1 /* Connection tracking via netlink socket. Allows for user space 2 * protocol helpers and general trouble making from userspace. 3 * 4 * (C) 2001 by Jay Schulist <jschlst@samba.org> 5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org> 6 * (C) 2003 by Patrick Mchardy <kaber@trash.net> 7 * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org> 8 * 9 * Initial connection tracking via netlink development funded and 10 * generally made possible by Network Robots, Inc. (www.networkrobots.com) 11 * 12 * Further development of this code funded by Astaro AG (http://www.astaro.com) 13 * 14 * This software may be used and distributed according to the terms 15 * of the GNU General Public License, incorporated herein by reference. 16 */ 17 18 #include <linux/init.h> 19 #include <linux/module.h> 20 #include <linux/kernel.h> 21 #include <linux/rculist.h> 22 #include <linux/rculist_nulls.h> 23 #include <linux/types.h> 24 #include <linux/timer.h> 25 #include <linux/security.h> 26 #include <linux/skbuff.h> 27 #include <linux/errno.h> 28 #include <linux/netlink.h> 29 #include <linux/spinlock.h> 30 #include <linux/interrupt.h> 31 #include <linux/slab.h> 32 #include <linux/siphash.h> 33 34 #include <linux/netfilter.h> 35 #include <net/ipv6.h> 36 #include <net/netlink.h> 37 #include <net/sock.h> 38 #include <net/netfilter/nf_conntrack.h> 39 #include <net/netfilter/nf_conntrack_core.h> 40 #include <net/netfilter/nf_conntrack_expect.h> 41 #include <net/netfilter/nf_conntrack_helper.h> 42 #include <net/netfilter/nf_conntrack_seqadj.h> 43 #include <net/netfilter/nf_conntrack_l4proto.h> 44 #include <net/netfilter/nf_conntrack_tuple.h> 45 #include <net/netfilter/nf_conntrack_acct.h> 46 #include <net/netfilter/nf_conntrack_zones.h> 47 #include <net/netfilter/nf_conntrack_timestamp.h> 48 #include <net/netfilter/nf_conntrack_labels.h> 49 #include <net/netfilter/nf_conntrack_synproxy.h> 50 #if IS_ENABLED(CONFIG_NF_NAT) 51 #include <net/netfilter/nf_nat.h> 52 #include <net/netfilter/nf_nat_helper.h> 53 #endif 54 55 #include <linux/netfilter/nfnetlink.h> 56 #include <linux/netfilter/nfnetlink_conntrack.h> 57 58 #include "nf_internals.h" 59 60 MODULE_LICENSE("GPL"); 61 MODULE_DESCRIPTION("List and change connection tracking table"); 62 63 struct ctnetlink_list_dump_ctx { 64 unsigned long last_id; 65 unsigned int cpu; 66 bool done; 67 }; 68 69 static int ctnetlink_dump_tuples_proto(struct sk_buff *skb, 70 const struct nf_conntrack_tuple *tuple, 71 const struct nf_conntrack_l4proto *l4proto) 72 { 73 int ret = 0; 74 struct nlattr *nest_parms; 75 76 nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO); 77 if (!nest_parms) 78 goto nla_put_failure; 79 if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum)) 80 goto nla_put_failure; 81 82 if (likely(l4proto->tuple_to_nlattr)) 83 ret = l4proto->tuple_to_nlattr(skb, tuple); 84 85 nla_nest_end(skb, nest_parms); 86 87 return ret; 88 89 nla_put_failure: 90 return -1; 91 } 92 93 static int ipv4_tuple_to_nlattr(struct sk_buff *skb, 94 const struct nf_conntrack_tuple *tuple) 95 { 96 if (nla_put_in_addr(skb, CTA_IP_V4_SRC, tuple->src.u3.ip) || 97 nla_put_in_addr(skb, CTA_IP_V4_DST, tuple->dst.u3.ip)) 98 return -EMSGSIZE; 99 return 0; 100 } 101 102 static int ipv6_tuple_to_nlattr(struct sk_buff *skb, 103 const struct nf_conntrack_tuple *tuple) 104 { 105 if (nla_put_in6_addr(skb, CTA_IP_V6_SRC, &tuple->src.u3.in6) || 106 nla_put_in6_addr(skb, CTA_IP_V6_DST, &tuple->dst.u3.in6)) 107 return -EMSGSIZE; 108 return 0; 109 } 110 111 static int ctnetlink_dump_tuples_ip(struct sk_buff *skb, 112 const struct nf_conntrack_tuple *tuple) 113 { 114 int ret = 0; 115 struct nlattr *nest_parms; 116 117 nest_parms = nla_nest_start(skb, CTA_TUPLE_IP); 118 if (!nest_parms) 119 goto nla_put_failure; 120 121 switch (tuple->src.l3num) { 122 case NFPROTO_IPV4: 123 ret = ipv4_tuple_to_nlattr(skb, tuple); 124 break; 125 case NFPROTO_IPV6: 126 ret = ipv6_tuple_to_nlattr(skb, tuple); 127 break; 128 } 129 130 nla_nest_end(skb, nest_parms); 131 132 return ret; 133 134 nla_put_failure: 135 return -1; 136 } 137 138 static int ctnetlink_dump_tuples(struct sk_buff *skb, 139 const struct nf_conntrack_tuple *tuple) 140 { 141 const struct nf_conntrack_l4proto *l4proto; 142 int ret; 143 144 rcu_read_lock(); 145 ret = ctnetlink_dump_tuples_ip(skb, tuple); 146 147 if (ret >= 0) { 148 l4proto = nf_ct_l4proto_find(tuple->dst.protonum); 149 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto); 150 } 151 rcu_read_unlock(); 152 return ret; 153 } 154 155 static int ctnetlink_dump_zone_id(struct sk_buff *skb, int attrtype, 156 const struct nf_conntrack_zone *zone, int dir) 157 { 158 if (zone->id == NF_CT_DEFAULT_ZONE_ID || zone->dir != dir) 159 return 0; 160 if (nla_put_be16(skb, attrtype, htons(zone->id))) 161 goto nla_put_failure; 162 return 0; 163 164 nla_put_failure: 165 return -1; 166 } 167 168 static int ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct) 169 { 170 if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status))) 171 goto nla_put_failure; 172 return 0; 173 174 nla_put_failure: 175 return -1; 176 } 177 178 static int ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct, 179 bool skip_zero) 180 { 181 long timeout; 182 183 if (nf_ct_is_confirmed(ct)) 184 timeout = nf_ct_expires(ct) / HZ; 185 else 186 timeout = ct->timeout / HZ; 187 188 if (skip_zero && timeout == 0) 189 return 0; 190 191 if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout))) 192 goto nla_put_failure; 193 return 0; 194 195 nla_put_failure: 196 return -1; 197 } 198 199 static int ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct, 200 bool destroy) 201 { 202 const struct nf_conntrack_l4proto *l4proto; 203 struct nlattr *nest_proto; 204 int ret; 205 206 l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct)); 207 if (!l4proto->to_nlattr) 208 return 0; 209 210 nest_proto = nla_nest_start(skb, CTA_PROTOINFO); 211 if (!nest_proto) 212 goto nla_put_failure; 213 214 ret = l4proto->to_nlattr(skb, nest_proto, ct, destroy); 215 216 nla_nest_end(skb, nest_proto); 217 218 return ret; 219 220 nla_put_failure: 221 return -1; 222 } 223 224 static int ctnetlink_dump_helpinfo(struct sk_buff *skb, 225 const struct nf_conn *ct) 226 { 227 struct nlattr *nest_helper; 228 const struct nf_conn_help *help = nfct_help(ct); 229 struct nf_conntrack_helper *helper; 230 231 if (!help) 232 return 0; 233 234 rcu_read_lock(); 235 helper = rcu_dereference(help->helper); 236 if (!helper) 237 goto out; 238 239 nest_helper = nla_nest_start(skb, CTA_HELP); 240 if (!nest_helper) 241 goto nla_put_failure; 242 if (nla_put_string(skb, CTA_HELP_NAME, helper->name)) 243 goto nla_put_failure; 244 245 if (helper->to_nlattr) 246 helper->to_nlattr(skb, ct); 247 248 nla_nest_end(skb, nest_helper); 249 out: 250 rcu_read_unlock(); 251 return 0; 252 253 nla_put_failure: 254 rcu_read_unlock(); 255 return -1; 256 } 257 258 static int 259 dump_counters(struct sk_buff *skb, struct nf_conn_acct *acct, 260 enum ip_conntrack_dir dir, int type) 261 { 262 enum ctattr_type attr = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG; 263 struct nf_conn_counter *counter = acct->counter; 264 struct nlattr *nest_count; 265 u64 pkts, bytes; 266 267 if (type == IPCTNL_MSG_CT_GET_CTRZERO) { 268 pkts = atomic64_xchg(&counter[dir].packets, 0); 269 bytes = atomic64_xchg(&counter[dir].bytes, 0); 270 } else { 271 pkts = atomic64_read(&counter[dir].packets); 272 bytes = atomic64_read(&counter[dir].bytes); 273 } 274 275 nest_count = nla_nest_start(skb, attr); 276 if (!nest_count) 277 goto nla_put_failure; 278 279 if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts), 280 CTA_COUNTERS_PAD) || 281 nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes), 282 CTA_COUNTERS_PAD)) 283 goto nla_put_failure; 284 285 nla_nest_end(skb, nest_count); 286 287 return 0; 288 289 nla_put_failure: 290 return -1; 291 } 292 293 static int 294 ctnetlink_dump_acct(struct sk_buff *skb, const struct nf_conn *ct, int type) 295 { 296 struct nf_conn_acct *acct = nf_conn_acct_find(ct); 297 298 if (!acct) 299 return 0; 300 301 if (dump_counters(skb, acct, IP_CT_DIR_ORIGINAL, type) < 0) 302 return -1; 303 if (dump_counters(skb, acct, IP_CT_DIR_REPLY, type) < 0) 304 return -1; 305 306 return 0; 307 } 308 309 static int 310 ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct) 311 { 312 struct nlattr *nest_count; 313 const struct nf_conn_tstamp *tstamp; 314 315 tstamp = nf_conn_tstamp_find(ct); 316 if (!tstamp) 317 return 0; 318 319 nest_count = nla_nest_start(skb, CTA_TIMESTAMP); 320 if (!nest_count) 321 goto nla_put_failure; 322 323 if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start), 324 CTA_TIMESTAMP_PAD) || 325 (tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP, 326 cpu_to_be64(tstamp->stop), 327 CTA_TIMESTAMP_PAD))) 328 goto nla_put_failure; 329 nla_nest_end(skb, nest_count); 330 331 return 0; 332 333 nla_put_failure: 334 return -1; 335 } 336 337 #ifdef CONFIG_NF_CONNTRACK_MARK 338 static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct, 339 bool dump) 340 { 341 u32 mark = READ_ONCE(ct->mark); 342 343 if (!mark && !dump) 344 return 0; 345 346 if (nla_put_be32(skb, CTA_MARK, htonl(mark))) 347 goto nla_put_failure; 348 return 0; 349 350 nla_put_failure: 351 return -1; 352 } 353 #else 354 #define ctnetlink_dump_mark(a, b, c) (0) 355 #endif 356 357 #ifdef CONFIG_NF_CONNTRACK_SECMARK 358 static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) 359 { 360 struct nlattr *nest_secctx; 361 struct lsm_context ctx; 362 int ret; 363 364 ret = security_secid_to_secctx(ct->secmark, &ctx); 365 if (ret < 0) 366 return 0; 367 368 ret = -1; 369 nest_secctx = nla_nest_start(skb, CTA_SECCTX); 370 if (!nest_secctx) 371 goto nla_put_failure; 372 373 if (nla_put_string(skb, CTA_SECCTX_NAME, ctx.context)) 374 goto nla_put_failure; 375 nla_nest_end(skb, nest_secctx); 376 377 ret = 0; 378 nla_put_failure: 379 security_release_secctx(&ctx); 380 return ret; 381 } 382 #else 383 #define ctnetlink_dump_secctx(a, b) (0) 384 #endif 385 386 #ifdef CONFIG_NF_CONNTRACK_EVENTS 387 static int 388 ctnetlink_dump_event_timestamp(struct sk_buff *skb, const struct nf_conn *ct) 389 { 390 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP 391 const struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct); 392 393 if (e) { 394 u64 ts = local64_read(&e->timestamp); 395 396 if (ts) 397 return nla_put_be64(skb, CTA_TIMESTAMP_EVENT, 398 cpu_to_be64(ts), CTA_TIMESTAMP_PAD); 399 } 400 #endif 401 return 0; 402 } 403 404 static inline int ctnetlink_label_size(const struct nf_conn *ct) 405 { 406 struct nf_conn_labels *labels = nf_ct_labels_find(ct); 407 408 if (!labels) 409 return 0; 410 return nla_total_size(sizeof(labels->bits)); 411 } 412 #endif 413 414 static int 415 ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct) 416 { 417 struct nf_conn_labels *labels = nf_ct_labels_find(ct); 418 unsigned int i; 419 420 if (!labels) 421 return 0; 422 423 i = 0; 424 do { 425 if (labels->bits[i] != 0) 426 return nla_put(skb, CTA_LABELS, sizeof(labels->bits), 427 labels->bits); 428 i++; 429 } while (i < ARRAY_SIZE(labels->bits)); 430 431 return 0; 432 } 433 434 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple) 435 436 static int ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct) 437 { 438 struct nlattr *nest_parms; 439 440 if (!(ct->status & IPS_EXPECTED)) 441 return 0; 442 443 nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER); 444 if (!nest_parms) 445 goto nla_put_failure; 446 if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0) 447 goto nla_put_failure; 448 nla_nest_end(skb, nest_parms); 449 450 return 0; 451 452 nla_put_failure: 453 return -1; 454 } 455 456 static int 457 dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type) 458 { 459 struct nlattr *nest_parms; 460 461 nest_parms = nla_nest_start(skb, type); 462 if (!nest_parms) 463 goto nla_put_failure; 464 465 if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS, 466 htonl(seq->correction_pos)) || 467 nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE, 468 htonl(seq->offset_before)) || 469 nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER, 470 htonl(seq->offset_after))) 471 goto nla_put_failure; 472 473 nla_nest_end(skb, nest_parms); 474 475 return 0; 476 477 nla_put_failure: 478 return -1; 479 } 480 481 static int ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, struct nf_conn *ct) 482 { 483 struct nf_conn_seqadj *seqadj = nfct_seqadj(ct); 484 struct nf_ct_seqadj *seq; 485 486 if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj) 487 return 0; 488 489 spin_lock_bh(&ct->lock); 490 seq = &seqadj->seq[IP_CT_DIR_ORIGINAL]; 491 if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1) 492 goto err; 493 494 seq = &seqadj->seq[IP_CT_DIR_REPLY]; 495 if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1) 496 goto err; 497 498 spin_unlock_bh(&ct->lock); 499 return 0; 500 err: 501 spin_unlock_bh(&ct->lock); 502 return -1; 503 } 504 505 static int ctnetlink_dump_ct_synproxy(struct sk_buff *skb, struct nf_conn *ct) 506 { 507 struct nf_conn_synproxy *synproxy = nfct_synproxy(ct); 508 struct nlattr *nest_parms; 509 510 if (!synproxy) 511 return 0; 512 513 nest_parms = nla_nest_start(skb, CTA_SYNPROXY); 514 if (!nest_parms) 515 goto nla_put_failure; 516 517 if (nla_put_be32(skb, CTA_SYNPROXY_ISN, htonl(synproxy->isn)) || 518 nla_put_be32(skb, CTA_SYNPROXY_ITS, htonl(synproxy->its)) || 519 nla_put_be32(skb, CTA_SYNPROXY_TSOFF, htonl(synproxy->tsoff))) 520 goto nla_put_failure; 521 522 