1 /* Connection tracking via netlink socket. Allows for user space 2 * protocol helpers and general trouble making from userspace. 3 * 4 * (C) 2001 by Jay Schulist <jschlst@samba.org> 5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org> 6 * (C) 2003 by Patrick Mchardy <kaber@trash.net> 7 * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org> 8 * 9 * Initial connection tracking via netlink development funded and 10 * generally made possible by Network Robots, Inc. (www.networkrobots.com) 11 * 12 * Further development of this code funded by Astaro AG (http://www.astaro.com) 13 * 14 * This software may be used and distributed according to the terms 15 * of the GNU General Public License, incorporated herein by reference. 16 */ 17 18 #include <linux/init.h> 19 #include <linux/module.h> 20 #include <linux/kernel.h> 21 #include <linux/rculist.h> 22 #include <linux/rculist_nulls.h> 23 #include <linux/types.h> 24 #include <linux/timer.h> 25 #include <linux/security.h> 26 #include <linux/skbuff.h> 27 #include <linux/errno.h> 28 #include <linux/netlink.h> 29 #include <linux/spinlock.h> 30 #include <linux/interrupt.h> 31 #include <linux/slab.h> 32 #include <linux/siphash.h> 33 34 #include <linux/netfilter.h> 35 #include <net/netlink.h> 36 #include <net/sock.h> 37 #include <net/netfilter/nf_conntrack.h> 38 #include <net/netfilter/nf_conntrack_core.h> 39 #include <net/netfilter/nf_conntrack_expect.h> 40 #include <net/netfilter/nf_conntrack_helper.h> 41 #include <net/netfilter/nf_conntrack_seqadj.h> 42 #include <net/netfilter/nf_conntrack_l4proto.h> 43 #include <net/netfilter/nf_conntrack_tuple.h> 44 #include <net/netfilter/nf_conntrack_acct.h> 45 #include <net/netfilter/nf_conntrack_zones.h> 46 #include <net/netfilter/nf_conntrack_timestamp.h> 47 #include <net/netfilter/nf_conntrack_labels.h> 48 #include <net/netfilter/nf_conntrack_synproxy.h> 49 #if IS_ENABLED(CONFIG_NF_NAT) 50 #include <net/netfilter/nf_nat.h> 51 #include <net/netfilter/nf_nat_helper.h> 52 #endif 53 54 #include <linux/netfilter/nfnetlink.h> 55 #include <linux/netfilter/nfnetlink_conntrack.h> 56 57 #include "nf_internals.h" 58 59 MODULE_LICENSE("GPL"); 60 61 struct ctnetlink_list_dump_ctx { 62 struct nf_conn *last; 63 unsigned int cpu; 64 bool done; 65 }; 66 67 static int ctnetlink_dump_tuples_proto(struct sk_buff *skb, 68 const struct nf_conntrack_tuple *tuple, 69 const struct nf_conntrack_l4proto *l4proto) 70 { 71 int ret = 0; 72 struct nlattr *nest_parms; 73 74 nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO); 75 if (!nest_parms) 76 goto nla_put_failure; 77 if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum)) 78 goto nla_put_failure; 79 80 if (likely(l4proto->tuple_to_nlattr)) 81 ret = l4proto->tuple_to_nlattr(skb, tuple); 82 83 nla_nest_end(skb, nest_parms); 84 85 return ret; 86 87 nla_put_failure: 88 return -1; 89 } 90 91 static int ipv4_tuple_to_nlattr(struct sk_buff *skb, 92 const struct nf_conntrack_tuple *tuple) 93 { 94 if (nla_put_in_addr(skb, CTA_IP_V4_SRC, tuple->src.u3.ip) || 95 nla_put_in_addr(skb, CTA_IP_V4_DST, tuple->dst.u3.ip)) 96 return -EMSGSIZE; 97 return 0; 98 } 99 100 static int ipv6_tuple_to_nlattr(struct sk_buff *skb, 101 const struct nf_conntrack_tuple *tuple) 102 { 103 if (nla_put_in6_addr(skb, CTA_IP_V6_SRC, &tuple->src.u3.in6) || 104 nla_put_in6_addr(skb, CTA_IP_V6_DST, &tuple->dst.u3.in6)) 105 return -EMSGSIZE; 106 return 0; 107 } 108 109 static int ctnetlink_dump_tuples_ip(struct sk_buff *skb, 110 const struct nf_conntrack_tuple *tuple) 111 { 112 int ret = 0; 113 struct nlattr *nest_parms; 114 115 nest_parms = nla_nest_start(skb, CTA_TUPLE_IP); 116 if (!nest_parms) 117 goto nla_put_failure; 118 119 switch (tuple->src.l3num) { 120 case NFPROTO_IPV4: 121 ret = ipv4_tuple_to_nlattr(skb, tuple); 122 break; 123 case NFPROTO_IPV6: 124 ret = ipv6_tuple_to_nlattr(skb, tuple); 125 break; 126 } 127 128 nla_nest_end(skb, nest_parms); 129 130 return ret; 131 132 nla_put_failure: 133 return -1; 134 } 135 136 static int ctnetlink_dump_tuples(struct sk_buff *skb, 137 const struct nf_conntrack_tuple *tuple) 138 { 139 const struct nf_conntrack_l4proto *l4proto; 140 int ret; 141 142 rcu_read_lock(); 143 ret = ctnetlink_dump_tuples_ip(skb, tuple); 144 145 if (ret >= 0) { 146 l4proto = nf_ct_l4proto_find(tuple->dst.protonum); 147 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto); 148 } 149 rcu_read_unlock(); 150 return ret; 151 } 152 153 static int ctnetlink_dump_zone_id(struct sk_buff *skb, int attrtype, 154 const struct nf_conntrack_zone *zone, int dir) 155 { 156 if (zone->id == NF_CT_DEFAULT_ZONE_ID || zone->dir != dir) 157 return 0; 158 if (nla_put_be16(skb, attrtype, htons(zone->id))) 159 goto nla_put_failure; 160 return 0; 161 162 nla_put_failure: 163 return -1; 164 } 165 166 static int ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct) 167 { 168 if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status))) 169 goto nla_put_failure; 170 return 0; 171 172 nla_put_failure: 173 return -1; 174 } 175 176 static int ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct, 177 