blob: 03547c60f3893390c27bb19e33316fadcef7f644 [file] [log] [blame]
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001/* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
3 *
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
Harald Weltedc808fe2006-03-20 17:56:32 -08005 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08006 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07007 * (C) 2005-2008 by Pablo Neira Ayuso <pablo@netfilter.org>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08008 *
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08009 * Initial connection tracking via netlink development funded and
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080010 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
11 *
12 * Further development of this code funded by Astaro AG (http://www.astaro.com)
13 *
14 * This software may be used and distributed according to the terms
15 * of the GNU General Public License, incorporated herein by reference.
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080016 */
17
18#include <linux/init.h>
19#include <linux/module.h>
20#include <linux/kernel.h>
Ingo Molnar711bbdd2008-05-17 08:26:25 +020021#include <linux/rculist.h>
Eric Dumazetea781f12009-03-25 21:05:46 +010022#include <linux/rculist_nulls.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080023#include <linux/types.h>
24#include <linux/timer.h>
25#include <linux/skbuff.h>
26#include <linux/errno.h>
27#include <linux/netlink.h>
28#include <linux/spinlock.h>
Yasuyuki Kozakai40a839f2006-06-27 03:00:35 -070029#include <linux/interrupt.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080030#include <linux/notifier.h>
31
32#include <linux/netfilter.h>
Arnaldo Carvalho de Melodc5fc572007-03-25 23:06:12 -070033#include <net/netlink.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080034#include <net/netfilter/nf_conntrack.h>
35#include <net/netfilter/nf_conntrack_core.h>
Martin Josefsson77ab9cf2006-11-29 02:34:58 +010036#include <net/netfilter/nf_conntrack_expect.h>
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080037#include <net/netfilter/nf_conntrack_helper.h>
38#include <net/netfilter/nf_conntrack_l3proto.h>
Martin Josefsson605dcad2006-11-29 02:35:06 +010039#include <net/netfilter/nf_conntrack_l4proto.h>
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -080040#include <net/netfilter/nf_conntrack_tuple.h>
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -070041#include <net/netfilter/nf_conntrack_acct.h>
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -080042#ifdef CONFIG_NF_NAT_NEEDED
43#include <net/netfilter/nf_nat_core.h>
44#include <net/netfilter/nf_nat_protocol.h>
45#endif
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080046
47#include <linux/netfilter/nfnetlink.h>
48#include <linux/netfilter/nfnetlink_conntrack.h>
49
50MODULE_LICENSE("GPL");
51
Harald Weltedc808fe2006-03-20 17:56:32 -080052static char __initdata version[] = "0.93";
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080053
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080054static inline int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080055ctnetlink_dump_tuples_proto(struct sk_buff *skb,
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -080056 const struct nf_conntrack_tuple *tuple,
Martin Josefsson605dcad2006-11-29 02:35:06 +010057 struct nf_conntrack_l4proto *l4proto)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080058{
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080059 int ret = 0;
Patrick McHardydf6fb862007-09-28 14:37:03 -070060 struct nlattr *nest_parms;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080061
Patrick McHardydf6fb862007-09-28 14:37:03 -070062 nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
63 if (!nest_parms)
64 goto nla_put_failure;
Patrick McHardy77236b62007-12-17 22:29:45 -080065 NLA_PUT_U8(skb, CTA_PROTO_NUM, tuple->dst.protonum);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080066
Patrick McHardyfdf70832007-09-28 14:37:41 -070067 if (likely(l4proto->tuple_to_nlattr))
68 ret = l4proto->tuple_to_nlattr(skb, tuple);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -080069
Patrick McHardydf6fb862007-09-28 14:37:03 -070070 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080071
72 return ret;
73
Patrick McHardydf6fb862007-09-28 14:37:03 -070074nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080075 return -1;
76}
77
78static inline int
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -080079ctnetlink_dump_tuples_ip(struct sk_buff *skb,
80 const struct nf_conntrack_tuple *tuple,
81 struct nf_conntrack_l3proto *l3proto)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080082{
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080083 int ret = 0;
Patrick McHardydf6fb862007-09-28 14:37:03 -070084 struct nlattr *nest_parms;
85
86 nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);
87 if (!nest_parms)
88 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -080089
Patrick McHardyfdf70832007-09-28 14:37:41 -070090 if (likely(l3proto->tuple_to_nlattr))
91 ret = l3proto->tuple_to_nlattr(skb, tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080092
Patrick McHardydf6fb862007-09-28 14:37:03 -070093 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080094
95 return ret;
96
Patrick McHardydf6fb862007-09-28 14:37:03 -070097nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -080098 return -1;
99}
100
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800101static int
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800102ctnetlink_dump_tuples(struct sk_buff *skb,
103 const struct nf_conntrack_tuple *tuple)
104{
105 int ret;
106 struct nf_conntrack_l3proto *l3proto;
Martin Josefsson605dcad2006-11-29 02:35:06 +0100107 struct nf_conntrack_l4proto *l4proto;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800108
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100109 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800110 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800111
112 if (unlikely(ret < 0))
113 return ret;
114
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100115 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
Martin Josefsson605dcad2006-11-29 02:35:06 +0100116 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -0800117
118 return ret;
119}
120
121static inline int
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800122ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
123{
Patrick McHardy77236b62007-12-17 22:29:45 -0800124 NLA_PUT_BE32(skb, CTA_STATUS, htonl(ct->status));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800125 return 0;
126
Patrick McHardydf6fb862007-09-28 14:37:03 -0700127nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800128 return -1;
129}
130
131static inline int
132ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
133{
Patrick McHardy77236b62007-12-17 22:29:45 -0800134 long timeout = (ct->timeout.expires - jiffies) / HZ;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800135
Patrick McHardy77236b62007-12-17 22:29:45 -0800136 if (timeout < 0)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800137 timeout = 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800138
Patrick McHardy77236b62007-12-17 22:29:45 -0800139 NLA_PUT_BE32(skb, CTA_TIMEOUT, htonl(timeout));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800140 return 0;
141
Patrick McHardydf6fb862007-09-28 14:37:03 -0700142nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800143 return -1;
144}
145
146static inline int
147ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
148{
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200149 struct nf_conntrack_l4proto *l4proto;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700150 struct nlattr *nest_proto;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800151 int ret;
152
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100153 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
154 if (!l4proto->to_nlattr)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800155 return 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800156
Patrick McHardydf6fb862007-09-28 14:37:03 -0700157 nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
158 if (!nest_proto)
159 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800160
Patrick McHardyfdf70832007-09-28 14:37:41 -0700161 ret = l4proto->to_nlattr(skb, nest_proto, ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800162
Patrick McHardydf6fb862007-09-28 14:37:03 -0700163 nla_nest_end(skb, nest_proto);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800164
165 return ret;
166
Patrick McHardydf6fb862007-09-28 14:37:03 -0700167nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800168 return -1;
169}
170
171static inline int
172ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
173{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700174 struct nlattr *nest_helper;
Harald Weltedc808fe2006-03-20 17:56:32 -0800175 const struct nf_conn_help *help = nfct_help(ct);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700176 struct nf_conntrack_helper *helper;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800177
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700178 if (!help)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800179 return 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800180
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700181 helper = rcu_dereference(help->helper);
182 if (!helper)
183 goto out;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800184
Patrick McHardydf6fb862007-09-28 14:37:03 -0700185 nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
186 if (!nest_helper)
187 goto nla_put_failure;
Patrick McHardy77236b62007-12-17 22:29:45 -0800188 NLA_PUT_STRING(skb, CTA_HELP_NAME, helper->name);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700189
Patrick McHardyfdf70832007-09-28 14:37:41 -0700190 if (helper->to_nlattr)
191 helper->to_nlattr(skb, ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800192
Patrick McHardydf6fb862007-09-28 14:37:03 -0700193 nla_nest_end(skb, nest_helper);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700194out:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800195 return 0;
196
Patrick McHardydf6fb862007-09-28 14:37:03 -0700197nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800198 return -1;
199}
200
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800201static int
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800202ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
203 enum ip_conntrack_dir dir)
204{
205 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700206 struct nlattr *nest_count;
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700207 const struct nf_conn_counter *acct;
208
209 acct = nf_conn_acct_find(ct);
210 if (!acct)
211 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800212
Patrick McHardydf6fb862007-09-28 14:37:03 -0700213 nest_count = nla_nest_start(skb, type | NLA_F_NESTED);
214 if (!nest_count)
215 goto nla_put_failure;
216
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700217 NLA_PUT_BE64(skb, CTA_COUNTERS_PACKETS,
218 cpu_to_be64(acct[dir].packets));
219 NLA_PUT_BE64(skb, CTA_COUNTERS_BYTES,
220 cpu_to_be64(acct[dir].bytes));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800221
