1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
4 *
5 * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com>
6 */
7 #include <linux/init.h>
8 #include <linux/module.h>
9 #include <linux/kernel.h>
10 #include <linux/skbuff.h>
11 #include <linux/netlink.h>
12 #include <linux/rculist.h>
13 #include <linux/slab.h>
14 #include <linux/types.h>
15 #include <linux/list.h>
16 #include <linux/errno.h>
17 #include <linux/capability.h>
18 #include <net/netlink.h>
19 #include <net/sock.h>
20
21 #include <net/netfilter/nf_conntrack_helper.h>
22 #include <net/netfilter/nf_conntrack_expect.h>
23 #include <net/netfilter/nf_conntrack_ecache.h>
24
25 #include <linux/netfilter/nfnetlink.h>
26 #include <linux/netfilter/nfnetlink_conntrack.h>
27 #include <linux/netfilter/nfnetlink_cthelper.h>
28
29 MODULE_LICENSE("GPL");
30 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
31 MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers");
32
33 struct nfnl_cthelper {
34 struct list_head list;
35 struct nf_conntrack_helper *helper;
36 };
37
38 static LIST_HEAD(nfnl_cthelper_list);
39
40 static int
nfnl_userspace_cthelper(struct sk_buff * skb,unsigned int protoff,struct nf_conn * ct,enum ip_conntrack_info ctinfo)41 nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff,
42 struct nf_conn *ct, enum ip_conntrack_info ctinfo)
43 {
44 struct nf_conntrack_helper *helper;
45 const struct nf_conn_help *help;
46 unsigned int helper_flags;
47
48 help = nfct_help(ct);
49 if (help == NULL)
50 return NF_DROP;
51
52 /* rcu_read_lock()ed by nf_hook_thresh */
53 helper = rcu_dereference(help->helper);
54 if (helper == NULL)
55 return NF_DROP;
56
57 helper_flags = READ_ONCE(helper->flags);
58
59 /* This is a user-space helper not yet configured, skip. */
60 if ((helper_flags &
61 (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) ==
62 NF_CT_HELPER_F_USERSPACE)
63 return NF_ACCEPT;
64
65 /* If the user-space helper is not available, don't block traffic. */
66 return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS;
67 }
68
69 static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = {
70 [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, },
71 [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, },
72 };
73
74 static int
nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple * tuple,const struct nlattr * attr)75 nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
76 const struct nlattr *attr)
77 {
78 int err;
79 struct nlattr *tb[NFCTH_TUPLE_MAX+1];
80
81 err = nla_parse_nested_deprecated(tb, NFCTH_TUPLE_MAX, attr,
82 nfnl_cthelper_tuple_pol, NULL);
83 if (err < 0)
84 return err;
85
86 if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
87 return -EINVAL;
88
89 /* Not all fields are initialized so first zero the tuple */
90 memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
91
92 tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
93 tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
94
95 return 0;
96 }
97
98 static int
nfnl_cthelper_from_nlattr(struct nlattr * attr,struct nf_conn * ct)99 nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
100 {
101 struct nf_conn_help *help = nfct_help(ct);
102 const struct nf_conntrack_helper *helper;
103
104 if (!help)
105 return -EINVAL;
106
107 if (attr == NULL)
108 return -EINVAL;
109
110 helper = rcu_dereference(help->helper);
111 if (!helper || helper->data_len == 0)
112 return -EINVAL;
113
114 nla_memcpy(help->data, attr, sizeof(help->data));
115 return 0;
116 }
117
118 static int
nfnl_cthelper_to_nlattr(struct sk_buff * skb,const struct nf_conn * ct)119 nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct)
120 {
121 const struct nf_conn_help *help = nfct_help(ct);
122 const struct nf_conntrack_helper *helper;
123
124 if (!help)
125 return 0;
126
127 helper = rcu_dereference(help->helper);
128 if (helper && helper->data_len &&
