA_PROTOINFO_SCTP] = { .type = NLA_NESTED },
1419};
1420
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001421static inline int
Patrick McHardy39938322009-08-25 16:07:58 +02001422ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001423{
Patrick McHardy39938322009-08-25 16:07:58 +02001424 const struct nlattr *attr = cda[CTA_PROTOINFO];
1425 struct nlattr *tb[CTA_PROTOINFO_MAX+1];
Martin Josefsson605dcad2006-11-29 02:35:06 +01001426 struct nf_conntrack_l4proto *l4proto;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001427 int err = 0;
1428
Patrick McHardyd0b02682010-02-10 15:38:33 +01001429 nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001430
Florian Westphalcd915662009-03-18 17:28:37 +01001431 rcu_read_lock();
1432 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
Patrick McHardyfdf70832007-09-28 14:37:41 -07001433 if (l4proto->from_nlattr)
1434 err = l4proto->from_nlattr(tb, ct);
Florian Westphalcd915662009-03-18 17:28:37 +01001435 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001436
1437 return err;
1438}
1439
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001440#ifdef CONFIG_NF_NAT_NEEDED
Patrick McHardyd0b02682010-02-10 15:38:33 +01001441static const struct nla_policy nat_seq_policy[CTA_NAT_SEQ_MAX+1] = {
1442 [CTA_NAT_SEQ_CORRECTION_POS] = { .type = NLA_U32 },
1443 [CTA_NAT_SEQ_OFFSET_BEFORE] = { .type = NLA_U32 },
1444 [CTA_NAT_SEQ_OFFSET_AFTER] = { .type = NLA_U32 },
1445};
1446
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001447static inline int
Patrick McHardy39938322009-08-25 16:07:58 +02001448change_nat_seq_adj(struct nf_nat_seq *natseq, const struct nlattr * const attr)
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001449{
1450 struct nlattr *cda[CTA_NAT_SEQ_MAX+1];
1451
Patrick McHardyd0b02682010-02-10 15:38:33 +01001452 nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, nat_seq_policy);
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001453
1454 if (!cda[CTA_NAT_SEQ_CORRECTION_POS])
1455 return -EINVAL;
1456
1457 natseq->correction_pos =
Patrick McHardy77236b62007-12-17 22:29:45 -08001458 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_CORRECTION_POS]));
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001459
1460 if (!cda[CTA_NAT_SEQ_OFFSET_BEFORE])
1461 return -EINVAL;
1462
1463 natseq->offset_before =
Patrick McHardy77236b62007-12-17 22:29:45 -08001464 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_BEFORE]));
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001465
1466 if (!cda[CTA_NAT_SEQ_OFFSET_AFTER])
1467 return -EINVAL;
1468
1469 natseq->offset_after =
Patrick McHardy77236b62007-12-17 22:29:45 -08001470 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_AFTER]));
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001471
1472 return 0;
1473}
1474
1475static int
Patrick McHardy39938322009-08-25 16:07:58 +02001476ctnetlink_change_nat_seq_adj(struct nf_conn *ct,
1477 const struct nlattr * const cda[])
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001478{
1479 int ret = 0;
1480 struct nf_conn_nat *nat = nfct_nat(ct);
1481
1482 if (!nat)
1483 return 0;
1484
1485 if (cda[CTA_NAT_SEQ_ADJ_ORIG]) {
1486 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_ORIGINAL],
1487 cda[CTA_NAT_SEQ_ADJ_ORIG]);
1488 if (ret < 0)
1489 return ret;
1490
1491 ct->status |= IPS_SEQ_ADJUST;
1492 }
1493
1494 if (cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1495 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_REPLY],
1496 cda[CTA_NAT_SEQ_ADJ_REPLY]);
1497 if (ret < 0)
1498 return ret;
1499
1500 ct->status |= IPS_SEQ_ADJUST;
1501 }
1502
1503 return 0;
1504}
1505#endif
1506
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001507static int
Patrick McHardy39938322009-08-25 16:07:58 +02001508ctnetlink_change_conntrack(struct nf_conn *ct,
1509 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001510{
1511 int err;
1512
Pablo Neira Ayusoe0983602009-03-16 15:27:22 +01001513 /* only allow NAT changes and master assignation for new conntracks */
1514 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])
1515 return -EOPNOTSUPP;
1516
Patrick McHardydf6fb862007-09-28 14:37:03 -07001517 if (cda[CTA_HELP]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001518 err = ctnetlink_change_helper(ct, cda);
1519 if (err < 0)
1520 return err;
1521 }
1522
Patrick McHardydf6fb862007-09-28 14:37:03 -07001523 if (cda[CTA_TIMEOUT]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001524 err = ctnetlink_change_timeout(ct, cda);
1525 if (err < 0)
1526 return err;
1527 }
1528
Patrick McHardydf6fb862007-09-28 14:37:03 -07001529 if (cda[CTA_STATUS]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001530 err = ctnetlink_change_status(ct, cda);
1531 if (err < 0)
1532 return err;
1533 }
1534
Patrick McHardydf6fb862007-09-28 14:37:03 -07001535 if (cda[CTA_PROTOINFO]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001536 err = ctnetlink_change_protoinfo(ct, cda);
1537 if (err < 0)
1538 return err;
1539 }
1540
Martin Josefssonbcd1e832006-04-01 02:23:21 -08001541#if defined(CONFIG_NF_CONNTRACK_MARK)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001542 if (cda[CTA_MARK])
Patrick McHardy77236b62007-12-17 22:29:45 -08001543 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001544#endif
1545
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001546#ifdef CONFIG_NF_NAT_NEEDED
1547 if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1548 err = ctnetlink_change_nat_seq_adj(ct, cda);
1549 if (err < 0)
1550 return err;
1551 }
1552#endif
1553
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001554 return 0;
1555}
1556
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001557static struct nf_conn *
Patrick McHardyef00f892010-02-15 18:14:57 +01001558ctnetlink_create_conntrack(struct net *net, u16 zone,
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01001559 const struct nlattr * const cda[],
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001560 struct nf_conntrack_tuple *otuple,
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001561 struct nf_conntrack_tuple *rtuple,
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001562 u8 u3)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001563{
1564 struct nf_conn *ct;
1565 int err = -EINVAL;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001566 struct nf_conntrack_helper *helper;
Pablo Neira Ayuso315c34d2011-04-21 10:55:07 +02001567 struct nf_conn_tstamp *tstamp;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001568
Patrick McHardyef00f892010-02-15 18:14:57 +01001569 ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
Julia Lawallcd7fcbf2009-01-12 00:06:08 +00001570 if (IS_ERR(ct))
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001571 return ERR_PTR(-ENOMEM);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001572
Patrick McHardydf6fb862007-09-28 14:37:03 -07001573 if (!cda[CTA_TIMEOUT])
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001574 goto err1;
Patrick McHardy77236b62007-12-17 22:29:45 -08001575 ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001576
1577 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001578
Patrick McHardy58a3c9b2008-01-31 04:36:54 -08001579 rcu_read_lock();
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001580 if (cda[CTA_HELP]) {
Pablo Neira Ayuso29fe1b42009-04-22 02:26:37 -07001581 char *helpname = NULL;
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +02001582 struct nlattr *helpinfo = NULL;
1583
1584 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001585 if (err < 0)
1586 goto err2;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001587
Patrick McHardy794e6872010-02-03 13:41:29 +01001588 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
1589 nf_ct_protonum(ct));
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001590 if (helper == NULL) {
1591 rcu_read_unlock();
1592#ifdef CONFIG_MODULES
1593 if (request_module("nfct-helper-%s", helpname) < 0) {
1594 err = -EOPNOTSUPP;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001595 goto err1;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001596 }
1597
1598 rcu_read_lock();
Patrick McHardy794e6872010-02-03 13:41:29 +01001599 helper = __nf_conntrack_helper_find(helpname,
1600 nf_ct_l3num(ct),
1601 nf_ct_protonum(ct));
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001602 if (helper) {
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001603 err = -EAGAIN;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001604 goto err2;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001605 }
1606 rcu_read_unlock();
1607#endif
1608 err = -EOPNOTSUPP;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001609 goto err1;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001610 } else {
1611 struct nf_conn_help *help;
1612
Pablo Neira Ayuso1afc5672012-06-07 12:11:50 +02001613 help = nf_ct_helper_ext_add(ct, helper, GFP_ATOMIC);
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001614 if (help == NULL) {
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001615 err = -ENOMEM;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001616 goto err2;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001617 }