nla_nest_end(skb, nest_parms); 523 524 return 0; 525 526 nla_put_failure: 527 return -1; 528 } 529 530 static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct) 531 { 532 __be32 id = (__force __be32)nf_ct_get_id(ct); 533 534 if (nla_put_be32(skb, CTA_ID, id)) 535 goto nla_put_failure; 536 return 0; 537 538 nla_put_failure: 539 return -1; 540 } 541 542 static int ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct) 543 { 544 if (nla_put_be32(skb, CTA_USE, htonl(refcount_read(&ct->ct_general.use)))) 545 goto nla_put_failure; 546 return 0; 547 548 nla_put_failure: 549 return -1; 550 } 551 552 /* all these functions access ct->ext. Caller must either hold a reference 553 * on ct or prevent its deletion by holding either the bucket spinlock or 554 * pcpu dying list lock. 555 */ 556 static int ctnetlink_dump_extinfo(struct sk_buff *skb, 557 struct nf_conn *ct, u32 type) 558 { 559 if (ctnetlink_dump_acct(skb, ct, type) < 0 || 560 ctnetlink_dump_timestamp(skb, ct) < 0 || 561 ctnetlink_dump_helpinfo(skb, ct) < 0 || 562 ctnetlink_dump_labels(skb, ct) < 0 || 563 ctnetlink_dump_ct_seq_adj(skb, ct) < 0 || 564 ctnetlink_dump_ct_synproxy(skb, ct) < 0) 565 return -1; 566 567 return 0; 568 } 569 570 static int ctnetlink_dump_info(struct sk_buff *skb, struct nf_conn *ct) 571 { 572 if (ctnetlink_dump_status(skb, ct) < 0 || 573 ctnetlink_dump_mark(skb, ct, true) < 0 || 574 ctnetlink_dump_secctx(skb, ct) < 0 || 575 ctnetlink_dump_id(skb, ct) < 0 || 576 ctnetlink_dump_use(skb, ct) < 0 || 577 ctnetlink_dump_master(skb, ct) < 0) 578 return -1; 579 580 if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) && 581 (ctnetlink_dump_timeout(skb, ct, false) < 0 || 582 ctnetlink_dump_protoinfo(skb, ct, false) < 0)) 583 return -1; 584 585 return 0; 586 } 587 588 static int 589 ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, 590 struct nf_conn *ct, bool extinfo, unsigned int flags) 591 { 592 const struct nf_conntrack_zone *zone; 593 struct nlmsghdr *nlh; 594 struct nlattr *nest_parms; 595 unsigned int event; 596 597 if (portid) 598 flags |= NLM_F_MULTI; 599 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW); 600 nlh = nfnl_msg_put(skb, portid, seq, event, flags, nf_ct_l3num(ct), 601 NFNETLINK_V0, 0); 602 if (!nlh) 603 goto nlmsg_failure; 604 605 zone = nf_ct_zone(ct); 606 607 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); 608 if (!nest_parms) 609 goto nla_put_failure; 610 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0) 611 goto nla_put_failure; 612 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 613 NF_CT_ZONE_DIR_ORIG) < 0) 614 goto nla_put_failure; 615 nla_nest_end(skb, nest_parms); 616 617 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY); 618 if (!nest_parms) 619 goto nla_put_failure; 620 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0) 621 goto nla_put_failure; 622 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 623 NF_CT_ZONE_DIR_REPL) < 0) 624 goto nla_put_failure; 625 nla_nest_end(skb, nest_parms); 626 627 if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone, 628 NF_CT_DEFAULT_ZONE_DIR) < 0) 629 goto nla_put_failure; 630 631 if (ctnetlink_dump_info(skb, ct) < 0) 632 goto nla_put_failure; 633 if (extinfo && ctnetlink_dump_extinfo(skb, ct, type) < 0) 634 goto nla_put_failure; 635 636 nlmsg_end(skb, nlh); 637 return skb->len; 638 639 nlmsg_failure: 640 nla_put_failure: 641 nlmsg_cancel(skb, nlh); 642 return -1; 643 } 644 645 static const struct nla_policy cta_ip_nla_policy[CTA_IP_MAX + 1] = { 646 [CTA_IP_V4_SRC] = { .type = NLA_U32 }, 647 [CTA_IP_V4_DST] = { .type = NLA_U32 }, 648 [CTA_IP_V6_SRC] = { .len = sizeof(__be32) * 4 }, 649 [CTA_IP_V6_DST] = { .len = sizeof(__be32) * 4 }, 650 }; 651 652 #if defined(CONFIG_NETFILTER_NETLINK_GLUE_CT) || defined(CONFIG_NF_CONNTRACK_EVENTS) 653 static size_t ctnetlink_proto_size(const struct nf_conn *ct) 654 { 655 const struct nf_conntrack_l4proto *l4proto; 656 size_t len, len4 = 0; 657 658 len = nla_policy_len(cta_ip_nla_policy, CTA_IP_MAX + 1); 659 len *= 3u; /* ORIG, REPLY, MASTER */ 660 661 l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct)); 662 len += l4proto->nlattr_size; 663 if (l4proto->nlattr_tuple_size) { 664 len4 = l4proto->nlattr_tuple_size(); 665 len4 *= 3u; /* ORIG, REPLY, MASTER */ 666 } 667 668 return len + len4; 669 } 670 671 static inline size_t ctnetlink_acct_size(const struct nf_conn *ct) 672 { 673 if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT)) 674 return 0; 675 return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */ 676 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */ 677 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */ 678 ; 679 } 680 681 static inline int ctnetlink_secctx_size(const struct nf_conn *ct) 682 { 683 #ifdef CONFIG_NF_CONNTRACK_SECMARK 684 int ret; 685 686 ret = security_secid_to_secctx(ct->secmark, NULL); 687 if (ret < 0) 688 return 0; 689 690 return nla_total_size(0) /* CTA_SECCTX */ 691 + nla_total_size(sizeof(char) * ret); /* CTA_SECCTX_NAME */ 692 #else 693 return 0; 694 #endif 695 } 696 697 static inline size_t ctnetlink_timestamp_size(const struct nf_conn *ct) 698 { 699 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP 700 if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP)) 701 return 0; 702 return nla_total_size(0) + 2 * nla_total_size_64bit(sizeof(uint64_t)); 703 #else 704 return 0; 705 #endif 706 } 707 #endif 708 709 #ifdef CONFIG_NF_CONNTRACK_EVENTS 710 static size_t ctnetlink_nlmsg_size(const struct nf_conn *ct) 711 { 712 return NLMSG_ALIGN(sizeof(struct nfgenmsg)) 713 + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */ 714 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */ 715 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */ 716 + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */ 717 + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */ 718 + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */ 719 + ctnetlink_acct_size(ct) 720 + ctnetlink_timestamp_size(ct) 721 + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */ 722 + nla_total_size(0) /* CTA_PROTOINFO */ 723 + nla_total_size(0) /* CTA_HELP */ 724 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ 725 + ctnetlink_secctx_size(ct) 726 #if IS_ENABLED(CONFIG_NF_NAT) 727 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ 728 + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ 729 #endif 730 #ifdef CONFIG_NF_CONNTRACK_MARK 731 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */ 732 #endif 733 #ifdef CONFIG_NF_CONNTRACK_ZONES 734 + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE|CTA_TUPLE_ZONE */ 735 #endif 736 + ctnetlink_proto_size(ct) 737 + ctnetlink_label_size(ct) 738 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP 739 + nla_total_size(sizeof(u64)) /* CTA_TIMESTAMP_EVENT */ 740 #endif 741 ; 742 } 743 744 static int 745 ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item) 746 { 747 const struct nf_conntrack_zone *zone; 748 struct net *net; 749 struct nlmsghdr *nlh; 750 struct nlattr *nest_parms; 751 struct nf_conn *ct = item->ct; 752 struct sk_buff *skb; 753 unsigned int type; 754 unsigned int flags = 0, group; 755 int err; 756 757 if (events & (1 << IPCT_DESTROY)) { 758 type = IPCTNL_MSG_CT_DELETE; 759 group = NFNLGRP_CONNTRACK_DESTROY; 760 } else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) { 761 type = IPCTNL_MSG_CT_NEW; 762 flags = NLM_F_CREATE|NLM_F_EXCL; 763 group = NFNLGRP_CONNTRACK_NEW; 764 } else if (events) { 765 type = IPCTNL_MSG_CT_NEW; 766 group = NFNLGRP_CONNTRACK_UPDATE; 767 } else 768 return 0; 769 770 net = nf_ct_net(ct); 771 if (!item->report && !nfnetlink_has_listeners(net, group)) 772 return 0; 773 774 skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC); 775 if (skb == NULL) 776 goto errout; 777 778 type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type); 779 nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, nf_ct_l3num(ct), 780 NFNETLINK_V0, 0); 781 if (!nlh) 782 goto nlmsg_failure; 783 784 zone = nf_ct_zone(ct); 785 786 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); 787 if (!nest_parms) 788 goto nla_put_failure; 789 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0) 790 goto nla_put_failure; 791 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 792 NF_CT_ZONE_DIR_ORIG) < 0) 793 goto nla_put_failure; 794 nla_nest_end(skb, nest_parms); 795 796 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY); 797 if (!nest_parms) 798 goto nla_put_failure; 799 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0) 800 goto nla_put_failure; 801 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 802 NF_CT_ZONE_DIR_REPL) < 0) 803 goto nla_put_failure; 804 nla_nest_end(skb, nest_parms); 805 806 if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone, 807 NF_CT_DEFAULT_ZONE_DIR) < 0) 808 goto nla_put_failure; 809 810 if (ctnetlink_dump_id(skb, ct) < 0) 811 goto nla_put_failure; 812 813 if (ctnetlink_dump_status(skb, ct) < 0) 814 goto nla_put_failure; 815 816 if (events & (1 << IPCT_DESTROY)) { 817 if (ctnetlink_dump_timeout(skb, ct, true) < 0) 818 goto nla_put_failure; 819 820 if (ctnetlink_dump_acct(skb, ct, type) < 0 || 821 ctnetlink_dump_timestamp(skb, ct) < 0 || 822 ctnetlink_dump_protoinfo(skb, ct, true) < 0) 823 goto nla_put_failure; 824 } else { 825 if (ctnetlink_dump_timeout(skb, ct, false) < 0) 826 goto nla_put_failure; 827 828 if (events & (1 << IPCT_PROTOINFO) && 829 ctnetlink_dump_protoinfo(skb, ct, false) < 0) 830 goto nla_put_failure; 831 832 if ((events & (1 << IPCT_HELPER) || nfct_help(ct)) 833 && ctnetlink_dump_helpinfo(skb, ct) < 0) 834 goto nla_put_failure; 835 836 #ifdef CONFIG_NF_CONNTRACK_SECMARK 837 if ((events & (1 << IPCT_SECMARK) || ct->secmark) 838 && ctnetlink_dump_secctx(skb, ct) < 0) 839 goto nla_put_failure; 840 #endif 841 if (events & (1 << IPCT_LABEL) && 842 ctnetlink_dump_labels(skb, ct) < 0) 843 goto nla_put_failure; 844 845 if (events & (1 << IPCT_RELATED) && 846 ctnetlink_dump_master(skb, ct) < 0) 847 goto nla_put_failure; 848 849 if (events & (1 << IPCT_SEQADJ) && 850 ctnetlink_dump_ct_seq_adj(skb, ct) < 0) 851 goto nla_put_failure; 852 853 if (events & (1 << IPCT_SYNPROXY) && 854 ctnetlink_dump_ct_synproxy(skb, ct) < 0) 855 goto nla_put_failure; 856 } 857 858 #ifdef CONFIG_NF_CONNTRACK_MARK 859 if (ctnetlink_dump_mark(skb, ct, events & (1 << IPCT_MARK))) 860 goto nla_put_failure; 861 #endif 862 863 if (ctnetlink_dump_event_timestamp(skb, ct)) 864 goto nla_put_failure; 865 866 nlmsg_end(skb, nlh); 867 err = nfnetlink_send(skb, net, item->portid, group, item->report, 868 GFP_ATOMIC); 869 if (err == -ENOBUFS || err == -EAGAIN) 870 return -ENOBUFS; 871 872 return 0; 873 874 nla_put_failure: 875 nlmsg_cancel(skb, nlh); 876 nlmsg_failure: 877 kfree_skb(skb); 878 errout: 879 if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0) 880 return -ENOBUFS; 881 882 return 0; 883 } 884 #endif /* CONFIG_NF_CONNTRACK_EVENTS */ 885 886 static int ctnetlink_done(struct netlink_callback *cb) 887 { 888 kfree(cb->data); 889 return 0; 890 } 891 892 struct ctnetlink_filter_u32 { 893 u32 val; 894 u32 mask; 895 }; 896 897 struct ctnetlink_filter { 898 u8 family; 899 bool zone_filter; 900 901 u_int32_t orig_flags; 902 u_int32_t reply_flags; 903 904 struct nf_conntrack_tuple orig; 905 struct nf_conntrack_tuple reply; 906 struct nf_conntrack_zone zone; 907 908 struct ctnetlink_filter_u32 mark; 909 struct ctnetlink_filter_u32 status; 910 }; 911 912 static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX + 1] = { 913 [CTA_FILTER_ORIG_FLAGS] = NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL), 914 [CTA_FILTER_REPLY_FLAGS] = NLA_POLICY_MASK(NLA_U32, CTA_FILTER_F_ALL), 915 }; 916 917 static int ctnetlink_parse_filter(const struct nlattr *attr, 918 struct ctnetlink_filter *filter) 919 { 920 struct nlattr *tb[CTA_FILTER_MAX + 1]; 921 int ret = 0; 922 923 ret = nla_parse_nested(tb, CTA_FILTER_MAX, attr, cta_filter_nla_policy, 924 NULL); 925 if (ret) 926 return ret; 927 928 if (tb[CTA_FILTER_ORIG_FLAGS]) 929 filter->orig_flags = nla_get_u32(tb[CTA_FILTER_ORIG_FLAGS]); 930 931 if (tb[CTA_FILTER_REPLY_FLAGS]) 932 filter->reply_flags = nla_get_u32(tb[CTA_FILTER_REPLY_FLAGS]); 933 934 return 0; 935 } 936 937 static int ctnetlink_parse_zone(const struct nlattr *attr, 938 struct nf_conntrack_zone *zone); 939 static int ctnetlink_parse_tuple_filter(const struct nlattr * const cda[], 940 struct nf_conntrack_tuple *tuple, 941 u32 type, u_int8_t l3num, 942 struct nf_conntrack_zone *zone, 943 u_int32_t flags); 944 945 static int ctnetlink_filter_parse_mark(struct ctnetlink_filter_u32 *mark, 946 const struct nlattr * const cda[]) 947 { 948 #ifdef CONFIG_NF_CONNTRACK_MARK 949 if (cda[CTA_MARK]) { 950 mark->val = ntohl(nla_get_be32(cda[CTA_MARK])); 951 952 if (cda[CTA_MARK_MASK]) 953 mark->mask = ntohl(nla_get_be32(cda[CTA_MARK_MASK])); 954 else 955 mark->mask = 0xffffffff; 956 } else if (cda[CTA_MARK_MASK]) { 957 return -EINVAL; 958 } 959 #endif 960 return 0; 961 } 962 963 static int ctnetlink_filter_parse_status(struct ctnetlink_filter_u32 *status, 964 const struct nlattr * const cda[]) 965 { 966 if (cda[CTA_STATUS]) { 967 status->val = ntohl(nla_get_be32(cda[CTA_STATUS])); 968 if (cda[CTA_STATUS_MASK]) 969 status->mask = ntohl(nla_get_be32(cda[CTA_STATUS_MASK])); 970 else 971 status->mask = status->val; 972 973 /* status->val == 0? always true, else always false. */ 974 if (status->mask == 0) 975 return -EINVAL; 976 } else if (cda[CTA_STATUS_MASK]) { 977 return -EINVAL; 978 } 979 980 /* CTA_STATUS is NLA_U32, if this fires UAPI