129 nla_put(skb, CTA_HELP_INFO, helper->data_len, &help->data))
130 goto nla_put_failure;
131
132 return 0;
133
134 nla_put_failure:
135 return -ENOSPC;
136 }
137
138 static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = {
139 [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING,
140 .len = NF_CT_HELPER_NAME_LEN-1 },
141 [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, },
142 [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, },
143 };
144
145 static int
nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy * expect_policy,const struct nlattr * attr)146 nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
147 const struct nlattr *attr)
148 {
149 int err;
150 struct nlattr *tb[NFCTH_POLICY_MAX+1];
151
152 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr,
153 nfnl_cthelper_expect_pol, NULL);
154 if (err < 0)
155 return err;
156
157 if (!tb[NFCTH_POLICY_NAME] ||
158 !tb[NFCTH_POLICY_EXPECT_MAX] ||
159 !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
160 return -EINVAL;
161
162 nla_strscpy(expect_policy->name,
163 tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN);
164 expect_policy->max_expected =
165 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
166 if (!expect_policy->max_expected)
167 expect_policy->max_expected = NF_CT_EXPECT_MAX_CNT;
168 if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
169 return -EINVAL;
170
171 expect_policy->timeout =
172 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
173
174 return 0;
175 }
176
177 static const struct nla_policy
178 nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = {
179 [NFCTH_POLICY_SET_NUM] = NLA_POLICY_MAX(NLA_BE32, NF_CT_MAX_EXPECT_CLASSES),
180 };
181
182 static int
nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper * helper,const struct nlattr * attr)183 nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
184 const struct nlattr *attr)
185 {
186 int i, ret;
187 struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
188 unsigned int class_max;
189
190 ret = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr,
191 nfnl_cthelper_expect_policy_set,
192 NULL);
193 if (ret < 0)
194 return ret;
195
196 if (!tb[NFCTH_POLICY_SET_NUM])
197 return -EINVAL;
198
199 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
200 if (class_max == 0)
201 return -EINVAL;
202 if (class_max > NF_CT_MAX_EXPECT_CLASSES)
203 return -EOVERFLOW;
204
205 for (i = 0; i < class_max; i++) {
206 if (!tb[NFCTH_POLICY_SET+i])
207 goto err;
208
209 ret = nfnl_cthelper_expect_policy(&helper->expect_policy[i],
210 tb[NFCTH_POLICY_SET+i]);
211 if (ret < 0)
212 goto err;
213 }
214
215 helper->expect_class_max = class_max - 1;
216 return 0;
217 err:
218 return -EINVAL;
219 }
220
221 static int
nfnl_cthelper_create(const struct nlattr * const tb[],struct nf_conntrack_tuple * tuple)222 nfnl_cthelper_create(const struct nlattr * const tb[],
223 struct nf_conntrack_tuple *tuple)
224 {
225 struct nf_conntrack_helper *helper;
226 struct nfnl_cthelper *nfcth;
227 unsigned int size;
228 int ret;
229
230 if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN])
231 return -EINVAL;
232
233 nfcth = kzalloc_obj(*nfcth, GFP_KERNEL_ACCOUNT);
234 if (nfcth == NULL)
235 return -ENOMEM;
236
237 helper = kzalloc_obj(*helper, GFP_KERNEL_ACCOUNT);
238 if (!helper) {
239 ret = -ENOMEM;
240 goto err_cth;
241 }
242
243 nfcth->helper = helper;
244
245 ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]);
246 if (ret < 0)
247 goto err_helper;
248
249 nla_strscpy(helper->name,
250 tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN);
251 size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
252 if (size > sizeof_field(struct nf_conn_help, data)) {
253 ret = -ENOMEM;
254 goto err_helper;
255 }
256 helper->data_len = size;
257
258 helper->flags |= NF_CT_HELPER_F_USERSPACE;
259 memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));