bool skip_zero) 178 { 179 long timeout = nf_ct_expires(ct) / HZ; 180 181 if (skip_zero && timeout == 0) 182 return 0; 183 184 if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout))) 185 goto nla_put_failure; 186 return 0; 187 188 nla_put_failure: 189 return -1; 190 } 191 192 static int ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct, 193 bool destroy) 194 { 195 const struct nf_conntrack_l4proto *l4proto; 196 struct nlattr *nest_proto; 197 int ret; 198 199 l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct)); 200 if (!l4proto->to_nlattr) 201 return 0; 202 203 nest_proto = nla_nest_start(skb, CTA_PROTOINFO); 204 if (!nest_proto) 205 goto nla_put_failure; 206 207 ret = l4proto->to_nlattr(skb, nest_proto, ct, destroy); 208 209 nla_nest_end(skb, nest_proto); 210 211 return ret; 212 213 nla_put_failure: 214 return -1; 215 } 216 217 static int ctnetlink_dump_helpinfo(struct sk_buff *skb, 218 const struct nf_conn *ct) 219 { 220 struct nlattr *nest_helper; 221 const struct nf_conn_help *help = nfct_help(ct); 222 struct nf_conntrack_helper *helper; 223 224 if (!help) 225 return 0; 226 227 rcu_read_lock(); 228 helper = rcu_dereference(help->helper); 229 if (!helper) 230 goto out; 231 232 nest_helper = nla_nest_start(skb, CTA_HELP); 233 if (!nest_helper) 234 goto nla_put_failure; 235 if (nla_put_string(skb, CTA_HELP_NAME, helper->name)) 236 goto nla_put_failure; 237 238 if (helper->to_nlattr) 239 helper->to_nlattr(skb, ct); 240 241 nla_nest_end(skb, nest_helper); 242 out: 243 rcu_read_unlock(); 244 return 0; 245 246 nla_put_failure: 247 rcu_read_unlock(); 248 return -1; 249 } 250 251 static int 252 dump_counters(struct sk_buff *skb, struct nf_conn_acct *acct, 253 enum ip_conntrack_dir dir, int type) 254 { 255 enum ctattr_type attr = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG; 256 struct nf_conn_counter *counter = acct->counter; 257 struct nlattr *nest_count; 258 u64 pkts, bytes; 259 260 if (type == IPCTNL_MSG_CT_GET_CTRZERO) { 261 pkts = atomic64_xchg(&counter[dir].packets, 0); 262 bytes = atomic64_xchg(&counter[dir].bytes, 0); 263 } else { 264 pkts = atomic64_read(&counter[dir].packets); 265 bytes = atomic64_read(&counter[dir].bytes); 266 } 267 268 nest_count = nla_nest_start(skb, attr); 269 if (!nest_count) 270 goto nla_put_failure; 271 272 if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts), 273 CTA_COUNTERS_PAD) || 274 nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes), 275 CTA_COUNTERS_PAD)) 276 goto nla_put_failure; 277 278 nla_nest_end(skb, nest_count); 279 280 return 0; 281 282 nla_put_failure: 283 return -1; 284 } 285 286 static int 287 ctnetlink_dump_acct(struct sk_buff *skb, const struct nf_conn *ct, int type) 288 { 289 struct nf_conn_acct *acct = nf_conn_acct_find(ct); 290 291 if (!acct) 292 return 0; 293 294 if (dump_counters(skb, acct, IP_CT_DIR_ORIGINAL, type) < 0) 295 return -1; 296 if (dump_counters(skb, acct, IP_CT_DIR_REPLY, type) < 0) 297 return -1; 298 299 return 0; 300 } 301 302 static int 303 ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct) 304 { 305 struct nlattr *nest_count; 306 const struct nf_conn_tstamp *tstamp; 307 308 tstamp = nf_conn_tstamp_find(ct); 309 if (!tstamp) 310 return 0; 311 312 nest_count = nla_nest_start(skb, CTA_TIMESTAMP); 313 if (!nest_count) 314 goto nla_put_failure; 315 316 if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start), 317 CTA_TIMESTAMP_PAD) || 318 (tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP, 319 cpu_to_be64(tstamp->stop), 320 CTA_TIMESTAMP_PAD))) 321 goto nla_put_failure; 322 nla_nest_end(skb, nest_count); 323 324 return 0; 325 326 nla_put_failure: 327 return -1; 328 } 329 330 #ifdef CONFIG_NF_CONNTRACK_MARK 331 static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct) 332 { 333 if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark))) 334 goto nla_put_failure; 335 return 0; 336 337 nla_put_failure: 338 return -1; 339 } 340 #else 341 #define ctnetlink_dump_mark(a, b) (0) 342 #endif 343 344 #ifdef CONFIG_NF_CONNTRACK_SECMARK 345 static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) 346 { 347 struct nlattr *nest_secctx; 348 int len, ret; 349 char *secctx; 350 351 ret = security_secid_to_secctx(ct->secmark, &secctx, &len); 352 if (ret) 353 return 0; 354 355 ret = -1; 356 nest_secctx = nla_nest_start(skb, CTA_SECCTX); 357 if (!nest_secctx) 358 goto nla_put_failure; 359 360 if (nla_put_string(skb, CTA_SECCTX_NAME, secctx)) 361 goto nla_put_failure; 362 nla_nest_end(skb, nest_secctx); 363 364 ret = 0; 365 nla_put_failure: 366 security_release_secctx(secctx, len); 367 return ret; 368 } 369 #else 370 #define ctnetlink_dump_secctx(a, b) (0) 371 #endif 372 373 #ifdef CONFIG_NF_CONNTRACK_LABELS 374 static inline int ctnetlink_label_size(const struct nf_conn *ct) 375 { 376 struct nf_conn_labels *labels = nf_ct_labels_find(ct); 377 378 if (!labels) 379 return 0; 380 return nla_total_size(sizeof(labels->bits)); 381 } 382 383 static int 384 ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct) 385 { 386 struct nf_conn_labels *labels = nf_ct_labels_find(ct); 387 unsigned int i; 388 389 if (!labels) 390 return 0; 391 392 i = 0; 393 do { 394 if (labels->bits[i] != 0) 395 return nla_put(skb, CTA_LABELS, sizeof(labels->bits), 396 labels->bits); 397 i++; 398 } while (i < ARRAY_SIZE(labels->bits)); 399 400 return 0; 401 } 402 #else 403 #define ctnetlink_dump_labels(a, b) (0) 404 #define ctnetlink_label_size(a) (0) 405 #endif 406 407 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple) 408 409 static int ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct) 410 { 411 struct nlattr *nest_parms; 412 413 if (!