needs to be extended */ 981 BUILD_BUG_ON(__IPS_MAX_BIT >= 32); 982 return 0; 983 } 984 985 static struct ctnetlink_filter * 986 ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) 987 { 988 struct ctnetlink_filter *filter; 989 int err; 990 991 #ifndef CONFIG_NF_CONNTRACK_MARK 992 if (cda[CTA_MARK] || cda[CTA_MARK_MASK]) 993 return ERR_PTR(-EOPNOTSUPP); 994 #endif 995 996 filter = kzalloc_obj(*filter); 997 if (filter == NULL) 998 return ERR_PTR(-ENOMEM); 999 1000 filter->family = family; 1001 1002 err = ctnetlink_filter_parse_mark(&filter->mark, cda); 1003 if (err) 1004 goto err_filter; 1005 1006 err = ctnetlink_filter_parse_status(&filter->status, cda); 1007 if (err) 1008 goto err_filter; 1009 1010 if (cda[CTA_ZONE]) { 1011 err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone); 1012 if (err < 0) 1013 goto err_filter; 1014 filter->zone_filter = true; 1015 } 1016 1017 if (!cda[CTA_FILTER]) 1018 return filter; 1019 1020 err = ctnetlink_parse_filter(cda[CTA_FILTER], filter); 1021 if (err < 0) 1022 goto err_filter; 1023 1024 if (filter->orig_flags) { 1025 if (!cda[CTA_TUPLE_ORIG]) { 1026 err = -EINVAL; 1027 goto err_filter; 1028 } 1029 1030 err = ctnetlink_parse_tuple_filter(cda, &filter->orig, 1031 CTA_TUPLE_ORIG, 1032 filter->family, 1033 &filter->zone, 1034 filter->orig_flags); 1035 if (err < 0) 1036 goto err_filter; 1037 } 1038 1039 if (filter->reply_flags) { 1040 if (!cda[CTA_TUPLE_REPLY]) { 1041 err = -EINVAL; 1042 goto err_filter; 1043 } 1044 1045 err = ctnetlink_parse_tuple_filter(cda, &filter->reply, 1046 CTA_TUPLE_REPLY, 1047 filter->family, 1048 &filter->zone, 1049 filter->reply_flags); 1050 if (err < 0) 1051 goto err_filter; 1052 } 1053 1054 return filter; 1055 1056 err_filter: 1057 kfree(filter); 1058 1059 return ERR_PTR(err); 1060 } 1061 1062 static bool ctnetlink_needs_filter(u8 family, const struct nlattr * const *cda) 1063 { 1064 return family || cda[CTA_MARK] || cda[CTA_FILTER] || cda[CTA_STATUS] || cda[CTA_ZONE]; 1065 } 1066 1067 static int ctnetlink_start(struct netlink_callback *cb) 1068 { 1069 const struct nlattr * const *cda = cb->data; 1070 struct ctnetlink_filter *filter = NULL; 1071 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1072 u8 family = nfmsg->nfgen_family; 1073 1074 if (ctnetlink_needs_filter(family, cda)) { 1075 filter = ctnetlink_alloc_filter(cda, family); 1076 if (IS_ERR(filter)) 1077 return PTR_ERR(filter); 1078 } 1079 1080 cb->data = filter; 1081 return 0; 1082 } 1083 1084 static int ctnetlink_filter_match_tuple(struct nf_conntrack_tuple *filter_tuple, 1085 struct nf_conntrack_tuple *ct_tuple, 1086 u_int32_t flags, int family) 1087 { 1088 switch (family) { 1089 case NFPROTO_IPV4: 1090 if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) && 1091 filter_tuple->src.u3.ip != ct_tuple->src.u3.ip) 1092 return 0; 1093 1094 if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) && 1095 filter_tuple->dst.u3.ip != ct_tuple->dst.u3.ip) 1096 return 0; 1097 break; 1098 case NFPROTO_IPV6: 1099 if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) && 1100 !ipv6_addr_cmp(&filter_tuple->src.u3.in6, 1101 &ct_tuple->src.u3.in6)) 1102 return 0; 1103 1104 if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) && 1105 !ipv6_addr_cmp(&filter_tuple->dst.u3.in6, 1106 &ct_tuple->dst.u3.in6)) 1107 return 0; 1108 break; 1109 } 1110 1111 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_NUM)) && 1112 filter_tuple->dst.protonum != ct_tuple->dst.protonum) 1113 return 0; 1114 1115 switch (ct_tuple->dst.protonum) { 1116 case IPPROTO_TCP: 1117 case IPPROTO_UDP: 1118 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_SRC_PORT)) && 1119 filter_tuple->src.u.tcp.port != ct_tuple->src.u.tcp.port) 1120 return 0; 1121 1122 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_DST_PORT)) && 1123 filter_tuple->dst.u.tcp.port != ct_tuple->dst.u.tcp.port) 1124 return 0; 1125 break; 1126 case IPPROTO_ICMP: 1127 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMP_TYPE)) && 1128 filter_tuple->dst.u.icmp.type != ct_tuple->dst.u.icmp.type) 1129 return 0; 1130 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMP_CODE)) && 1131 filter_tuple->dst.u.icmp.code != ct_tuple->dst.u.icmp.code) 1132 return 0; 1133 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMP_ID)) && 1134 filter_tuple->src.u.icmp.id != ct_tuple->src.u.icmp.id) 1135 return 0; 1136 break; 1137 case IPPROTO_ICMPV6: 1138 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_TYPE)) && 1139 filter_tuple->dst.u.icmp.type != ct_tuple->dst.u.icmp.type) 1140 return 0; 1141 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_CODE)) && 1142 filter_tuple->dst.u.icmp.code != ct_tuple->dst.u.icmp.code) 1143 return 0; 1144 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_ID)) && 1145 filter_tuple->src.u.icmp.id != ct_tuple->src.u.icmp.id) 1146 return 0; 1147 break; 1148 } 1149 1150 return 1; 1151 } 1152 1153 static int ctnetlink_filter_match(struct nf_conn *ct, void *data) 1154 { 1155 struct ctnetlink_filter *filter = data; 1156 struct nf_conntrack_tuple *tuple; 1157 u32 status; 1158 1159 if (filter == NULL) 1160 goto out; 1161 1162 /* Match entries of a given L3 protocol number. 1163 * If it is not specified, ie. l3proto == 0, 1164 * then match everything. 1165 */ 1166 if (filter->family && nf_ct_l3num(ct) != filter->family) 1167 goto ignore_entry; 1168 1169 if (filter->zone_filter && 1170 !nf_ct_zone_equal_any(ct, &filter->zone)) 1171 goto ignore_entry; 1172 1173 if (filter->orig_flags) { 1174 tuple = nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL); 1175 if (!ctnetlink_filter_match_tuple(&filter->orig, tuple, 1176 filter->orig_flags, 1177 filter->family)) 1178 goto ignore_entry; 1179 } 1180 1181 if (filter->reply_flags) { 1182 tuple = nf_ct_tuple(ct, IP_CT_DIR_REPLY); 1183 if (!ctnetlink_filter_match_tuple(&filter->reply, tuple, 1184 filter->reply_flags, 1185 filter->family)) 1186 goto ignore_entry; 1187 } 1188 1189 #ifdef CONFIG_NF_CONNTRACK_MARK 1190 if ((READ_ONCE(ct->mark) & filter->mark.mask) != filter->mark.val) 1191 goto ignore_entry; 1192 #endif 1193 status = (u32)READ_ONCE(ct->status); 1194 if ((status & filter->status.mask) != filter->status.val) 1195 goto ignore_entry; 1196 1197 out: 1198 return 1; 1199 1200 ignore_entry: 1201 return 0; 1202 } 1203 1204 static unsigned long ctnetlink_get_id(const struct nf_conn *ct) 1205 { 1206 unsigned long id = nf_ct_get_id(ct); 1207 1208 return id ? id : 1; 1209 } 1210 1211 static int 1212 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 1213 { 1214 unsigned int flags = cb->data ? NLM_F_DUMP_FILTERED : 0; 1215 struct net *net = sock_net(skb->sk); 1216 unsigned long last_id = cb->args[1]; 1217 struct nf_conntrack_tuple_hash *h; 1218 struct hlist_nulls_node *n; 1219 struct nf_conn *nf_ct_evict[8]; 1220 struct nf_conn *ct; 1221 int res, i; 1222 spinlock_t *lockp; 1223 1224 i = 0; 1225 1226 local_bh_disable(); 1227 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) { 1228 restart: 1229 while (i) { 1230 i--; 1231 if (nf_ct_should_gc(nf_ct_evict[i])) 1232 nf_ct_kill(nf_ct_evict[i]); 1233 nf_ct_put(nf_ct_evict[i]); 1234 } 1235 1236 lockp = &nf_conntrack_locks[cb->args[0] % CONNTRACK_LOCKS]; 1237 nf_conntrack_lock(lockp); 1238 if (cb->args[0] >= nf_conntrack_htable_size) { 1239 spin_unlock(lockp); 1240 goto out; 1241 } 1242 hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]], 1243 hnnode) { 1244 ct = nf_ct_tuplehash_to_ctrack(h); 1245 if (nf_ct_is_expired(ct)) { 1246 /* need to defer nf_ct_kill() until lock is released */ 1247 if (i < ARRAY_SIZE(nf_ct_evict) && 1248 refcount_inc_not_zero(&ct->ct_general.use)) 1249 nf_ct_evict[i++] = ct; 1250 continue; 1251 } 1252 1253 if (!net_eq(net, nf_ct_net(ct))) 1254 continue; 1255 1256 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL) 1257 continue; 1258 1259 if (cb->args[1]) { 1260 if (ctnetlink_get_id(ct) != last_id) 1261 continue; 1262 cb->args[1] = 0; 1263 } 1264 if (!ctnetlink_filter_match(ct, cb->data)) 1265 continue; 1266 1267 res = 1268 ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid, 1269 cb->nlh->nlmsg_seq, 1270 NFNL_MSG_TYPE(cb->nlh->nlmsg_type), 1271 ct, true, flags); 1272 if (res < 0) { 1273 cb->args[1] = ctnetlink_get_id(ct); 1274 spin_unlock(lockp); 1275 goto out; 1276 } 1277 } 1278 spin_unlock(lockp); 1279 if (cb->args[1]) { 1280 cb->args[1] = 0; 1281 goto restart; 1282 } 1283 } 1284 out: 1285 local_bh_enable(); 1286 if (last_id) { 1287 /* nf ct hash resize happened, now clear the leftover. */ 1288 if (cb->args[1] == last_id) 1289 cb->args[1] = 0; 1290 } 1291 1292 while (i) { 1293 i--; 1294 if (nf_ct_should_gc(nf_ct_evict[i])) 1295 nf_ct_kill(nf_ct_evict[i]); 1296 nf_ct_put(nf_ct_evict[i]); 1297 } 1298 1299 return skb->len; 1300 } 1301 1302 static int ipv4_nlattr_to_tuple(struct nlattr *tb[], 1303 struct nf_conntrack_tuple *t, 1304 u_int32_t flags) 1305 { 1306 if (flags & CTA_FILTER_FLAG(CTA_IP_SRC)) { 1307 if (!tb[CTA_IP_V4_SRC]) 1308 return -EINVAL; 1309 1310 t->src.u3.ip = nla_get_in_addr(tb[CTA_IP_V4_SRC]); 1311 } 1312 1313 if (flags & CTA_FILTER_FLAG(CTA_IP_DST)) { 1314 if (!tb[CTA_IP_V4_DST]) 1315 return -EINVAL; 1316 1317 t->dst.u3.ip = nla_get_in_addr(tb[CTA_IP_V4_DST]); 1318 } 1319 1320 return 0; 1321 } 1322 1323 static int ipv6_nlattr_to_tuple(struct nlattr *tb[], 1324 struct nf_conntrack_tuple *t, 1325 u_int32_t flags) 1326 { 1327 if (flags & CTA_FILTER_FLAG(CTA_IP_SRC)) { 1328 if (!tb[CTA_IP_V6_SRC]) 1329 return -EINVAL; 1330 1331 t->src.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_SRC]); 1332 } 1333 1334 if (flags & CTA_FILTER_FLAG(CTA_IP_DST)) { 1335 if (!tb[CTA_IP_V6_DST]) 1336 return -EINVAL; 1337 1338 t->dst.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_DST]); 1339 } 1340 1341 return 0; 1342 } 1343 1344 static int ctnetlink_parse_tuple_ip(struct nlattr *attr, 1345 struct nf_conntrack_tuple *tuple, 1346 u_int32_t flags) 1347 { 1348 struct nlattr *tb[CTA_IP_MAX+1]; 1349 int ret = 0; 1350 1351 ret = nla_parse_nested_deprecated(tb, CTA_IP_MAX, attr, 1352 cta_ip_nla_policy, NULL); 1353 if (ret < 0) 1354 return ret; 1355 1356 switch (tuple->src.l3num) { 1357 case NFPROTO_IPV4: 1358 ret = ipv4_nlattr_to_tuple(tb, tuple, flags); 1359 break; 1360 case NFPROTO_IPV6: 1361 ret = ipv6_nlattr_to_tuple(tb, tuple, flags); 1362 break; 1363 } 1364 1365 return ret; 1366 } 1367 1368 static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = { 1369 [CTA_PROTO_NUM] = { .type = NLA_U8 }, 1370 }; 1371 1372 static int ctnetlink_parse_tuple_proto(struct nlattr *attr, 1373 struct nf_conntrack_tuple *tuple, 1374 u_int32_t flags) 1375 { 1376 const struct nf_conntrack_l4proto *l4proto; 1377 struct nlattr *tb[CTA_PROTO_MAX+1]; 1378 int ret = 0; 1379 1380 ret = nla_parse_nested_deprecated(tb, CTA_PROTO_MAX, attr, 1381 proto_nla_policy, NULL); 1382 if (ret < 0) 1383 return ret; 1384 1385 if (!(flags & CTA_FILTER_FLAG(CTA_PROTO_NUM))) 1386 return 0; 1387 1388 if (!tb[CTA_PROTO_NUM]) 1389 return -EINVAL; 1390 1391 tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]); 1392 1393 rcu_read_lock(); 1394 l4proto = nf_ct_l4proto_find(tuple->dst.protonum); 1395 1396 if (likely(l4proto->nlattr_to_tuple)) { 1397 ret = nla_validate_nested_deprecated(attr, CTA_PROTO_MAX, 1398 l4proto->nla_policy, 1399 NULL); 1400 if (ret == 0) 1401 ret = l4proto->nlattr_to_tuple(tb, tuple, flags); 1402 } 1403 1404 rcu_read_unlock(); 1405 1406 return ret; 1407 } 1408 1409 static int 1410 ctnetlink_parse_zone(const struct nlattr *attr, 1411 struct nf_conntrack_zone *zone) 1412 { 1413 nf_ct_zone_init(zone, NF_CT_DEFAULT_ZONE_ID, 1414 NF_CT_DEFAULT_ZONE_DIR, 0); 1415 #ifdef CONFIG_NF_CONNTRACK_ZONES 1416 if (attr) 1417 zone->id = ntohs(nla_get_be16(attr)); 1418 #else 1419 if (attr) 1420 return -EOPNOTSUPP; 1421 #endif 1422 return 0; 1423 } 1424 1425 static int 1426 ctnetlink_parse_tuple_zone(struct nlattr *attr, enum ctattr_type type, 1427 struct nf_conntrack_zone *zone) 1428 { 1429 int ret; 1430 1431 if (zone->id != NF_CT_DEFAULT_ZONE_ID) 1432 return -EINVAL; 1433 1434 ret = ctnetlink_parse_zone(attr, zone); 1435 if (ret < 0) 1436 return ret; 1437 1438 if (type == CTA_TUPLE_REPLY) 1439 zone->dir = NF_CT_ZONE_DIR_REPL; 1440 else 1441 zone->dir = NF_CT_ZONE_DIR_ORIG; 1442 1443 return 0; 1444 } 1445 1446 static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = { 1447 [CTA_TUPLE_IP] = { .type = NLA_NESTED }, 1448 [CTA_TUPLE_PROTO] = { .type = NLA_NESTED }, 1449 [CTA_TUPLE_ZONE] = { .type = NLA_U16 }, 1450 }; 1451 1452 #define CTA_FILTER_F_ALL_CTA_PROTO \ 1453 (CTA_FILTER_F_CTA_PROTO_SRC_PORT | \ 1454 CTA_FILTER_F_CTA_PROTO_DST_PORT | \ 1455 CTA_FILTER_F_CTA_PROTO_ICMP_TYPE | \ 1456 CTA_FILTER_F_CTA_PROTO_ICMP_CODE | \ 1457 CTA_FILTER_F_CTA_PROTO_ICMP_ID | \ 1458 CTA_FILTER_F_CTA_PROTO_ICMPV6_TYPE | \ 1459 CTA_FILTER_F_CTA_PROTO_ICMPV6_CODE | \ 1460 CTA_FILTER_F_CTA_PROTO_ICMPV6_ID) 1461 1462 static int 1463 ctnetlink_parse_tuple_filter(const struct nlattr * const cda[], 1464 struct nf_conntrack_tuple *tuple, u32 type, 1465 u_int8_t l3num, struct nf_conntrack_zone *zone, 1466 u_int32_t flags) 1467 { 1468 struct nlattr *tb[CTA_TUPLE_MAX+1]; 1469 int err; 1470 1471 memset(tuple, 0, sizeof(*tuple)); 1472 1473 err = nla_parse_nested_deprecated(tb, CTA_TUPLE_MAX, cda[type], 1474 tuple_nla_policy, NULL); 1475 if (err < 0) 1476 return err; 1477 1478 if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6) 1479 return -EOPNOTSUPP; 1480 tuple->src.l3num = l3num; 1481 1482 if (flags & CTA_FILTER_FLAG(CTA_IP_DST) || 1483 flags & CTA_FILTER_FLAG(CTA_IP_SRC)) { 1484 if (!tb[CTA_TUPLE_IP]) 