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +02001618 /* set private helper data if allowed. */
Pablo Neira Ayuso7be54ca2012-09-21 16:52:08 +02001619 if (helper->from_nlattr)
Pablo Neira Ayusoae243be2012-06-07 14:19:42 +02001620 helper->from_nlattr(helpinfo, ct);
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001621
1622 /* not in hash table yet so not strictly necessary */
Stephen Hemmingera9b3cd72011-08-01 16:19:00 +00001623 RCU_INIT_POINTER(help->helper, helper);
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001624 }
1625 } else {
1626 /* try an implicit helper assignation */
Patrick McHardyb2a15a62010-02-03 14:13:03 +01001627 err = __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001628 if (err < 0)
1629 goto err2;
Patrick McHarrdy3c158f72007-06-05 12:55:27 -07001630 }
Yasuyuki Kozakaidafc7412006-11-27 10:25:32 -08001631
Pablo Neira Ayusoa88e22a2010-02-19 14:24:39 +01001632 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
1633 err = ctnetlink_change_nat(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001634 if (err < 0)
1635 goto err2;
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001636 }
1637
Pablo Neira Ayusoa88e22a2010-02-19 14:24:39 +01001638 nf_ct_acct_ext_add(ct, GFP_ATOMIC);
Pablo Neira Ayusoa992ca22011-01-19 16:00:07 +01001639 nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
Pablo Neira Ayusoa88e22a2010-02-19 14:24:39 +01001640 nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
Florian Westphalc539f012013-01-11 06:30:44 +00001641 nf_ct_labels_ext_add(ct);
1642
Pablo Neira Ayusoa88e22a2010-02-19 14:24:39 +01001643 /* we must add conntrack extensions before confirmation. */
1644 ct->status |= IPS_CONFIRMED;
1645
1646 if (cda[CTA_STATUS]) {
1647 err = ctnetlink_change_status(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001648 if (err < 0)
1649 goto err2;
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001650 }
1651
Pablo Neira Ayusoc969aa72009-02-09 14:33:57 -08001652#ifdef CONFIG_NF_NAT_NEEDED
1653 if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1654 err = ctnetlink_change_nat_seq_adj(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001655 if (err < 0)
1656 goto err2;
Pablo Neira Ayusoc969aa72009-02-09 14:33:57 -08001657 }
1658#endif
1659
Changli Gaoe5fc9e72010-11-12 17:33:17 +01001660 memset(&ct->proto, 0, sizeof(ct->proto));
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001661 if (cda[CTA_PROTOINFO]) {
1662 err = ctnetlink_change_protoinfo(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001663 if (err < 0)
1664 goto err2;
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001665 }
1666
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001667#if defined(CONFIG_NF_CONNTRACK_MARK)
1668 if (cda[CTA_MARK])
1669 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1670#endif
1671
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001672 /* setup master conntrack: this is a confirmed expectation */
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001673 if (cda[CTA_TUPLE_MASTER]) {
1674 struct nf_conntrack_tuple master;
1675 struct nf_conntrack_tuple_hash *master_h;
1676 struct nf_conn *master_ct;
1677
1678 err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);
1679 if (err < 0)
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001680 goto err2;
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001681
Patrick McHardyef00f892010-02-15 18:14:57 +01001682 master_h = nf_conntrack_find_get(net, zone, &master);
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001683 if (master_h == NULL) {
1684 err = -ENOENT;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001685 goto err2;
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001686 }
1687 master_ct = nf_ct_tuplehash_to_ctrack(master_h);
Pablo Neira Ayusof2a89002007-12-12 10:34:29 -08001688 __set_bit(IPS_EXPECTED_BIT, &ct->status);
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001689 ct->master = master_ct;
Pablo Neira Ayusof2a89002007-12-12 10:34:29 -08001690 }
Pablo Neira Ayuso315c34d2011-04-21 10:55:07 +02001691 tstamp = nf_conn_tstamp_find(ct);
1692 if (tstamp)
1693 tstamp->start = ktime_to_ns(ktime_get_real());
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001694
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001695 err = nf_conntrack_hash_check_insert(ct);
1696 if (err < 0)
1697 goto err2;
1698
Patrick McHardy58a3c9b2008-01-31 04:36:54 -08001699 rcu_read_unlock();
Yasuyuki Kozakaidafc7412006-11-27 10:25:32 -08001700
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001701 return ct;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001702
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001703err2:
1704 rcu_read_unlock();
1705err1:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001706 nf_conntrack_free(ct);
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001707 return ERR_PTR(err);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001708}
1709
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001710static int
1711ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardy39938322009-08-25 16:07:58 +02001712 const struct nlmsghdr *nlh,
1713 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001714{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01001715 struct net *net = sock_net(ctnl);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001716 struct nf_conntrack_tuple otuple, rtuple;
1717 struct nf_conntrack_tuple_hash *h = NULL;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02001718 struct nfgenmsg *nfmsg = nlmsg_data(nlh);
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001719 struct nf_conn *ct;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001720 u_int8_t u3 = nfmsg->nfgen_family;
Patrick McHardyef00f892010-02-15 18:14:57 +01001721 u16 zone;
1722 int err;
1723
1724 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
1725 if (err < 0)
1726 return err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001727
Patrick McHardydf6fb862007-09-28 14:37:03 -07001728 if (cda[CTA_TUPLE_ORIG]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001729 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1730 if (err < 0)
1731 return err;
1732 }
1733
Patrick McHardydf6fb862007-09-28 14:37:03 -07001734 if (cda[CTA_TUPLE_REPLY]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001735 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1736 if (err < 0)
1737 return err;
1738 }
1739
Patrick McHardydf6fb862007-09-28 14:37:03 -07001740 if (cda[CTA_TUPLE_ORIG])
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001741 h = nf_conntrack_find_get(net, zone, &otuple);
Patrick McHardydf6fb862007-09-28 14:37:03 -07001742 else if (cda[CTA_TUPLE_REPLY])
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001743 h = nf_conntrack_find_get(net, zone, &rtuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001744
1745 if (h == NULL) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001746 err = -ENOENT;
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001747 if (nlh->nlmsg_flags & NLM_F_CREATE) {
Pablo Neira Ayusofecc1132009-05-05 17:48:26 +02001748 enum ip_conntrack_events events;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001749
Patrick McHardyef00f892010-02-15 18:14:57 +01001750 ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001751 &rtuple, u3);
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001752 if (IS_ERR(ct))
1753 return PTR_ERR(ct);
1754
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001755 err = 0;
Pablo Neira Ayusofecc1132009-05-05 17:48:26 +02001756 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1757 events = IPCT_RELATED;
1758 else
1759 events = IPCT_NEW;
1760
Patrick McHardy858b31332010-02-03 13:48:53 +01001761 nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
1762 (1 << IPCT_ASSURED) |
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +02001763 (1 << IPCT_HELPER) |
1764 (1 << IPCT_PROTOINFO) |
1765 (1 << IPCT_NATSEQADJ) |
1766 (1 << IPCT_MARK) | events,
Eric W. Biederman15e47302012-09-07 20:12:54 +00001767 ct, NETLINK_CB(skb).portid,
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +02001768 nlmsg_report(nlh));
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001769 nf_ct_put(ct);
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001770 }
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001771
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001772 return err;
1773 }
1774 /* implicit 'else' */
1775
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001776 err = -EEXIST;
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001777 ct = nf_ct_tuplehash_to_ctrack(h);
Pablo Neira Ayusoff4ca822007-08-07 18:11:26 -07001778 if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001779 spin_lock_bh(&nf_conntrack_lock);
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001780 err = ctnetlink_change_conntrack(ct, cda);
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001781 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001782 if (err == 0) {
Patrick McHardy858b31332010-02-03 13:48:53 +01001783 nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
1784 (1 << IPCT_ASSURED) |
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +02001785 (1 << IPCT_HELPER) |