Patrick McHardydf6fb862007-09-28 14:37:03 -0700222 nla_nest_end(skb, nest_count);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800223
224 return 0;
225
Patrick McHardydf6fb862007-09-28 14:37:03 -0700226nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800227 return -1;
228}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800229
230#ifdef CONFIG_NF_CONNTRACK_MARK
231static inline int
232ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
233{
Patrick McHardy77236b62007-12-17 22:29:45 -0800234 NLA_PUT_BE32(skb, CTA_MARK, htonl(ct->mark));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800235 return 0;
236
Patrick McHardydf6fb862007-09-28 14:37:03 -0700237nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800238 return -1;
239}
240#else
241#define ctnetlink_dump_mark(a, b) (0)
242#endif
243
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800244#ifdef CONFIG_NF_CONNTRACK_SECMARK
245static inline int
246ctnetlink_dump_secmark(struct sk_buff *skb, const struct nf_conn *ct)
247{
Patrick McHardy77236b62007-12-17 22:29:45 -0800248 NLA_PUT_BE32(skb, CTA_SECMARK, htonl(ct->secmark));
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800249 return 0;
250
251nla_put_failure:
252 return -1;
253}
254#else
255#define ctnetlink_dump_secmark(a, b) (0)
256#endif
257
Pablo Neira Ayuso0f417ce2007-12-17 22:28:19 -0800258#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
259
260static inline int
261ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)
262{
263 struct nlattr *nest_parms;
264
265 if (!(ct->status & IPS_EXPECTED))
266 return 0;
267
268 nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);
269 if (!nest_parms)
270 goto nla_put_failure;
271 if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
272 goto nla_put_failure;
273 nla_nest_end(skb, nest_parms);
274
275 return 0;
276
277nla_put_failure:
278 return -1;
279}
280
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800281#ifdef CONFIG_NF_NAT_NEEDED
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800282static int
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800283dump_nat_seq_adj(struct sk_buff *skb, const struct nf_nat_seq *natseq, int type)
284{
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800285 struct nlattr *nest_parms;
286
287 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
288 if (!nest_parms)
289 goto nla_put_failure;
290
Patrick McHardy77236b62007-12-17 22:29:45 -0800291 NLA_PUT_BE32(skb, CTA_NAT_SEQ_CORRECTION_POS,
292 htonl(natseq->correction_pos));
293 NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_BEFORE,
294 htonl(natseq->offset_before));
295 NLA_PUT_BE32(skb, CTA_NAT_SEQ_OFFSET_AFTER,
296 htonl(natseq->offset_after));
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800297
298 nla_nest_end(skb, nest_parms);
299
300 return 0;
301
302nla_put_failure:
303 return -1;
304}
305
306static inline int
307ctnetlink_dump_nat_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
308{
309 struct nf_nat_seq *natseq;
310 struct nf_conn_nat *nat = nfct_nat(ct);
311
312 if (!(ct->status & IPS_SEQ_ADJUST) || !nat)
313 return 0;
314
315 natseq = &nat->seq[IP_CT_DIR_ORIGINAL];
316 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_ORIG) == -1)
317 return -1;
318
319 natseq = &nat->seq[IP_CT_DIR_REPLY];
320 if (dump_nat_seq_adj(skb, natseq, CTA_NAT_SEQ_ADJ_REPLY) == -1)
321 return -1;
322
323 return 0;
324}
325#else
326#define ctnetlink_dump_nat_seq_adj(a, b) (0)
327#endif
328
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800329static inline int
330ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
331{
Patrick McHardy77236b62007-12-17 22:29:45 -0800332 NLA_PUT_BE32(skb, CTA_ID, htonl((unsigned long)ct));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800333 return 0;
334
Patrick McHardydf6fb862007-09-28 14:37:03 -0700335nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800336 return -1;
337}
338
339static inline int
340ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
341{
Patrick McHardy77236b62007-12-17 22:29:45 -0800342 NLA_PUT_BE32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use)));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800343 return 0;
344
Patrick McHardydf6fb862007-09-28 14:37:03 -0700345nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800346 return -1;
347}
348
349#define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
350
351static int
352ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800353 int event, int nowait,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800354 const struct nf_conn *ct)
355{
356 struct nlmsghdr *nlh;
357 struct nfgenmsg *nfmsg;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700358 struct nlattr *nest_parms;
Arnaldo Carvalho de Melo27a884d2007-04-19 20:29:13 -0700359 unsigned char *b = skb_tail_pointer(skb);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800360
361 event |= NFNL_SUBSYS_CTNETLINK << 8;
362 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
363 nfmsg = NLMSG_DATA(nlh);
364
365 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200366 nfmsg->nfgen_family = nf_ct_l3num(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800367 nfmsg->version = NFNETLINK_V0;
368 nfmsg->res_id = 0;
369
Patrick McHardydf6fb862007-09-28 14:37:03 -0700370 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
371 if (!nest_parms)
372 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800373 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700374 goto nla_put_failure;
375 nla_nest_end(skb, nest_parms);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800376
Patrick McHardydf6fb862007-09-28 14:37:03 -0700377 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
378 if (!nest_parms)
379 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800380 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700381 goto nla_put_failure;
382 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800383
384 if (ctnetlink_dump_status(skb, ct) < 0 ||
385 ctnetlink_dump_timeout(skb, ct) < 0 ||
386 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
387 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
388 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
389 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
390 ctnetlink_dump_mark(skb, ct) < 0 ||
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800391 ctnetlink_dump_secmark(skb, ct) < 0 ||
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800392 ctnetlink_dump_id(skb, ct) < 0 ||
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800393 ctnetlink_dump_use(skb, ct) < 0 ||
Pablo Neira Ayuso0f417ce2007-12-17 22:28:19 -0800394 ctnetlink_dump_master(skb, ct) < 0 ||
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800395 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700396 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800397
Arnaldo Carvalho de Melo27a884d2007-04-19 20:29:13 -0700398 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800399 return skb->len;
400
401nlmsg_failure:
Patrick McHardydf6fb862007-09-28 14:37:03 -0700402nla_put_failure:
Arnaldo Carvalho de Melodc5fc572007-03-25 23:06:12 -0700403 nlmsg_trim(skb, b);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800404 return -1;
405}
406
407#ifdef CONFIG_NF_CONNTRACK_EVENTS
Holger Eitzenberger2732c4e2009-03-25 21:50:59 +0100408/*
409 * The general structure of a ctnetlink event is
410 *
411 * CTA_TUPLE_ORIG
412 * <l3/l4-proto-attributes>
413 * CTA_TUPLE_REPLY
414 * <l3/l4-proto-attributes>
415 * CTA_ID
416 * ...
417 * CTA_PROTOINFO
418 * <l4-proto-attributes>
419 * CTA_TUPLE_MASTER
420 * <l3/l4-proto-attributes>
421 *
422 * Therefore the formular is
423 *
424 * size = sizeof(headers) + sizeof(generic_nlas) + 3 * sizeof(tuple_nlas)
425 * + sizeof(protoinfo_nlas)
426 */
427static struct sk_buff *
428ctnetlink_alloc_skb(const struct nf_conntrack_tuple *tuple, gfp_t gfp)
429{
430 struct nf_conntrack_l3proto *l3proto;
431 struct nf_conntrack_l4proto *l4proto;
432 int len;
433
434#define NLA_TYPE_SIZE(type) nla_total_size(sizeof(type))
435
436 /* proto independant part */
437 len = NLMSG_SPACE(sizeof(struct nfgenmsg))
438 + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
439 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
440 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
441 + 3 * NLA_TYPE_SIZE(u_int8_t) /* CTA_PROTO_NUM */
442 + NLA_TYPE_SIZE(u_int32_t) /* CTA_ID */
443 + NLA_TYPE_SIZE(u_int32_t) /* CTA_STATUS */
444 + 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */
445 + 2 * NLA_TYPE_SIZE(uint64_t) /* CTA_COUNTERS_PACKETS */
446 + 2 * NLA_TYPE_SIZE(uint64_t) /* CTA_COUNTERS_BYTES */
447 + NLA_TYPE_SIZE(u_int32_t) /* CTA_TIMEOUT */
448 + nla_total_size(0) /* CTA_PROTOINFO */
449 + nla_total_size(0) /* CTA_HELP */
450 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
451 + NLA_TYPE_SIZE(u_int32_t) /* CTA_SECMARK */
452 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
453 + 2 * NLA_TYPE_SIZE(u_int32_t) /* CTA_NAT_SEQ_CORRECTION_POS */
454 + 2 * NLA_TYPE_SIZE(u_int32_t) /* CTA_NAT_SEQ_CORRECTION_BEFORE */
455 + 2 * NLA_TYPE_SIZE(u_int32_t) /* CTA_NAT_SEQ_CORRECTION_AFTER */
456 + NLA_TYPE_SIZE(u_int32_t); /* CTA_MARK */
457
458#undef NLA_TYPE_SIZE
459
460 rcu_read_lock();
461 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
462 len += l3proto->nla_size;
463
464 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
465 len += l4proto->nla_size;
466 rcu_read_unlock();
467
468 return alloc_skb(len, gfp);
469}
470
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800471static int ctnetlink_conntrack_event(struct notifier_block *this,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800472 unsigned long events, void *ptr)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800473{
474 struct nlmsghdr *nlh;
475 struct nfgenmsg *nfmsg;
Patrick McHardydf6fb862007-09-28 14:37:03 -0700476 struct nlattr *nest_parms;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +0100477 struct nf_ct_event *item = (struct nf_ct_event *)ptr;
478 struct nf_conn *ct = item->ct;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800479 struct sk_buff *skb;
480 unsigned int type;
Arnaldo Carvalho de Melo27a884d2007-04-19 20:29:13 -0700481 sk_buff_data_t b;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800482 unsigned int flags = 0, group;
483
484 /* ignore our fake conntrack entry */
485 if (ct == &nf_conntrack_untracked)
486 return NOTIFY_DONE;
487
488 if (events & IPCT_DESTROY) {
489 type = IPCTNL_MSG_CT_DELETE;
490 group = NFNLGRP_CONNTRACK_DESTROY;
491 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
492 type = IPCTNL_MSG_CT_NEW;
493 flags = NLM_F_CREATE|NLM_F_EXCL;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800494 group = NFNLGRP_CONNTRACK_NEW;
Pablo Neira Ayuso1a315262006-08-22 00:32:23 -0700495 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800496 type = IPCTNL_MSG_CT_NEW;
497 group = NFNLGRP_CONNTRACK_UPDATE;
498 } else
499 return NOTIFY_DONE;
Patrick McHardya2427692006-03-20 18:03:59 -0800500
Pablo Neira Ayuso1f9da252009-02-09 14:34:26 -0800501 if (!item->report && !nfnetlink_has_listeners(group))
Patrick McHardya2427692006-03-20 18:03:59 -0800502 return NOTIFY_DONE;
503
Holger Eitzenberger2732c4e2009-03-25 21:50:59 +0100504 skb = ctnetlink_alloc_skb(tuple(ct, IP_CT_DIR_ORIGINAL), GFP_ATOMIC);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800505 if (!skb)
506 return NOTIFY_DONE;
507
508 b = skb->tail;
509