1485 return -EINVAL; 1486 1487 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple, flags); 1488 if (err < 0) 1489 return err; 1490 } 1491 1492 if (flags & CTA_FILTER_FLAG(CTA_PROTO_NUM)) { 1493 if (!tb[CTA_TUPLE_PROTO]) 1494 return -EINVAL; 1495 1496 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple, flags); 1497 if (err < 0) 1498 return err; 1499 } else if (flags & CTA_FILTER_FLAG(ALL_CTA_PROTO)) { 1500 /* Can't manage proto flags without a protonum */ 1501 return -EINVAL; 1502 } 1503 1504 if ((flags & CTA_FILTER_FLAG(CTA_TUPLE_ZONE)) && tb[CTA_TUPLE_ZONE]) { 1505 if (!zone) 1506 return -EINVAL; 1507 1508 err = ctnetlink_parse_tuple_zone(tb[CTA_TUPLE_ZONE], 1509 type, zone); 1510 if (err < 0) 1511 return err; 1512 } 1513 1514 /* orig and expect tuples get DIR_ORIGINAL */ 1515 if (type == CTA_TUPLE_REPLY) 1516 tuple->dst.dir = IP_CT_DIR_REPLY; 1517 else 1518 tuple->dst.dir = IP_CT_DIR_ORIGINAL; 1519 1520 return 0; 1521 } 1522 1523 static int 1524 ctnetlink_parse_tuple(const struct nlattr * const cda[], 1525 struct nf_conntrack_tuple *tuple, u32 type, 1526 u_int8_t l3num, struct nf_conntrack_zone *zone) 1527 { 1528 return ctnetlink_parse_tuple_filter(cda, tuple, type, l3num, zone, 1529 CTA_FILTER_FLAG(ALL)); 1530 } 1531 1532 static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = { 1533 [CTA_HELP_NAME] = { .type = NLA_NUL_STRING, 1534 .len = NF_CT_HELPER_NAME_LEN - 1 }, 1535 }; 1536 1537 static int ctnetlink_parse_help(const struct nlattr *attr, char **helper_name, 1538 struct nlattr **helpinfo) 1539 { 1540 int err; 1541 struct nlattr *tb[CTA_HELP_MAX+1]; 1542 1543 err = nla_parse_nested_deprecated(tb, CTA_HELP_MAX, attr, 1544 help_nla_policy, NULL); 1545 if (err < 0) 1546 return err; 1547 1548 if (!tb[CTA_HELP_NAME]) 1549 return -EINVAL; 1550 1551 *helper_name = nla_data(tb[CTA_HELP_NAME]); 1552 1553 if (tb[CTA_HELP_INFO]) 1554 *helpinfo = tb[CTA_HELP_INFO]; 1555 1556 return 0; 1557 } 1558 1559 static const struct nla_policy ct_nla_policy[CTA_MAX+1] = { 1560 [CTA_TUPLE_ORIG] = { .type = NLA_NESTED }, 1561 [CTA_TUPLE_REPLY] = { .type = NLA_NESTED }, 1562 [CTA_STATUS] = { .type = NLA_U32 }, 1563 [CTA_PROTOINFO] = { .type = NLA_NESTED }, 1564 [CTA_HELP] = { .type = NLA_NESTED }, 1565 [CTA_NAT_SRC] = { .type = NLA_NESTED }, 1566 [CTA_TIMEOUT] = { .type = NLA_U32 }, 1567 [CTA_MARK] = { .type = NLA_U32 }, 1568 [CTA_ID] = { .type = NLA_U32 }, 1569 [CTA_NAT_DST] = { .type = NLA_NESTED }, 1570 [CTA_TUPLE_MASTER] = { .type = NLA_NESTED }, 1571 [CTA_NAT_SEQ_ADJ_ORIG] = { .type = NLA_NESTED }, 1572 [CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED }, 1573 [CTA_ZONE] = { .type = NLA_U16 }, 1574 [CTA_MARK_MASK] = { .type = NLA_U32 }, 1575 [CTA_LABELS] = { .type = NLA_BINARY, 1576 .len = NF_CT_LABELS_MAX_SIZE }, 1577 [CTA_LABELS_MASK] = { .type = NLA_BINARY, 1578 .len = NF_CT_LABELS_MAX_SIZE }, 1579 [CTA_FILTER] = { .type = NLA_NESTED }, 1580 [CTA_STATUS_MASK] = { .type = NLA_U32 }, 1581 [CTA_TIMESTAMP_EVENT] = { .type = NLA_REJECT }, 1582 }; 1583 1584 static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data) 1585 { 1586 return ctnetlink_filter_match(ct, data); 1587 } 1588 1589 static int ctnetlink_flush_conntrack(struct net *net, 1590 const struct nlattr * const cda[], 1591 u32 portid, int report, u8 family) 1592 { 1593 struct ctnetlink_filter *filter = NULL; 1594 struct nf_ct_iter_data iter = { 1595 .net = net, 1596 .portid = portid, 1597 .report = report, 1598 }; 1599 1600 if (ctnetlink_needs_filter(family, cda)) { 1601 filter = ctnetlink_alloc_filter(cda, family); 1602 if (IS_ERR(filter)) 1603 return PTR_ERR(filter); 1604 1605 iter.data = filter; 1606 } 1607 1608 nf_ct_iterate_cleanup_net(ctnetlink_flush_iterate, &iter); 1609 kfree(filter); 1610 1611 return 0; 1612 } 1613 1614 static int ctnetlink_del_conntrack(struct sk_buff *skb, 1615 const struct nfnl_info *info, 1616 const struct nlattr * const cda[]) 1617 { 1618 u8 family = info->nfmsg->nfgen_family; 1619 struct nf_conntrack_tuple_hash *h; 1620 struct nf_conntrack_tuple tuple; 1621 struct nf_conntrack_zone zone; 1622 struct nf_conn *ct; 1623 int err; 1624 1625 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone); 1626 if (err < 0) 1627 return err; 1628 1629 if (cda[CTA_TUPLE_ORIG] && !cda[CTA_FILTER]) 1630 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, 1631 family, &zone); 1632 else if (cda[CTA_TUPLE_REPLY] && !cda[CTA_FILTER]) 1633 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, 1634 family, &zone); 1635 else { 1636 u8 u3 = info->nfmsg->version || cda[CTA_FILTER] ? family : AF_UNSPEC; 1637 1638 return ctnetlink_flush_conntrack(info->net, cda, 1639 NETLINK_CB(skb).portid, 1640 nlmsg_report(info->nlh), u3); 1641 } 1642 1643 if (err < 0) 1644 return err; 1645 1646 h = nf_conntrack_find_get(info->net, &zone, &tuple); 1647 if (!h) 1648 return -ENOENT; 1649 1650 ct = nf_ct_tuplehash_to_ctrack(h); 1651 1652 if (cda[CTA_ID]) { 1653 __be32 id = nla_get_be32(cda[CTA_ID]); 1654 1655 if (id != (__force __be32)nf_ct_get_id(ct)) { 1656 nf_ct_put(ct); 1657 return -ENOENT; 1658 } 1659 } 1660 1661 nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(info->nlh)); 1662 nf_ct_put(ct); 1663 1664 return 0; 1665 } 1666 1667 static int ctnetlink_get_conntrack(struct sk_buff *skb, 1668 const struct nfnl_info *info, 1669 const struct nlattr * const cda[]) 1670 { 1671 u_int8_t u3 = info->nfmsg->nfgen_family; 1672 struct nf_conntrack_tuple_hash *h; 1673 struct nf_conntrack_tuple tuple; 1674 struct nf_conntrack_zone zone; 1675 struct sk_buff *skb2; 1676 struct nf_conn *ct; 1677 int err; 1678 1679 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1680 struct netlink_dump_control c = { 1681 .start = ctnetlink_start, 1682 .dump = ctnetlink_dump_table, 1683 .done = ctnetlink_done, 1684 .data = (void *)cda, 1685 }; 1686 1687 return netlink_dump_start(info->sk, skb, info->nlh, &c); 1688 } 1689 1690 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone); 1691 if (err < 0) 1692 return err; 1693 1694 if (cda[CTA_TUPLE_ORIG]) 1695 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, 1696 u3, &zone); 1697 else if (cda[CTA_TUPLE_REPLY]) 1698 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, 1699 u3, &zone); 1700 else 1701 return -EINVAL; 1702 1703 if (err < 0) 1704 return err; 1705 1706 h = nf_conntrack_find_get(info->net, &zone, &tuple); 1707 if (!h) 1708 return -ENOENT; 1709 1710 ct = nf_ct_tuplehash_to_ctrack(h); 1711 1712 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1713 if (!skb2) { 1714 nf_ct_put(ct); 1715 return -ENOMEM; 1716 } 1717 1718 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, 1719 info->nlh->nlmsg_seq, 1720 NFNL_MSG_TYPE(info->nlh->nlmsg_type), ct, 1721 true, 0); 1722 nf_ct_put(ct); 1723 if (err <= 0) { 1724 kfree_skb(skb2); 1725 return -ENOMEM; 1726 } 1727 1728 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 1729 } 1730 1731 #ifdef CONFIG_NF_CONNTRACK_EVENTS 1732 static int ctnetlink_dump_one_entry(struct sk_buff *skb, 1733 struct netlink_callback *cb, 1734 struct nf_conn *ct, 1735 bool dying) 1736 { 1737 struct ctnetlink_list_dump_ctx *ctx = (void *)cb->ctx; 1738 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1739 u8 l3proto = nfmsg->nfgen_family; 1740 int res; 1741 1742 if (l3proto && nf_ct_l3num(ct) != l3proto) 1743 return 0; 1744 1745 if (ctx->last_id) { 1746 if (ctnetlink_get_id(ct) != ctx->last_id) 1747 return 0; 1748 1749 ctx->last_id = 0; 1750 } 1751 1752 /* We can't dump extension info for the unconfirmed 1753 * list because unconfirmed conntracks can have 1754 * ct->ext reallocated (and thus freed). 1755 * 1756 * In the dying list case ct->ext can't be free'd 1757 * until after we drop pcpu->lock. 1758 */ 1759 res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid, 1760 cb->nlh->nlmsg_seq, 1761 NFNL_MSG_TYPE(cb->nlh->nlmsg_type), 1762 ct, dying, 0); 1763 if (res < 0) 1764 ctx->last_id = ctnetlink_get_id(ct); 1765 1766 return res; 1767 } 1768 #endif 1769 1770 static int 1771 ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb) 1772 { 1773 return 0; 1774 } 1775 1776 static int 1777 ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb) 1778 { 1779 struct ctnetlink_list_dump_ctx *ctx = (void *)cb->ctx; 1780 #ifdef CONFIG_NF_CONNTRACK_EVENTS 1781 const struct net *net = sock_net(skb->sk); 1782 struct nf_conntrack_net_ecache *ecache_net; 1783 unsigned long last_id = ctx->last_id; 1784 struct nf_conntrack_tuple_hash *h; 1785 struct hlist_nulls_node *n; 1786 #endif 1787 1788 if (ctx->done) 1789 return 0; 1790 1791 ctx->last_id = 0; 1792 1793 #ifdef CONFIG_NF_CONNTRACK_EVENTS 1794 ecache_net = nf_conn_pernet_ecache(net); 1795 spin_lock_bh(&ecache_net->dying_lock); 1796 1797 hlist_nulls_for_each_entry(h, n, &ecache_net->dying_list, hnnode) { 1798 struct nf_conn *ct; 1799 int res; 1800 1801 ct = nf_ct_tuplehash_to_ctrack(h); 1802 if (last_id && last_id != ctnetlink_get_id(ct)) 1803 continue; 1804 1805 res = ctnetlink_dump_one_entry(skb, cb, ct, true); 1806 if (res < 0) { 1807 spin_unlock_bh(&ecache_net->dying_lock); 1808 return skb->len; 1809 } 1810 1811 last_id = 0; 1812 } 1813 1814 spin_unlock_bh(&ecache_net->dying_lock); 1815 #endif 1816 ctx->done = true; 1817 1818 return skb->len; 1819 } 1820 1821 static int ctnetlink_get_ct_dying(struct sk_buff *skb, 1822 const struct nfnl_info *info, 1823 const struct nlattr * const cda[]) 1824 { 1825 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1826 struct netlink_dump_control c = { 1827 .dump = ctnetlink_dump_dying, 1828 }; 1829 return netlink_dump_start(info->sk, skb, info->nlh, &c); 1830 } 1831 1832 return -EOPNOTSUPP; 1833 } 1834 1835 static int ctnetlink_get_ct_unconfirmed(struct sk_buff *skb, 1836 const struct nfnl_info *info, 1837 const struct nlattr * const cda[]) 1838 { 1839 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1840 struct netlink_dump_control c = { 1841 .dump = ctnetlink_dump_unconfirmed, 1842 }; 1843 return netlink_dump_start(info->sk, skb, info->nlh, &c); 1844 } 1845 1846 return -EOPNOTSUPP; 1847 } 1848 1849 #if IS_ENABLED(CONFIG_NF_NAT) 1850 static int 1851 ctnetlink_parse_nat_setup(struct nf_conn *ct, 1852 enum nf_nat_manip_type manip, 1853 const struct nlattr *attr) 1854 __must_hold(RCU) 1855 { 1856 const struct nf_nat_hook *nat_hook; 1857 int err; 1858 1859 nat_hook = rcu_dereference(nf_nat_hook); 1860 if (!nat_hook) { 1861 #ifdef CONFIG_MODULES 1862 rcu_read_unlock(); 1863 nfnl_unlock(NFNL_SUBSYS_CTNETLINK); 1864 if (request_module("nf-nat") < 0) { 1865 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1866 rcu_read_lock(); 1867 return -EOPNOTSUPP; 1868 } 1869 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1870 rcu_read_lock(); 1871 nat_hook = rcu_dereference(nf_nat_hook); 1872 if (nat_hook) 1873 return -EAGAIN; 1874 #endif 1875 return -EOPNOTSUPP; 1876 } 1877 1878 err = nat_hook->parse_nat_setup(ct, manip, attr); 1879 if (err == -EAGAIN) { 1880 #ifdef CONFIG_MODULES 1881 rcu_read_unlock(); 1882 nfnl_unlock(NFNL_SUBSYS_CTNETLINK); 1883 if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) { 1884 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1885 rcu_read_lock(); 1886 return -EOPNOTSUPP; 1887 } 1888 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1889 rcu_read_lock(); 1890 #else 1891 err = -EOPNOTSUPP; 1892 #endif 1893 } 1894 return err; 1895 } 1896 #endif 1897 1898 static int 1899 ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[]) 1900 { 1901 return nf_ct_change_status_common(ct, ntohl(nla_get_be32(cda[CTA_STATUS]))); 1902 } 1903 1904 static int 1905 ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[]) 1906 { 1907 #if IS_ENABLED(CONFIG_NF_NAT) 1908 int ret; 1909 1910 if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC]) 1911 return 0; 1912 1913 ret = ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_DST, 1914 cda[CTA_NAT_DST]); 1915 if (ret < 0) 1916 return ret; 1917 1918 return ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_SRC, 1919 cda[CTA_NAT_SRC]); 1920 #else 1921 if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC]) 1922 return 0; 1923 return -EOPNOTSUPP; 1924 #endif 1925 } 1926 1927 static int ctnetlink_change_helper(struct nf_conn *ct, 1928 const struct nlattr * const cda[]) 1929 { 1930 struct nf_conntrack_helper *helper; 1931 struct nf_conn_help *help = nfct_help(ct); 1932 char *helpname = NULL; 1933 struct nlattr *helpinfo = NULL; 1934 int err; 1935 1936 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo); 1937 if (err < 0) 1938 return err; 1939 1940 /* don't change helper of sibling connections */ 1941 if (ct->master) { 1942 /* If we try to change the helper to the same thing twice, 1943 * treat the second attempt as a no-op instead of returning 1944 * an error. 