1786 (1 << IPCT_PROTOINFO) |
1787 (1 << IPCT_NATSEQADJ) |
1788 (1 << IPCT_MARK),
Eric W. Biederman15e47302012-09-07 20:12:54 +00001789 ct, NETLINK_CB(skb).portid,
Pablo Neira Ayusoa0891aa2009-06-13 12:26:29 +02001790 nlmsg_report(nlh));
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001791 }
Pablo Neira Ayusoff4ca822007-08-07 18:11:26 -07001792 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001793
Jozsef Kadlecsik7d367e02012-02-24 11:45:49 +01001794 nf_ct_put(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001795 return err;
1796}
1797
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001798static int
Eric W. Biederman15e47302012-09-07 20:12:54 +00001799ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001800 __u16 cpu, const struct ip_conntrack_stat *st)
1801{
1802 struct nlmsghdr *nlh;
1803 struct nfgenmsg *nfmsg;
Eric W. Biederman15e47302012-09-07 20:12:54 +00001804 unsigned int flags = portid ? NLM_F_MULTI : 0, event;
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001805
1806 event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS_CPU);
Eric W. Biederman15e47302012-09-07 20:12:54 +00001807 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001808 if (nlh == NULL)
1809 goto nlmsg_failure;
1810
1811 nfmsg = nlmsg_data(nlh);
1812 nfmsg->nfgen_family = AF_UNSPEC;
1813 nfmsg->version = NFNETLINK_V0;
1814 nfmsg->res_id = htons(cpu);
1815
1816 if (nla_put_be32(skb, CTA_STATS_SEARCHED, htonl(st->searched)) ||
1817 nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
1818 nla_put_be32(skb, CTA_STATS_NEW, htonl(st->new)) ||
1819 nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||
1820 nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||
1821 nla_put_be32(skb, CTA_STATS_DELETE, htonl(st->delete)) ||
1822 nla_put_be32(skb, CTA_STATS_DELETE_LIST, htonl(st->delete_list)) ||
1823 nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||
1824 nla_put_be32(skb, CTA_STATS_INSERT_FAILED,
1825 htonl(st->insert_failed)) ||
1826 nla_put_be32(skb, CTA_STATS_DROP, htonl(st->drop)) ||
1827 nla_put_be32(skb, CTA_STATS_EARLY_DROP, htonl(st->early_drop)) ||
1828 nla_put_be32(skb, CTA_STATS_ERROR, htonl(st->error)) ||
1829 nla_put_be32(skb, CTA_STATS_SEARCH_RESTART,
1830 htonl(st->search_restart)))
1831 goto nla_put_failure;
1832
1833 nlmsg_end(skb, nlh);
1834 return skb->len;
1835
1836nla_put_failure:
1837nlmsg_failure:
1838 nlmsg_cancel(skb, nlh);
1839 return -1;
1840}
1841
1842static int
1843ctnetlink_ct_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)
1844{
1845 int cpu;
1846 struct net *net = sock_net(skb->sk);
1847
1848 if (cb->args[0] == nr_cpu_ids)
1849 return 0;
1850
1851 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
1852 const struct ip_conntrack_stat *st;
1853
1854 if (!cpu_possible(cpu))
1855 continue;
1856
1857 st = per_cpu_ptr(net->ct.stat, cpu);
1858 if (ctnetlink_ct_stat_cpu_fill_info(skb,
Eric W. Biederman15e47302012-09-07 20:12:54 +00001859 NETLINK_CB(cb->skb).portid,
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001860 cb->nlh->nlmsg_seq,
1861 cpu, st) < 0)
1862 break;
1863 }
1864 cb->args[0] = cpu;
1865
1866 return skb->len;
1867}
1868
1869static int
1870ctnetlink_stat_ct_cpu(struct sock *ctnl, struct sk_buff *skb,
1871 const struct nlmsghdr *nlh,
1872 const struct nlattr * const cda[])
1873{
1874 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1875 struct netlink_dump_control c = {
1876 .dump = ctnetlink_ct_stat_cpu_dump,
1877 };
1878 return netlink_dump_start(ctnl, skb, nlh, &c);
1879 }
1880
1881 return 0;
1882}
1883
1884static int
Eric W. Biederman15e47302012-09-07 20:12:54 +00001885ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001886 struct net *net)
1887{
1888 struct nlmsghdr *nlh;
1889 struct nfgenmsg *nfmsg;
Eric W. Biederman15e47302012-09-07 20:12:54 +00001890 unsigned int flags = portid ? NLM_F_MULTI : 0, event;
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001891 unsigned int nr_conntracks = atomic_read(&net->ct.count);
1892
1893 event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS);
Eric W. Biederman15e47302012-09-07 20:12:54 +00001894 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001895 if (nlh == NULL)
1896 goto nlmsg_failure;
1897
1898 nfmsg = nlmsg_data(nlh);
1899 nfmsg->nfgen_family = AF_UNSPEC;
1900 nfmsg->version = NFNETLINK_V0;
1901 nfmsg->res_id = 0;
1902
1903 if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))
1904 goto nla_put_failure;
1905
1906 nlmsg_end(skb, nlh);
1907 return skb->len;
1908
1909nla_put_failure:
1910nlmsg_failure:
1911 nlmsg_cancel(skb, nlh);
1912 return -1;
1913}
1914
1915static int
1916ctnetlink_stat_ct(struct sock *ctnl, struct sk_buff *skb,
1917 const struct nlmsghdr *nlh,
1918 const struct nlattr * const cda[])
1919{
1920 struct sk_buff *skb2;
1921 int err;
1922
1923 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1924 if (skb2 == NULL)
1925 return -ENOMEM;
1926
Eric W. Biederman15e47302012-09-07 20:12:54 +00001927 err = ctnetlink_stat_ct_fill_info(skb2, NETLINK_CB(skb).portid,
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001928 nlh->nlmsg_seq,
1929 NFNL_MSG_TYPE(nlh->nlmsg_type),
1930 sock_net(skb->sk));
1931 if (err <= 0)
1932 goto free;
1933
Eric W. Biederman15e47302012-09-07 20:12:54 +00001934 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02001935 if (err < 0)
1936 goto out;
1937
1938 return 0;
1939
1940free:
1941 kfree_skb(skb2);
1942out:
1943 /* this avoids a loop in nfnetlink. */
1944 return err == -EAGAIN ? -ENOBUFS : err;
1945}
1946
Pablo Neira Ayuso7c622342012-06-19 02:10:57 +02001947#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02001948static size_t
1949ctnetlink_nfqueue_build_size(const struct nf_conn *ct)
1950{
1951 return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
1952 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
1953 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
1954 + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
1955 + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
1956 + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */
1957 + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
1958 + nla_total_size(0) /* CTA_PROTOINFO */
1959 + nla_total_size(0) /* CTA_HELP */
1960 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
1961 + ctnetlink_secctx_size(ct)
1962#ifdef CONFIG_NF_NAT_NEEDED
1963 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
1964 + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
1965#endif
1966#ifdef CONFIG_NF_CONNTRACK_MARK
1967 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
1968#endif
1969 + ctnetlink_proto_size(ct)
1970 ;
1971}
1972
1973static int
1974ctnetlink_nfqueue_build(struct sk_buff *skb, struct nf_conn *ct)
1975{
1976 struct nlattr *nest_parms;
1977
1978 rcu_read_lock();
1979 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
1980 if (!nest_parms)
1981 goto nla_put_failure;
1982 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
1983 goto nla_put_failure;
1984 nla_nest_end(skb, nest_parms);
1985
1986 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
1987 if (!nest_parms)
1988 goto nla_put_failure;
1989 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
1990 goto nla_put_failure;
1991 nla_nest_end(skb, nest_parms);
1992
1993 if (nf_ct_zone(ct)) {
1994 if (nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
1995 goto nla_put_failure;
1996 }
1997
1998 if (ctnetlink_dump_id(skb, ct) < 0)
1999 goto nla_put_failure;
2000
2001 if (ctnetlink_dump_status(skb, ct) < 0)
2002 goto nla_put_failure;
2003
2004 if (ctnetlink_dump_timeout(skb, ct) < 0)
2005 goto nla_put_failure;
2006
2007 if (ctnetlink_dump_protoinfo(skb, ct) < 0)
2008 goto nla_put_failure;
2009
2010 if (ctnetlink_dump_helpinfo(skb, ct) < 0)
2011 goto nla_put_failure;
2012
2013#ifdef CONFIG_NF_CONNTRACK_SECMARK
2014 if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0)
2015 goto nla_put_failure;
2016#endif
2017 if (ct->master && ctnetlink_dump_master(skb, ct) < 0)
2018 goto nla_put_failure;
2019
2020 if ((ct->status & IPS_SEQ_ADJUST) &&
2021 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
2022 goto nla_put_failure;
2023
2024#ifdef CONFIG_NF_CONNTRACK_MARK
2025 if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)
2026 goto nla_put_failure;
2027#endif
Florian Westphal0ceabd82013-01-11 06:30:45 +00002028 if (ctnetlink_dump_labels(skb, ct) < 0)
2029 goto nla_put_failure;
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02002030 rcu_read_unlock();
2031 return 0;
2032
2033nla_put_failure:
2034 rcu_read_unlock();
2035 return -ENOSPC;
2036}
2037
2038static int
2039ctnetlink_nfqueue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)
2040{
2041 int err;
2042
2043 if (cda[CTA_TIMEOUT]) {
2044 err = ctnetlink_change_timeout(ct, cda);
2045 if (err < 0)
2046 return err;
2047 }
2048 if (cda[CTA_STATUS]) {
2049 err = ctnetlink_change_status(ct, cda);
2050 if (err < 0)
2051 return err;
2052 }
2053 if (cda[CTA_HELP]) {
2054 err = ctnetlink_change_helper(ct, cda);
2055 if (err < 0)
2056 return err;
2057 }
2058#if defined(CONFIG_NF_CONNTRACK_MARK)
2059 if (cda[CTA_MARK])
2060 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
2061#endif
2062 return 0;
2063}
2064
2065static int