510 type |= NFNL_SUBSYS_CTNETLINK << 8;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +0100511 nlh = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800512 nfmsg = NLMSG_DATA(nlh);
513
514 nlh->nlmsg_flags = flags;
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200515 nfmsg->nfgen_family = nf_ct_l3num(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800516 nfmsg->version = NFNETLINK_V0;
517 nfmsg->res_id = 0;
518
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100519 rcu_read_lock();
Patrick McHardydf6fb862007-09-28 14:37:03 -0700520 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
521 if (!nest_parms)
522 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800523 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700524 goto nla_put_failure;
525 nla_nest_end(skb, nest_parms);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800526
Patrick McHardydf6fb862007-09-28 14:37:03 -0700527 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
528 if (!nest_parms)
529 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800530 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700531 goto nla_put_failure;
532 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800533
Eric Leblond1eedf692008-05-13 23:27:11 -0700534 if (ctnetlink_dump_id(skb, ct) < 0)
535 goto nla_put_failure;
536
Fabian Hugelshofere57dce62008-06-09 15:59:58 -0700537 if (ctnetlink_dump_status(skb, ct) < 0)
538 goto nla_put_failure;
539
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100540 if (events & IPCT_DESTROY) {
541 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
542 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700543 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100544 } else {
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100545 if (ctnetlink_dump_timeout(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700546 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100547
548 if (events & IPCT_PROTOINFO
549 && ctnetlink_dump_protoinfo(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700550 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100551
552 if ((events & IPCT_HELPER || nfct_help(ct))
553 && ctnetlink_dump_helpinfo(skb, ct) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -0700554 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100555
Pablo Neira Ayuso37fccd82007-12-17 22:28:41 -0800556#ifdef CONFIG_NF_CONNTRACK_SECMARK
557 if ((events & IPCT_SECMARK || ct->secmark)
558 && ctnetlink_dump_secmark(skb, ct) < 0)
559 goto nla_put_failure;
560#endif
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100561
Pablo Neira Ayuso0f417ce2007-12-17 22:28:19 -0800562 if (events & IPCT_RELATED &&
563 ctnetlink_dump_master(skb, ct) < 0)
564 goto nla_put_failure;
565
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -0800566 if (events & IPCT_NATSEQADJ &&
567 ctnetlink_dump_nat_seq_adj(skb, ct) < 0)
568 goto nla_put_failure;
Pablo Neira Ayuso7b621c12006-11-29 02:35:32 +0100569 }
Pablo Neira Ayusob9a37e02006-08-22 00:31:49 -0700570
Eric Leblonda83099a2008-01-31 04:44:27 -0800571#ifdef CONFIG_NF_CONNTRACK_MARK
572 if ((events & IPCT_MARK || ct->mark)
573 && ctnetlink_dump_mark(skb, ct) < 0)
574 goto nla_put_failure;
575#endif
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100576 rcu_read_unlock();
Eric Leblonda83099a2008-01-31 04:44:27 -0800577
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800578 nlh->nlmsg_len = skb->tail - b;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +0100579 nfnetlink_send(skb, item->pid, group, item->report);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800580 return NOTIFY_DONE;
581
Patrick McHardydf6fb862007-09-28 14:37:03 -0700582nla_put_failure:
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100583 rcu_read_unlock();
584nlmsg_failure:
Pablo Neira Ayusodd5b6ce2009-03-23 13:21:06 +0100585 nfnetlink_set_err(0, group, -ENOBUFS);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800586 kfree_skb(skb);
587 return NOTIFY_DONE;
588}
589#endif /* CONFIG_NF_CONNTRACK_EVENTS */
590
591static int ctnetlink_done(struct netlink_callback *cb)
592{
Patrick McHardy89f2e212006-05-29 18:24:58 -0700593 if (cb->args[1])
594 nf_ct_put((struct nf_conn *)cb->args[1]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800595 return 0;
596}
597
598static int
599ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
600{
Patrick McHardy89f2e212006-05-29 18:24:58 -0700601 struct nf_conn *ct, *last;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800602 struct nf_conntrack_tuple_hash *h;
Eric Dumazetea781f12009-03-25 21:05:46 +0100603 struct hlist_nulls_node *n;
Pablo Neira Ayuso87711cb2006-01-05 12:19:23 -0800604 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
605 u_int8_t l3proto = nfmsg->nfgen_family;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800606
Patrick McHardy76507f62008-01-31 04:38:38 -0800607 rcu_read_lock();
Patrick McHardyd205dc42006-08-17 18:12:38 -0700608 last = (struct nf_conn *)cb->args[1];
Patrick McHardy89f2e212006-05-29 18:24:58 -0700609 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
610restart:
Eric Dumazetea781f12009-03-25 21:05:46 +0100611 hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
612 hnnode) {
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800613 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800614 continue;
615 ct = nf_ct_tuplehash_to_ctrack(h);
Eric Dumazetea781f12009-03-25 21:05:46 +0100616 if (!atomic_inc_not_zero(&ct->ct_general.use))
617 continue;
Pablo Neira Ayuso87711cb2006-01-05 12:19:23 -0800618 /* Dump entries of a given L3 protocol number.
619 * If it is not specified, ie. l3proto == 0,
620 * then dump everything. */
Patrick McHardy5e8fbe22008-04-14 11:15:52 +0200621 if (l3proto && nf_ct_l3num(ct) != l3proto)
Eric Dumazetea781f12009-03-25 21:05:46 +0100622 goto releasect;
Patrick McHardyd205dc42006-08-17 18:12:38 -0700623 if (cb->args[1]) {
624 if (ct != last)
Eric Dumazetea781f12009-03-25 21:05:46 +0100625 goto releasect;
Patrick McHardyd205dc42006-08-17 18:12:38 -0700626 cb->args[1] = 0;
Patrick McHardy89f2e212006-05-29 18:24:58 -0700627 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800628 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800629 cb->nlh->nlmsg_seq,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800630 IPCTNL_MSG_CT_NEW,
Patrick McHardy89f2e212006-05-29 18:24:58 -0700631 1, ct) < 0) {
Patrick McHardy89f2e212006-05-29 18:24:58 -0700632 cb->args[1] = (unsigned long)ct;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800633 goto out;
Patrick McHardy89f2e212006-05-29 18:24:58 -0700634 }
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700635
Pablo Neira Ayuso01f34842006-09-20 12:00:45 -0700636 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700637 IPCTNL_MSG_CT_GET_CTRZERO) {
638 struct nf_conn_counter *acct;
639
640 acct = nf_conn_acct_find(ct);
641 if (acct)
642 memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));
643 }
Eric Dumazetea781f12009-03-25 21:05:46 +0100644releasect:
645 nf_ct_put(ct);
Patrick McHardy89f2e212006-05-29 18:24:58 -0700646 }
Patrick McHardyd205dc42006-08-17 18:12:38 -0700647 if (cb->args[1]) {
Patrick McHardy89f2e212006-05-29 18:24:58 -0700648 cb->args[1] = 0;
649 goto restart;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800650 }
651 }
Patrick McHardy89f2e212006-05-29 18:24:58 -0700652out:
Patrick McHardy76507f62008-01-31 04:38:38 -0800653 rcu_read_unlock();
Patrick McHardyd205dc42006-08-17 18:12:38 -0700654 if (last)
655 nf_ct_put(last);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800656
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800657 return skb->len;
658}
659
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800660static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700661ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800662{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700663 struct nlattr *tb[CTA_IP_MAX+1];
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800664 struct nf_conntrack_l3proto *l3proto;
665 int ret = 0;
666
Patrick McHardydf6fb862007-09-28 14:37:03 -0700667 nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800668
Florian Westphalcd915662009-03-18 17:28:37 +0100669 rcu_read_lock();
670 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800671
Patrick McHardyf73e9242007-09-28 14:39:55 -0700672 if (likely(l3proto->nlattr_to_tuple)) {
673 ret = nla_validate_nested(attr, CTA_IP_MAX,
674 l3proto->nla_policy);
675 if (ret == 0)
676 ret = l3proto->nlattr_to_tuple(tb, tuple);
677 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800678
Florian Westphalcd915662009-03-18 17:28:37 +0100679 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800680
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800681 return ret;
682}
683
Patrick McHardyf73e9242007-09-28 14:39:55 -0700684static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
685 [CTA_PROTO_NUM] = { .type = NLA_U8 },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800686};
687
688static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700689ctnetlink_parse_tuple_proto(struct nlattr *attr,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800690 struct nf_conntrack_tuple *tuple)
691{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700692 struct nlattr *tb[CTA_PROTO_MAX+1];
Martin Josefsson605dcad2006-11-29 02:35:06 +0100693 struct nf_conntrack_l4proto *l4proto;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800694 int ret = 0;
695
Patrick McHardyf73e9242007-09-28 14:39:55 -0700696 ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);
697 if (ret < 0)
698 return ret;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800699
Patrick McHardydf6fb862007-09-28 14:37:03 -0700700 if (!tb[CTA_PROTO_NUM])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800701 return -EINVAL;
Patrick McHardy77236b62007-12-17 22:29:45 -0800702 tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800703
Florian Westphalcd915662009-03-18 17:28:37 +0100704 rcu_read_lock();
705 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800706
Patrick McHardyf73e9242007-09-28 14:39:55 -0700707 if (likely(l4proto->nlattr_to_tuple)) {
708 ret = nla_validate_nested(attr, CTA_PROTO_MAX,
709 l4proto->nla_policy);
710 if (ret == 0)
711 ret = l4proto->nlattr_to_tuple(tb, tuple);
712 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800713
Florian Westphalcd915662009-03-18 17:28:37 +0100714 rcu_read_unlock();
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800715
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800716 return ret;
717}
718
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800719static int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700720ctnetlink_parse_tuple(struct nlattr *cda[], struct nf_conntrack_tuple *tuple,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800721 enum ctattr_tuple type, u_int8_t l3num)
722{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700723 struct nlattr *tb[CTA_TUPLE_MAX+1];
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800724 int err;
725
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800726 memset(tuple, 0, sizeof(*tuple));
727
Patrick McHardydf6fb862007-09-28 14:37:03 -0700728 nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800729
Patrick McHardydf6fb862007-09-28 14:37:03 -0700730 if (!tb[CTA_TUPLE_IP])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800731 return -EINVAL;