1945 */ 1946 err = -EBUSY; 1947 if (help) { 1948 rcu_read_lock(); 1949 helper = rcu_dereference(help->helper); 1950 if (helper && !strcmp(helper->name, helpname)) 1951 err = 0; 1952 rcu_read_unlock(); 1953 } 1954 1955 return err; 1956 } 1957 1958 if (!strcmp(helpname, "")) { 1959 if (help && help->helper) { 1960 /* we had a helper before ... */ 1961 nf_ct_remove_expectations(ct); 1962 RCU_INIT_POINTER(help->helper, NULL); 1963 } 1964 1965 return 0; 1966 } 1967 1968 rcu_read_lock(); 1969 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct), 1970 nf_ct_protonum(ct)); 1971 if (helper == NULL) { 1972 rcu_read_unlock(); 1973 return -EOPNOTSUPP; 1974 } 1975 1976 if (help) { 1977 if (rcu_access_pointer(help->helper) == helper) { 1978 /* update private helper data if allowed. */ 1979 if (helper->from_nlattr) 1980 helper->from_nlattr(helpinfo, ct); 1981 err = 0; 1982 } else 1983 err = -EBUSY; 1984 } else { 1985 /* we cannot set a helper for an existing conntrack */ 1986 err = -EOPNOTSUPP; 1987 } 1988 1989 rcu_read_unlock(); 1990 return err; 1991 } 1992 1993 static int ctnetlink_change_timeout(struct nf_conn *ct, 1994 const struct nlattr * const cda[]) 1995 { 1996 return __nf_ct_change_timeout(ct, (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ); 1997 } 1998 1999 #if defined(CONFIG_NF_CONNTRACK_MARK) 2000 static void ctnetlink_change_mark(struct nf_conn *ct, 2001 const struct nlattr * const cda[]) 2002 { 2003 u32 mark, newmark, mask = 0; 2004 2005 if (cda[CTA_MARK_MASK]) 2006 mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK])); 2007 2008 mark = ntohl(nla_get_be32(cda[CTA_MARK])); 2009 newmark = (READ_ONCE(ct->mark) & mask) ^ mark; 2010 if (newmark != READ_ONCE(ct->mark)) 2011 WRITE_ONCE(ct->mark, newmark); 2012 } 2013 #endif 2014 2015 static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = { 2016 [CTA_PROTOINFO_TCP] = { .type = NLA_NESTED }, 2017 [CTA_PROTOINFO_SCTP] = { .type = NLA_NESTED }, 2018 }; 2019 2020 static int ctnetlink_change_protoinfo(struct nf_conn *ct, 2021 const struct nlattr * const cda[]) 2022 { 2023 const struct nlattr *attr = cda[CTA_PROTOINFO]; 2024 const struct nf_conntrack_l4proto *l4proto; 2025 struct nlattr *tb[CTA_PROTOINFO_MAX+1]; 2026 int err = 0; 2027 2028 err = nla_parse_nested_deprecated(tb, CTA_PROTOINFO_MAX, attr, 2029 protoinfo_policy, NULL); 2030 if (err < 0) 2031 return err; 2032 2033 l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct)); 2034 if (l4proto->from_nlattr) 2035 err = l4proto->from_nlattr(tb, ct); 2036 2037 return err; 2038 } 2039 2040 static const struct nla_policy seqadj_policy[CTA_SEQADJ_MAX+1] = { 2041 [CTA_SEQADJ_CORRECTION_POS] = { .type = NLA_U32 }, 2042 [CTA_SEQADJ_OFFSET_BEFORE] = { .type = NLA_U32 }, 2043 [CTA_SEQADJ_OFFSET_AFTER] = { .type = NLA_U32 }, 2044 }; 2045 2046 static int change_seq_adj(struct nf_ct_seqadj *seq, 2047 const struct nlattr * const attr) 2048 { 2049 int err; 2050 struct nlattr *cda[CTA_SEQADJ_MAX+1]; 2051 2052 err = nla_parse_nested_deprecated(cda, CTA_SEQADJ_MAX, attr, 2053 seqadj_policy, NULL); 2054 if (err < 0) 2055 return err; 2056 2057 if (!cda[CTA_SEQADJ_CORRECTION_POS]) 2058 return -EINVAL; 2059 2060 seq->correction_pos = 2061 ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS])); 2062 2063 if (!cda[CTA_SEQADJ_OFFSET_BEFORE]) 2064 return -EINVAL; 2065 2066 seq->offset_before = 2067 ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE])); 2068 2069 if (!cda[CTA_SEQADJ_OFFSET_AFTER]) 2070 return -EINVAL; 2071 2072 seq->offset_after = 2073 ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER])); 2074 2075 return 0; 2076 } 2077 2078 static int 2079 ctnetlink_change_seq_adj(struct nf_conn *ct, 2080 const struct nlattr * const cda[]) 2081 { 2082 struct nf_conn_seqadj *seqadj = nfct_seqadj(ct); 2083 int ret = 0; 2084 2085 if (!seqadj) 2086 return 0; 2087 2088 spin_lock_bh(&ct->lock); 2089 if (cda[CTA_SEQ_ADJ_ORIG]) { 2090 ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL], 2091 cda[CTA_SEQ_ADJ_ORIG]); 2092 if (ret < 0) 2093 goto err; 2094 2095 set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); 2096 } 2097 2098 if (cda[CTA_SEQ_ADJ_REPLY]) { 2099 ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY], 2100 cda[CTA_SEQ_ADJ_REPLY]); 2101 if (ret < 0) 2102 goto err; 2103 2104 set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); 2105 } 2106 2107 spin_unlock_bh(&ct->lock); 2108 return 0; 2109 err: 2110 spin_unlock_bh(&ct->lock); 2111 return ret; 2112 } 2113 2114 static const struct nla_policy synproxy_policy[CTA_SYNPROXY_MAX + 1] = { 2115 [CTA_SYNPROXY_ISN] = { .type = NLA_U32 }, 2116 [CTA_SYNPROXY_ITS] = { .type = NLA_U32 }, 2117 [CTA_SYNPROXY_TSOFF] = { .type = NLA_U32 }, 2118 }; 2119 2120 static int ctnetlink_change_synproxy(struct nf_conn *ct, 2121 const struct nlattr * const cda[]) 2122 { 2123 struct nf_conn_synproxy *synproxy = nfct_synproxy(ct); 2124 struct nlattr *tb[CTA_SYNPROXY_MAX + 1]; 2125 int err; 2126 2127 if (!synproxy) 2128 return 0; 2129 2130 err = nla_parse_nested_deprecated(tb, CTA_SYNPROXY_MAX, 2131 cda[CTA_SYNPROXY], synproxy_policy, 2132 NULL); 2133 if (err < 0) 2134 return err; 2135 2136 if (!tb[CTA_SYNPROXY_ISN] || 2137 !tb[CTA_SYNPROXY_ITS] || 2138 !tb[CTA_SYNPROXY_TSOFF]) 2139 return -EINVAL; 2140 2141 synproxy->isn = ntohl(nla_get_be32(tb[CTA_SYNPROXY_ISN])); 2142 synproxy->its = ntohl(nla_get_be32(tb[CTA_SYNPROXY_ITS])); 2143 synproxy->tsoff = ntohl(nla_get_be32(tb[CTA_SYNPROXY_TSOFF])); 2144 2145 return 0; 2146 } 2147 2148 static int 2149 ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[]) 2150 { 2151 #ifdef CONFIG_NF_CONNTRACK_LABELS 2152 size_t len = nla_len(cda[CTA_LABELS]); 2153 const void *mask = cda[CTA_LABELS_MASK]; 2154 2155 if (len & (sizeof(u32)-1)) /* must be multiple of u32 */ 2156 return -EINVAL; 2157 2158 if (mask) { 2159 if (nla_len(cda[CTA_LABELS_MASK]) == 0 || 2160 nla_len(cda[CTA_LABELS_MASK]) != len) 2161 return -EINVAL; 2162 mask = nla_data(cda[CTA_LABELS_MASK]); 2163 } 2164 2165 len /= sizeof(u32); 2166 2167 return nf_connlabels_replace(ct, nla_data(cda[CTA_LABELS]), mask, len); 2168 #else 2169 return -EOPNOTSUPP; 2170 #endif 2171 } 2172 2173 static int 2174 ctnetlink_change_conntrack(struct nf_conn *ct, 2175 const struct nlattr * const cda[]) 2176 { 2177 int err; 2178 2179 /* only allow NAT changes and master assignation for new conntracks */ 2180 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER]) 2181 return -EOPNOTSUPP; 2182 2183 if (cda[CTA_HELP]) { 2184 err = ctnetlink_change_helper(ct, cda); 2185 if (err < 0) 2186 return err; 2187 } 2188 2189 if (cda[CTA_TIMEOUT]) { 2190 err = ctnetlink_change_timeout(ct, cda); 2191 if (err < 0) 2192 return err; 2193 } 2194 2195 if (cda[CTA_STATUS]) { 2196 err = ctnetlink_change_status(ct, cda); 2197 if (err < 0) 2198 return err; 2199 } 2200 2201 if (cda[CTA_PROTOINFO]) { 2202 err = ctnetlink_change_protoinfo(ct, cda); 2203 if (err < 0) 2204 return err; 2205 } 2206 2207 #if defined(CONFIG_NF_CONNTRACK_MARK) 2208 if (cda[CTA_MARK]) 2209 ctnetlink_change_mark(ct, cda); 2210 #endif 2211 2212 if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) { 2213 err = ctnetlink_change_seq_adj(ct, cda); 2214 if (err < 0) 2215 return err; 2216 } 2217 2218 if (cda[CTA_SYNPROXY]) { 2219 err = ctnetlink_change_synproxy(ct, cda); 2220 if (err < 0) 2221 return err; 2222 } 2223 2224 if (cda[CTA_LABELS]) { 2225 err = ctnetlink_attach_labels(ct, cda); 2226 if (err < 0) 2227 return err; 2228 } 2229 2230 return 0; 2231 } 2232 2233 static struct nf_conn * 2234 ctnetlink_create_conntrack(struct net *net, 2235 const struct nf_conntrack_zone *zone, 2236 const struct nlattr * const cda[], 2237 struct nf_conntrack_tuple *otuple, 2238 struct nf_conntrack_tuple *rtuple, 2239 u8 u3) 2240 { 2241 struct nf_conn *ct; 2242 int err = -EINVAL; 2243 struct nf_conntrack_helper *helper; 2244 struct nf_conn_tstamp *tstamp; 2245 u64 timeout; 2246 2247 ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC); 2248 if (IS_ERR(ct)) 2249 return ERR_PTR(-ENOMEM); 2250 2251 if (!cda[CTA_TIMEOUT]) 2252 goto err1; 2253 2254 rcu_read_lock(); 2255 if (cda[CTA_HELP]) { 2256 char *helpname = NULL; 2257 struct nlattr *helpinfo = NULL; 2258 2259 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo); 2260 if (err < 0) 2261 goto err2; 2262 2263 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct), 2264 nf_ct_protonum(ct)); 2265 if (helper == NULL) { 2266 rcu_read_unlock(); 2267 #ifdef CONFIG_MODULES 2268 if (request_module("nfct-helper-%s", helpname) < 0) { 2269 err = -EOPNOTSUPP; 2270 goto err1; 2271 } 2272 2273 rcu_read_lock(); 2274 helper = __nf_conntrack_helper_find(helpname, 2275 nf_ct_l3num(ct), 2276 nf_ct_protonum(ct)); 2277 if (helper) { 2278 err = -EAGAIN; 2279 goto err2; 2280 } 2281 rcu_read_unlock(); 2282 #endif 2283 err = -EOPNOTSUPP; 2284 goto err1; 2285 } else { 2286 struct nf_conn_help *help; 2287 2288 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); 2289 if (help == NULL) { 2290 err = -ENOMEM; 2291 goto err2; 2292 } 2293 /* set private helper data if allowed. */ 2294 if (helper->from_nlattr) 2295 helper->from_nlattr(helpinfo, ct); 2296 2297 /* disable helper auto-assignment for this entry */ 2298 ct->status |= IPS_HELPER; 2299 RCU_INIT_POINTER(help->helper, helper); 2300 } 2301 } 2302 2303 err = ctnetlink_setup_nat(ct, cda); 2304 if (err < 0) 2305 goto err2; 2306 2307 nf_ct_acct_ext_add(ct, GFP_ATOMIC); 2308 nf_ct_tstamp_ext_add(ct, GFP_ATOMIC); 2309 nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC); 2310 nf_ct_labels_ext_add(ct); 2311 nfct_seqadj_ext_add(ct); 2312 nfct_synproxy_ext_add(ct); 2313 2314 /* we must add conntrack extensions before confirmation. */ 2315 ct->status |= IPS_CONFIRMED; 2316 2317 timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ; 2318 __nf_ct_set_timeout(ct, timeout); 2319 2320 if (cda[CTA_STATUS]) { 2321 err = ctnetlink_change_status(ct, cda); 2322 if (err < 0) 2323 goto err2; 2324 } 2325 2326 if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) { 2327 err = ctnetlink_change_seq_adj(ct, cda); 2328 if (err < 0) 2329 goto err2; 2330 } 2331 2332 memset(&ct->proto, 0, sizeof(ct->proto)); 2333 if (cda[CTA_PROTOINFO]) { 2334 err = ctnetlink_change_protoinfo(ct, cda); 2335 if (err < 0) 2336 goto err2; 2337 } 2338 2339 if (cda[CTA_SYNPROXY]) { 2340 err = ctnetlink_change_synproxy(ct, cda); 2341 if (err < 0) 2342 goto err2; 2343 } 2344 2345 #if defined(CONFIG_NF_CONNTRACK_MARK) 2346 if (cda[CTA_MARK]) 2347 ctnetlink_change_mark(ct, cda); 2348 #endif 2349 2350 /* setup master conntrack: this is a confirmed expectation */ 2351 if (cda[CTA_TUPLE_MASTER]) { 2352 struct nf_conntrack_tuple master; 2353 struct nf_conntrack_tuple_hash *master_h; 2354 struct nf_conn *master_ct; 2355 2356 err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, 2357 u3, NULL); 2358 if (err < 0) 2359 goto err2; 2360 2361 master_h = nf_conntrack_find_get(net, zone, &master); 2362 if (master_h == NULL) { 2363 err = -ENOENT; 2364 goto err2; 2365 } 2366 master_ct = nf_ct_tuplehash_to_ctrack(master_h); 2367 __set_bit(IPS_EXPECTED_BIT, &ct->status); 2368 ct->master = master_ct; 2369 } 2370 tstamp = nf_conn_tstamp_find(ct); 2371 if (tstamp) 2372 tstamp->start = ktime_get_real_ns(); 2373 2374 err = nf_conntrack_hash_check_insert(ct); 2375 if (err < 0) 2376 goto err3; 2377 2378 rcu_read_unlock(); 2379 2380 return ct; 2381 2382 err3: 2383 if (ct->master) 2384 nf_ct_put(ct->master); 2385 err2: 2386 rcu_read_unlock(); 2387 err1: 2388 nf_conntrack_free(ct); 2389 return ERR_PTR(err); 2390 } 2391 2392 static int ctnetlink_new_conntrack(struct sk_buff *skb, 2393 const struct nfnl_info *info, 2394 const struct nlattr * const cda[]) 2395 { 2396 struct nf_conntrack_tuple otuple, rtuple; 2397 struct nf_conntrack_tuple_hash *h = NULL; 2398 u_int8_t u3 = info->nfmsg->nfgen_family; 2399 struct nf_conntrack_zone zone; 2400 struct nf_conn *ct; 2401 int err; 2402 2403 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone); 2404 if (err < 0) 2405 return err; 2406 2407 if (cda[CTA_TUPLE_ORIG]) { 2408 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, 2409 u3, &zone); 2410 if (err < 0) 2411 return err; 2412 } 2413 2414 if (cda[CTA_TUPLE_REPLY]) { 2415 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, 2416 u3, &zone); 2417 if (err < 0) 2418 return err; 2419 } 2420 2421 if (cda[CTA_TUPLE_ORIG]) 2422 h = nf_conntrack_find_get(info->net, &zone, &otuple); 2423 else if (cda[CTA_TUPLE_REPLY]) 2424 h = nf_conntrack_find_get(info->net, &zone, &rtuple); 2425 2426 if (h == NULL) { 2427 err = -ENOENT; 2428 if (info->nlh->nlmsg_flags & NLM_F_CREATE) { 2429 enum ip_conntrack_events events; 2430 2431 if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY]) 2432 return -EINVAL; 2433 if (otuple.dst.protonum != rtuple.dst.protonum) 2434 return -EINVAL; 2435 2436 ct = ctnetlink_create_conntrack(info->net, &zone, cda, 2437 &otuple, &rtuple, u3); 2438 if (IS_ERR(ct)) 2439 return PTR_ERR(ct); 2440 2441 err = 0; 2442 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 2443 events = 1 << IPCT_RELATED; 2444 else 2445 events = 1 << IPCT_NEW; 2446 2447 if (cda[CTA_LABELS] && 2448 ctnetlink_attach_labels(ct, cda) == 0) 2449 events |= (1 << IPCT_LABEL); 2450 2451 nf_conntrack_eventmask_report((1 << IPCT_REPLY) | 2452 (1 << IPCT_ASSURED) | 2453 (1 << IPCT_HELPER) | 2454 (1 << IPCT_PROTOINFO) | 2455 (1 << IPCT_SEQADJ) | 2456 (1 << IPCT_MARK) | 2457 (1 << IPCT_SYNPROXY) | 2458 events, 2459 ct, NETLINK_CB(skb).portid, 2460 nlmsg_report(info->nlh)); 2461 nf_ct_put(ct); 2462 } 2463 2464 return err; 2465 } 2466 /* implicit 'else' */ 2467 2468 err = -EEXIST; 2469 ct = nf_ct_tuplehash_to_ctrack(h); 2470 if (!