2066ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)
2067{
2068 struct nlattr *cda[CTA_MAX+1];
Pablo Neira Ayuso68e035c2012-08-14 12:47:37 +02002069 int ret;
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02002070
2071 nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);
2072
Pablo Neira Ayuso68e035c2012-08-14 12:47:37 +02002073 spin_lock_bh(&nf_conntrack_lock);
2074 ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
2075 spin_unlock_bh(&nf_conntrack_lock);
2076
2077 return ret;
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02002078}
2079
2080static struct nfq_ct_hook ctnetlink_nfqueue_hook = {
2081 .build_size = ctnetlink_nfqueue_build_size,
2082 .build = ctnetlink_nfqueue_build,
2083 .parse = ctnetlink_nfqueue_parse,
2084};
Pablo Neira Ayuso7c622342012-06-19 02:10:57 +02002085#endif /* CONFIG_NETFILTER_NETLINK_QUEUE_CT */
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02002086
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002087/***********************************************************************
2088 * EXPECT
2089 ***********************************************************************/
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002090
2091static inline int
2092ctnetlink_exp_dump_tuple(struct sk_buff *skb,
2093 const struct nf_conntrack_tuple *tuple,
2094 enum ctattr_expect type)
2095{
Patrick McHardydf6fb862007-09-28 14:37:03 -07002096 struct nlattr *nest_parms;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002097
Patrick McHardydf6fb862007-09-28 14:37:03 -07002098 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
2099 if (!nest_parms)
2100 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002101 if (ctnetlink_dump_tuples(skb, tuple) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07002102 goto nla_put_failure;
2103 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002104
2105 return 0;
2106
Patrick McHardydf6fb862007-09-28 14:37:03 -07002107nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002108 return -1;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002109}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002110
2111static inline int
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002112ctnetlink_exp_dump_mask(struct sk_buff *skb,
2113 const struct nf_conntrack_tuple *tuple,
Patrick McHardyd4156e82007-07-07 22:31:32 -07002114 const struct nf_conntrack_tuple_mask *mask)
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002115{
2116 int ret;
2117 struct nf_conntrack_l3proto *l3proto;
Martin Josefsson605dcad2006-11-29 02:35:06 +01002118 struct nf_conntrack_l4proto *l4proto;
Patrick McHardyd4156e82007-07-07 22:31:32 -07002119 struct nf_conntrack_tuple m;
Patrick McHardydf6fb862007-09-28 14:37:03 -07002120 struct nlattr *nest_parms;
Patrick McHardyd4156e82007-07-07 22:31:32 -07002121
2122 memset(&m, 0xFF, sizeof(m));
Patrick McHardyd4156e82007-07-07 22:31:32 -07002123 memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
Patrick McHardye5787562010-01-26 17:04:02 +01002124 m.src.u.all = mask->src.u.all;
2125 m.dst.protonum = tuple->dst.protonum;
Patrick McHardyd4156e82007-07-07 22:31:32 -07002126
Patrick McHardydf6fb862007-09-28 14:37:03 -07002127 nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
2128 if (!nest_parms)
2129 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002130
Hans Schillstrom3b988ec2012-03-05 02:24:29 +00002131 rcu_read_lock();
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01002132 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
Patrick McHardyd4156e82007-07-07 22:31:32 -07002133 ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
Hans Schillstrom3b988ec2012-03-05 02:24:29 +00002134 if (ret >= 0) {
2135 l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
2136 tuple->dst.protonum);
Patrick McHardyd4156e82007-07-07 22:31:32 -07002137 ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
Hans Schillstrom3b988ec2012-03-05 02:24:29 +00002138 }
2139 rcu_read_unlock();
2140
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002141 if (unlikely(ret < 0))
Patrick McHardydf6fb862007-09-28 14:37:03 -07002142 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002143
Patrick McHardydf6fb862007-09-28 14:37:03 -07002144 nla_nest_end(skb, nest_parms);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002145
2146 return 0;
2147
Patrick McHardydf6fb862007-09-28 14:37:03 -07002148nla_put_failure:
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002149 return -1;
2150}
2151
Patrick McHardyc7232c92012-08-26 19:14:06 +02002152static const union nf_inet_addr any_addr;
2153
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -08002154static int
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002155ctnetlink_exp_dump_expect(struct sk_buff *skb,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002156 const struct nf_conntrack_expect *exp)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002157{
2158 struct nf_conn *master = exp->master;
Xi Wangc1216382011-12-30 10:40:17 -05002159 long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
Pablo Neira Ayusobc01befd2010-09-28 21:06:34 +02002160 struct nf_conn_help *help;
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002161#ifdef CONFIG_NF_NAT_NEEDED
2162 struct nlattr *nest_parms;
2163 struct nf_conntrack_tuple nat_tuple = {};
2164#endif
Pablo Neira Ayuso544d5c72012-02-05 03:44:51 +01002165 struct nf_ct_helper_expectfn *expfn;
2166
Patrick McHardyd978e5d2007-12-17 22:37:03 -08002167 if (timeout < 0)
2168 timeout = 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002169
2170 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07002171 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08002172 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07002173 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002174 if (ctnetlink_exp_dump_tuple(skb,
2175 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
2176 CTA_EXPECT_MASTER) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07002177 goto nla_put_failure;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002178
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002179#ifdef CONFIG_NF_NAT_NEEDED
Patrick McHardyc7232c92012-08-26 19:14:06 +02002180 if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) ||
2181 exp->saved_proto.all) {
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002182 nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);
2183 if (!nest_parms)
2184 goto nla_put_failure;
2185
David S. Millercc1eb432012-04-01 18:57:48 -04002186 if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))
2187 goto nla_put_failure;
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002188
2189 nat_tuple.src.l3num = nf_ct_l3num(master);
Patrick McHardyc7232c92012-08-26 19:14:06 +02002190 nat_tuple.src.u3 = exp->saved_addr;
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002191 nat_tuple.dst.protonum = nf_ct_protonum(master);
2192 nat_tuple.src.u = exp->saved_proto;
2193
2194 if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,
2195 CTA_EXPECT_NAT_TUPLE) < 0)
2196 goto nla_put_failure;
2197 nla_nest_end(skb, nest_parms);
2198 }
2199#endif
David S. Millercc1eb432012-04-01 18:57:48 -04002200 if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||
2201 nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) ||
2202 nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
2203 nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
2204 goto nla_put_failure;
Pablo Neira Ayusobc01befd2010-09-28 21:06:34 +02002205 help = nfct_help(master);
2206 if (help) {
2207 struct nf_conntrack_helper *helper;
2208
2209 helper = rcu_dereference(help->helper);
David S. Millercc1eb432012-04-01 18:57:48 -04002210 if (helper &&
2211 nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))
2212 goto nla_put_failure;
Pablo Neira Ayusobc01befd2010-09-28 21:06:34 +02002213 }
Pablo Neira Ayuso544d5c72012-02-05 03:44:51 +01002214 expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);
David S. Millercc1eb432012-04-01 18:57:48 -04002215 if (expfn != NULL &&
2216 nla_put_string(skb, CTA_EXPECT_FN, expfn->name))
2217 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002218
2219 return 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002220
Patrick McHardydf6fb862007-09-28 14:37:03 -07002221nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002222 return -1;
2223}
2224
2225static int
Eric W. Biederman15e47302012-09-07 20:12:54 +00002226ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
Pablo Neira Ayuso8b0a2312009-06-02 20:03:34 +02002227 int event, const struct nf_conntrack_expect *exp)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002228{
2229 struct nlmsghdr *nlh;
2230 struct nfgenmsg *nfmsg;
Eric W. Biederman15e47302012-09-07 20:12:54 +00002231 unsigned int flags = portid ? NLM_F_MULTI : 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002232
2233 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
Eric W. Biederman15e47302012-09-07 20:12:54 +00002234 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002235 if (nlh == NULL)
2236 goto nlmsg_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002237
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002238 nfmsg = nlmsg_data(nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002239 nfmsg->nfgen_family = exp->tuple.src.l3num;