732
733 tuple->src.l3num = l3num;
734
Patrick McHardydf6fb862007-09-28 14:37:03 -0700735 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800736 if (err < 0)
737 return err;
738
Patrick McHardydf6fb862007-09-28 14:37:03 -0700739 if (!tb[CTA_TUPLE_PROTO])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800740 return -EINVAL;
741
Patrick McHardydf6fb862007-09-28 14:37:03 -0700742 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800743 if (err < 0)
744 return err;
745
746 /* orig and expect tuples get DIR_ORIGINAL */
747 if (type == CTA_TUPLE_REPLY)
748 tuple->dst.dir = IP_CT_DIR_REPLY;
749 else
750 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
751
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800752 return 0;
753}
754
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800755static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700756ctnetlink_parse_help(struct nlattr *attr, char **helper_name)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800757{
Patrick McHardydf6fb862007-09-28 14:37:03 -0700758 struct nlattr *tb[CTA_HELP_MAX+1];
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800759
Patrick McHardydf6fb862007-09-28 14:37:03 -0700760 nla_parse_nested(tb, CTA_HELP_MAX, attr, NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800761
Patrick McHardydf6fb862007-09-28 14:37:03 -0700762 if (!tb[CTA_HELP_NAME])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800763 return -EINVAL;
764
Patrick McHardydf6fb862007-09-28 14:37:03 -0700765 *helper_name = nla_data(tb[CTA_HELP_NAME]);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800766
767 return 0;
768}
769
Patrick McHardyf73e9242007-09-28 14:39:55 -0700770static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
771 [CTA_STATUS] = { .type = NLA_U32 },
772 [CTA_TIMEOUT] = { .type = NLA_U32 },
773 [CTA_MARK] = { .type = NLA_U32 },
774 [CTA_USE] = { .type = NLA_U32 },
775 [CTA_ID] = { .type = NLA_U32 },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800776};
777
778static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800779ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardydf6fb862007-09-28 14:37:03 -0700780 struct nlmsghdr *nlh, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800781{
782 struct nf_conntrack_tuple_hash *h;
783 struct nf_conntrack_tuple tuple;
784 struct nf_conn *ct;
785 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
786 u_int8_t u3 = nfmsg->nfgen_family;
787 int err = 0;
788
Patrick McHardydf6fb862007-09-28 14:37:03 -0700789 if (cda[CTA_TUPLE_ORIG])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800790 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
Patrick McHardydf6fb862007-09-28 14:37:03 -0700791 else if (cda[CTA_TUPLE_REPLY])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800792 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
793 else {
794 /* Flush the whole table */
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +0100795 nf_conntrack_flush(&init_net,
796 NETLINK_CB(skb).pid,
797 nlmsg_report(nlh));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800798 return 0;
799 }
800
801 if (err < 0)
802 return err;
803
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200804 h = nf_conntrack_find_get(&init_net, &tuple);
Pablo Neira Ayuso9ea8cfd2006-10-12 14:09:16 -0700805 if (!h)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800806 return -ENOENT;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800807
808 ct = nf_ct_tuplehash_to_ctrack(h);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800809
Patrick McHardydf6fb862007-09-28 14:37:03 -0700810 if (cda[CTA_ID]) {
Patrick McHardy77236b62007-12-17 22:29:45 -0800811 u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
Patrick McHardy7f85f912007-09-28 14:41:27 -0700812 if (id != (u32)(unsigned long)ct) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800813 nf_ct_put(ct);
814 return -ENOENT;
815 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800816 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800817
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +0100818 nf_conntrack_event_report(IPCT_DESTROY,
819 ct,
820 NETLINK_CB(skb).pid,
821 nlmsg_report(nlh));
822
823 /* death_by_timeout would report the event again */
824 set_bit(IPS_DYING_BIT, &ct->status);
825
Patrick McHardy51091762008-06-09 15:59:06 -0700826 nf_ct_kill(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800827 nf_ct_put(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800828
829 return 0;
830}
831
832static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800833ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardydf6fb862007-09-28 14:37:03 -0700834 struct nlmsghdr *nlh, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800835{
836 struct nf_conntrack_tuple_hash *h;
837 struct nf_conntrack_tuple tuple;
838 struct nf_conn *ct;
839 struct sk_buff *skb2 = NULL;
840 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
841 u_int8_t u3 = nfmsg->nfgen_family;
842 int err = 0;
843
Krzysztof Piotr Oledzki58401572008-07-21 10:01:34 -0700844 if (nlh->nlmsg_flags & NLM_F_DUMP)
Thomas Grafc702e802007-03-22 23:30:55 -0700845 return netlink_dump_start(ctnl, skb, nlh, ctnetlink_dump_table,
846 ctnetlink_done);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800847
Patrick McHardydf6fb862007-09-28 14:37:03 -0700848 if (cda[CTA_TUPLE_ORIG])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800849 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
Patrick McHardydf6fb862007-09-28 14:37:03 -0700850 else if (cda[CTA_TUPLE_REPLY])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800851 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
852 else
853 return -EINVAL;
854
855 if (err < 0)
856 return err;
857
Alexey Dobriyan400dad32008-10-08 11:35:03 +0200858 h = nf_conntrack_find_get(&init_net, &tuple);
Pablo Neira Ayuso9ea8cfd2006-10-12 14:09:16 -0700859 if (!h)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800860 return -ENOENT;
Pablo Neira Ayuso9ea8cfd2006-10-12 14:09:16 -0700861
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800862 ct = nf_ct_tuplehash_to_ctrack(h);
863
864 err = -ENOMEM;
865 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
866 if (!skb2) {
867 nf_ct_put(ct);
868 return -ENOMEM;
869 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800870
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100871 rcu_read_lock();
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800872 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800873 IPCTNL_MSG_CT_NEW, 1, ct);
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +0100874 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800875 nf_ct_put(ct);
876 if (err <= 0)
877 goto free;
878
879 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
880 if (err < 0)
881 goto out;
882
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800883 return 0;
884
885free:
886 kfree_skb(skb2);
887out:
888 return err;
889}
890
Pablo Neira Ayuso67671842008-10-20 03:34:27 -0700891#ifdef CONFIG_NF_NAT_NEEDED
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -0800892static int
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -0700893ctnetlink_parse_nat_setup(struct nf_conn *ct,
894 enum nf_nat_manip_type manip,
895 struct nlattr *attr)
896{
897 typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;
898
899 parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);
900 if (!parse_nat_setup) {
Johannes Berg95a5afc2008-10-16 15:24:51 -0700901#ifdef CONFIG_MODULES
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -0700902 rcu_read_unlock();
Patrick McHardy748085f2009-01-21 12:19:49 -0800903 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -0700904 nfnl_unlock();
905 if (request_module("nf-nat-ipv4") < 0) {
906 nfnl_lock();
Patrick McHardy748085f2009-01-21 12:19:49 -0800907 spin_lock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -0700908 rcu_read_lock();
909 return -EOPNOTSUPP;
910 }
911 nfnl_lock();
Patrick McHardy748085f2009-01-21 12:19:49 -0800912 spin_lock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -0700913 rcu_read_lock();
914 if (nfnetlink_parse_nat_setup_hook)
915 return -EAGAIN;
916#endif
917 return -EOPNOTSUPP;
918 }
919
920 return parse_nat_setup(ct, manip, attr);
921}
Pablo Neira Ayuso67671842008-10-20 03:34:27 -0700922#endif
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -0700923
924static int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700925ctnetlink_change_status(struct nf_conn *ct, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800926{
927 unsigned long d;
Patrick McHardy77236b62007-12-17 22:29:45 -0800928 unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800929 d = ct->status ^ status;
930
931 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
932 /* unchangeable */
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -0700933 return -EBUSY;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800934
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800935 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
936 /* SEEN_REPLY bit can only be set */
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -0700937 return -EBUSY;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -0800938
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800939 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
940 /* ASSURED bit can only be set */
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -0700941 return -EBUSY;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800942
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800943 /* Be careful here, modifying NAT bits can screw up things,
944 * so don't let users modify them directly if they don't pass
Jozsef Kadlecsik5b1158e2006-12-02 22:07:13 -0800945 * nf_nat_range. */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800946 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
947 return 0;
948}
949
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -0700950static int
951ctnetlink_change_nat(struct nf_conn *ct, struct nlattr *cda[])
952{
953#ifdef CONFIG_NF_NAT_NEEDED
954 int ret;
955
956 if (cda[CTA_NAT_DST]) {
957 ret = ctnetlink_parse_nat_setup(ct,
958 IP_NAT_MANIP_DST,
959 cda[CTA_NAT_DST]);
960 if (ret < 0)
961 return ret;
962 }
963 if (cda[CTA_NAT_SRC]) {
964 ret = ctnetlink_parse_nat_setup(ct,
965 IP_NAT_MANIP_SRC,
966 cda[CTA_NAT_SRC]);
967 if (ret < 0)
968 return ret;
969 }
970 return 0;
971#else
972 return -EOPNOTSUPP;
973#endif
974}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800975
976static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -0700977ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800978{
979 struct nf_conntrack_helper *helper;
Harald Weltedc808fe2006-03-20 17:56:32 -0800980 struct nf_conn_help *help = nfct_help(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800981 char *helpname;
982 int err;
983
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800984 /* don't change helper of sibling connections */
985 if (ct->master)
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -0700986 return -EBUSY;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800987
Patrick McHardydf6fb862007-09-28 14:37:03 -0700988 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800989 if (err < 0)
990 return err;
991
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -0700992 if (!strcmp(helpname, "")) {