(info->nlh->nlmsg_flags & NLM_F_EXCL)) { 2471 err = ctnetlink_change_conntrack(ct, cda); 2472 if (err == 0) { 2473 nf_conntrack_eventmask_report((1 << IPCT_REPLY) | 2474 (1 << IPCT_ASSURED) | 2475 (1 << IPCT_HELPER) | 2476 (1 << IPCT_LABEL) | 2477 (1 << IPCT_PROTOINFO) | 2478 (1 << IPCT_SEQADJ) | 2479 (1 << IPCT_MARK) | 2480 (1 << IPCT_SYNPROXY), 2481 ct, NETLINK_CB(skb).portid, 2482 nlmsg_report(info->nlh)); 2483 } 2484 } 2485 2486 nf_ct_put(ct); 2487 return err; 2488 } 2489 2490 static int 2491 ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq, 2492 __u16 cpu, const struct ip_conntrack_stat *st) 2493 { 2494 struct nlmsghdr *nlh; 2495 unsigned int flags = portid ? NLM_F_MULTI : 0, event; 2496 2497 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, 2498 IPCTNL_MSG_CT_GET_STATS_CPU); 2499 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, 2500 NFNETLINK_V0, htons(cpu)); 2501 if (!nlh) 2502 goto nlmsg_failure; 2503 2504 if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) || 2505 nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) || 2506 nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) || 2507 nla_put_be32(skb, CTA_STATS_INSERT_FAILED, 2508 htonl(st->insert_failed)) || 2509 nla_put_be32(skb, CTA_STATS_DROP, htonl(st->drop)) || 2510 nla_put_be32(skb, CTA_STATS_EARLY_DROP, htonl(st->early_drop)) || 2511 nla_put_be32(skb, CTA_STATS_ERROR, htonl(st->error)) || 2512 nla_put_be32(skb, CTA_STATS_SEARCH_RESTART, 2513 htonl(st->search_restart)) || 2514 nla_put_be32(skb, CTA_STATS_CLASH_RESOLVE, 2515 htonl(st->clash_resolve)) || 2516 nla_put_be32(skb, CTA_STATS_CHAIN_TOOLONG, 2517 htonl(st->chaintoolong))) 2518 goto nla_put_failure; 2519 2520 nlmsg_end(skb, nlh); 2521 return skb->len; 2522 2523 nla_put_failure: 2524 nlmsg_failure: 2525 nlmsg_cancel(skb, nlh); 2526 return -1; 2527 } 2528 2529 static int 2530 ctnetlink_ct_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb) 2531 { 2532 int cpu; 2533 struct net *net = sock_net(skb->sk); 2534 2535 if (cb->args[0] == nr_cpu_ids) 2536 return 0; 2537 2538 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) { 2539 const struct ip_conntrack_stat *st; 2540 2541 if (!cpu_possible(cpu)) 2542 continue; 2543 2544 st = per_cpu_ptr(net->ct.stat, cpu); 2545 if (ctnetlink_ct_stat_cpu_fill_info(skb, 2546 NETLINK_CB(cb->skb).portid, 2547 cb->nlh->nlmsg_seq, 2548 cpu, st) < 0) 2549 break; 2550 } 2551 cb->args[0] = cpu; 2552 2553 return skb->len; 2554 } 2555 2556 static int ctnetlink_stat_ct_cpu(struct sk_buff *skb, 2557 const struct nfnl_info *info, 2558 const struct nlattr * const cda[]) 2559 { 2560 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 2561 struct netlink_dump_control c = { 2562 .dump = ctnetlink_ct_stat_cpu_dump, 2563 }; 2564 return netlink_dump_start(info->sk, skb, info->nlh, &c); 2565 } 2566 2567 return 0; 2568 } 2569 2570 static int 2571 ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, 2572 struct net *net) 2573 { 2574 unsigned int flags = portid ? NLM_F_MULTI : 0, event; 2575 unsigned int nr_conntracks; 2576 struct nlmsghdr *nlh; 2577 2578 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_GET_STATS); 2579 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, 2580 NFNETLINK_V0, 0); 2581 if (!nlh) 2582 goto nlmsg_failure; 2583 2584 nr_conntracks = nf_conntrack_count(net); 2585 if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks))) 2586 goto nla_put_failure; 2587 2588 if (nla_put_be32(skb, CTA_STATS_GLOBAL_MAX_ENTRIES, htonl(nf_conntrack_max))) 2589 goto nla_put_failure; 2590 2591 nlmsg_end(skb, nlh); 2592 return skb->len; 2593 2594 nla_put_failure: 2595 nlmsg_failure: 2596 nlmsg_cancel(skb, nlh); 2597 return -1; 2598 } 2599 2600 static int ctnetlink_stat_ct(struct sk_buff *skb, const struct nfnl_info *info, 2601 const struct nlattr * const cda[]) 2602 { 2603 struct sk_buff *skb2; 2604 int err; 2605 2606 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2607 if (skb2 == NULL) 2608 return -ENOMEM; 2609 2610 err = ctnetlink_stat_ct_fill_info(skb2, NETLINK_CB(skb).portid, 2611 info->nlh->nlmsg_seq, 2612 NFNL_MSG_TYPE(info->nlh->nlmsg_type), 2613 sock_net(skb->sk)); 2614 if (err <= 0) { 2615 kfree_skb(skb2); 2616 return -ENOMEM; 2617 } 2618 2619 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 2620 } 2621 2622 static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { 2623 [CTA_EXPECT_MASTER] = { .type = NLA_NESTED }, 2624 [CTA_EXPECT_TUPLE] = { .type = NLA_NESTED }, 2625 [CTA_EXPECT_MASK] = { .type = NLA_NESTED }, 2626 [CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 }, 2627 [CTA_EXPECT_ID] = { .type = NLA_U32 }, 2628 [CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING, 2629 .len = NF_CT_HELPER_NAME_LEN - 1 }, 2630 [CTA_EXPECT_ZONE] = { .type = NLA_U16 }, 2631 [CTA_EXPECT_FLAGS] = NLA_POLICY_MASK(NLA_BE32, NF_CT_EXPECT_MASK), 2632 [CTA_EXPECT_CLASS] = { .type = NLA_U32 }, 2633 [CTA_EXPECT_NAT] = { .type = NLA_NESTED }, 2634 [CTA_EXPECT_FN] = { .type = NLA_NUL_STRING }, 2635 }; 2636 2637 static struct nf_conntrack_expect * 2638 ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct, 2639 struct nf_conntrack_tuple *tuple, 2640 struct nf_conntrack_tuple *mask); 2641 2642 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT 2643 static size_t 2644 ctnetlink_glue_build_size(const struct nf_conn *ct) 2645 { 2646 return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */ 2647 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */ 2648 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */ 2649 + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */ 2650 + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */ 2651 + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */ 2652 + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */ 2653 + nla_total_size(0) /* CTA_PROTOINFO */ 2654 + nla_total_size(0) /* CTA_HELP */ 2655 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ 2656 + ctnetlink_secctx_size(ct) 2657 + ctnetlink_acct_size(ct) 2658 + ctnetlink_timestamp_size(ct) 2659 #if IS_ENABLED(CONFIG_NF_NAT) 2660 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ 2661 + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ 2662 #endif 2663 #ifdef CONFIG_NF_CONNTRACK_MARK 2664 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */ 2665 #endif 2666 #ifdef CONFIG_NF_CONNTRACK_ZONES 2667 + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE|CTA_TUPLE_ZONE */ 2668 #endif 2669 + ctnetlink_proto_size(ct) 2670 ; 2671 } 2672 2673 static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct) 2674 { 2675 const struct nf_conntrack_zone *zone; 2676 struct nlattr *nest_parms; 2677 2678 zone = nf_ct_zone(ct); 2679 2680 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); 2681 if (!nest_parms) 2682 goto nla_put_failure; 2683 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0) 2684 goto nla_put_failure; 2685 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 2686 NF_CT_ZONE_DIR_ORIG) < 0) 2687 goto nla_put_failure; 2688 nla_nest_end(skb, nest_parms); 2689 2690 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY); 2691 if (!nest_parms) 2692 goto nla_put_failure; 2693 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0) 2694 goto nla_put_failure; 2695 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 2696 NF_CT_ZONE_DIR_REPL) < 0) 2697 goto nla_put_failure; 2698 nla_nest_end(skb, nest_parms); 2699 2700 if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone, 2701 NF_CT_DEFAULT_ZONE_DIR) < 0) 2702 goto nla_put_failure; 2703 2704 if (ctnetlink_dump_id(skb, ct) < 0) 2705 goto nla_put_failure; 2706 2707 if (ctnetlink_dump_status(skb, ct) < 0) 2708 goto nla_put_failure; 2709 2710 if (ctnetlink_dump_timeout(skb, ct, false) < 0) 2711 goto nla_put_failure; 2712 2713 if (ctnetlink_dump_protoinfo(skb, ct, false) < 0) 2714 goto nla_put_failure; 2715 2716 if (ctnetlink_dump_acct(skb, ct, IPCTNL_MSG_CT_GET) < 0 || 2717 ctnetlink_dump_timestamp(skb, ct) < 0) 2718 goto nla_put_failure; 2719 2720 if (ctnetlink_dump_helpinfo(skb, ct) < 0) 2721 goto nla_put_failure; 2722 2723 #ifdef CONFIG_NF_CONNTRACK_SECMARK 2724 if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0) 2725 goto nla_put_failure; 2726 #endif 2727 if (ct->master && ctnetlink_dump_master(skb, ct) < 0) 2728 goto nla_put_failure; 2729 2730 if ((ct->status & IPS_SEQ_ADJUST) && 2731 ctnetlink_dump_ct_seq_adj(skb, ct) < 0) 2732 goto nla_put_failure; 2733 2734 if (ctnetlink_dump_ct_synproxy(skb, ct) < 0) 2735 goto nla_put_failure; 2736 2737 #ifdef CONFIG_NF_CONNTRACK_MARK 2738 if (ctnetlink_dump_mark(skb, ct, true) < 0) 2739 goto nla_put_failure; 2740 #endif 2741 if (ctnetlink_dump_labels(skb, ct) < 0) 2742 goto nla_put_failure; 2743 return 0; 2744 2745 nla_put_failure: 2746 return -ENOSPC; 2747 } 2748 2749 static int 2750 ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct, 2751 enum ip_conntrack_info ctinfo, 2752 u_int16_t ct_attr, u_int16_t ct_info_attr) 2753 { 2754 struct nlattr *nest_parms; 2755 2756 nest_parms = nla_nest_start(skb, ct_attr); 2757 if (!nest_parms) 2758 goto nla_put_failure; 2759 2760 if (__ctnetlink_glue_build(skb, ct) < 0) 2761 goto nla_put_failure; 2762 2763 nla_nest_end(skb, nest_parms); 2764 2765 if (nla_put_be32(skb, ct_info_attr, htonl(ctinfo))) 2766 goto nla_put_failure; 2767 2768 return 0; 2769 2770 nla_put_failure: 2771 return -ENOSPC; 2772 } 2773 2774 static int 2775 ctnetlink_update_status(struct nf_conn *ct, const struct nlattr * const cda[]) 2776 { 2777 unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS])); 2778 unsigned long d = ct->status ^ status; 2779 2780 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY)) 2781 /* SEEN_REPLY bit can only be set */ 2782 return -EBUSY; 2783 2784 if (d & IPS_ASSURED && !(status & IPS_ASSURED)) 2785 /* ASSURED bit can only be set */ 2786 return -EBUSY; 2787 2788 /* This check is less strict than ctnetlink_change_status() 2789 * because callers often flip IPS_EXPECTED bits when sending 2790 * an NFQA_CT attribute to the kernel. So ignore the 2791 * unchangeable bits but do not error out. Also user programs 2792 * are allowed to clear the bits that they are allowed to change. 2793 */ 2794 __nf_ct_change_status(ct, status, ~status); 2795 return 0; 2796 } 2797 2798 static int 2799 ctnetlink_glue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct) 2800 { 2801 int err; 2802 2803 if (cda[CTA_TIMEOUT]) { 2804 err = ctnetlink_change_timeout(ct, cda); 2805 if (err < 0) 2806 return err; 2807 } 2808 if (cda[CTA_STATUS]) { 2809 err = ctnetlink_update_status(ct, cda); 2810 if (err < 0) 2811 return err; 2812 } 2813 if (cda[CTA_HELP]) { 2814 err = ctnetlink_change_helper(ct, cda); 2815 if (err < 0) 2816 return err; 2817 } 2818 if (cda[CTA_LABELS]) { 2819 err = ctnetlink_attach_labels(ct, cda); 2820 if (err < 0) 2821 return err; 2822 } 2823 #if defined(CONFIG_NF_CONNTRACK_MARK) 2824 if (cda[CTA_MARK]) { 2825 ctnetlink_change_mark(ct, cda); 2826 } 2827 #endif 2828 return 0; 2829 } 2830 2831 static int 2832 ctnetlink_glue_parse(const struct nlattr *attr, struct nf_conn *ct) 2833 { 2834 struct nlattr *cda[CTA_MAX+1]; 2835 int ret; 2836 2837 ret = nla_parse_nested_deprecated(cda, CTA_MAX, attr, ct_nla_policy, 2838 NULL); 2839 if (ret < 0) 2840 return ret; 2841 2842 return ctnetlink_glue_parse_ct((const struct nlattr **)cda, ct); 2843 } 2844 2845 static int ctnetlink_glue_exp_parse(const struct nlattr * const *cda, 2846 const struct nf_conn *ct, 2847 struct nf_conntrack_tuple *tuple, 2848 struct nf_conntrack_tuple *mask) 2849 { 2850 int err; 2851 2852 err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE, 2853 nf_ct_l3num(ct), NULL); 2854 if (err < 0) 2855 return err; 2856 2857 return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK, 2858 nf_ct_l3num(ct), NULL); 2859 } 2860 2861 static int 2862 ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, 2863 u32 portid, u32 report) 2864 { 2865 struct nlattr *cda[CTA_EXPECT_MAX+1]; 2866 struct nf_conntrack_tuple tuple, mask; 2867 struct nf_conntrack_expect *exp; 2868 int err; 2869 2870 err = nla_parse_nested_deprecated(cda, CTA_EXPECT_MAX, attr, 2871 exp_nla_policy, NULL); 2872 if (err < 0) 2873 return err; 2874 2875 err = ctnetlink_glue_exp_parse((const struct nlattr * const *)cda, 2876 ct, &tuple, &mask); 2877 if (err < 0) 2878 return err; 2879 2880 exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct, 2881 &tuple, &mask); 2882 if (IS_ERR(exp)) 2883 return PTR_ERR(exp); 2884 2885 err = nf_ct_expect_related_report(exp, portid, report, 0); 2886 nf_ct_expect_put(exp); 2887 return err; 2888 } 2889 2890 static void ctnetlink_glue_seqadj(struct sk_buff *skb, struct nf_conn *ct, 2891 enum ip_conntrack_info ctinfo, int diff) 2892 { 2893 if (!