2240 nfmsg->version = NFNETLINK_V0;
2241 nfmsg->res_id = 0;
2242
2243 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07002244 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002245
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002246 nlmsg_end(skb, nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002247 return skb->len;
2248
2249nlmsg_failure:
Patrick McHardydf6fb862007-09-28 14:37:03 -07002250nla_put_failure:
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002251 nlmsg_cancel(skb, nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002252 return -1;
2253}
2254
2255#ifdef CONFIG_NF_CONNTRACK_EVENTS
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +02002256static int
2257ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002258{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002259 struct nf_conntrack_expect *exp = item->exp;
2260 struct net *net = nf_ct_exp_net(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002261 struct nlmsghdr *nlh;
2262 struct nfgenmsg *nfmsg;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002263 struct sk_buff *skb;
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002264 unsigned int type, group;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002265 int flags = 0;
2266
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002267 if (events & (1 << IPEXP_DESTROY)) {
2268 type = IPCTNL_MSG_EXP_DELETE;
2269 group = NFNLGRP_CONNTRACK_EXP_DESTROY;
2270 } else if (events & (1 << IPEXP_NEW)) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002271 type = IPCTNL_MSG_EXP_NEW;
2272 flags = NLM_F_CREATE|NLM_F_EXCL;
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002273 group = NFNLGRP_CONNTRACK_EXP_NEW;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002274 } else
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +02002275 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002276
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002277 if (!item->report && !nfnetlink_has_listeners(net, group))
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +02002278 return 0;
Pablo Neira Ayusob3a27bf2006-08-22 00:32:05 -07002279
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002280 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
2281 if (skb == NULL)
Pablo Neira Ayuso150ace02009-04-17 17:47:31 +02002282 goto errout;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002283
Marcus Sundbergb633ad52006-02-04 02:11:09 -08002284 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
Eric W. Biederman15e47302012-09-07 20:12:54 +00002285 nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002286 if (nlh == NULL)
2287 goto nlmsg_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002288
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002289 nfmsg = nlmsg_data(nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002290 nfmsg->nfgen_family = exp->tuple.src.l3num;
2291 nfmsg->version = NFNETLINK_V0;
2292 nfmsg->res_id = 0;
2293
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01002294 rcu_read_lock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002295 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07002296 goto nla_put_failure;
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01002297 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002298
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002299 nlmsg_end(skb, nlh);
Eric W. Biederman15e47302012-09-07 20:12:54 +00002300 nfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC);
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +02002301 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002302
Patrick McHardydf6fb862007-09-28 14:37:03 -07002303nla_put_failure:
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01002304 rcu_read_unlock();
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002305 nlmsg_cancel(skb, nlh);
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01002306nlmsg_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002307 kfree_skb(skb);
Pablo Neira Ayuso150ace02009-04-17 17:47:31 +02002308errout:
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002309 nfnetlink_set_err(net, 0, 0, -ENOBUFS);
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +02002310 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002311}
2312#endif
Patrick McHardycf6994c2007-07-07 22:32:34 -07002313static int ctnetlink_exp_done(struct netlink_callback *cb)
2314{
Patrick McHardy31f15872007-07-07 22:35:21 -07002315 if (cb->args[1])
2316 nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
Patrick McHardycf6994c2007-07-07 22:32:34 -07002317 return 0;
2318}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002319
2320static int
2321ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
2322{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002323 struct net *net = sock_net(skb->sk);
Patrick McHardycf6994c2007-07-07 22:32:34 -07002324 struct nf_conntrack_expect *exp, *last;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002325 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
Patrick McHardy31f15872007-07-07 22:35:21 -07002326 struct hlist_node *n;
Pablo Neira Ayuso87711cb2006-01-05 12:19:23 -08002327 u_int8_t l3proto = nfmsg->nfgen_family;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002328
Patrick McHardy7d0742d2008-01-31 04:38:19 -08002329 rcu_read_lock();
Patrick McHardy31f15872007-07-07 22:35:21 -07002330 last = (struct nf_conntrack_expect *)cb->args[1];
2331 for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
Patrick McHardycf6994c2007-07-07 22:32:34 -07002332restart:
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02002333 hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
Patrick McHardy31f15872007-07-07 22:35:21 -07002334 hnode) {
2335 if (l3proto && exp->tuple.src.l3num != l3proto)
Patrick McHardycf6994c2007-07-07 22:32:34 -07002336 continue;
Patrick McHardy31f15872007-07-07 22:35:21 -07002337 if (cb->args[1]) {
2338 if (exp != last)
2339 continue;
2340 cb->args[1] = 0;
2341 }
Pablo Neira Ayuso8b0a2312009-06-02 20:03:34 +02002342 if (ctnetlink_exp_fill_info(skb,
Eric W. Biederman15e47302012-09-07 20:12:54 +00002343 NETLINK_CB(cb->skb).portid,
Patrick McHardy31f15872007-07-07 22:35:21 -07002344 cb->nlh->nlmsg_seq,
2345 IPCTNL_MSG_EXP_NEW,
Pablo Neira Ayuso8b0a2312009-06-02 20:03:34 +02002346 exp) < 0) {
Patrick McHardy7d0742d2008-01-31 04:38:19 -08002347 if (!atomic_inc_not_zero(&exp->use))
2348 continue;
Patrick McHardy31f15872007-07-07 22:35:21 -07002349 cb->args[1] = (unsigned long)exp;
2350 goto out;
2351 }
Patrick McHardycf6994c2007-07-07 22:32:34 -07002352 }
Patrick McHardy31f15872007-07-07 22:35:21 -07002353 if (cb->args[1]) {
2354 cb->args[1] = 0;
2355 goto restart;
Patrick McHardycf6994c2007-07-07 22:32:34 -07002356 }
2357 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002358out:
Patrick McHardy7d0742d2008-01-31 04:38:19 -08002359 rcu_read_unlock();
Patrick McHardycf6994c2007-07-07 22:32:34 -07002360 if (last)
2361 nf_ct_expect_put(last);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002362
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002363 return skb->len;
2364}
2365
Patrick McHardyf73e9242007-09-28 14:39:55 -07002366static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
Patrick McHardyd0b02682010-02-10 15:38:33 +01002367 [CTA_EXPECT_MASTER] = { .type = NLA_NESTED },
2368 [CTA_EXPECT_TUPLE] = { .type = NLA_NESTED },
2369 [CTA_EXPECT_MASK] = { .type = NLA_NESTED },
Patrick McHardyf73e9242007-09-28 14:39:55 -07002370 [CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },
2371 [CTA_EXPECT_ID] = { .type = NLA_U32 },
Florian Westphal6d1fafc2012-11-22 01:32:46 +00002372 [CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING,
2373 .len = NF_CT_HELPER_NAME_LEN - 1 },
Pablo Neira Ayusobcac0df2010-09-22 08:35:36 +02002374 [CTA_EXPECT_ZONE] = { .type = NLA_U16 },
Pablo Neira Ayuso8b008fa2010-09-22 08:36:59 +02002375 [CTA_EXPECT_FLAGS] = { .type = NLA_U32 },
Pablo Neira Ayusob8c5e522012-02-05 03:21:12 +01002376 [CTA_EXPECT_CLASS] = { .type = NLA_U32 },
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002377 [CTA_EXPECT_NAT] = { .type = NLA_NESTED },
Pablo Neira Ayuso544d5c72012-02-05 03:44:51 +01002378 [CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002379};
2380
2381static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002382ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardy39938322009-08-25 16:07:58 +02002383 const struct nlmsghdr *nlh,
2384 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002385{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002386 struct net *net = sock_net(ctnl);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002387 struct nf_conntrack_tuple tuple;
2388 struct nf_conntrack_expect *exp;
2389 struct sk_buff *skb2;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002390 struct nfgenmsg *nfmsg = nlmsg_data(nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002391 u_int8_t u3 = nfmsg->nfgen_family;
Patrick McHardyef00f892010-02-15 18:14:57 +01002392 u16 zone;
2393 int err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002394