993 if (help && help->helper) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800994 /* we had a helper before ... */
995 nf_ct_remove_expectations(ct);
Patrick McHarrdy3c158f72007-06-05 12:55:27 -0700996 rcu_assign_pointer(help->helper, NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -0800997 }
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -0700998
999 return 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001000 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001001
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -07001002 helper = __nf_conntrack_helper_find_byname(helpname);
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001003 if (helper == NULL) {
1004#ifdef CONFIG_MODULES
1005 spin_unlock_bh(&nf_conntrack_lock);
1006
1007 if (request_module("nfct-helper-%s", helpname) < 0) {
1008 spin_lock_bh(&nf_conntrack_lock);
1009 return -EOPNOTSUPP;
1010 }
1011
1012 spin_lock_bh(&nf_conntrack_lock);
1013 helper = __nf_conntrack_helper_find_byname(helpname);
1014 if (helper)
1015 return -EAGAIN;
1016#endif
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07001017 return -EOPNOTSUPP;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001018 }
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -07001019
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001020 if (help) {
1021 if (help->helper == helper)
1022 return 0;
1023 if (help->helper)
1024 return -EBUSY;
1025 /* need to zero data of old helper */
1026 memset(&help->help, 0, sizeof(help->help));
1027 } else {
Pablo Neira Ayusofab00c52008-08-18 21:31:46 -07001028 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001029 if (help == NULL)
1030 return -ENOMEM;
1031 }
Yasuyuki Kozakaidf293bb2007-05-10 14:15:58 -07001032
Patrick McHarrdy3c158f72007-06-05 12:55:27 -07001033 rcu_assign_pointer(help->helper, helper);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001034
1035 return 0;
1036}
1037
1038static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -07001039ctnetlink_change_timeout(struct nf_conn *ct, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001040{
Patrick McHardy77236b62007-12-17 22:29:45 -08001041 u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001042
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001043 if (!del_timer(&ct->timeout))
1044 return -ETIME;
1045
1046 ct->timeout.expires = jiffies + timeout * HZ;
1047 add_timer(&ct->timeout);
1048
1049 return 0;
1050}
1051
1052static inline int
Patrick McHardydf6fb862007-09-28 14:37:03 -07001053ctnetlink_change_protoinfo(struct nf_conn *ct, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001054{
Patrick McHardydf6fb862007-09-28 14:37:03 -07001055 struct nlattr *tb[CTA_PROTOINFO_MAX+1], *attr = cda[CTA_PROTOINFO];
Martin Josefsson605dcad2006-11-29 02:35:06 +01001056 struct nf_conntrack_l4proto *l4proto;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001057 int err = 0;
1058
Patrick McHardydf6fb862007-09-28 14:37:03 -07001059 nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, NULL);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001060
Florian Westphalcd915662009-03-18 17:28:37 +01001061 rcu_read_lock();
1062 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
Patrick McHardyfdf70832007-09-28 14:37:41 -07001063 if (l4proto->from_nlattr)
1064 err = l4proto->from_nlattr(tb, ct);
Florian Westphalcd915662009-03-18 17:28:37 +01001065 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001066
1067 return err;
1068}
1069
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001070#ifdef CONFIG_NF_NAT_NEEDED
1071static inline int
1072change_nat_seq_adj(struct nf_nat_seq *natseq, struct nlattr *attr)
1073{
1074 struct nlattr *cda[CTA_NAT_SEQ_MAX+1];
1075
1076 nla_parse_nested(cda, CTA_NAT_SEQ_MAX, attr, NULL);
1077
1078 if (!cda[CTA_NAT_SEQ_CORRECTION_POS])
1079 return -EINVAL;
1080
1081 natseq->correction_pos =
Patrick McHardy77236b62007-12-17 22:29:45 -08001082 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_CORRECTION_POS]));
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001083
1084 if (!cda[CTA_NAT_SEQ_OFFSET_BEFORE])
1085 return -EINVAL;
1086
1087 natseq->offset_before =
Patrick McHardy77236b62007-12-17 22:29:45 -08001088 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_BEFORE]));
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001089
1090 if (!cda[CTA_NAT_SEQ_OFFSET_AFTER])
1091 return -EINVAL;
1092
1093 natseq->offset_after =
Patrick McHardy77236b62007-12-17 22:29:45 -08001094 ntohl(nla_get_be32(cda[CTA_NAT_SEQ_OFFSET_AFTER]));
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001095
1096 return 0;
1097}
1098
1099static int
1100ctnetlink_change_nat_seq_adj(struct nf_conn *ct, struct nlattr *cda[])
1101{
1102 int ret = 0;
1103 struct nf_conn_nat *nat = nfct_nat(ct);
1104
1105 if (!nat)
1106 return 0;
1107
1108 if (cda[CTA_NAT_SEQ_ADJ_ORIG]) {
1109 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_ORIGINAL],
1110 cda[CTA_NAT_SEQ_ADJ_ORIG]);
1111 if (ret < 0)
1112 return ret;
1113
1114 ct->status |= IPS_SEQ_ADJUST;
1115 }
1116
1117 if (cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1118 ret = change_nat_seq_adj(&nat->seq[IP_CT_DIR_REPLY],
1119 cda[CTA_NAT_SEQ_ADJ_REPLY]);
1120 if (ret < 0)
1121 return ret;
1122
1123 ct->status |= IPS_SEQ_ADJUST;
1124 }
1125
1126 return 0;
1127}
1128#endif
1129
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001130static int
Patrick McHardydf6fb862007-09-28 14:37:03 -07001131ctnetlink_change_conntrack(struct nf_conn *ct, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001132{
1133 int err;
1134
Pablo Neira Ayusoe0983602009-03-16 15:27:22 +01001135 /* only allow NAT changes and master assignation for new conntracks */
1136 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])
1137 return -EOPNOTSUPP;
1138
Patrick McHardydf6fb862007-09-28 14:37:03 -07001139 if (cda[CTA_HELP]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001140 err = ctnetlink_change_helper(ct, cda);
1141 if (err < 0)
1142 return err;
1143 }
1144
Patrick McHardydf6fb862007-09-28 14:37:03 -07001145 if (cda[CTA_TIMEOUT]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001146 err = ctnetlink_change_timeout(ct, cda);
1147 if (err < 0)
1148 return err;
1149 }
1150
Patrick McHardydf6fb862007-09-28 14:37:03 -07001151 if (cda[CTA_STATUS]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001152 err = ctnetlink_change_status(ct, cda);
1153 if (err < 0)
1154 return err;
1155 }
1156
Patrick McHardydf6fb862007-09-28 14:37:03 -07001157 if (cda[CTA_PROTOINFO]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001158 err = ctnetlink_change_protoinfo(ct, cda);
1159 if (err < 0)
1160 return err;
1161 }
1162
Martin Josefssonbcd1e832006-04-01 02:23:21 -08001163#if defined(CONFIG_NF_CONNTRACK_MARK)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001164 if (cda[CTA_MARK])
Patrick McHardy77236b62007-12-17 22:29:45 -08001165 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001166#endif
1167
Pablo Neira Ayuso13eae152007-12-17 22:28:00 -08001168#ifdef CONFIG_NF_NAT_NEEDED
1169 if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1170 err = ctnetlink_change_nat_seq_adj(ct, cda);
1171 if (err < 0)
1172 return err;
1173 }
1174#endif
1175
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001176 return 0;
1177}
1178
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001179static inline void
1180ctnetlink_event_report(struct nf_conn *ct, u32 pid, int report)
1181{
1182 unsigned int events = 0;
1183
1184 if (test_bit(IPS_EXPECTED_BIT, &ct->status))
1185 events |= IPCT_RELATED;
1186 else
1187 events |= IPCT_NEW;
1188
1189 nf_conntrack_event_report(IPCT_STATUS |
1190 IPCT_HELPER |
1191 IPCT_REFRESH |
1192 IPCT_PROTOINFO |
1193 IPCT_NATSEQADJ |
1194 IPCT_MARK |
1195 events,
1196 ct,
1197 pid,
1198 report);
1199}
1200
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001201static struct nf_conn *
Patrick McHardydf6fb862007-09-28 14:37:03 -07001202ctnetlink_create_conntrack(struct nlattr *cda[],
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001203 struct nf_conntrack_tuple *otuple,
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001204 struct nf_conntrack_tuple *rtuple,
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001205 u8 u3)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001206{
1207 struct nf_conn *ct;
1208 int err = -EINVAL;
Yasuyuki Kozakaiceceae12007-07-07 22:23:42 -07001209 struct nf_conntrack_helper *helper;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001210
Patrick McHardyb54ad402008-11-24 15:56:17 -08001211 ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
Julia Lawallcd7fcbf2009-01-12 00:06:08 +00001212 if (IS_ERR(ct))
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001213 return ERR_PTR(-ENOMEM);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001214
Patrick McHardydf6fb862007-09-28 14:37:03 -07001215 if (!cda[CTA_TIMEOUT])
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001216 goto err1;
Patrick McHardy77236b62007-12-17 22:29:45 -08001217 ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001218
1219 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
1220 ct->status |= IPS_CONFIRMED;
1221
Patrick McHardy58a3c9b2008-01-31 04:36:54 -08001222 rcu_read_lock();
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001223 if (cda[CTA_HELP]) {
1224 char *helpname;
1225
1226 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001227 if (err < 0)
1228 goto err2;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001229
1230 helper = __nf_conntrack_helper_find_byname(helpname);
1231 if (helper == NULL) {
1232 rcu_read_unlock();
1233#ifdef CONFIG_MODULES
1234 if (request_module("nfct-helper-%s", helpname) < 0) {
1235 err = -EOPNOTSUPP;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001236 goto err1;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001237 }
1238
1239 rcu_read_lock();
1240 helper = __nf_conntrack_helper_find_byname(helpname);
1241 if (helper) {
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001242 err = -EAGAIN;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001243 goto err2;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001244 }
1245 rcu_read_unlock();
1246#endif
1247 err = -EOPNOTSUPP;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001248 goto err1;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001249 } else {
1250 struct nf_conn_help *help;
1251
1252 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1253 if (help == NULL) {
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001254 err = -ENOMEM;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001255 goto err2;
Pablo Neira Ayuso226c0c02008-11-18 11:54:05 +01001256 }
1257
1258 /* not in hash table yet so not strictly necessary */
1259 rcu_assign_pointer(help->helper, helper);
1260 }
1261 } else {
1262 /* try an implicit helper assignation */
1263 err = __nf_ct_try_assign_helper(ct, GFP_ATOMIC);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001264 if (err < 0)
1265 goto err2;
Patrick McHarrdy3c158f72007-06-05 12:55:27 -07001266 }
Yasuyuki Kozakaidafc7412006-11-27 10:25:32 -08001267
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001268 if (cda[CTA_STATUS]) {
1269 err = ctnetlink_change_status(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001270 if (err < 0)
1271 goto err2;
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001272 }
1273