260
261 helper->me = THIS_MODULE;
262 helper->help = nfnl_userspace_cthelper;
263 helper->from_nlattr = nfnl_cthelper_from_nlattr;
264 helper->to_nlattr = nfnl_cthelper_to_nlattr;
265
266 /* Default to queue number zero, this can be updated at any time. */
267 if (tb[NFCTH_QUEUE_NUM])
268 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
269
270 if (tb[NFCTH_STATUS]) {
271 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
272
273 switch(status) {
274 case NFCT_HELPER_STATUS_ENABLED:
275 helper->flags |= NF_CT_HELPER_F_CONFIGURED;
276 break;
277 case NFCT_HELPER_STATUS_DISABLED:
278 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED;
279 break;
280 }
281 }
282
283 ret = __nf_conntrack_helper_register(helper);
284 if (ret < 0)
285 goto err_helper;
286
287 list_add_tail(&nfcth->list, &nfnl_cthelper_list);
288 return 0;
289 err_helper:
290 kfree(helper);
291 err_cth:
292 kfree(nfcth);
293 return ret;
294 }
295
296 static int
nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy * policy,struct nf_conntrack_expect_policy * new_policy,const struct nlattr * attr)297 nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy,
298 struct nf_conntrack_expect_policy *new_policy,
299 const struct nlattr *attr)
300 {
301 struct nlattr *tb[NFCTH_POLICY_MAX + 1];
302 int err;
303
304 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr,
305 nfnl_cthelper_expect_pol, NULL);
306 if (err < 0)
307 return err;
308
309 if (!tb[NFCTH_POLICY_NAME] ||
310 !tb[NFCTH_POLICY_EXPECT_MAX] ||
311 !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
312 return -EINVAL;
313
314 if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name))
315 return -EBUSY;
316
317 new_policy->max_expected =
318 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
319 if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
320 return -EINVAL;
321
322 new_policy->timeout =
323 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
324
325 return 0;
326 }
327
nfnl_cthelper_update_policy_all(struct nlattr * tb[],struct nf_conntrack_helper * helper)328 static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
329 struct nf_conntrack_helper *helper)
330 {
331 struct nf_conntrack_expect_policy *new_policy;
332 struct nf_conntrack_expect_policy *policy;
333 int i, ret = 0;
334
335 new_policy = kmalloc_objs(*new_policy, helper->expect_class_max + 1);
336 if (!new_policy)
337 return -ENOMEM;
338
339 /* Check first that all policy attributes are well-formed, so we don't
340 * leave things in inconsistent state on errors.
341 */
342 for (i = 0; i < helper->expect_class_max + 1; i++) {
343
344 if (!tb[NFCTH_POLICY_SET + i]) {
345 ret = -EINVAL;
346 goto err;
347 }
348
349 ret = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
350 &new_policy[i],
351 tb[NFCTH_POLICY_SET + i]);
352 if (ret < 0)
353 goto err;
354 }
355 /* Now we can safely update them. */
356 for (i = 0; i < helper->expect_class_max + 1; i++) {
357 policy = (struct nf_conntrack_expect_policy *)
358 &helper->expect_policy[i];
359 policy->max_expected = new_policy[i].max_expected;
360 policy->timeout = new_policy[i].timeout;
361 }
362
363 err:
364 kfree(new_policy);
365 return ret;
366 }
367
nfnl_cthelper_update_policy(struct nf_conntrack_helper * helper,const struct nlattr * attr)368 static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper,
369 const struct nlattr *attr)
370 {
371 struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1];
372 unsigned int class_max;
373 int err;
374
375 err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr,
376 nfnl_cthelper_expect_policy_set,
377 NULL);
378 if (err < 0)
379 return err;
380
381 if (!tb[NFCTH_POLICY_SET_NUM])
382 return -EINVAL;
383
384 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
385 if (helper->expect_class_max + 1 != class_max)
386 return -EBUSY;
387
388 return nfnl_cthelper_update_policy_all(tb, helper);