(ct->status & IPS_EXPECTED)) 414 return 0; 415 416 nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER); 417 if (!nest_parms) 418 goto nla_put_failure; 419 if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0) 420 goto nla_put_failure; 421 nla_nest_end(skb, nest_parms); 422 423 return 0; 424 425 nla_put_failure: 426 return -1; 427 } 428 429 static int 430 dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type) 431 { 432 struct nlattr *nest_parms; 433 434 nest_parms = nla_nest_start(skb, type); 435 if (!nest_parms) 436 goto nla_put_failure; 437 438 if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS, 439 htonl(seq->correction_pos)) || 440 nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE, 441 htonl(seq->offset_before)) || 442 nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER, 443 htonl(seq->offset_after))) 444 goto nla_put_failure; 445 446 nla_nest_end(skb, nest_parms); 447 448 return 0; 449 450 nla_put_failure: 451 return -1; 452 } 453 454 static int ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, struct nf_conn *ct) 455 { 456 struct nf_conn_seqadj *seqadj = nfct_seqadj(ct); 457 struct nf_ct_seqadj *seq; 458 459 if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj) 460 return 0; 461 462 spin_lock_bh(&ct->lock); 463 seq = &seqadj->seq[IP_CT_DIR_ORIGINAL]; 464 if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1) 465 goto err; 466 467 seq = &seqadj->seq[IP_CT_DIR_REPLY]; 468 if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1) 469 goto err; 470 471 spin_unlock_bh(&ct->lock); 472 return 0; 473 err: 474 spin_unlock_bh(&ct->lock); 475 return -1; 476 } 477 478 static int ctnetlink_dump_ct_synproxy(struct sk_buff *skb, struct nf_conn *ct) 479 { 480 struct nf_conn_synproxy *synproxy = nfct_synproxy(ct); 481 struct nlattr *nest_parms; 482 483 if (!synproxy) 484 return 0; 485 486 nest_parms = nla_nest_start(skb, CTA_SYNPROXY); 487 if (!nest_parms) 488 goto nla_put_failure; 489 490 if (nla_put_be32(skb, CTA_SYNPROXY_ISN, htonl(synproxy->isn)) || 491 nla_put_be32(skb, CTA_SYNPROXY_ITS, htonl(synproxy->its)) || 492 nla_put_be32(skb, CTA_SYNPROXY_TSOFF, htonl(synproxy->tsoff))) 493 goto nla_put_failure; 494 495 nla_nest_end(skb, nest_parms); 496 497 return 0; 498 499 nla_put_failure: 500 return -1; 501 } 502 503 static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct) 504 { 505 __be32 id = (__force __be32)nf_ct_get_id(ct); 506 507 if (nla_put_be32(skb, CTA_ID, id)) 508 goto nla_put_failure; 509 return 0; 510 511 nla_put_failure: 512 return -1; 513 } 514 515 static int ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct) 516 { 517 if (nla_put_be32(skb, CTA_USE, htonl(refcount_read(&ct->ct_general.use)))) 518 goto nla_put_failure; 519 return 0; 520 521 nla_put_failure: 522 return -1; 523 } 524 525 /* all these functions access ct->ext. Caller must either hold a reference 526 * on ct or prevent its deletion by holding either the bucket spinlock or 527 * pcpu dying list lock. 528 */ 529 static int ctnetlink_dump_extinfo(struct sk_buff *skb, 530 struct nf_conn *ct, u32 type) 531 { 532 if (ctnetlink_dump_acct(skb, ct, type) < 0 || 533 ctnetlink_dump_timestamp(skb, ct) < 0 || 534 ctnetlink_dump_helpinfo(skb, ct) < 0 || 535 ctnetlink_dump_labels(skb, ct) < 0 || 536 ctnetlink_dump_ct_seq_adj(skb, ct) < 0 || 537 ctnetlink_dump_ct_synproxy(skb, ct) < 0) 538 return -1; 539 540 return 0; 541 } 542 543 static int ctnetlink_dump_info(struct sk_buff *skb, struct nf_conn *ct) 544 { 545 if (ctnetlink_dump_status(skb, ct) < 0 || 546 ctnetlink_dump_mark(skb, ct) < 0 || 547 ctnetlink_dump_secctx(skb, ct) < 0 || 548 ctnetlink_dump_id(skb, ct) < 0 || 549 ctnetlink_dump_use(skb, ct) < 0 || 550 ctnetlink_dump_master(skb, ct) < 0) 551 return -1; 552 553 if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) && 554 (ctnetlink_dump_timeout(skb, ct, false) < 0 || 555 ctnetlink_dump_protoinfo(skb, ct, false) < 0)) 556 return -1; 557 558 return 0; 559 } 560 561 static int 562 ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, 563 struct nf_conn *ct, bool extinfo, unsigned int flags) 564 { 565 const struct nf_conntrack_zone *zone; 566 struct nlmsghdr *nlh; 567 struct nlattr *nest_parms; 568 unsigned int event; 569 570 if (portid) 571 flags |= NLM_F_MULTI; 572 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW); 573 nlh = nfnl_msg_put(skb, portid, seq, event, flags, nf_ct_l3num(ct), 574 NFNETLINK_V0, 0); 575 if (!nlh) 576 goto nlmsg_failure; 577 578 zone = nf_ct_zone(ct); 579 580 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); 