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001274 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
1275 err = ctnetlink_change_nat(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001276 if (err < 0)
1277 goto err2;
Pablo Neira Ayusoe6a7d3c2008-10-14 11:58:31 -07001278 }
1279
Pablo Neira Ayusoc969aa72009-02-09 14:33:57 -08001280#ifdef CONFIG_NF_NAT_NEEDED
1281 if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
1282 err = ctnetlink_change_nat_seq_adj(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001283 if (err < 0)
1284 goto err2;
Pablo Neira Ayusoc969aa72009-02-09 14:33:57 -08001285 }
1286#endif
1287
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001288 if (cda[CTA_PROTOINFO]) {
1289 err = ctnetlink_change_protoinfo(ct, cda);
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001290 if (err < 0)
1291 goto err2;
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001292 }
1293
Patrick McHardy3ec19252008-11-26 03:57:44 -08001294 nf_ct_acct_ext_add(ct, GFP_ATOMIC);
Pablo Neira Ayuso1575e7e2008-08-18 21:30:55 -07001295
1296#if defined(CONFIG_NF_CONNTRACK_MARK)
1297 if (cda[CTA_MARK])
1298 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1299#endif
1300
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001301 /* setup master conntrack: this is a confirmed expectation */
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001302 if (cda[CTA_TUPLE_MASTER]) {
1303 struct nf_conntrack_tuple master;
1304 struct nf_conntrack_tuple_hash *master_h;
1305 struct nf_conn *master_ct;
1306
1307 err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);
1308 if (err < 0)
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001309 goto err2;
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001310
Eric Dumazetea781f12009-03-25 21:05:46 +01001311 master_h = nf_conntrack_find_get(&init_net, &master);
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001312 if (master_h == NULL) {
1313 err = -ENOENT;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001314 goto err2;
Pablo Neira Ayuso7ec47492009-03-16 15:25:46 +01001315 }
1316 master_ct = nf_ct_tuplehash_to_ctrack(master_h);
Pablo Neira Ayusof2a89002007-12-12 10:34:29 -08001317 __set_bit(IPS_EXPECTED_BIT, &ct->status);
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001318 ct->master = master_ct;
Pablo Neira Ayusof2a89002007-12-12 10:34:29 -08001319 }
Pablo Neira Ayuso5faa1f42007-09-28 14:43:53 -07001320
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001321 add_timer(&ct->timeout);
1322 nf_conntrack_hash_insert(ct);
Patrick McHardy58a3c9b2008-01-31 04:36:54 -08001323 rcu_read_unlock();
Yasuyuki Kozakaidafc7412006-11-27 10:25:32 -08001324
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001325 return ct;
Patrick McHardy0f5b3e82009-03-18 17:36:40 +01001326
1327err2:
1328 rcu_read_unlock();
1329err1:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001330 nf_conntrack_free(ct);
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001331 return ERR_PTR(err);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001332}
1333
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001334static int
1335ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardydf6fb862007-09-28 14:37:03 -07001336 struct nlmsghdr *nlh, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001337{
1338 struct nf_conntrack_tuple otuple, rtuple;
1339 struct nf_conntrack_tuple_hash *h = NULL;
1340 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1341 u_int8_t u3 = nfmsg->nfgen_family;
1342 int err = 0;
1343
Patrick McHardydf6fb862007-09-28 14:37:03 -07001344 if (cda[CTA_TUPLE_ORIG]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001345 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1346 if (err < 0)
1347 return err;
1348 }
1349
Patrick McHardydf6fb862007-09-28 14:37:03 -07001350 if (cda[CTA_TUPLE_REPLY]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001351 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1352 if (err < 0)
1353 return err;
1354 }
1355
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001356 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardydf6fb862007-09-28 14:37:03 -07001357 if (cda[CTA_TUPLE_ORIG])
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001358 h = __nf_conntrack_find(&init_net, &otuple);
Patrick McHardydf6fb862007-09-28 14:37:03 -07001359 else if (cda[CTA_TUPLE_REPLY])
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001360 h = __nf_conntrack_find(&init_net, &rtuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001361
1362 if (h == NULL) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001363 err = -ENOENT;
Pablo Neira Ayusof0a3c082009-03-16 15:28:09 +01001364 if (nlh->nlmsg_flags & NLM_F_CREATE) {
1365 struct nf_conn *ct;
1366
1367 ct = ctnetlink_create_conntrack(cda, &otuple,
1368 &rtuple, u3);
1369 if (IS_ERR(ct)) {
1370 err = PTR_ERR(ct);
1371 goto out_unlock;
1372 }
1373 err = 0;
1374 nf_conntrack_get(&ct->ct_general);
1375 spin_unlock_bh(&nf_conntrack_lock);
1376 ctnetlink_event_report(ct,
1377 NETLINK_CB(skb).pid,
1378 nlmsg_report(nlh));
1379 nf_ct_put(ct);
1380 } else
1381 spin_unlock_bh(&nf_conntrack_lock);
1382
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001383 return err;
1384 }
1385 /* implicit 'else' */
1386
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001387 /* We manipulate the conntrack inside the global conntrack table lock,
1388 * so there's no need to increase the refcount */
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001389 err = -EEXIST;
Pablo Neira Ayusoff4ca822007-08-07 18:11:26 -07001390 if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001391 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
1392
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001393 err = ctnetlink_change_conntrack(ct, cda);
1394 if (err == 0) {
1395 nf_conntrack_get(&ct->ct_general);
1396 spin_unlock_bh(&nf_conntrack_lock);
1397 ctnetlink_event_report(ct,
1398 NETLINK_CB(skb).pid,
1399 nlmsg_report(nlh));
1400 nf_ct_put(ct);
1401 } else
1402 spin_unlock_bh(&nf_conntrack_lock);
1403
1404 return err;
Pablo Neira Ayusoff4ca822007-08-07 18:11:26 -07001405 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001406
1407out_unlock:
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001408 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001409 return err;
1410}
1411
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001412/***********************************************************************
1413 * EXPECT
1414 ***********************************************************************/
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001415
1416static inline int
1417ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1418 const struct nf_conntrack_tuple *tuple,
1419 enum ctattr_expect type)
1420{
Patrick McHardydf6fb862007-09-28 14:37:03 -07001421 struct nlattr *nest_parms;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001422
Patrick McHardydf6fb862007-09-28 14:37:03 -07001423 nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
1424 if (!nest_parms)
1425 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001426 if (ctnetlink_dump_tuples(skb, tuple) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001427 goto nla_put_failure;
1428 nla_nest_end(skb, nest_parms);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001429
1430 return 0;
1431
Patrick McHardydf6fb862007-09-28 14:37:03 -07001432nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001433 return -1;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001434}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001435
1436static inline int
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001437ctnetlink_exp_dump_mask(struct sk_buff *skb,
1438 const struct nf_conntrack_tuple *tuple,
Patrick McHardyd4156e82007-07-07 22:31:32 -07001439 const struct nf_conntrack_tuple_mask *mask)
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001440{
1441 int ret;
1442 struct nf_conntrack_l3proto *l3proto;
Martin Josefsson605dcad2006-11-29 02:35:06 +01001443 struct nf_conntrack_l4proto *l4proto;
Patrick McHardyd4156e82007-07-07 22:31:32 -07001444 struct nf_conntrack_tuple m;
Patrick McHardydf6fb862007-09-28 14:37:03 -07001445 struct nlattr *nest_parms;
Patrick McHardyd4156e82007-07-07 22:31:32 -07001446
1447 memset(&m, 0xFF, sizeof(m));
1448 m.src.u.all = mask->src.u.all;
1449 memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
1450
Patrick McHardydf6fb862007-09-28 14:37:03 -07001451 nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
1452 if (!nest_parms)
1453 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001454
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001455 l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
Patrick McHardyd4156e82007-07-07 22:31:32 -07001456 ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001457
1458 if (unlikely(ret < 0))
Patrick McHardydf6fb862007-09-28 14:37:03 -07001459 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001460
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001461 l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
Patrick McHardyd4156e82007-07-07 22:31:32 -07001462 ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001463 if (unlikely(ret < 0))
Patrick McHardydf6fb862007-09-28 14:37:03 -07001464 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001465
Patrick McHardydf6fb862007-09-28 14:37:03 -07001466 nla_nest_end(skb, nest_parms);
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001467
1468 return 0;
1469
Patrick McHardydf6fb862007-09-28 14:37:03 -07001470nla_put_failure:
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001471 return -1;
1472}
1473
Ilpo Järvinenbb5cf802008-01-05 23:11:31 -08001474static int
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001475ctnetlink_exp_dump_expect(struct sk_buff *skb,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001476 const struct nf_conntrack_expect *exp)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001477{
1478 struct nf_conn *master = exp->master;
Patrick McHardyd978e5d2007-12-17 22:37:03 -08001479 long timeout = (exp->timeout.expires - jiffies) / HZ;
1480
1481 if (timeout < 0)
1482 timeout = 0;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001483
1484 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001485 goto nla_put_failure;
Pablo Neira Ayuso1cde6432006-03-22 13:54:15 -08001486 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001487 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001488 if (ctnetlink_exp_dump_tuple(skb,
1489 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1490 CTA_EXPECT_MASTER) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001491 goto nla_put_failure;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001492
Patrick McHardyd978e5d2007-12-17 22:37:03 -08001493 NLA_PUT_BE32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout));
Patrick McHardy77236b62007-12-17 22:29:45 -08001494 NLA_PUT_BE32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001495
1496 return 0;
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001497
Patrick McHardydf6fb862007-09-28 14:37:03 -07001498nla_put_failure:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001499 return -1;
1500}
1501
1502static int
1503ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001504 int event,
1505 int nowait,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001506 const struct nf_conntrack_expect *exp)