389 }
390
391 static int
nfnl_cthelper_update(const struct nlattr * const tb[],struct nf_conntrack_helper * helper)392 nfnl_cthelper_update(const struct nlattr * const tb[],
393 struct nf_conntrack_helper *helper)
394 {
395 u32 size;
396 int ret;
397
398 if (tb[NFCTH_PRIV_DATA_LEN]) {
399 size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
400 if (size != helper->data_len)
401 return -EBUSY;
402 }
403
404 if (tb[NFCTH_POLICY]) {
405 ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);
406 if (ret < 0)
407 return ret;
408 }
409 if (tb[NFCTH_QUEUE_NUM])
410 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
411
412 if (tb[NFCTH_STATUS]) {
413 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
414
415 switch(status) {
416 case NFCT_HELPER_STATUS_ENABLED:
417 WRITE_ONCE(helper->flags, helper->flags | NF_CT_HELPER_F_CONFIGURED);
418 break;
419 case NFCT_HELPER_STATUS_DISABLED:
420 WRITE_ONCE(helper->flags, helper->flags & ~NF_CT_HELPER_F_CONFIGURED);
421 break;
422 }
423 }
424 return 0;
425 }
426
nfnl_cthelper_new(struct sk_buff * skb,const struct nfnl_info * info,const struct nlattr * const tb[])427 static int nfnl_cthelper_new(struct sk_buff *skb, const struct nfnl_info *info,
428 const struct nlattr * const tb[])
429 {
430 const char *helper_name;
431 struct nf_conntrack_helper *cur, *helper = NULL;
432 struct nf_conntrack_tuple tuple;
433 struct nfnl_cthelper *nlcth;
434 int ret = 0;
435
436 if (!capable(CAP_NET_ADMIN))
437 return -EPERM;
438
439 if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
440 return -EINVAL;
441
442 helper_name = nla_data(tb[NFCTH_NAME]);
443
444 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
445 if (ret < 0)
446 return ret;
447
448 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
449 cur = nlcth->helper;
450
451 if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
452 continue;
453
454 if ((tuple.src.l3num != cur->tuple.src.l3num ||
455 tuple.dst.protonum != cur->tuple.dst.protonum))
456 continue;
457
458 if (info->nlh->nlmsg_flags & NLM_F_EXCL)
459 return -EEXIST;
460
461 helper = cur;
462 break;
463 }
464
465 if (helper == NULL)
466 ret = nfnl_cthelper_create(tb, &tuple);
467 else
468 ret = nfnl_cthelper_update(tb, helper);
469
470 return ret;
471 }
472
473 static int
nfnl_cthelper_dump_tuple(struct sk_buff * skb,struct nf_conntrack_helper * helper)474 nfnl_cthelper_dump_tuple(struct sk_buff *skb,
475 struct nf_conntrack_helper *helper)
476 {
477 struct nlattr *nest_parms;
478
479 nest_parms = nla_nest_start(skb, NFCTH_TUPLE);
480 if (nest_parms == NULL)
481 goto nla_put_failure;
482
483 if (nla_put_be16(skb, NFCTH_TUPLE_L3PROTONUM,
484 htons(helper->tuple.src.l3num)))
485 goto nla_put_failure;
486
487 if (nla_put_u8(skb, NFCTH_TUPLE_L4PROTONUM, helper->tuple.dst.protonum))
488 goto nla_put_failure;
489
490 nla_nest_end(skb, nest_parms);
491 return 0;
492
493 nla_put_failure:
494 return -1;
495 }
496
497 static int
nfnl_cthelper_dump_policy(struct sk_buff * skb,struct nf_conntrack_helper * helper)498 nfnl_cthelper_dump_policy(struct sk_buff *skb,
499 struct nf_conntrack_helper *helper)
500 {
501 int i;
502 struct nlattr *nest_parms1, *nest_parms2;
503
504 nest_parms1 = nla_nest_start(skb, NFCTH_POLICY);
505 if (nest_parms1 == NULL)
506 goto nla_put_failure;
507
508 if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
509 htonl(helper->expect_class_max + 1)))
510 goto nla_put_failure;
511
512 for (i = 0; i < helper->expect_class_max + 1; i++) {
513 nest_parms2 = nla_nest_start(skb, (NFCTH_POLICY_SET + i));
514 if (nest_parms2 == NULL)
515 goto nla_put_failure;
516
517 if (nla_put_string(skb, NFCTH_POLICY_NAME,
518 helper->expect_policy[i].name))
519 goto nla_put_failure;
520
521 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_MAX,
522 htonl(helper->expect_policy[i].max_expected)))
523 goto nla_put_failure;