David S. Millerb8f3ab42011-01-18 12:40:38 -08002395 if (nlh->nlmsg_flags & NLM_F_DUMP) {
Pablo Neira Ayuso80d326f2012-02-24 14:30:15 +00002396 struct netlink_dump_control c = {
2397 .dump = ctnetlink_exp_dump_table,
2398 .done = ctnetlink_exp_done,
2399 };
2400 return netlink_dump_start(ctnl, skb, nlh, &c);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002401 }
2402
Patrick McHardyef00f892010-02-15 18:14:57 +01002403 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
2404 if (err < 0)
2405 return err;
2406
Pablo Neira Ayuso35dba1d2011-12-14 12:45:22 +01002407 if (cda[CTA_EXPECT_TUPLE])
2408 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
2409 else if (cda[CTA_EXPECT_MASTER])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002410 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
2411 else
2412 return -EINVAL;
2413
2414 if (err < 0)
2415 return err;
2416
Patrick McHardyef00f892010-02-15 18:14:57 +01002417 exp = nf_ct_expect_find_get(net, zone, &tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002418 if (!exp)
2419 return -ENOENT;
2420
Patrick McHardydf6fb862007-09-28 14:37:03 -07002421 if (cda[CTA_EXPECT_ID]) {
Patrick McHardy77236b62007-12-17 22:29:45 -08002422 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
Patrick McHardy35832402007-09-28 14:41:50 -07002423 if (ntohl(id) != (u32)(unsigned long)exp) {
Patrick McHardy68236452007-07-07 22:30:49 -07002424 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002425 return -ENOENT;
2426 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002427 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002428
2429 err = -ENOMEM;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002430 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
Pablo Neira Ayuso81378f72011-12-24 19:03:46 +01002431 if (skb2 == NULL) {
2432 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002433 goto out;
Pablo Neira Ayuso81378f72011-12-24 19:03:46 +01002434 }
Thomas Graf4e9b8262006-11-27 09:25:58 -08002435
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01002436 rcu_read_lock();
Eric W. Biederman15e47302012-09-07 20:12:54 +00002437 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,
Pablo Neira Ayuso8b0a2312009-06-02 20:03:34 +02002438 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01002439 rcu_read_unlock();
Pablo Neira Ayuso81378f72011-12-24 19:03:46 +01002440 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002441 if (err <= 0)
2442 goto free;
2443
Eric W. Biederman15e47302012-09-07 20:12:54 +00002444 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
Pablo Neira Ayuso81378f72011-12-24 19:03:46 +01002445 if (err < 0)
2446 goto out;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002447
Pablo Neira Ayuso81378f72011-12-24 19:03:46 +01002448 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002449
2450free:
2451 kfree_skb(skb2);
2452out:
Pablo Neira Ayuso81378f72011-12-24 19:03:46 +01002453 /* this avoids a loop in nfnetlink. */
2454 return err == -EAGAIN ? -ENOBUFS : err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002455}
2456
2457static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002458ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardy39938322009-08-25 16:07:58 +02002459 const struct nlmsghdr *nlh,
2460 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002461{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002462 struct net *net = sock_net(ctnl);
Patrick McHardy31f15872007-07-07 22:35:21 -07002463 struct nf_conntrack_expect *exp;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002464 struct nf_conntrack_tuple tuple;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002465 struct nfgenmsg *nfmsg = nlmsg_data(nlh);
Patrick McHardy31f15872007-07-07 22:35:21 -07002466 struct hlist_node *n, *next;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002467 u_int8_t u3 = nfmsg->nfgen_family;
Patrick McHardy31f15872007-07-07 22:35:21 -07002468 unsigned int i;
Patrick McHardyef00f892010-02-15 18:14:57 +01002469 u16 zone;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002470 int err;
2471
Patrick McHardydf6fb862007-09-28 14:37:03 -07002472 if (cda[CTA_EXPECT_TUPLE]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002473 /* delete a single expect by tuple */
Patrick McHardyef00f892010-02-15 18:14:57 +01002474 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
2475 if (err < 0)
2476 return err;
2477
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002478 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
2479 if (err < 0)
2480 return err;
2481
2482 /* bump usage count to 2 */
Patrick McHardyef00f892010-02-15 18:14:57 +01002483 exp = nf_ct_expect_find_get(net, zone, &tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002484 if (!exp)
2485 return -ENOENT;
2486
Patrick McHardydf6fb862007-09-28 14:37:03 -07002487 if (cda[CTA_EXPECT_ID]) {
Patrick McHardy77236b62007-12-17 22:29:45 -08002488 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
Patrick McHardy35832402007-09-28 14:41:50 -07002489 if (ntohl(id) != (u32)(unsigned long)exp) {
Patrick McHardy68236452007-07-07 22:30:49 -07002490 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002491 return -ENOENT;
2492 }
2493 }
2494
2495 /* after list removal, usage count == 1 */
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002496 spin_lock_bh(&nf_conntrack_lock);
2497 if (del_timer(&exp->timeout)) {
Eric W. Biederman15e47302012-09-07 20:12:54 +00002498 nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002499 nlmsg_report(nlh));
2500 nf_ct_expect_put(exp);
2501 }
2502 spin_unlock_bh(&nf_conntrack_lock);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002503 /* have to put what we 'get' above.
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002504 * after this line usage count == 0 */
Patrick McHardy68236452007-07-07 22:30:49 -07002505 nf_ct_expect_put(exp);
Patrick McHardydf6fb862007-09-28 14:37:03 -07002506 } else if (cda[CTA_EXPECT_HELP_NAME]) {
2507 char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
Patrick McHardy31f15872007-07-07 22:35:21 -07002508 struct nf_conn_help *m_help;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002509
2510 /* delete all expectations for this helper */
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08002511 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardy31f15872007-07-07 22:35:21 -07002512 for (i = 0; i < nf_ct_expect_hsize; i++) {
2513 hlist_for_each_entry_safe(exp, n, next,
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002514 &net->ct.expect_hash[i],
Patrick McHardy31f15872007-07-07 22:35:21 -07002515 hnode) {
2516 m_help = nfct_help(exp->master);
Patrick McHardy794e6872010-02-03 13:41:29 +01002517 if (!strcmp(m_help->helper->name, name) &&
2518 del_timer(&exp->timeout)) {
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002519 nf_ct_unlink_expect_report(exp,
Eric W. Biederman15e47302012-09-07 20:12:54 +00002520 NETLINK_CB(skb).portid,
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002521 nlmsg_report(nlh));
Patrick McHardy31f15872007-07-07 22:35:21 -07002522 nf_ct_expect_put(exp);
2523 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002524 }
2525 }
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08002526 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002527 } else {
2528 /* This basically means we have to flush everything*/
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08002529 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardy31f15872007-07-07 22:35:21 -07002530 for (i = 0; i < nf_ct_expect_hsize; i++) {
2531 hlist_for_each_entry_safe(exp, n, next,
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002532 &net->ct.expect_hash[i],
Patrick McHardy31f15872007-07-07 22:35:21 -07002533 hnode) {
2534 if (del_timer(&exp->timeout)) {
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002535 nf_ct_unlink_expect_report(exp,
Eric W. Biederman15e47302012-09-07 20:12:54 +00002536 NETLINK_CB(skb).portid,
Pablo Neira Ayusoebbf41d2010-10-19 10:19:06 +02002537 nlmsg_report(nlh));
Patrick McHardy31f15872007-07-07 22:35:21 -07002538 nf_ct_expect_put(exp);
2539 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002540 }
2541 }
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08002542 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002543 }
2544
2545 return 0;
2546}
2547static int
Patrick McHardy39938322009-08-25 16:07:58 +02002548ctnetlink_change_expect(struct nf_conntrack_expect *x,
2549 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002550{
Kelvie Wong9768e1a2012-05-02 14:39:24 +00002551 if (cda[CTA_EXPECT_TIMEOUT]) {
2552 if (!del_timer(&x->timeout))
2553 return -ETIME;
2554
2555 x->timeout.expires = jiffies +
2556 ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
2557 add_timer(&x->timeout);
2558 }
2559 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002560}
2561
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002562static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
2563 [CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 },
2564 [CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED },
2565};
2566
2567static int
2568ctnetlink_parse_expect_nat(const struct nlattr *attr,
2569 struct nf_conntrack_expect *exp,