(ct->status & IPS_NAT_MASK)) 2894 return; 2895 2896 nf_ct_tcp_seqadj_set(skb, ct, ctinfo, diff); 2897 } 2898 2899 static const struct nfnl_ct_hook ctnetlink_glue_hook = { 2900 .build_size = ctnetlink_glue_build_size, 2901 .build = ctnetlink_glue_build, 2902 .parse = ctnetlink_glue_parse, 2903 .attach_expect = ctnetlink_glue_attach_expect, 2904 .seq_adjust = ctnetlink_glue_seqadj, 2905 }; 2906 #endif /* CONFIG_NETFILTER_NETLINK_GLUE_CT */ 2907 2908 /*********************************************************************** 2909 * EXPECT 2910 ***********************************************************************/ 2911 2912 static int ctnetlink_exp_dump_tuple(struct sk_buff *skb, 2913 const struct nf_conntrack_tuple *tuple, 2914 u32 type) 2915 { 2916 struct nlattr *nest_parms; 2917 2918 nest_parms = nla_nest_start(skb, type); 2919 if (!nest_parms) 2920 goto nla_put_failure; 2921 if (ctnetlink_dump_tuples(skb, tuple) < 0) 2922 goto nla_put_failure; 2923 nla_nest_end(skb, nest_parms); 2924 2925 return 0; 2926 2927 nla_put_failure: 2928 return -1; 2929 } 2930 2931 static int ctnetlink_exp_dump_mask(struct sk_buff *skb, 2932 const struct nf_conntrack_tuple *tuple, 2933 const struct nf_conntrack_tuple_mask *mask) 2934 { 2935 const struct nf_conntrack_l4proto *l4proto; 2936 struct nf_conntrack_tuple m; 2937 struct nlattr *nest_parms; 2938 int ret; 2939 2940 memset(&m, 0xFF, sizeof(m)); 2941 memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3)); 2942 m.src.u.all = mask->src.u.all; 2943 m.src.l3num = tuple->src.l3num; 2944 m.dst.protonum = tuple->dst.protonum; 2945 2946 nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK); 2947 if (!nest_parms) 2948 goto nla_put_failure; 2949 2950 rcu_read_lock(); 2951 ret = ctnetlink_dump_tuples_ip(skb, &m); 2952 if (ret >= 0) { 2953 l4proto = nf_ct_l4proto_find(tuple->dst.protonum); 2954 ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto); 2955 } 2956 rcu_read_unlock(); 2957 2958 if (unlikely(ret < 0)) 2959 goto nla_put_failure; 2960 2961 nla_nest_end(skb, nest_parms); 2962 2963 return 0; 2964 2965 nla_put_failure: 2966 return -1; 2967 } 2968 2969 #if IS_ENABLED(CONFIG_NF_NAT) 2970 static const union nf_inet_addr any_addr; 2971 #endif 2972 2973 static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp) 2974 { 2975 static siphash_aligned_key_t exp_id_seed; 2976 unsigned long a, b, c, d; 2977 2978 net_get_random_once(&exp_id_seed, sizeof(exp_id_seed)); 2979 2980 a = (unsigned long)exp; 2981 b = (unsigned long)exp->helper; 2982 c = (unsigned long)exp->master; 2983 d = (unsigned long)siphash(&exp->tuple, sizeof(exp->tuple), &exp_id_seed); 2984 2985 #ifdef CONFIG_64BIT 2986 return (__force __be32)siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &exp_id_seed); 2987 #else 2988 return (__force __be32)siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &exp_id_seed); 2989 #endif 2990 } 2991 2992 static int 2993 ctnetlink_exp_dump_expect(struct sk_buff *skb, 2994 const struct nf_conntrack_expect *exp) 2995 { 2996 struct nf_conn *master = exp->master; 2997 long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ; 2998 struct nf_conntrack_helper *helper; 2999 #if IS_ENABLED(CONFIG_NF_NAT) 3000 struct nlattr *nest_parms; 3001 struct nf_conntrack_tuple nat_tuple = {}; 3002 #endif 3003 struct nf_ct_helper_expectfn *expfn; 3004 3005 if (timeout < 0) 3006 timeout = 0; 3007 3008 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0) 3009 goto nla_put_failure; 3010 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0) 3011 goto nla_put_failure; 3012 if (ctnetlink_exp_dump_tuple(skb, 3013 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple, 3014 CTA_EXPECT_MASTER) < 0) 3015 goto nla_put_failure; 3016 3017 #if IS_ENABLED(CONFIG_NF_NAT) 3018 if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) || 3019 exp->saved_proto.all) { 3020 nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT); 3021 if (!nest_parms) 3022 goto nla_put_failure; 3023 3024 if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir))) 3025 goto nla_put_failure; 3026 3027 nat_tuple.src.l3num = nf_ct_l3num(master); 3028 nat_tuple.src.u3 = exp->saved_addr; 3029 nat_tuple.dst.protonum = nf_ct_protonum(master); 3030 nat_tuple.src.u = exp->saved_proto; 3031 3032 if (ctnetlink_exp_dump_tuple(skb, &nat_tuple, 3033 CTA_EXPECT_NAT_TUPLE) < 0) 3034 goto nla_put_failure; 3035 nla_nest_end(skb, nest_parms); 3036 } 3037 #endif 3038 if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) || 3039 nla_put_be32(skb, CTA_EXPECT_ID, nf_expect_get_id(exp)) || 3040 nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) || 3041 nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class))) 3042 goto nla_put_failure; 3043 3044 helper = rcu_dereference(exp->helper); 3045 if (helper && 3046 nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name)) 3047 goto nla_put_failure; 3048 3049 expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn); 3050 if (expfn != NULL && 3051 nla_put_string(skb, CTA_EXPECT_FN, expfn->name)) 3052 goto nla_put_failure; 3053 3054 return 0; 3055 3056 nla_put_failure: 3057 return -1; 3058 } 3059 3060 static int 3061 ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq, 3062 int event, const struct nf_conntrack_expect *exp) 3063 { 3064 struct nlmsghdr *nlh; 3065 unsigned int flags = portid ? NLM_F_MULTI : 0; 3066 3067 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, event); 3068 nlh = nfnl_msg_put(skb, portid, seq, event, flags, 3069 exp->tuple.src.l3num, NFNETLINK_V0, 0); 3070 if (!nlh) 3071 goto nlmsg_failure; 3072 3073 if (ctnetlink_exp_dump_expect(skb, exp) < 0) 3074 goto nla_put_failure; 3075 3076 nlmsg_end(skb, nlh); 3077 return skb->len; 3078 3079 nlmsg_failure: 3080 nla_put_failure: 3081 nlmsg_cancel(skb, nlh); 3082 return -1; 3083 } 3084 3085 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3086 static int 3087 ctnetlink_expect_event(unsigned int events, const struct nf_exp_event *item) 3088 { 3089 struct nf_conntrack_expect *exp = item->exp; 3090 struct net *net = nf_ct_exp_net(exp); 3091 struct nlmsghdr *nlh; 3092 struct sk_buff *skb; 3093 unsigned int type, group; 3094 int flags = 0; 3095 3096 if (events & (1 << IPEXP_DESTROY)) { 3097 type = IPCTNL_MSG_EXP_DELETE; 3098 group = NFNLGRP_CONNTRACK_EXP_DESTROY; 3099 } else if (events & (1 << IPEXP_NEW)) { 3100 type = IPCTNL_MSG_EXP_NEW; 3101 flags = NLM_F_CREATE|NLM_F_EXCL; 3102 group = NFNLGRP_CONNTRACK_EXP_NEW; 3103 } else 3104 return 0; 3105 3106 if (!item->report && !nfnetlink_has_listeners(net, group)) 3107 return 0; 3108 3109 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 3110 if (skb == NULL) 3111 goto errout; 3112 3113 type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, type); 3114 nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, 3115 exp->tuple.src.l3num, NFNETLINK_V0, 0); 3116 if (!nlh) 3117 goto nlmsg_failure; 3118 3119 if (ctnetlink_exp_dump_expect(skb, exp) < 0) 3120 goto nla_put_failure; 3121 3122 nlmsg_end(skb, nlh); 3123 nfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC); 3124 return 0; 3125 3126 nla_put_failure: 3127 nlmsg_cancel(skb, nlh); 3128 nlmsg_failure: 3129 kfree_skb(skb); 3130 errout: 3131 nfnetlink_set_err(net, 0, 0, -ENOBUFS); 3132 return 0; 3133 } 3134 #endif 3135 3136 static unsigned long ctnetlink_exp_id(const struct nf_conntrack_expect *exp) 3137 { 3138 unsigned long id = (unsigned long)exp; 3139 3140 id += nf_ct_get_id(exp->master); 3141 id += exp->class; 3142 3143 return id ? id : 1; 3144 } 3145 3146 static int 3147 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 3148 { 3149 struct net *net = sock_net(skb->sk); 3150 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3151 u_int8_t l3proto = nfmsg->nfgen_family; 3152 unsigned long last_id = cb->args[1]; 3153 struct nf_conntrack_expect *exp; 3154 3155 rcu_read_lock(); 3156 for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) { 3157 restart: 3158 hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]], 3159 hnode) { 3160 if (l3proto && exp->tuple.src.l3num != l3proto) 3161 continue; 3162 3163 if (!net_eq(nf_ct_net(exp->master), net)) 3164 continue; 3165 3166 if (cb->args[1]) { 3167 if (ctnetlink_exp_id(exp) != last_id) 3168 continue; 3169 cb->args[1] = 0; 3170 } 3171 if (ctnetlink_exp_fill_info(skb, 3172 NETLINK_CB(cb->skb).portid, 3173 cb->nlh->nlmsg_seq, 3174 IPCTNL_MSG_EXP_NEW, 3175 exp) < 0) { 3176 cb->args[1] = ctnetlink_exp_id(exp); 3177 goto out; 3178 } 3179 } 3180 if (cb->args[1]) { 3181 cb->args[1] = 0; 3182 goto restart; 3183 } 3184 } 3185 out: 3186 rcu_read_unlock(); 3187 return skb->len; 3188 } 3189 3190 static int 3191 ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 3192 { 3193 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3194 struct nf_conn *ct = cb->data; 3195 struct nf_conn_help *help; 3196 u_int8_t l3proto = nfmsg->nfgen_family; 3197 unsigned long last_id = cb->args[1]; 3198 struct nf_conntrack_expect *exp; 3199 3200 if (cb->args[0]) 3201 return 0; 3202 3203 help = nfct_help(ct); 3204 if (!help) 3205 return 0; 3206 3207 rcu_read_lock(); 3208 3209 restart: 3210 hlist_for_each_entry_rcu(exp, &help->expectations, lnode) { 3211 if (l3proto && exp->tuple.src.l3num != l3proto) 3212 continue; 3213 if (cb->args[1]) { 3214 if (ctnetlink_exp_id(exp) != last_id) 3215 continue; 3216 cb->args[1] = 0; 3217 } 3218 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).portid, 3219 cb->nlh->nlmsg_seq, 3220 IPCTNL_MSG_EXP_NEW, 3221 exp) < 0) { 3222 cb->args[1] = ctnetlink_exp_id(exp); 3223 goto out; 3224 } 3225 } 3226 if (cb->args[1]) { 3227 cb->args[1] = 0; 3228 goto restart; 3229 } 3230 cb->args[0] = 1; 3231 out: 3232 rcu_read_unlock(); 3233 return skb->len; 3234 } 3235 3236 static int ctnetlink_dump_exp_ct_start(struct netlink_callback *cb) 3237 { 3238 struct nf_conn *ct = cb->data; 3239 3240 if (!refcount_inc_not_zero(&ct->ct_general.use)) 3241 return -ENOENT; 3242 return 0; 3243 } 3244 3245 static int ctnetlink_dump_exp_ct_done(struct netlink_callback *cb) 3246 { 3247 struct nf_conn *ct = cb->data; 3248 3249 if (ct) 3250 nf_ct_put(ct); 3251 return 0; 3252 } 3253 3254 static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, 3255 struct sk_buff *skb, 3256 const struct nlmsghdr *nlh, 3257 const struct nlattr * const cda[], 3258 struct netlink_ext_ack *extack) 3259 { 3260 int err; 3261 struct nfgenmsg *nfmsg = nlmsg_data(nlh); 3262 u_int8_t u3 = nfmsg->nfgen_family; 3263 struct nf_conntrack_tuple tuple; 3264 struct nf_conntrack_tuple_hash *h; 3265 struct nf_conn *ct; 3266 struct nf_conntrack_zone zone; 3267 struct netlink_dump_control c = { 3268 .dump = ctnetlink_exp_ct_dump_table, 3269 .start = ctnetlink_dump_exp_ct_start, 3270 .done = ctnetlink_dump_exp_ct_done, 3271 }; 3272 3273 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, 3274 u3, NULL); 3275 if (err < 0) 3276 return err; 3277 3278 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3279 if (err < 0) 3280 return err; 3281 3282 h = nf_conntrack_find_get(net, &zone, &tuple); 3283 if (!h) 3284 return -ENOENT; 3285 3286 ct = nf_ct_tuplehash_to_ctrack(h); 3287 /* No expectation linked to this connection tracking. */ 3288 if (!nfct_help(ct)) { 3289 nf_ct_put(ct); 3290 return 0; 3291 } 3292 3293 c.data = ct; 3294 3295 err = netlink_dump_start(ctnl, skb, nlh, &c); 3296 nf_ct_put(ct); 3297 3298 return err; 3299 } 3300 3301 static int ctnetlink_get_expect(struct sk_buff *skb, 3302 const struct nfnl_info *info, 3303 const struct nlattr * const cda[]) 3304 { 3305 u_int8_t u3 = info->nfmsg->nfgen_family; 3306 struct nf_conntrack_tuple tuple; 3307 struct nf_conntrack_expect *exp; 3308 struct nf_conntrack_zone zone; 3309 struct sk_buff *skb2; 3310 int err; 3311 3312 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3313 if (cda[CTA_EXPECT_MASTER]) 3314 return ctnetlink_dump_exp_ct(info->net, info->sk, skb, 3315 info->nlh, cda, 3316 info->extack); 3317 else { 3318 struct netlink_dump_control c = { 3319 .dump = ctnetlink_exp_dump_table, 3320 }; 3321 return netlink_dump_start(info->sk, skb, info->nlh, &c); 3322 } 3323 } 3324 3325 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3326 if (err < 0) 3327 return err; 3328 3329 if (cda[CTA_EXPECT_TUPLE]) 3330 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3331 u3, NULL); 3332 else if (cda[CTA_EXPECT_MASTER]) 3333 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, 3334 u3, NULL); 3335 else 3336 return -EINVAL; 3337 3338 if (err < 0) 3339 return err; 3340 3341 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3342 if (!skb2) 3343 return -ENOMEM; 3344 3345 spin_lock_bh(&nf_conntrack_expect_lock); 3346 exp = nf_ct_expect_find_get(info->net, &zone, &tuple); 3347 if (!exp) { 3348 spin_unlock_bh(&nf_conntrack_expect_lock); 3349 kfree_skb(skb2); 3350 return -ENOENT; 3351 } 3352 3353 if (cda[CTA_EXPECT_ID]) { 3354 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); 3355 3356 if (id != nf_expect_get_id(exp)) { 3357 nf_ct_expect_put(exp); 3358 spin_unlock_bh(&nf_conntrack_expect_lock); 3359 kfree_skb(skb2); 3360 return -ENOENT; 3361 } 3362 } 3363 3364 rcu_read_lock(); 3365 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, 3366 info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, 3367 exp); 3368 rcu_read_unlock(); 3369 nf_ct_expect_put(exp); 3370 spin_unlock_bh(&nf_conntrack_expect_lock); 3371 3372 if (err <= 0) { 3373 kfree_skb(skb2); 3374 return -ENOMEM; 3375 } 3376 3377 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 3378 } 3379 3380 static bool expect_iter_name(struct nf_conntrack_expect *exp, void *data) 3381 { 3382 struct nf_conntrack_helper *helper; 3383 const char *name = data; 3384 3385 helper = rcu_dereference(exp->helper); 3386 if (!helper) 3387 return false; 3388 3389 return strcmp(helper->name, name) == 0; 3390 } 3391 3392 static bool expect_iter_all(struct nf_conntrack_expect *exp, void *data) 3393 { 3394 return true; 3395 } 3396 3397 static int ctnetlink_del_expect(struct sk_buff *skb, 3398 const struct nfnl_info *info, 3399 const struct nlattr * const cda[]) 3400 { 3401 u_int8_t u3 = info->nfmsg->nfgen_family; 3402 struct nf_conntrack_expect *exp; 3403 struct nf_conntrack_tuple tuple; 3404 struct nf_conntrack_zone zone; 3405 int err; 3406 3407 if (cda[CTA_EXPECT_TUPLE]) { 3408 /* delete a single expect by tuple */ 3409 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3410 if (err < 0) 3411 return err; 3412 3413 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3414 u3, NULL); 3415 if (err < 0) 3416 return err; 3417 3418 spin_lock_bh(&nf_conntrack_expect_lock); 3419 3420 /* bump usage count to 2 */ 3421 exp = nf_ct_expect_find_get(info->net, &zone, &tuple); 3422 if (!exp) { 3423 spin_unlock_bh(&nf_conntrack_expect_lock); 3424 return -ENOENT; 3425 } 3426 3427 if (cda[CTA_EXPECT_ID]) { 3428 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); 3429 3430 if (id != nf_expect_get_id(exp)) { 3431 nf_ct_expect_put(exp); 3432 spin_unlock_bh(&nf_conntrack_expect_lock); 3433 return -ENOENT; 3434 } 3435 } 3436 3437 /* after list removal, usage count == 1 */ 3438 if (timer_delete(&exp->timeout)) { 3439 nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, 3440 nlmsg_report(info->nlh)); 3441 nf_ct_expect_put(exp); 3442 } 3443 spin_unlock_bh(&nf_conntrack_expect_lock); 3444 /* have to put what we 'get' above. 