581 if (!nest_parms) 582 goto nla_put_failure; 583 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0) 584 goto nla_put_failure; 585 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 586 NF_CT_ZONE_DIR_ORIG) < 0) 587 goto nla_put_failure; 588 nla_nest_end(skb, nest_parms); 589 590 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY); 591 if (!nest_parms) 592 goto nla_put_failure; 593 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0) 594 goto nla_put_failure; 595 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 596 NF_CT_ZONE_DIR_REPL) < 0) 597 goto nla_put_failure; 598 nla_nest_end(skb, nest_parms); 599 600 if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone, 601 NF_CT_DEFAULT_ZONE_DIR) < 0) 602 goto nla_put_failure; 603 604 if (ctnetlink_dump_info(skb, ct) < 0) 605 goto nla_put_failure; 606 if (extinfo && ctnetlink_dump_extinfo(skb, ct, type) < 0) 607 goto nla_put_failure; 608 609 nlmsg_end(skb, nlh); 610 return skb->len; 611 612 nlmsg_failure: 613 nla_put_failure: 614 nlmsg_cancel(skb, nlh); 615 return -1; 616 } 617 618 static const struct nla_policy cta_ip_nla_policy[CTA_IP_MAX + 1] = { 619 [CTA_IP_V4_SRC] = { .type = NLA_U32 }, 620 [CTA_IP_V4_DST] = { .type = NLA_U32 }, 621 [CTA_IP_V6_SRC] = { .len = sizeof(__be32) * 4 }, 622 [CTA_IP_V6_DST] = { .len = sizeof(__be32) * 4 }, 623 }; 624 625 #if defined(CONFIG_NETFILTER_NETLINK_GLUE_CT) || defined(CONFIG_NF_CONNTRACK_EVENTS) 626 static size_t ctnetlink_proto_size(const struct nf_conn *ct) 627 { 628 const struct nf_conntrack_l4proto *l4proto; 629 size_t len, len4 = 0; 630 631 len = nla_policy_len(cta_ip_nla_policy, CTA_IP_MAX + 1); 632 len *= 3u; /* ORIG, REPLY, MASTER */ 633 634 l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct)); 635 len += l4proto->nlattr_size; 636 if (l4proto->nlattr_tuple_size) { 637 len4 = l4proto->nlattr_tuple_size(); 638 len4 *= 3u; /* ORIG, REPLY, MASTER */ 639 } 640 641 return len + len4; 642 } 643 #endif 644 645 static inline size_t ctnetlink_acct_size(const struct nf_conn *ct) 646 { 647 if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT)) 648 return 0; 649 return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */ 650 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */ 651 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */ 652 ; 653 } 654 655 static inline int ctnetlink_secctx_size(const struct nf_conn *ct) 656 { 657 #ifdef CONFIG_NF_CONNTRACK_SECMARK 658 int len, ret; 659 660 ret = security_secid_to_secctx(ct->secmark, NULL, &len); 661 if (ret) 662 return 0; 663 664 return nla_total_size(0) /* CTA_SECCTX */ 665 + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */ 666 #else 667 return 0; 668 #endif 669 } 670 671 static inline size_t ctnetlink_timestamp_size(const struct nf_conn *ct) 672 { 673 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP 674 if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP)) 675 return 0; 676 return nla_total_size(0) + 2 * nla_total_size_64bit(sizeof(uint64_t)); 677 #else 678 return 0; 679 #endif 680 } 681 682 #ifdef CONFIG_NF_CONNTRACK_EVENTS 683 static size_t ctnetlink_nlmsg_size(const struct nf_conn *ct) 684 { 685 return NLMSG_ALIGN(sizeof(struct nfgenmsg)) 686 + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */ 687 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */ 688 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */ 689 + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */ 690 + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */ 691 + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */ 692 + ctnetlink_acct_size(ct) 693 + ctnetlink_timestamp_size(ct) 694 + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */ 695 + nla_total_size(0) /* CTA_PROTOINFO */ 696 + nla_total_size(0) /* CTA_HELP */ 697 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ 698 + ctnetlink_secctx_size(ct) 699 #if IS_ENABLED(CONFIG_NF_NAT) 700 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ 701 + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ 702 #endif 703 #ifdef CONFIG_NF_CONNTRACK_MARK 704 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */ 705 #endif 706 #ifdef CONFIG_NF_CONNTRACK_ZONES 707 + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE|CTA_TUPLE_ZONE */ 708 #endif 709 + ctnetlink_proto_size(ct) 710 + ctnetlink_label_size(ct) 711 ; 712 } 713 714 static int 715 ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item) 716 { 717 const struct nf_conntrack_zone *zone; 718 struct net *net; 719 struct nlmsghdr *nlh; 720 struct nlattr *nest_parms; 721 struct nf_conn *ct = item->ct; 722 struct sk_buff *skb; 723 unsigned int type; 724 unsigned int flags = 0, group; 725 int err; 726 727 if (events & (1 << IPCT_DESTROY)) { 728 type = IPCTNL_MSG_CT_DELETE; 729 group = NFNLGRP_CONNTRACK_DESTROY; 730 } else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) { 731 type = IPCTNL_MSG_CT_NEW; 732 flags = NLM_F_CREATE|NLM_F_EXCL; 733 group = NFNLGRP_CONNTRACK_NEW; 734 } else if (events) { 735 type = IPCTNL_MSG_CT_NEW; 736 group = NFNLGRP_CONNTRACK_UPDATE; 737 } else 738 