2570 u_int8_t u3)
2571{
2572#ifdef CONFIG_NF_NAT_NEEDED
2573 struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];
2574 struct nf_conntrack_tuple nat_tuple = {};
2575 int err;
2576
2577 nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_nla_policy);
2578
2579 if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE])
2580 return -EINVAL;
2581
2582 err = ctnetlink_parse_tuple((const struct nlattr * const *)tb,
2583 &nat_tuple, CTA_EXPECT_NAT_TUPLE, u3);
2584 if (err < 0)
2585 return err;
2586
Patrick McHardyc7232c92012-08-26 19:14:06 +02002587 exp->saved_addr = nat_tuple.src.u3;
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002588 exp->saved_proto = nat_tuple.src.u;
2589 exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));
2590
2591 return 0;
2592#else
2593 return -EOPNOTSUPP;
2594#endif
2595}
2596
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002597static int
Patrick McHardyef00f892010-02-15 18:14:57 +01002598ctnetlink_create_expect(struct net *net, u16 zone,
2599 const struct nlattr * const cda[],
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002600 u_int8_t u3,
Eric W. Biederman15e47302012-09-07 20:12:54 +00002601 u32 portid, int report)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002602{
2603 struct nf_conntrack_tuple tuple, mask, master_tuple;
2604 struct nf_conntrack_tuple_hash *h = NULL;
2605 struct nf_conntrack_expect *exp;
2606 struct nf_conn *ct;
Harald Weltedc808fe2006-03-20 17:56:32 -08002607 struct nf_conn_help *help;
Pablo Neira Ayuso660fdb22012-02-05 02:34:16 +01002608 struct nf_conntrack_helper *helper = NULL;
Pablo Neira Ayusob8c5e522012-02-05 03:21:12 +01002609 u_int32_t class = 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002610 int err = 0;
2611
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002612 /* caller guarantees that those three CTA_EXPECT_* exist */
2613 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
2614 if (err < 0)
2615 return err;
2616 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
2617 if (err < 0)
2618 return err;
2619 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
2620 if (err < 0)
2621 return err;
2622
2623 /* Look for master conntrack of this expectation */
Patrick McHardyef00f892010-02-15 18:14:57 +01002624 h = nf_conntrack_find_get(net, zone, &master_tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002625 if (!h)
2626 return -ENOENT;
2627 ct = nf_ct_tuplehash_to_ctrack(h);
Pablo Neira Ayuso660fdb22012-02-05 02:34:16 +01002628
2629 /* Look for helper of this expectation */
2630 if (cda[CTA_EXPECT_HELP_NAME]) {
2631 const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
2632
2633 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
2634 nf_ct_protonum(ct));
2635 if (helper == NULL) {
2636#ifdef CONFIG_MODULES
2637 if (request_module("nfct-helper-%s", helpname) < 0) {
2638 err = -EOPNOTSUPP;
2639 goto out;
2640 }
2641
2642 helper = __nf_conntrack_helper_find(helpname,
2643 nf_ct_l3num(ct),
2644 nf_ct_protonum(ct));
2645 if (helper) {
2646 err = -EAGAIN;
2647 goto out;
2648 }
2649#endif
2650 err = -EOPNOTSUPP;
2651 goto out;
2652 }
2653 }
2654
Pablo Neira Ayusob8c5e522012-02-05 03:21:12 +01002655 if (cda[CTA_EXPECT_CLASS] && helper) {
2656 class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
2657 if (class > helper->expect_class_max) {
2658 err = -EINVAL;
2659 goto out;
2660 }
2661 }
Patrick McHardy68236452007-07-07 22:30:49 -07002662 exp = nf_ct_expect_alloc(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002663 if (!exp) {
2664 err = -ENOMEM;
2665 goto out;
2666 }
Pablo Neira Ayusobc01befd2010-09-28 21:06:34 +02002667 help = nfct_help(ct);
2668 if (!help) {
2669 if (!cda[CTA_EXPECT_TIMEOUT]) {
2670 err = -EINVAL;
Jesper Juhl1310b9552012-12-26 11:49:40 +00002671 goto err_out;
Pablo Neira Ayusobc01befd2010-09-28 21:06:34 +02002672 }
2673 exp->timeout.expires =
2674 jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002675
Pablo Neira Ayusobc01befd2010-09-28 21:06:34 +02002676 exp->flags = NF_CT_EXPECT_USERSPACE;
2677 if (cda[CTA_EXPECT_FLAGS]) {
2678 exp->flags |=
2679 ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
2680 }
2681 } else {
2682 if (cda[CTA_EXPECT_FLAGS]) {
2683 exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
2684 exp->flags &= ~NF_CT_EXPECT_USERSPACE;
2685 } else
2686 exp->flags = 0;
2687 }
Pablo Neira Ayuso544d5c72012-02-05 03:44:51 +01002688 if (cda[CTA_EXPECT_FN]) {
2689 const char *name = nla_data(cda[CTA_EXPECT_FN]);
2690 struct nf_ct_helper_expectfn *expfn;
2691
2692 expfn = nf_ct_helper_expectfn_find_by_name(name);
2693 if (expfn == NULL) {
2694 err = -EINVAL;
2695 goto err_out;
2696 }
2697 exp->expectfn = expfn->expectfn;
2698 } else
2699 exp->expectfn = NULL;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002700
Pablo Neira Ayusob8c5e522012-02-05 03:21:12 +01002701 exp->class = class;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002702 exp->master = ct;
Pablo Neira Ayuso660fdb22012-02-05 02:34:16 +01002703 exp->helper = helper;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002704 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
Patrick McHardyd4156e82007-07-07 22:31:32 -07002705 memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
2706 exp->mask.src.u.all = mask.src.u.all;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002707
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002708 if (cda[CTA_EXPECT_NAT]) {
2709 err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],
2710 exp, u3);
2711 if (err < 0)
2712 goto err_out;
2713 }
Eric W. Biederman15e47302012-09-07 20:12:54 +00002714 err = nf_ct_expect_related_report(exp, portid, report);
Pablo Neira Ayuso076a0ca2012-02-05 03:41:52 +01002715err_out:
Patrick McHardy68236452007-07-07 22:30:49 -07002716 nf_ct_expect_put(exp);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08002717out:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002718 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
2719 return err;
2720}
2721
2722static int
2723ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardy39938322009-08-25 16:07:58 +02002724 const struct nlmsghdr *nlh,
2725 const struct nlattr * const cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002726{
Alexey Dobriyan9592a5c2010-01-13 16:04:18 +01002727 struct net *net = sock_net(ctnl);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002728 struct nf_conntrack_tuple tuple;
2729 struct nf_conntrack_expect *exp;
Pablo Neira Ayuso96bcf932009-06-02 20:07:39 +02002730 struct nfgenmsg *nfmsg = nlmsg_data(nlh);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002731 u_int8_t u3 = nfmsg->nfgen_family;
Patrick McHardyef00f892010-02-15 18:14:57 +01002732 u16 zone;
2733 int err;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002734
Patrick McHardydf6fb862007-09-28 14:37:03 -07002735 if (!cda[CTA_EXPECT_TUPLE]
2736 || !cda[CTA_EXPECT_MASK]
2737 || !cda[CTA_EXPECT_MASTER])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002738 return -EINVAL;
2739
Patrick McHardyef00f892010-02-15 18:14:57 +01002740 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
2741 if (err < 0)
2742 return err;
2743
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002744 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
2745 if (err < 0)
2746 return err;
2747
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08002748 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardyef00f892010-02-15 18:14:57 +01002749 exp = __nf_ct_expect_find(net, zone, &tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002750
2751 if (!exp) {
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08002752 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002753 err = -ENOENT;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01002754 if (nlh->nlmsg_flags & NLM_F_CREATE) {
Patrick McHardyef00f892010-02-15 18:14:57 +01002755 err = ctnetlink_create_expect(net, zone, cda,
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01002756 u3,
Eric W. Biederman15e47302012-09-07 20:12:54 +00002757 NETLINK_CB(skb).portid,
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01002758 nlmsg_report(nlh));
2759 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002760 return err;
2761 }
2762
2763 err = -EEXIST;
2764 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
2765 err = ctnetlink_change_expect(exp, cda);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08002766 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002767
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002768 return err;
2769}
2770
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02002771static int
Eric W. Biederman15e47302012-09-07 20:12:54 +00002772ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu,
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02002773 const struct ip_conntrack_stat *st)
2774{
2775 struct nlmsghdr *nlh;
2776 struct nfgenmsg *nfmsg;
Eric W. Biederman15e47302012-09-07 20:12:54 +00002777 unsigned int flags = portid ? NLM_F_MULTI : 0, event;
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02002778
2779 event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_EXP_GET_STATS_CPU);
Eric W. Biederman15e47302012-09-07 20:12:54 +00002780 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02002781 if (nlh == NULL)