1507{
1508 struct nlmsghdr *nlh;
1509 struct nfgenmsg *nfmsg;
Arnaldo Carvalho de Melo27a884d2007-04-19 20:29:13 -07001510 unsigned char *b = skb_tail_pointer(skb);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001511
1512 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1513 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1514 nfmsg = NLMSG_DATA(nlh);
1515
1516 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1517 nfmsg->nfgen_family = exp->tuple.src.l3num;
1518 nfmsg->version = NFNETLINK_V0;
1519 nfmsg->res_id = 0;
1520
1521 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001522 goto nla_put_failure;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001523
Arnaldo Carvalho de Melo27a884d2007-04-19 20:29:13 -07001524 nlh->nlmsg_len = skb_tail_pointer(skb) - b;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001525 return skb->len;
1526
1527nlmsg_failure:
Patrick McHardydf6fb862007-09-28 14:37:03 -07001528nla_put_failure:
Arnaldo Carvalho de Melodc5fc572007-03-25 23:06:12 -07001529 nlmsg_trim(skb, b);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001530 return -1;
1531}
1532
1533#ifdef CONFIG_NF_CONNTRACK_EVENTS
1534static int ctnetlink_expect_event(struct notifier_block *this,
1535 unsigned long events, void *ptr)
1536{
1537 struct nlmsghdr *nlh;
1538 struct nfgenmsg *nfmsg;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001539 struct nf_exp_event *item = (struct nf_exp_event *)ptr;
1540 struct nf_conntrack_expect *exp = item->exp;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001541 struct sk_buff *skb;
1542 unsigned int type;
Arnaldo Carvalho de Melo27a884d2007-04-19 20:29:13 -07001543 sk_buff_data_t b;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001544 int flags = 0;
1545
1546 if (events & IPEXP_NEW) {
1547 type = IPCTNL_MSG_EXP_NEW;
1548 flags = NLM_F_CREATE|NLM_F_EXCL;
1549 } else
1550 return NOTIFY_DONE;
1551
Pablo Neira Ayuso1f9da252009-02-09 14:34:26 -08001552 if (!item->report &&
1553 !nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
Pablo Neira Ayusob3a27bf2006-08-22 00:32:05 -07001554 return NOTIFY_DONE;
1555
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001556 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1557 if (!skb)
1558 return NOTIFY_DONE;
1559
1560 b = skb->tail;
1561
Marcus Sundbergb633ad52006-02-04 02:11:09 -08001562 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001563 nlh = NLMSG_PUT(skb, item->pid, 0, type, sizeof(struct nfgenmsg));
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001564 nfmsg = NLMSG_DATA(nlh);
1565
1566 nlh->nlmsg_flags = flags;
1567 nfmsg->nfgen_family = exp->tuple.src.l3num;
1568 nfmsg->version = NFNETLINK_V0;
1569 nfmsg->res_id = 0;
1570
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001571 rcu_read_lock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001572 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
Patrick McHardydf6fb862007-09-28 14:37:03 -07001573 goto nla_put_failure;
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001574 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001575
1576 nlh->nlmsg_len = skb->tail - b;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001577 nfnetlink_send(skb, item->pid, NFNLGRP_CONNTRACK_EXP_NEW, item->report);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001578 return NOTIFY_DONE;
1579
Patrick McHardydf6fb862007-09-28 14:37:03 -07001580nla_put_failure:
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001581 rcu_read_unlock();
1582nlmsg_failure:
Pablo Neira Ayusodd5b6ce2009-03-23 13:21:06 +01001583 nfnetlink_set_err(0, 0, -ENOBUFS);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001584 kfree_skb(skb);
1585 return NOTIFY_DONE;
1586}
1587#endif
Patrick McHardycf6994c2007-07-07 22:32:34 -07001588static int ctnetlink_exp_done(struct netlink_callback *cb)
1589{
Patrick McHardy31f15872007-07-07 22:35:21 -07001590 if (cb->args[1])
1591 nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
Patrick McHardycf6994c2007-07-07 22:32:34 -07001592 return 0;
1593}
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001594
1595static int
1596ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1597{
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001598 struct net *net = &init_net;
Patrick McHardycf6994c2007-07-07 22:32:34 -07001599 struct nf_conntrack_expect *exp, *last;
Pablo Neira Ayuso87711cb2006-01-05 12:19:23 -08001600 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
Patrick McHardy31f15872007-07-07 22:35:21 -07001601 struct hlist_node *n;
Pablo Neira Ayuso87711cb2006-01-05 12:19:23 -08001602 u_int8_t l3proto = nfmsg->nfgen_family;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001603
Patrick McHardy7d0742d2008-01-31 04:38:19 -08001604 rcu_read_lock();
Patrick McHardy31f15872007-07-07 22:35:21 -07001605 last = (struct nf_conntrack_expect *)cb->args[1];
1606 for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
Patrick McHardycf6994c2007-07-07 22:32:34 -07001607restart:
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001608 hlist_for_each_entry(exp, n, &net->ct.expect_hash[cb->args[0]],
Patrick McHardy31f15872007-07-07 22:35:21 -07001609 hnode) {
1610 if (l3proto && exp->tuple.src.l3num != l3proto)
Patrick McHardycf6994c2007-07-07 22:32:34 -07001611 continue;
Patrick McHardy31f15872007-07-07 22:35:21 -07001612 if (cb->args[1]) {
1613 if (exp != last)
1614 continue;
1615 cb->args[1] = 0;
1616 }
1617 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1618 cb->nlh->nlmsg_seq,
1619 IPCTNL_MSG_EXP_NEW,
1620 1, exp) < 0) {
Patrick McHardy7d0742d2008-01-31 04:38:19 -08001621 if (!atomic_inc_not_zero(&exp->use))
1622 continue;
Patrick McHardy31f15872007-07-07 22:35:21 -07001623 cb->args[1] = (unsigned long)exp;
1624 goto out;
1625 }
Patrick McHardycf6994c2007-07-07 22:32:34 -07001626 }
Patrick McHardy31f15872007-07-07 22:35:21 -07001627 if (cb->args[1]) {
1628 cb->args[1] = 0;
1629 goto restart;
Patrick McHardycf6994c2007-07-07 22:32:34 -07001630 }
1631 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001632out:
Patrick McHardy7d0742d2008-01-31 04:38:19 -08001633 rcu_read_unlock();
Patrick McHardycf6994c2007-07-07 22:32:34 -07001634 if (last)
1635 nf_ct_expect_put(last);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001636
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001637 return skb->len;
1638}
1639
Patrick McHardyf73e9242007-09-28 14:39:55 -07001640static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
1641 [CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },
1642 [CTA_EXPECT_ID] = { .type = NLA_U32 },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001643};
1644
1645static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001646ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardydf6fb862007-09-28 14:37:03 -07001647 struct nlmsghdr *nlh, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001648{
1649 struct nf_conntrack_tuple tuple;
1650 struct nf_conntrack_expect *exp;
1651 struct sk_buff *skb2;
1652 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1653 u_int8_t u3 = nfmsg->nfgen_family;
1654 int err = 0;
1655
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001656 if (nlh->nlmsg_flags & NLM_F_DUMP) {
Thomas Grafc702e802007-03-22 23:30:55 -07001657 return netlink_dump_start(ctnl, skb, nlh,
1658 ctnetlink_exp_dump_table,
Patrick McHardycf6994c2007-07-07 22:32:34 -07001659 ctnetlink_exp_done);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001660 }
1661
Patrick McHardydf6fb862007-09-28 14:37:03 -07001662 if (cda[CTA_EXPECT_MASTER])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001663 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1664 else
1665 return -EINVAL;
1666
1667 if (err < 0)
1668 return err;
1669
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001670 exp = nf_ct_expect_find_get(&init_net, &tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001671 if (!exp)
1672 return -ENOENT;
1673
Patrick McHardydf6fb862007-09-28 14:37:03 -07001674 if (cda[CTA_EXPECT_ID]) {
Patrick McHardy77236b62007-12-17 22:29:45 -08001675 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
Patrick McHardy35832402007-09-28 14:41:50 -07001676 if (ntohl(id) != (u32)(unsigned long)exp) {
Patrick McHardy68236452007-07-07 22:30:49 -07001677 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001678 return -ENOENT;
1679 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001680 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001681
1682 err = -ENOMEM;
1683 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1684 if (!skb2)
1685 goto out;
Thomas Graf4e9b8262006-11-27 09:25:58 -08001686
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001687 rcu_read_lock();
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001688 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001689 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1690 1, exp);
Pablo Neira Ayuso528a3a62008-11-17 16:00:40 +01001691 rcu_read_unlock();
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001692 if (err <= 0)
1693 goto free;
1694
Patrick McHardy68236452007-07-07 22:30:49 -07001695 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001696
1697 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1698
1699free:
1700 kfree_skb(skb2);
1701out:
Patrick McHardy68236452007-07-07 22:30:49 -07001702 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001703 return err;
1704}
1705
1706static int
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001707ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardydf6fb862007-09-28 14:37:03 -07001708 struct nlmsghdr *nlh, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001709{
Patrick McHardy31f15872007-07-07 22:35:21 -07001710 struct nf_conntrack_expect *exp;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001711 struct nf_conntrack_tuple tuple;
1712 struct nf_conntrack_helper *h;
1713 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
Patrick McHardy31f15872007-07-07 22:35:21 -07001714 struct hlist_node *n, *next;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001715 u_int8_t u3 = nfmsg->nfgen_family;
Patrick McHardy31f15872007-07-07 22:35:21 -07001716 unsigned int i;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001717 int err;
1718
Patrick McHardydf6fb862007-09-28 14:37:03 -07001719 if (cda[CTA_EXPECT_TUPLE]) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001720 /* delete a single expect by tuple */
1721 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1722 if (err < 0)
1723 return err;
1724
1725 /* bump usage count to 2 */
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001726 exp = nf_ct_expect_find_get(&init_net, &tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001727 if (!exp)
1728 return -ENOENT;
1729
Patrick McHardydf6fb862007-09-28 14:37:03 -07001730 if (cda[CTA_EXPECT_ID]) {
Patrick McHardy77236b62007-12-17 22:29:45 -08001731 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
Patrick McHardy35832402007-09-28 14:41:50 -07001732 if (ntohl(id) != (u32)(unsigned long)exp) {
Patrick McHardy68236452007-07-07 22:30:49 -07001733 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001734 return -ENOENT;
1735 }
1736 }
1737
1738 /* after list removal, usage count == 1 */
Patrick McHardy68236452007-07-07 22:30:49 -07001739 nf_ct_unexpect_related(exp);
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001740 /* have to put what we 'get' above.