return 0; 739 740 net = nf_ct_net(ct); 741 if (!item->report && !nfnetlink_has_listeners(net, group)) 742 return 0; 743 744 skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC); 745 if (skb == NULL) 746 goto errout; 747 748 type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type); 749 nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, nf_ct_l3num(ct), 750 NFNETLINK_V0, 0); 751 if (!nlh) 752 goto nlmsg_failure; 753 754 zone = nf_ct_zone(ct); 755 756 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); 757 if (!nest_parms) 758 goto nla_put_failure; 759 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0) 760 goto nla_put_failure; 761 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 762 NF_CT_ZONE_DIR_ORIG) < 0) 763 goto nla_put_failure; 764 nla_nest_end(skb, nest_parms); 765 766 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY); 767 if (!nest_parms) 768 goto nla_put_failure; 769 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0) 770 goto nla_put_failure; 771 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 772 NF_CT_ZONE_DIR_REPL) < 0) 773 goto nla_put_failure; 774 nla_nest_end(skb, nest_parms); 775 776 if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone, 777 NF_CT_DEFAULT_ZONE_DIR) < 0) 778 goto nla_put_failure; 779 780 if (ctnetlink_dump_id(skb, ct) < 0) 781 goto nla_put_failure; 782 783 if (ctnetlink_dump_status(skb, ct) < 0) 784 goto nla_put_failure; 785 786 if (events & (1 << IPCT_DESTROY)) { 787 if (ctnetlink_dump_timeout(skb, ct, true) < 0) 788 goto nla_put_failure; 789 790 if (ctnetlink_dump_acct(skb, ct, type) < 0 || 791 ctnetlink_dump_timestamp(skb, ct) < 0 || 792 ctnetlink_dump_protoinfo(skb, ct, true) < 0) 793 goto nla_put_failure; 794 } else { 795 if (ctnetlink_dump_timeout(skb, ct, false) < 0) 796 goto nla_put_failure; 797 798 if (events & (1 << IPCT_PROTOINFO) && 799 ctnetlink_dump_protoinfo(skb, ct, false) < 0) 800 goto nla_put_failure; 801 802 if ((events & (1 << IPCT_HELPER) || nfct_help(ct)) 803 && ctnetlink_dump_helpinfo(skb, ct) < 0) 804 goto nla_put_failure; 805 806 #ifdef CONFIG_NF_CONNTRACK_SECMARK 807 if ((events & (1 << IPCT_SECMARK) || ct->secmark) 808 && ctnetlink_dump_secctx(skb, ct) < 0) 809 goto nla_put_failure; 810 #endif 811 if (events & (1 << IPCT_LABEL) && 812 ctnetlink_dump_labels(skb, ct) < 0) 813 goto nla_put_failure; 814 815 if (events & (1 << IPCT_RELATED) && 816 ctnetlink_dump_master(skb, ct) < 0) 817 goto nla_put_failure; 818 819 if (events & (1 << IPCT_SEQADJ) && 820 ctnetlink_dump_ct_seq_adj(skb, ct) < 0) 821 goto nla_put_failure; 822 823 if (events & (1 << IPCT_SYNPROXY) && 824 ctnetlink_dump_ct_synproxy(skb, ct) < 0) 825 goto nla_put_failure; 826 } 827 828 #ifdef CONFIG_NF_CONNTRACK_MARK 829 if ((events & (1 << IPCT_MARK) || ct->mark) 830 && ctnetlink_dump_mark(skb, ct) < 0) 831 goto nla_put_failure; 832 #endif 833 nlmsg_end(skb, nlh); 834 err = nfnetlink_send(skb, net, item->portid, group, item->report, 835 GFP_ATOMIC); 836 if (err == -ENOBUFS || err == -EAGAIN) 837 return -ENOBUFS; 838 839 return 0; 840 841 nla_put_failure: 842 nlmsg_cancel(skb, nlh); 843 nlmsg_failure: 844 kfree_skb(skb); 845 errout: 846 if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0) 847 return -ENOBUFS; 848 849 return 0; 850 } 851 #endif /* CONFIG_NF_CONNTRACK_EVENTS */ 852 853 static int ctnetlink_done(struct netlink_callback *cb) 854 { 855 if (cb->args[1]) 856 nf_ct_put((struct nf_conn *)cb->args[1]); 857 kfree(cb->data); 858 return 0; 859 } 860 861 struct ctnetlink_filter_u32 { 862 u32 val; 863 u32 mask; 864 }; 865 866 struct ctnetlink_filter { 867 u8 family; 868 869 u_int32_t orig_flags; 870 u_int32_t reply_flags; 871 872 struct nf_conntrack_tuple orig; 873 struct nf_conntrack_tuple reply; 874 struct nf_conntrack_zone zone; 875 876 struct ctnetlink_filter_u32 mark; 877 struct ctnetlink_filter_u32 status; 878 }; 879 880 static const struct nla_policy cta_filter_nla_policy[CTA_FILTER_MAX + 1] = { 881 [CTA_FILTER_ORIG_FLAGS] = { .type = NLA_U32 }, 882 [CTA_FILTER_REPLY_FLAGS] = { .type = NLA_U32 }, 883 }; 884 885 static int ctnetlink_parse_filter(const struct nlattr *attr, 886 struct ctnetlink_filter *filter) 887 { 888 struct nlattr *tb[CTA_FILTER_MAX + 1]; 889 int ret = 0; 890 891 ret = nla_parse_nested(tb, CTA_FILTER_MAX, attr, cta_filter_nla_policy, 892 NULL); 893 if (ret) 894 return ret; 895 896 if (tb[CTA_FILTER_ORIG_FLAGS]) { 897 filter->orig_flags = nla_get_u32(tb[CTA_FILTER_ORIG_FLAGS]); 898 if (filter->orig_flags & ~CTA_FILTER_F_ALL) 899 return -EOPNOTSUPP; 900 } 901 902 if (tb[CTA_FILTER_REPLY_FLAGS]) { 903 filter->reply_flags = nla_get_u32(tb[CTA_FILTER_REPLY_FLAGS]); 904 if (filter->reply_flags & ~CTA_FILTER_F_ALL) 905 return -EOPNOTSUPP; 906 } 907 908 return 0; 909 } 910 911 static int ctnetlink_parse_zone(const struct nlattr *attr, 912 struct nf_conntrack_zone *zone); 913 static int ctnetlink_parse_tuple_filter(const struct nlattr * const cda[], 914 struct nf_conntrack_tuple *tuple, 915 u32 type, u_int8_t l3num, 916 struct nf_conntrack_zone *zone, 917 u_int32_t flags); 918 919 static int