2782 goto nlmsg_failure;
2783
2784 nfmsg = nlmsg_data(nlh);
2785 nfmsg->nfgen_family = AF_UNSPEC;
2786 nfmsg->version = NFNETLINK_V0;
2787 nfmsg->res_id = htons(cpu);
2788
2789 if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) ||
2790 nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) ||
2791 nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete)))
2792 goto nla_put_failure;
2793
2794 nlmsg_end(skb, nlh);
2795 return skb->len;
2796
2797nla_put_failure:
2798nlmsg_failure:
2799 nlmsg_cancel(skb, nlh);
2800 return -1;
2801}
2802
2803static int
2804ctnetlink_exp_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)
2805{
2806 int cpu;
2807 struct net *net = sock_net(skb->sk);
2808
2809 if (cb->args[0] == nr_cpu_ids)
2810 return 0;
2811
2812 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
2813 const struct ip_conntrack_stat *st;
2814
2815 if (!cpu_possible(cpu))
2816 continue;
2817
2818 st = per_cpu_ptr(net->ct.stat, cpu);
Eric W. Biederman15e47302012-09-07 20:12:54 +00002819 if (ctnetlink_exp_stat_fill_info(skb, NETLINK_CB(cb->skb).portid,
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02002820 cb->nlh->nlmsg_seq,
2821 cpu, st) < 0)
2822 break;
2823 }
2824 cb->args[0] = cpu;
2825
2826 return skb->len;
2827}
2828
2829static int
2830ctnetlink_stat_exp_cpu(struct sock *ctnl, struct sk_buff *skb,
2831 const struct nlmsghdr *nlh,
2832 const struct nlattr * const cda[])
2833{
2834 if (nlh->nlmsg_flags & NLM_F_DUMP) {
2835 struct netlink_dump_control c = {
2836 .dump = ctnetlink_exp_stat_cpu_dump,
2837 };
2838 return netlink_dump_start(ctnl, skb, nlh, &c);
2839 }
2840
2841 return 0;
2842}
2843
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002844#ifdef CONFIG_NF_CONNTRACK_EVENTS
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +02002845static struct nf_ct_event_notifier ctnl_notifier = {
2846 .fcn = ctnetlink_conntrack_event,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002847};
2848
Pablo Neira Ayusoe34d5c12009-06-03 10:32:06 +02002849static struct nf_exp_event_notifier ctnl_notifier_exp = {
2850 .fcn = ctnetlink_expect_event,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002851};
2852#endif
2853
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07002854static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002855 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07002856 .attr_count = CTA_MAX,
2857 .policy = ct_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002858 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07002859 .attr_count = CTA_MAX,
2860 .policy = ct_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002861 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07002862 .attr_count = CTA_MAX,
2863 .policy = ct_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002864 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07002865 .attr_count = CTA_MAX,
2866 .policy = ct_nla_policy },
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02002867 [IPCTNL_MSG_CT_GET_STATS_CPU] = { .call = ctnetlink_stat_ct_cpu },
2868 [IPCTNL_MSG_CT_GET_STATS] = { .call = ctnetlink_stat_ct },
Pablo Neira Ayusod871bef2012-11-27 14:49:42 +01002869 [IPCTNL_MSG_CT_GET_DYING] = { .call = ctnetlink_get_ct_dying },
2870 [IPCTNL_MSG_CT_GET_UNCONFIRMED] = { .call = ctnetlink_get_ct_unconfirmed },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002871};
2872
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07002873static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002874 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
Patrick McHardyf73e9242007-09-28 14:39:55 -07002875 .attr_count = CTA_EXPECT_MAX,
2876 .policy = exp_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002877 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
Patrick McHardyf73e9242007-09-28 14:39:55 -07002878 .attr_count = CTA_EXPECT_MAX,
2879 .policy = exp_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002880 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
Patrick McHardyf73e9242007-09-28 14:39:55 -07002881 .attr_count = CTA_EXPECT_MAX,
2882 .policy = exp_nla_policy },
Pablo Neira Ayuso392025f2012-06-26 20:27:09 +02002883 [IPCTNL_MSG_EXP_GET_STATS_CPU] = { .call = ctnetlink_stat_exp_cpu },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002884};
2885
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07002886static const struct nfnetlink_subsystem ctnl_subsys = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002887 .name = "conntrack",
2888 .subsys_id = NFNL_SUBSYS_CTNETLINK,
2889 .cb_count = IPCTNL_MSG_MAX,
2890 .cb = ctnl_cb,
2891};
2892
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07002893static const struct nfnetlink_subsystem ctnl_exp_subsys = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002894 .name = "conntrack_expect",
2895 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
2896 .cb_count = IPCTNL_MSG_EXP_MAX,
2897 .cb = ctnl_exp_cb,
2898};
2899
Patrick McHardyd2483dd2006-12-02 22:06:05 -08002900MODULE_ALIAS("ip_conntrack_netlink");
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002901MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
Pablo Neira Ayuso34f9a2e2006-02-04 02:11:41 -08002902MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002903
Pablo Neira Ayuso70e99422011-11-22 00:16:51 +01002904static int __net_init ctnetlink_net_init(struct net *net)
2905{
2906#ifdef CONFIG_NF_CONNTRACK_EVENTS
2907 int ret;
2908
2909 ret = nf_conntrack_register_notifier(net, &ctnl_notifier);
2910 if (ret < 0) {
2911 pr_err("ctnetlink_init: cannot register notifier.\n");
2912 goto err_out;
2913 }
2914
2915 ret = nf_ct_expect_register_notifier(net, &ctnl_notifier_exp);
2916 if (ret < 0) {
2917 pr_err("ctnetlink_init: cannot expect register notifier.\n");
2918 goto err_unreg_notifier;
2919 }
2920#endif
2921 return 0;
2922
2923#ifdef CONFIG_NF_CONNTRACK_EVENTS
2924err_unreg_notifier:
2925 nf_conntrack_unregister_notifier(net, &ctnl_notifier);
2926err_out:
2927 return ret;
2928#endif
2929}
2930
2931static void ctnetlink_net_exit(struct net *net)
2932{
2933#ifdef CONFIG_NF_CONNTRACK_EVENTS
2934 nf_ct_expect_unregister_notifier(net, &ctnl_notifier_exp);
2935 nf_conntrack_unregister_notifier(net, &ctnl_notifier);
2936#endif
2937}
2938
2939static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)
2940{
2941 struct net *net;
2942
2943 list_for_each_entry(net, net_exit_list, exit_list)
2944 ctnetlink_net_exit(net);
2945}
2946
2947static struct pernet_operations ctnetlink_net_ops = {
2948 .init = ctnetlink_net_init,
2949 .exit_batch = ctnetlink_net_exit_batch,
2950};
2951
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002952static int __init ctnetlink_init(void)
2953{
2954 int ret;
2955
Stephen Hemminger654d0fb2010-05-13 15:02:08 +02002956 pr_info("ctnetlink v%s: registering with nfnetlink.\n", version);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002957 ret = nfnetlink_subsys_register(&ctnl_subsys);
2958 if (ret < 0) {
Stephen Hemminger654d0fb2010-05-13 15:02:08 +02002959 pr_err("ctnetlink_init: cannot register with nfnetlink.\n");
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002960 goto err_out;
2961 }
2962
2963 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
2964 if (ret < 0) {
Stephen Hemminger654d0fb2010-05-13 15:02:08 +02002965 pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n");
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002966 goto err_unreg_subsys;
2967 }
2968
Julia Lawallef6acf62012-08-29 06:49:16 +00002969 ret = register_pernet_subsys(&ctnetlink_net_ops);
2970 if (ret < 0) {
Pablo Neira Ayuso70e99422011-11-22 00:16:51 +01002971 pr_err("ctnetlink_init: cannot register pernet operations\n");
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002972 goto err_unreg_exp_subsys;
2973 }
Pablo Neira Ayuso7c622342012-06-19 02:10:57 +02002974#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02002975 /* setup interaction between nf_queue and nf_conntrack_netlink. */
2976 RCU_INIT_POINTER(nfq_ct_hook, &ctnetlink_nfqueue_hook);
2977#endif
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002978 return 0;
2979
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002980err_unreg_exp_subsys:
2981 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002982err_unreg_subsys:
2983 nfnetlink_subsys_unregister(&ctnl_subsys);
2984err_out:
2985 return ret;
2986}
2987
2988static void __exit ctnetlink_exit(void)
2989{
Stephen Hemminger654d0fb2010-05-13 15:02:08 +02002990 pr_info("ctnetlink: unregistering from nfnetlink.\n");
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002991
Pablo Neira Ayuso70e99422011-11-22 00:16:51 +01002992 unregister_pernet_subsys(&ctnetlink_net_ops);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002993 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
2994 nfnetlink_subsys_unregister(&ctnl_subsys);
Pablo Neira Ayuso7c622342012-06-19 02:10:57 +02002995#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
Pablo Neira Ayuso9cb01762012-06-07 12:13:39 +02002996 RCU_INIT_POINTER(nfq_ct_hook, NULL);
2997#endif
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08002998}
2999
3000module_init(ctnetlink_init);
3001module_exit(ctnetlink_exit);