524
525 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_TIMEOUT,
526 htonl(helper->expect_policy[i].timeout)))
527 goto nla_put_failure;
528
529 nla_nest_end(skb, nest_parms2);
530 }
531 nla_nest_end(skb, nest_parms1);
532 return 0;
533
534 nla_put_failure:
535 return -1;
536 }
537
538 static int
nfnl_cthelper_fill_info(struct sk_buff * skb,u32 portid,u32 seq,u32 type,int event,struct nf_conntrack_helper * helper)539 nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
540 int event, struct nf_conntrack_helper *helper)
541 {
542 unsigned int flags = portid ? NLM_F_MULTI : 0;
543 struct nlmsghdr *nlh;
544 int status;
545
546 event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event);
547 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
548 NFNETLINK_V0, 0);
549 if (!nlh)
550 goto nlmsg_failure;
551
552 if (nla_put_string(skb, NFCTH_NAME, helper->name))
553 goto nla_put_failure;
554
555 if (nla_put_be32(skb, NFCTH_QUEUE_NUM, htonl(helper->queue_num)))
556 goto nla_put_failure;
557
558 if (nfnl_cthelper_dump_tuple(skb, helper) < 0)
559 goto nla_put_failure;
560
561 if (nfnl_cthelper_dump_policy(skb, helper) < 0)
562 goto nla_put_failure;
563
564 if (nla_put_be32(skb, NFCTH_PRIV_DATA_LEN, htonl(helper->data_len)))
565 goto nla_put_failure;
566
567 if (READ_ONCE(helper->flags) & NF_CT_HELPER_F_CONFIGURED)
568 status = NFCT_HELPER_STATUS_ENABLED;
569 else
570 status = NFCT_HELPER_STATUS_DISABLED;
571
572 if (nla_put_be32(skb, NFCTH_STATUS, htonl(status)))
573 goto nla_put_failure;
574
575 nlmsg_end(skb, nlh);
576 return skb->len;
577
578 nlmsg_failure:
579 nla_put_failure:
580 nlmsg_cancel(skb, nlh);
581 return -1;
582 }
583
584 static int
nfnl_cthelper_dump_table(struct sk_buff * skb,struct netlink_callback * cb)585 nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
586 {
587 struct nf_conntrack_helper *cur, *last;
588 unsigned int helper_flags;
589
590 rcu_read_lock();
591 last = (struct nf_conntrack_helper *)cb->args[1];
592 for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) {
593 restart:
594 hlist_for_each_entry_rcu(cur,
595 &nf_ct_helper_hash[cb->args[0]], hnode) {
596
597 helper_flags = READ_ONCE(cur->flags);
598
599 /* skip non-userspace conntrack helpers. */
600 if (!(helper_flags & NF_CT_HELPER_F_USERSPACE))
601 continue;
602
603 if (cb->args[1]) {
604 if (cur != last)
605 continue;
606 cb->args[1] = 0;
607 }
608 if (nfnl_cthelper_fill_info(skb,
609 NETLINK_CB(cb->skb).portid,
610 cb->nlh->nlmsg_seq,
611 NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
612 NFNL_MSG_CTHELPER_NEW, cur) < 0) {
613 cb->args[1] = (unsigned long)cur;
614 goto out;
615 }
616 }
617 if (cb->args[1]) {
618 cb->args[1] = 0;
619 goto restart;
620 }
621 }
622 out:
623 rcu_read_unlock();
624 return skb->len;
625 }
626
nfnl_cthelper_get(struct sk_buff * skb,const struct nfnl_info * info,const struct nlattr * const tb[])627 static int nfnl_cthelper_get(struct sk_buff *skb, const struct nfnl_info *info,
628 const struct nlattr * const tb[])
629 {
630 int ret = -ENOENT;
631 struct nf_conntrack_helper *cur;
632 struct sk_buff *skb2;
633 char *helper_name = NULL;
634 struct nf_conntrack_tuple tuple;
635 struct nfnl_cthelper *nlcth;
636 bool tuple_set = false;
637
638 if (!capable(CAP_NET_ADMIN))
639 return -EPERM;
640
641 if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
642 struct netlink_dump_control c = {
643 .dump = nfnl_cthelper_dump_table,
644 };
645 return netlink_dump_start(info->sk, skb, info->nlh, &c);
646 }
647
648 if (tb[NFCTH_NAME])
649 helper_name = nla_data(tb[NFCTH_NAME]);
650
651 if (tb[NFCTH_TUPLE]) {
652 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
653 if (ret < 0)
654 return ret;
655
656 tuple_set = true;
657 }
658
659 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
660 cur = nlcth->helper;
661 if (helper_name &&
662 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