ctnetlink_filter_parse_mark(struct ctnetlink_filter_u32 *mark, 920 const struct nlattr * const cda[]) 921 { 922 #ifdef CONFIG_NF_CONNTRACK_MARK 923 if (cda[CTA_MARK]) { 924 mark->val = ntohl(nla_get_be32(cda[CTA_MARK])); 925 926 if (cda[CTA_MARK_MASK]) 927 mark->mask = ntohl(nla_get_be32(cda[CTA_MARK_MASK])); 928 else 929 mark->mask = 0xffffffff; 930 } else if (cda[CTA_MARK_MASK]) { 931 return -EINVAL; 932 } 933 #endif 934 return 0; 935 } 936 937 static int ctnetlink_filter_parse_status(struct ctnetlink_filter_u32 *status, 938 const struct nlattr * const cda[]) 939 { 940 if (cda[CTA_STATUS]) { 941 status->val = ntohl(nla_get_be32(cda[CTA_STATUS])); 942 if (cda[CTA_STATUS_MASK]) 943 status->mask = ntohl(nla_get_be32(cda[CTA_STATUS_MASK])); 944 else 945 status->mask = status->val; 946 947 /* status->val == 0? always true, else always false. */ 948 if (status->mask == 0) 949 return -EINVAL; 950 } else if (cda[CTA_STATUS_MASK]) { 951 return -EINVAL; 952 } 953 954 /* CTA_STATUS is NLA_U32, if this fires UAPI needs to be extended */ 955 BUILD_BUG_ON(__IPS_MAX_BIT >= 32); 956 return 0; 957 } 958 959 static struct ctnetlink_filter * 960 ctnetlink_alloc_filter(const struct nlattr * const cda[], u8 family) 961 { 962 struct ctnetlink_filter *filter; 963 int err; 964 965 #ifndef CONFIG_NF_CONNTRACK_MARK 966 if (cda[CTA_MARK] || cda[CTA_MARK_MASK]) 967 return ERR_PTR(-EOPNOTSUPP); 968 #endif 969 970 filter = kzalloc(sizeof(*filter), GFP_KERNEL); 971 if (filter == NULL) 972 return ERR_PTR(-ENOMEM); 973 974 filter->family = family; 975 976 err = ctnetlink_filter_parse_mark(&filter->mark, cda); 977 if (err) 978 goto err_filter; 979 980 err = ctnetlink_filter_parse_status(&filter->status, cda); 981 if (err) 982 goto err_filter; 983 984 if (!cda[CTA_FILTER]) 985 return filter; 986 987 err = ctnetlink_parse_zone(cda[CTA_ZONE], &filter->zone); 988 if (err < 0) 989 goto err_filter; 990 991 err = ctnetlink_parse_filter(cda[CTA_FILTER], filter); 992 if (err < 0) 993 goto err_filter; 994 995 if (filter->orig_flags) { 996 if (!cda[CTA_TUPLE_ORIG]) { 997 err = -EINVAL; 998 goto err_filter; 999 } 1000 1001 err = ctnetlink_parse_tuple_filter(cda, &filter->orig, 1002 CTA_TUPLE_ORIG, 1003 filter->family, 1004 &filter->zone, 1005 filter->orig_flags); 1006 if (err < 0) 1007 goto err_filter; 1008 } 1009 1010 if (filter->reply_flags) { 1011 if (!cda[CTA_TUPLE_REPLY]) { 1012 err = -EINVAL; 1013 goto err_filter; 1014 } 1015 1016 err = ctnetlink_parse_tuple_filter(cda, &filter->reply, 1017 CTA_TUPLE_REPLY, 1018 filter->family, 1019 &filter->zone, 1020 filter->reply_flags); 1021 if (err < 0) 1022 goto err_filter; 1023 } 1024 1025 return filter; 1026 1027 err_filter: 1028 kfree(filter); 1029 1030 return ERR_PTR(err); 1031 } 1032 1033 static bool ctnetlink_needs_filter(u8 family, const struct nlattr * const *cda) 1034 { 1035 return family || cda[CTA_MARK] || cda[CTA_FILTER] || cda[CTA_STATUS]; 1036 } 1037 1038 static int ctnetlink_start(struct netlink_callback *cb) 1039 { 1040 const struct nlattr * const *cda = cb->data; 1041 struct ctnetlink_filter *filter = NULL; 1042 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1043 u8 family = nfmsg->nfgen_family; 1044 1045 if (ctnetlink_needs_filter(family, cda)) { 1046 filter = ctnetlink_alloc_filter(cda, family); 1047 if (IS_ERR(filter)) 1048 return PTR_ERR(filter); 1049 } 1050 1051 cb->data = filter; 1052 return 0; 1053 } 1054 1055 static int ctnetlink_filter_match_tuple(struct nf_conntrack_tuple *filter_tuple, 1056 struct nf_conntrack_tuple *ct_tuple, 1057 u_int32_t flags, int family) 1058 { 1059 switch (family) { 1060 case NFPROTO_IPV4: 1061 if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) && 1062 filter_tuple->src.u3.ip != ct_tuple->src.u3.ip) 1063 return 0; 1064 1065 if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) && 1066 filter_tuple->dst.u3.ip != ct_tuple->dst.u3.ip) 1067 return 0; 1068 break; 1069 case NFPROTO_IPV6: 1070 if ((flags & CTA_FILTER_FLAG(CTA_IP_SRC)) && 1071 !ipv6_addr_cmp(&filter_tuple->src.u3.in6, 1072 &ct_tuple->src.u3.in6)) 1073 return 0; 1074 1075 if ((flags & CTA_FILTER_FLAG(CTA_IP_DST)) && 1076 !ipv6_addr_cmp(&filter_tuple->dst.u3.in6, 1077 &ct_tuple->dst.u3.in6)) 1078 return 0; 1079 break; 1080 } 1081 1082 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_NUM)) && 1083 filter_tuple->dst.protonum != ct_tuple->dst.protonum) 1084 return 0; 1085 1086 switch (ct_tuple->dst.protonum) { 1087 case IPPROTO_TCP: 1088 case IPPROTO_UDP: 1089 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_SRC_PORT)) && 1090 filter_tuple->src.u.tcp.port != ct_tuple->src.u.tcp.port) 1091 return 0; 1092 1093 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_DST_PORT)) && 1094 filter_tuple->dst.u.tcp.port != ct_tuple->dst.u.tcp.port) 1095 return 0; 1096 break; 1097 case IPPROTO_ICMP: 1098 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMP_TYPE)) && 1099 filter_tuple->dst.u.icmp.type != ct_tuple->dst.u.icmp.type) 1100 return 0; 1101 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMP_CODE)) && 1102 filter_tuple->dst.u.icmp.code != ct_tuple->dst.u.icmp.code) 