3445 * after this line usage count == 0 */ 3446 nf_ct_expect_put(exp); 3447 } else if (cda[CTA_EXPECT_HELP_NAME]) { 3448 char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]); 3449 3450 nf_ct_expect_iterate_net(info->net, expect_iter_name, name, 3451 NETLINK_CB(skb).portid, 3452 nlmsg_report(info->nlh)); 3453 } else { 3454 /* This basically means we have to flush everything*/ 3455 nf_ct_expect_iterate_net(info->net, expect_iter_all, NULL, 3456 NETLINK_CB(skb).portid, 3457 nlmsg_report(info->nlh)); 3458 } 3459 3460 return 0; 3461 } 3462 static int 3463 ctnetlink_change_expect(struct nf_conntrack_expect *x, 3464 const struct nlattr * const cda[]) 3465 { 3466 if (cda[CTA_EXPECT_TIMEOUT]) { 3467 if (!timer_delete(&x->timeout)) 3468 return -ETIME; 3469 3470 x->timeout.expires = jiffies + 3471 ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ; 3472 add_timer(&x->timeout); 3473 } 3474 return 0; 3475 } 3476 3477 #if IS_ENABLED(CONFIG_NF_NAT) 3478 static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = { 3479 [CTA_EXPECT_NAT_DIR] = NLA_POLICY_MAX(NLA_BE32, IP_CT_DIR_REPLY), 3480 [CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED }, 3481 }; 3482 #endif 3483 3484 static int 3485 ctnetlink_parse_expect_nat(const struct nlattr *attr, 3486 struct nf_conntrack_expect *exp, 3487 u_int8_t u3) 3488 { 3489 #if IS_ENABLED(CONFIG_NF_NAT) 3490 struct nlattr *tb[CTA_EXPECT_NAT_MAX+1]; 3491 struct nf_conntrack_tuple nat_tuple = {}; 3492 int err; 3493 3494 err = nla_parse_nested_deprecated(tb, CTA_EXPECT_NAT_MAX, attr, 3495 exp_nat_nla_policy, NULL); 3496 if (err < 0) 3497 return err; 3498 3499 if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE]) 3500 return -EINVAL; 3501 3502 err = ctnetlink_parse_tuple((const struct nlattr * const *)tb, 3503 &nat_tuple, CTA_EXPECT_NAT_TUPLE, 3504 u3, NULL); 3505 if (err < 0) 3506 return err; 3507 3508 exp->saved_addr = nat_tuple.src.u3; 3509 exp->saved_proto = nat_tuple.src.u; 3510 exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR])); 3511 3512 return 0; 3513 #else 3514 return -EOPNOTSUPP; 3515 #endif 3516 } 3517 3518 static struct nf_conntrack_expect * 3519 ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, 3520 struct nf_conntrack_tuple *tuple, 3521 struct nf_conntrack_tuple *mask) 3522 { 3523 struct net *net = read_pnet(&ct->ct_net); 3524 struct nf_conntrack_helper *helper; 3525 struct nf_conntrack_expect *exp; 3526 struct nf_conn_help *help; 3527 u32 class = 0; 3528 int err; 3529 3530 help = nfct_help(ct); 3531 if (!help) 3532 return ERR_PTR(-EOPNOTSUPP); 3533 3534 helper = rcu_dereference(help->helper); 3535 if (!helper) 3536 return ERR_PTR(-EOPNOTSUPP); 3537 3538 if (cda[CTA_EXPECT_CLASS]) { 3539 class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS])); 3540 if (class > helper->expect_class_max) 3541 return ERR_PTR(-EINVAL); 3542 } 3543 exp = nf_ct_expect_alloc(ct); 3544 if (!exp) 3545 return ERR_PTR(-ENOMEM); 3546 3547 if (cda[CTA_EXPECT_FLAGS]) { 3548 exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS])); 3549 exp->flags &= ~NF_CT_EXPECT_USERSPACE; 3550 } else { 3551 exp->flags = 0; 3552 } 3553 if (cda[CTA_EXPECT_FN]) { 3554 const char *name = nla_data(cda[CTA_EXPECT_FN]); 3555 struct nf_ct_helper_expectfn *expfn; 3556 3557 expfn = nf_ct_helper_expectfn_find_by_name(name); 3558 if (expfn == NULL) { 3559 err = -EINVAL; 3560 goto err_out; 3561 } 3562 exp->expectfn = expfn->expectfn; 3563 } else 3564 exp->expectfn = NULL; 3565 3566 exp->class = class; 3567 exp->master = ct; 3568 write_pnet(&exp->net, net); 3569 #ifdef CONFIG_NF_CONNTRACK_ZONES 3570 exp->zone = ct->zone; 3571 #endif 3572 rcu_assign_pointer(exp->helper, helper); 3573 exp->tuple = *tuple; 3574 exp->mask.src.u3 = mask->src.u3; 3575 exp->mask.src.u.all = mask->src.u.all; 3576 3577 if (cda[CTA_EXPECT_NAT]) { 3578 err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT], 3579 exp, nf_ct_l3num(ct)); 3580 if (err < 0) 3581 goto err_out; 3582 #if IS_ENABLED(CONFIG_NF_NAT) 3583 } else { 3584 memset(&exp->saved_addr, 0, sizeof(exp->saved_addr)); 3585 memset(&exp->saved_proto, 0, sizeof(exp->saved_proto)); 3586 exp->dir = 0; 3587 #endif 3588 } 3589 return exp; 3590 err_out: 3591 nf_ct_expect_put(exp); 3592 return ERR_PTR(err); 3593 } 3594 3595 static int 3596 ctnetlink_create_expect(struct net *net, 3597 const struct nf_conntrack_zone *zone, 3598 const struct nlattr * const cda[], 3599 u_int8_t u3, u32 portid, int report) 3600 { 3601 struct nf_conntrack_tuple tuple, mask, master_tuple; 3602 struct nf_conntrack_tuple_hash *h = NULL; 3603 struct nf_conntrack_expect *exp; 3604 struct nf_conn *ct; 3605 int err; 3606 3607 /* caller guarantees that those three CTA_EXPECT_* exist */ 3608 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3609 u3, NULL); 3610 if (err < 0) 3611 return err; 3612 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, 3613 u3, NULL); 3614 if (err < 0) 3615 return err; 3616 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, 3617 u3, NULL); 3618 if (err < 0) 3619 return err; 3620 3621 /* Look for master conntrack of this expectation */ 3622 h = nf_conntrack_find_get(net, zone, &master_tuple); 3623 if (!h) 3624 return -ENOENT; 3625 ct = nf_ct_tuplehash_to_ctrack(h); 3626 3627 rcu_read_lock(); 3628 exp = ctnetlink_alloc_expect(cda, ct, &tuple, &mask); 3629 if (IS_ERR(exp)) { 3630 err = PTR_ERR(exp); 3631 goto err_rcu; 3632 } 3633 3634 err = nf_ct_expect_related_report(exp, portid, report, 0); 3635 nf_ct_expect_put(exp); 3636 err_rcu: 3637 rcu_read_unlock(); 3638 nf_ct_put(ct); 3639 3640 return err; 3641 } 3642 3643 static int ctnetlink_new_expect(struct sk_buff *skb, 3644 const struct nfnl_info *info, 3645 const struct nlattr * const cda[]) 3646 { 3647 u_int8_t u3 = info->nfmsg->nfgen_family; 3648 struct nf_conntrack_tuple tuple; 3649 struct nf_conntrack_expect *exp; 3650 struct nf_conntrack_zone zone; 3651 int err; 3652 3653 if (!cda[CTA_EXPECT_TUPLE] 3654 || !cda[CTA_EXPECT_MASK] 3655 || !cda[CTA_EXPECT_MASTER]) 3656 return -EINVAL; 3657 3658 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3659 if (err < 0) 3660 return err; 3661 3662 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3663 u3, NULL); 3664 if (err < 0) 3665 return err; 3666 3667 spin_lock_bh(&nf_conntrack_expect_lock); 3668 exp = __nf_ct_expect_find(info->net, &zone, &tuple); 3669 if (!exp) { 3670 spin_unlock_bh(&nf_conntrack_expect_lock); 3671 err = -ENOENT; 3672 if (info->nlh->nlmsg_flags & NLM_F_CREATE) { 3673 err = ctnetlink_create_expect(info->net, &zone, cda, u3, 3674 NETLINK_CB(skb).portid, 3675 nlmsg_report(info->nlh)); 3676 } 3677 return err; 3678 } 3679 3680 err = -EEXIST; 3681 if (!(info->nlh->nlmsg_flags & NLM_F_EXCL)) 3682 err = ctnetlink_change_expect(exp, cda); 3683 spin_unlock_bh(&nf_conntrack_expect_lock); 3684 3685 return err; 3686 } 3687 3688 static int 3689 ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu, 3690 const struct ip_conntrack_stat *st) 3691 { 3692 struct nlmsghdr *nlh; 3693 unsigned int flags = portid ? NLM_F_MULTI : 0, event; 3694 3695 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, 3696 IPCTNL_MSG_EXP_GET_STATS_CPU); 3697 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, 3698 NFNETLINK_V0, htons(cpu)); 3699 if (!nlh) 3700 goto nlmsg_failure; 3701 3702 if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) || 3703 nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) || 3704 nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete))) 3705 goto nla_put_failure; 3706 3707 nlmsg_end(skb, nlh); 3708 return skb->len; 3709 3710 nla_put_failure: 3711 nlmsg_failure: 3712 nlmsg_cancel(skb, nlh); 3713 return -1; 3714 } 3715 3716 static int 3717 ctnetlink_exp_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb) 3718 { 3719 int cpu; 3720 struct net *net = sock_net(skb->sk); 3721 3722 if (cb->args[0] == nr_cpu_ids) 3723 return 0; 3724 3725 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) { 3726 const struct ip_conntrack_stat *st; 3727 3728 if (!cpu_possible(cpu)) 3729 continue; 3730 3731 st = per_cpu_ptr(net->ct.stat, cpu); 3732 if (ctnetlink_exp_stat_fill_info(skb, NETLINK_CB(cb->skb).portid, 3733 cb->nlh->nlmsg_seq, 3734 cpu, st) < 0) 3735 break; 3736 } 3737 cb->args[0] = cpu; 3738 3739 return skb->len; 3740 } 3741 3742 static int ctnetlink_stat_exp_cpu(struct sk_buff *skb, 3743 const struct nfnl_info *info, 3744 const struct nlattr * const cda[]) 3745 { 3746 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3747 struct netlink_dump_control c = { 3748 .dump = ctnetlink_exp_stat_cpu_dump, 3749 }; 3750 return netlink_dump_start(info->sk, skb, info->nlh, &c); 3751 } 3752 3753 return 0; 3754 } 3755 3756 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3757 static struct nf_ct_event_notifier ctnl_notifier = { 3758 .ct_event = ctnetlink_conntrack_event, 3759 .exp_event = ctnetlink_expect_event, 3760 }; 3761 #endif 3762 3763 static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = { 3764 [IPCTNL_MSG_CT_NEW] = { 3765 .call = ctnetlink_new_conntrack, 3766 .type = NFNL_CB_MUTEX, 3767 .attr_count = CTA_MAX, 3768 .policy = ct_nla_policy 3769 }, 3770 [IPCTNL_MSG_CT_GET] = { 3771 .call = ctnetlink_get_conntrack, 3772 .type = NFNL_CB_MUTEX, 3773 .attr_count = CTA_MAX, 3774 .policy = ct_nla_policy 3775 }, 3776 [IPCTNL_MSG_CT_DELETE] = { 3777 .call = ctnetlink_del_conntrack, 3778 .type = NFNL_CB_MUTEX, 3779 .attr_count = CTA_MAX, 3780 .policy = ct_nla_policy 3781 }, 3782 [IPCTNL_MSG_CT_GET_CTRZERO] = { 3783 .call = ctnetlink_get_conntrack, 3784 .type = NFNL_CB_MUTEX, 3785 .attr_count = CTA_MAX, 3786 .policy = ct_nla_policy 3787 }, 3788 [IPCTNL_MSG_CT_GET_STATS_CPU] = { 3789 .call = ctnetlink_stat_ct_cpu, 3790 .type = NFNL_CB_MUTEX, 3791 }, 3792 [IPCTNL_MSG_CT_GET_STATS] = { 3793 .call = ctnetlink_stat_ct, 3794 .type = NFNL_CB_MUTEX, 3795 }, 3796 [IPCTNL_MSG_CT_GET_DYING] = { 3797 .call = ctnetlink_get_ct_dying, 3798 .type = NFNL_CB_MUTEX, 3799 }, 3800 [IPCTNL_MSG_CT_GET_UNCONFIRMED] = { 3801 .call = ctnetlink_get_ct_unconfirmed, 3802 .type = NFNL_CB_MUTEX, 3803 }, 3804 }; 3805 3806 static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = { 3807 [IPCTNL_MSG_EXP_GET] = { 3808 .call = ctnetlink_get_expect, 3809 .type = NFNL_CB_MUTEX, 3810 .attr_count = CTA_EXPECT_MAX, 3811 .policy = exp_nla_policy 3812 }, 3813 [IPCTNL_MSG_EXP_NEW] = { 3814 .call = ctnetlink_new_expect, 3815 .type = NFNL_CB_MUTEX, 3816 .attr_count = CTA_EXPECT_MAX, 3817 .policy = exp_nla_policy 3818 }, 3819 [IPCTNL_MSG_EXP_DELETE] = { 3820 .call = ctnetlink_del_expect, 3821 .type = NFNL_CB_MUTEX, 3822 .attr_count = CTA_EXPECT_MAX, 3823 .policy = exp_nla_policy 3824 }, 3825 [IPCTNL_MSG_EXP_GET_STATS_CPU] = { 3826 .call = ctnetlink_stat_exp_cpu, 3827 .type = NFNL_CB_MUTEX, 3828 }, 3829 }; 3830 3831 static const struct nfnetlink_subsystem ctnl_subsys = { 3832 .name = "conntrack", 3833 .subsys_id = NFNL_SUBSYS_CTNETLINK, 3834 .cb_count = IPCTNL_MSG_MAX, 3835 .cb = ctnl_cb, 3836 }; 3837 3838 static const struct nfnetlink_subsystem ctnl_exp_subsys = { 3839 .name = "conntrack_expect", 3840 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP, 3841 .cb_count = IPCTNL_MSG_EXP_MAX, 3842 .cb = ctnl_exp_cb, 3843 }; 3844 3845 MODULE_ALIAS("ip_conntrack_netlink"); 3846 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK); 3847 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP); 3848 3849 static int __net_init ctnetlink_net_init(struct net *net) 3850 { 3851 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3852 nf_conntrack_register_notifier(net, &ctnl_notifier); 3853 #endif 3854 return 0; 3855 } 3856 3857 static void ctnetlink_net_pre_exit(struct net *net) 3858 { 3859 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3860 nf_conntrack_unregister_notifier(net); 3861 #endif 3862 } 3863 3864 static struct pernet_operations ctnetlink_net_ops = { 3865 .init = ctnetlink_net_init, 3866 .pre_exit = ctnetlink_net_pre_exit, 3867 }; 3868 3869 static int __init ctnetlink_init(void) 3870 { 3871 int ret; 3872 3873 NL_ASSERT_CTX_FITS(struct ctnetlink_list_dump_ctx); 3874 3875 ret = nfnetlink_subsys_register(&ctnl_subsys); 3876 if (ret < 0) { 3877 pr_err("ctnetlink_init: cannot register with nfnetlink.\n"); 3878 goto err_out; 3879 } 3880 3881 ret = nfnetlink_subsys_register(&ctnl_exp_subsys); 3882 if (ret < 0) { 3883 pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n"); 3884 goto err_unreg_subsys; 3885 } 3886 3887 ret = register_pernet_subsys(&ctnetlink_net_ops); 3888 if (ret < 0) { 3889 pr_err("ctnetlink_init: cannot register pernet operations\n"); 3890 goto err_unreg_exp_subsys; 3891 } 3892 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT 3893 /* setup interaction between nf_queue and nf_conntrack_netlink. */ 3894 RCU_INIT_POINTER(nfnl_ct_hook, &ctnetlink_glue_hook); 3895 #endif 3896 return 0; 3897 3898 err_unreg_exp_subsys: 3899 nfnetlink_subsys_unregister(&ctnl_exp_subsys); 3900 err_unreg_subsys: 3901 nfnetlink_subsys_unregister(&ctnl_subsys); 3902 err_out: 3903 return ret; 3904 } 3905 3906 static void __exit ctnetlink_exit(void) 3907 { 3908 unregister_pernet_subsys(&ctnetlink_net_ops); 3909 nfnetlink_subsys_unregister(&ctnl_exp_subsys); 3910 nfnetlink_subsys_unregister(&ctnl_subsys); 3911 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT 3912 RCU_INIT_POINTER(nfnl_ct_hook, NULL); 3913 #endif 3914 synchronize_rcu(); 3915 } 3916 3917 module_init(ctnetlink_init); 3918 module_exit(ctnetlink_exit); 3919