663 continue;
664
665 if (tuple_set &&
666 (tuple.src.l3num != cur->tuple.src.l3num ||
667 tuple.dst.protonum != cur->tuple.dst.protonum))
668 continue;
669
670 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
671 if (skb2 == NULL) {
672 ret = -ENOMEM;
673 break;
674 }
675
676 ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
677 info->nlh->nlmsg_seq,
678 NFNL_MSG_TYPE(info->nlh->nlmsg_type),
679 NFNL_MSG_CTHELPER_NEW, cur);
680 if (ret <= 0) {
681 kfree_skb(skb2);
682 break;
683 }
684
685 ret = nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid);
686 break;
687 }
688
689 return ret;
690 }
691
nfnl_cthelper_del(struct sk_buff * skb,const struct nfnl_info * info,const struct nlattr * const tb[])692 static int nfnl_cthelper_del(struct sk_buff *skb, const struct nfnl_info *info,
693 const struct nlattr * const tb[])
694 {
695 char *helper_name = NULL;
696 struct nf_conntrack_helper *cur;
697 struct nf_conntrack_tuple tuple;
698 bool tuple_set = false, found = false;
699 struct nfnl_cthelper *nlcth, *n;
700 int j = 0, ret;
701
702 if (!capable(CAP_NET_ADMIN))
703 return -EPERM;
704
705 if (tb[NFCTH_NAME])
706 helper_name = nla_data(tb[NFCTH_NAME]);
707
708 if (tb[NFCTH_TUPLE]) {
709 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
710 if (ret < 0)
711 return ret;
712
713 tuple_set = true;
714 }
715
716 ret = -ENOENT;
717 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
718 cur = nlcth->helper;
719 j++;
720
721 if (helper_name &&
722 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
723 continue;
724
725 if (tuple_set &&
726 (tuple.src.l3num != cur->tuple.src.l3num ||
727 tuple.dst.protonum != cur->tuple.dst.protonum))
728 continue;
729
730 found = true;
731 nf_conntrack_helper_unregister(cur);
732
733 list_del(&nlcth->list);
734 kfree(nlcth);
735 }
736
737 /* Make sure we return success if we flush and there is no helpers */
738 return (found || j == 0) ? 0 : ret;
739 }
740
741 static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
742 [NFCTH_NAME] = { .type = NLA_NUL_STRING,
743 .len = NF_CT_HELPER_NAME_LEN-1 },
744 [NFCTH_QUEUE_NUM] = { .type = NLA_U32, },
745 [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, },
746 [NFCTH_STATUS] = { .type = NLA_U32, },
747 };
748
749 static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = {
750 [NFNL_MSG_CTHELPER_NEW] = {
751 .call = nfnl_cthelper_new,
752 .type = NFNL_CB_MUTEX,
753 .attr_count = NFCTH_MAX,
754 .policy = nfnl_cthelper_policy
755 },
756 [NFNL_MSG_CTHELPER_GET] = {
757 .call = nfnl_cthelper_get,
758 .type = NFNL_CB_MUTEX,
759 .attr_count = NFCTH_MAX,
760 .policy = nfnl_cthelper_policy
761 },
762 [NFNL_MSG_CTHELPER_DEL] = {
763 .call = nfnl_cthelper_del,
764 .type = NFNL_CB_MUTEX,
765 .attr_count = NFCTH_MAX,
766 .policy = nfnl_cthelper_policy
767 },
768 };
769
770 static const struct nfnetlink_subsystem nfnl_cthelper_subsys = {
771 .name = "cthelper",
772 .subsys_id = NFNL_SUBSYS_CTHELPER,
773 .cb_count = NFNL_MSG_CTHELPER_MAX,
774 .cb = nfnl_cthelper_cb,
775 };
776
777 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER);
778
nfnl_cthelper_init(void)779 static int __init nfnl_cthelper_init(void)
780 {
781 int ret;
782
783 ret = nfnetlink_subsys_register(&nfnl_cthelper_subsys);
784 if (ret < 0) {
785 pr_err("nfnl_cthelper: cannot register with nfnetlink.\n");
786 goto err_out;
787 }
788 return 0;
789 err_out:
790 return ret;
791 }
792
nfnl_cthelper_exit(void)793 static void __exit nfnl_cthelper_exit(void)
794 {
795 struct nf_conntrack_helper *cur;
796 struct nfnl_cthelper *nlcth, *n;
797
798 nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
799
800 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
801 cur = nlcth->helper;
802
803 nf_conntrack_helper_unregister(cur);
804 kfree(nlcth);
805 }
806 }
807
808 module_init(nfnl_cthelper_init);
809 module_exit(nfnl_cthelper_exit);
810