1103 return 0; 1104 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMP_ID)) && 1105 filter_tuple->src.u.icmp.id != ct_tuple->src.u.icmp.id) 1106 return 0; 1107 break; 1108 case IPPROTO_ICMPV6: 1109 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_TYPE)) && 1110 filter_tuple->dst.u.icmp.type != ct_tuple->dst.u.icmp.type) 1111 return 0; 1112 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_CODE)) && 1113 filter_tuple->dst.u.icmp.code != ct_tuple->dst.u.icmp.code) 1114 return 0; 1115 if ((flags & CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_ID)) && 1116 filter_tuple->src.u.icmp.id != ct_tuple->src.u.icmp.id) 1117 return 0; 1118 break; 1119 } 1120 1121 return 1; 1122 } 1123 1124 static int ctnetlink_filter_match(struct nf_conn *ct, void *data) 1125 { 1126 struct ctnetlink_filter *filter = data; 1127 struct nf_conntrack_tuple *tuple; 1128 u32 status; 1129 1130 if (filter == NULL) 1131 goto out; 1132 1133 /* Match entries of a given L3 protocol number. 1134 * If it is not specified, ie. l3proto == 0, 1135 * then match everything. 1136 */ 1137 if (filter->family && nf_ct_l3num(ct) != filter->family) 1138 goto ignore_entry; 1139 1140 if (filter->orig_flags) { 1141 tuple = nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL); 1142 if (!ctnetlink_filter_match_tuple(&filter->orig, tuple, 1143 filter->orig_flags, 1144 filter->family)) 1145 goto ignore_entry; 1146 } 1147 1148 if (filter->reply_flags) { 1149 tuple = nf_ct_tuple(ct, IP_CT_DIR_REPLY); 1150 if (!ctnetlink_filter_match_tuple(&filter->reply, tuple, 1151 filter->reply_flags, 1152 filter->family)) 1153 goto ignore_entry; 1154 } 1155 1156 #ifdef CONFIG_NF_CONNTRACK_MARK 1157 if ((ct->mark & filter->mark.mask) != filter->mark.val) 1158 goto ignore_entry; 1159 #endif 1160 status = (u32)READ_ONCE(ct->status); 1161 if ((status & filter->status.mask) != filter->status.val) 1162 goto ignore_entry; 1163 1164 out: 1165 return 1; 1166 1167 ignore_entry: 1168 return 0; 1169 } 1170 1171 static int 1172 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 1173 { 1174 unsigned int flags = cb->data ? NLM_F_DUMP_FILTERED : 0; 1175 struct net *net = sock_net(skb->sk); 1176 struct nf_conn *ct, *last; 1177 struct nf_conntrack_tuple_hash *h; 1178 struct hlist_nulls_node *n; 1179 struct nf_conn *nf_ct_evict[8]; 1180 int res, i; 1181 spinlock_t *lockp; 1182 1183 last = (struct nf_conn *)cb->args[1]; 1184 i = 0; 1185 1186 local_bh_disable(); 1187 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) { 1188 restart: 1189 while (i) { 1190 i--; 1191 if (nf_ct_should_gc(nf_ct_evict[i])) 1192 nf_ct_kill(nf_ct_evict[i]); 1193 nf_ct_put(nf_ct_evict[i]); 1194 } 1195 1196 lockp = &nf_conntrack_locks[cb->args[0] % CONNTRACK_LOCKS]; 1197 nf_conntrack_lock(lockp); 1198 if (cb->args[0] >= nf_conntrack_htable_size) { 1199 spin_unlock(lockp); 1200 goto out; 1201 } 1202 hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]], 1203 hnnode) { 1204 ct = nf_ct_tuplehash_to_ctrack(h); 1205 if (nf_ct_is_expired(ct)) { 1206 if (i < ARRAY_SIZE(nf_ct_evict) && 1207 refcount_inc_not_zero(&ct->ct_general.use)) 1208 nf_ct_evict[i++] = ct; 1209 continue; 1210 } 1211 1212 if (!net_eq(net, nf_ct_net(ct))) 1213 continue; 1214 1215 if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL) 1216 continue; 1217 1218 if (cb->args[1]) { 1219 if (ct != last) 1220 continue; 1221 cb->args[1] = 0; 1222 } 1223 if (!ctnetlink_filter_match(ct, cb->data)) 1224 continue; 1225 1226 res = 1227 ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid, 1228 cb->nlh->nlmsg_seq, 1229 NFNL_MSG_TYPE(cb->nlh->nlmsg_type), 1230 ct, true, flags); 1231 if (res < 0) { 1232 nf_conntrack_get(&ct->ct_general); 1233 cb->args[1] = (unsigned long)ct; 1234 spin_unlock(lockp); 1235 goto out; 1236 } 1237 } 1238 spin_unlock(lockp); 1239 if (cb->args[1]) { 1240 cb->args[1] = 0; 1241 goto restart; 1242 } 1243 } 1244 out: 1245 local_bh_enable(); 1246 if (last) { 1247 /* nf ct hash resize happened, now clear the leftover. */ 1248 if ((struct nf_conn *)cb->args[1] == last) 1249 cb->args[1] = 0; 1250 1251 nf_ct_put(last); 1252 } 1253 1254 while (i) { 1255 i--; 1256 if (nf_ct_should_gc(nf_ct_evict[i])) 1257 nf_ct_kill(nf_ct_evict[i]); 1258 nf_ct_put(nf_ct_evict[i]); 1259 } 1260 1261 return skb->len; 1262 } 1263 1264 static int ipv4_nlattr_to_tuple(struct nlattr *tb[], 1265 struct nf_conntrack_tuple *t, 1266 u_int32_t flags) 1267 { 1268 if (flags & CTA_FILTER_FLAG(CTA_IP_SRC)) { 1269 if (!tb[CTA_IP_V4_SRC]) 1270 return -EINVAL; 1271 1272 t->src.u3.ip = nla_get_in_addr(tb[CTA_IP_V4_SRC]); 1273 } 1274 1275 if (flags & CTA_FILTER_FLAG(CTA_IP_DST)) { 1276 if (!tb[CTA_IP_V4_DST]) 1277 return -EINVAL; 1278 1279 t->dst.u3.ip = nla_get_in_addr(tb[CTA_IP_V4_DST]); 1280 } 1281 1282 return 0; 1283 } 1284 1285 static int ipv6_nlattr_to_tuple(struct nlattr *tb[], 1286 struct nf_conntrack_tuple *t, 1287 u_int32_t flags) 1288 { 1289 if (flags & CTA_FILTER_FLAG(CTA_IP_SRC)) { 1290 if (!tb[CTA_IP_V6_SRC]) 1291 return -EINVAL; 1292 1293 t->src.