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001741 * after this line usage count == 0 */
Patrick McHardy68236452007-07-07 22:30:49 -07001742 nf_ct_expect_put(exp);
Patrick McHardydf6fb862007-09-28 14:37:03 -07001743 } else if (cda[CTA_EXPECT_HELP_NAME]) {
1744 char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
Patrick McHardy31f15872007-07-07 22:35:21 -07001745 struct nf_conn_help *m_help;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001746
1747 /* delete all expectations for this helper */
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001748 spin_lock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001749 h = __nf_conntrack_helper_find_byname(name);
1750 if (!h) {
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001751 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayuso0adf9d62008-06-09 15:56:20 -07001752 return -EOPNOTSUPP;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001753 }
Patrick McHardy31f15872007-07-07 22:35:21 -07001754 for (i = 0; i < nf_ct_expect_hsize; i++) {
1755 hlist_for_each_entry_safe(exp, n, next,
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001756 &init_net.ct.expect_hash[i],
Patrick McHardy31f15872007-07-07 22:35:21 -07001757 hnode) {
1758 m_help = nfct_help(exp->master);
1759 if (m_help->helper == h
1760 && del_timer(&exp->timeout)) {
1761 nf_ct_unlink_expect(exp);
1762 nf_ct_expect_put(exp);
1763 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001764 }
1765 }
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001766 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001767 } else {
1768 /* This basically means we have to flush everything*/
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001769 spin_lock_bh(&nf_conntrack_lock);
Patrick McHardy31f15872007-07-07 22:35:21 -07001770 for (i = 0; i < nf_ct_expect_hsize; i++) {
1771 hlist_for_each_entry_safe(exp, n, next,
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001772 &init_net.ct.expect_hash[i],
Patrick McHardy31f15872007-07-07 22:35:21 -07001773 hnode) {
1774 if (del_timer(&exp->timeout)) {
1775 nf_ct_unlink_expect(exp);
1776 nf_ct_expect_put(exp);
1777 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001778 }
1779 }
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001780 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001781 }
1782
1783 return 0;
1784}
1785static int
Patrick McHardydf6fb862007-09-28 14:37:03 -07001786ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001787{
1788 return -EOPNOTSUPP;
1789}
1790
1791static int
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001792ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001793{
1794 struct nf_conntrack_tuple tuple, mask, master_tuple;
1795 struct nf_conntrack_tuple_hash *h = NULL;
1796 struct nf_conntrack_expect *exp;
1797 struct nf_conn *ct;
Harald Weltedc808fe2006-03-20 17:56:32 -08001798 struct nf_conn_help *help;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001799 int err = 0;
1800
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001801 /* caller guarantees that those three CTA_EXPECT_* exist */
1802 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1803 if (err < 0)
1804 return err;
1805 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1806 if (err < 0)
1807 return err;
1808 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1809 if (err < 0)
1810 return err;
1811
1812 /* Look for master conntrack of this expectation */
Alexey Dobriyan400dad32008-10-08 11:35:03 +02001813 h = nf_conntrack_find_get(&init_net, &master_tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001814 if (!h)
1815 return -ENOENT;
1816 ct = nf_ct_tuplehash_to_ctrack(h);
Harald Weltedc808fe2006-03-20 17:56:32 -08001817 help = nfct_help(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001818
Harald Weltedc808fe2006-03-20 17:56:32 -08001819 if (!help || !help->helper) {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001820 /* such conntrack hasn't got any helper, abort */
Pablo Neira Ayusobfe29672008-11-17 15:55:48 +01001821 err = -EOPNOTSUPP;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001822 goto out;
1823 }
1824
Patrick McHardy68236452007-07-07 22:30:49 -07001825 exp = nf_ct_expect_alloc(ct);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001826 if (!exp) {
1827 err = -ENOMEM;
1828 goto out;
1829 }
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001830
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001831 exp->expectfn = NULL;
1832 exp->flags = 0;
1833 exp->master = ct;
Patrick McHardy9457d852006-12-02 22:05:25 -08001834 exp->helper = NULL;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001835 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
Patrick McHardyd4156e82007-07-07 22:31:32 -07001836 memcpy(&exp->mask.src.u3, &mask.src.u3, sizeof(exp->mask.src.u3));
1837 exp->mask.src.u.all = mask.src.u.all;
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001838
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001839 err = nf_ct_expect_related_report(exp, pid, report);
Patrick McHardy68236452007-07-07 22:30:49 -07001840 nf_ct_expect_put(exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001841
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08001842out:
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001843 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1844 return err;
1845}
1846
1847static int
1848ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
Patrick McHardydf6fb862007-09-28 14:37:03 -07001849 struct nlmsghdr *nlh, struct nlattr *cda[])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001850{
1851 struct nf_conntrack_tuple tuple;
1852 struct nf_conntrack_expect *exp;
1853 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1854 u_int8_t u3 = nfmsg->nfgen_family;
1855 int err = 0;
1856
Patrick McHardydf6fb862007-09-28 14:37:03 -07001857 if (!cda[CTA_EXPECT_TUPLE]
1858 || !cda[CTA_EXPECT_MASK]
1859 || !cda[CTA_EXPECT_MASTER])
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001860 return -EINVAL;
1861
1862 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1863 if (err < 0)
1864 return err;
1865
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001866 spin_lock_bh(&nf_conntrack_lock);
Alexey Dobriyan9b03f382008-10-08 11:35:03 +02001867 exp = __nf_ct_expect_find(&init_net, &tuple);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001868
1869 if (!exp) {
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001870 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001871 err = -ENOENT;
Pablo Neira Ayuso19abb7b2008-11-18 11:56:20 +01001872 if (nlh->nlmsg_flags & NLM_F_CREATE) {
1873 err = ctnetlink_create_expect(cda,
1874 u3,
1875 NETLINK_CB(skb).pid,
1876 nlmsg_report(nlh));
1877 }
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001878 return err;
1879 }
1880
1881 err = -EEXIST;
1882 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1883 err = ctnetlink_change_expect(exp, cda);
Patrick McHardyf8ba1af2008-01-31 04:38:58 -08001884 spin_unlock_bh(&nf_conntrack_lock);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001885
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001886 return err;
1887}
1888
1889#ifdef CONFIG_NF_CONNTRACK_EVENTS
1890static struct notifier_block ctnl_notifier = {
1891 .notifier_call = ctnetlink_conntrack_event,
1892};
1893
1894static struct notifier_block ctnl_notifier_exp = {
1895 .notifier_call = ctnetlink_expect_event,
1896};
1897#endif
1898
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07001899static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001900 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07001901 .attr_count = CTA_MAX,
1902 .policy = ct_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001903 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07001904 .attr_count = CTA_MAX,
1905 .policy = ct_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001906 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07001907 .attr_count = CTA_MAX,
1908 .policy = ct_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001909 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
Patrick McHardyf73e9242007-09-28 14:39:55 -07001910 .attr_count = CTA_MAX,
1911 .policy = ct_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001912};
1913
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07001914static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001915 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
Patrick McHardyf73e9242007-09-28 14:39:55 -07001916 .attr_count = CTA_EXPECT_MAX,
1917 .policy = exp_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001918 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
Patrick McHardyf73e9242007-09-28 14:39:55 -07001919 .attr_count = CTA_EXPECT_MAX,
1920 .policy = exp_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001921 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
Patrick McHardyf73e9242007-09-28 14:39:55 -07001922 .attr_count = CTA_EXPECT_MAX,
1923 .policy = exp_nla_policy },
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001924};
1925
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07001926static const struct nfnetlink_subsystem ctnl_subsys = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001927 .name = "conntrack",
1928 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1929 .cb_count = IPCTNL_MSG_MAX,
1930 .cb = ctnl_cb,
1931};
1932
Patrick McHardy7c8d4cb2007-09-28 14:15:45 -07001933static const struct nfnetlink_subsystem ctnl_exp_subsys = {
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001934 .name = "conntrack_expect",
1935 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1936 .cb_count = IPCTNL_MSG_EXP_MAX,
1937 .cb = ctnl_exp_cb,
1938};
1939
Patrick McHardyd2483dd2006-12-02 22:06:05 -08001940MODULE_ALIAS("ip_conntrack_netlink");
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001941MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
Pablo Neira Ayuso34f9a2e2006-02-04 02:11:41 -08001942MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001943
1944static int __init ctnetlink_init(void)
1945{
1946 int ret;
1947
1948 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1949 ret = nfnetlink_subsys_register(&ctnl_subsys);
1950 if (ret < 0) {
1951 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1952 goto err_out;
1953 }
1954
1955 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1956 if (ret < 0) {
1957 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1958 goto err_unreg_subsys;
1959 }
1960
1961#ifdef CONFIG_NF_CONNTRACK_EVENTS
1962 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1963 if (ret < 0) {
1964 printk("ctnetlink_init: cannot register notifier.\n");
1965 goto err_unreg_exp_subsys;
1966 }
1967
Patrick McHardy68236452007-07-07 22:30:49 -07001968 ret = nf_ct_expect_register_notifier(&ctnl_notifier_exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001969 if (ret < 0) {
1970 printk("ctnetlink_init: cannot expect register notifier.\n");
1971 goto err_unreg_notifier;
1972 }
1973#endif
1974
1975 return 0;
1976
1977#ifdef CONFIG_NF_CONNTRACK_EVENTS
1978err_unreg_notifier:
1979 nf_conntrack_unregister_notifier(&ctnl_notifier);
1980err_unreg_exp_subsys:
1981 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1982#endif
1983err_unreg_subsys:
1984 nfnetlink_subsys_unregister(&ctnl_subsys);
1985err_out:
1986 return ret;
1987}
1988
1989static void __exit ctnetlink_exit(void)
1990{
1991 printk("ctnetlink: unregistering from nfnetlink.\n");
1992
1993#ifdef CONFIG_NF_CONNTRACK_EVENTS
Patrick McHardy68236452007-07-07 22:30:49 -07001994 nf_ct_expect_unregister_notifier(&ctnl_notifier_exp);
Pablo Neira Ayusoc1d10ad2006-01-05 12:19:05 -08001995 nf_conntrack_unregister_notifier(&ctnl_notifier);
1996#endif
1997
1998 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1999 nfnetlink_subsys_unregister(&ctnl_subsys);
2000 return;
2001}
2002
2003module_init(ctnetlink_init);
2004module_exit(ctnetlink_exit);