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_SRC]); 1294 } 1295 1296 if (flags & CTA_FILTER_FLAG(CTA_IP_DST)) { 1297 if (!tb[CTA_IP_V6_DST]) 1298 return -EINVAL; 1299 1300 t->dst.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_DST]); 1301 } 1302 1303 return 0; 1304 } 1305 1306 static int ctnetlink_parse_tuple_ip(struct nlattr *attr, 1307 struct nf_conntrack_tuple *tuple, 1308 u_int32_t flags) 1309 { 1310 struct nlattr *tb[CTA_IP_MAX+1]; 1311 int ret = 0; 1312 1313 ret = nla_parse_nested_deprecated(tb, CTA_IP_MAX, attr, NULL, NULL); 1314 if (ret < 0) 1315 return ret; 1316 1317 ret = nla_validate_nested_deprecated(attr, CTA_IP_MAX, 1318 cta_ip_nla_policy, NULL); 1319 if (ret) 1320 return ret; 1321 1322 switch (tuple->src.l3num) { 1323 case NFPROTO_IPV4: 1324 ret = ipv4_nlattr_to_tuple(tb, tuple, flags); 1325 break; 1326 case NFPROTO_IPV6: 1327 ret = ipv6_nlattr_to_tuple(tb, tuple, flags); 1328 break; 1329 } 1330 1331 return ret; 1332 } 1333 1334 static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = { 1335 [CTA_PROTO_NUM] = { .type = NLA_U8 }, 1336 }; 1337 1338 static int ctnetlink_parse_tuple_proto(struct nlattr *attr, 1339 struct nf_conntrack_tuple *tuple, 1340 u_int32_t flags) 1341 { 1342 const struct nf_conntrack_l4proto *l4proto; 1343 struct nlattr *tb[CTA_PROTO_MAX+1]; 1344 int ret = 0; 1345 1346 ret = nla_parse_nested_deprecated(tb, CTA_PROTO_MAX, attr, 1347 proto_nla_policy, NULL); 1348 if (ret < 0) 1349 return ret; 1350 1351 if (!(flags & CTA_FILTER_FLAG(CTA_PROTO_NUM))) 1352 return 0; 1353 1354 if (!tb[CTA_PROTO_NUM]) 1355 return -EINVAL; 1356 1357 tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]); 1358 1359 rcu_read_lock(); 1360 l4proto = nf_ct_l4proto_find(tuple->dst.protonum); 1361 1362 if (likely(l4proto->nlattr_to_tuple)) { 1363 ret = nla_validate_nested_deprecated(attr, CTA_PROTO_MAX, 1364 l4proto->nla_policy, 1365 NULL); 1366 if (ret == 0) 1367 ret = l4proto->nlattr_to_tuple(tb, tuple, flags); 1368 } 1369 1370 rcu_read_unlock(); 1371 1372 return ret; 1373 } 1374 1375 static int 1376 ctnetlink_parse_zone(const struct nlattr *attr, 1377 struct nf_conntrack_zone *zone) 1378 { 1379 nf_ct_zone_init(zone, NF_CT_DEFAULT_ZONE_ID, 1380 NF_CT_DEFAULT_ZONE_DIR, 0); 1381 #ifdef CONFIG_NF_CONNTRACK_ZONES 1382 if (attr) 1383 zone->id = ntohs(nla_get_be16(attr)); 1384 #else 1385 if (attr) 1386 return -EOPNOTSUPP; 1387 #endif 1388 return 0; 1389 } 1390 1391 static int 1392 ctnetlink_parse_tuple_zone(struct nlattr *attr, enum ctattr_type type, 1393 struct nf_conntrack_zone *zone) 1394 { 1395 int ret; 1396 1397 if (zone->id != NF_CT_DEFAULT_ZONE_ID) 1398 return -EINVAL; 1399 1400 ret = ctnetlink_parse_zone(attr, zone); 1401 if (ret < 0) 1402 return ret; 1403 1404 if (type == CTA_TUPLE_REPLY) 1405 zone->dir = NF_CT_ZONE_DIR_REPL; 1406 else 1407 zone->dir = NF_CT_ZONE_DIR_ORIG; 1408 1409 return 0; 1410 } 1411 1412 static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = { 1413 [CTA_TUPLE_IP] = { .type = NLA_NESTED }, 1414 [CTA_TUPLE_PROTO] = { .type = NLA_NESTED }, 1415 [CTA_TUPLE_ZONE] = { .type = NLA_U16 }, 1416 }; 1417 1418 #define CTA_FILTER_F_ALL_CTA_PROTO \ 1419 (CTA_FILTER_F_CTA_PROTO_SRC_PORT | \ 1420 CTA_FILTER_F_CTA_PROTO_DST_PORT | \ 1421 CTA_FILTER_F_CTA_PROTO_ICMP_TYPE | \ 1422 CTA_FILTER_F_CTA_PROTO_ICMP_CODE | \ 1423 CTA_FILTER_F_CTA_PROTO_ICMP_ID | \ 1424 CTA_FILTER_F_CTA_PROTO_ICMPV6_TYPE | \ 1425 CTA_FILTER_F_CTA_PROTO_ICMPV6_CODE | \ 1426 CTA_FILTER_F_CTA_PROTO_ICMPV6_ID) 1427 1428 static int 1429 ctnetlink_parse_tuple_filter(const struct nlattr * const cda[], 1430 struct nf_conntrack_tuple *tuple, u32 type, 1431 u_int8_t l3num, struct nf_conntrack_zone *zone, 1432 u_int32_t flags) 1433 { 1434 struct nlattr *tb[CTA_TUPLE_MAX+1]; 1435 int err; 1436 1437 memset(tuple, 0, sizeof(*tuple)); 1438 1439 err = nla_parse_nested_deprecated(tb, CTA_TUPLE_MAX, cda[type], 1440 tuple_nla_policy, NULL); 1441 if (err < 0) 1442 return err; 1443 1444 if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6) 1445 return -EOPNOTSUPP; 1446 tuple->src.l3num = l3num; 1447 1448 if (flags & CTA_FILTER_FLAG(CTA_IP_DST) || 1449 flags & CTA_FILTER_FLAG(CTA_IP_SRC)) { 1450 if (!tb[CTA_TUPLE_IP]) 1451 return -EINVAL; 1452 1453 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple, flags); 1454 if (err < 0) 1455 return err; 1456 } 1457 1458 if (flags & CTA_FILTER_FLAG(CTA_PROTO_NUM)) { 1459 if (!tb[CTA_TUPLE_PROTO]) 1460 return -EINVAL; 1461 1462 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple, flags); 1463 if (err < 0) 1464 return err; 1465 } else if (flags & CTA_FILTER_FLAG(ALL_CTA_PROTO)) { 1466 /* Can't manage proto flags without a protonum */ 1467 return -EINVAL; 1468 } 1469 1470 if ((flags & CTA_FILTER_FLAG(CTA_TUPLE_ZONE)) && tb[CTA_TUPLE_ZONE]) { 1471 if (!zone) 1472 return -EINVAL; 1473 1474 err = ctnetlink_parse_tuple_zone(tb[CTA_TUPLE_ZONE], 1475 type, zone); 1476 if (err < 0) 1477 return err; 1478 } 1479 1480 /* orig and expect tuples get DIR_ORIGINAL */ 1481 if (type == CTA_TUPLE_REPLY) 1482 tuple->dst.dir = IP_CT_DIR_REPLY; 1483 else 1484 tuple->dst.dir = IP_CT_DIR_ORIGINAL; 1485 1486 return 0; 1487 } 1488 1489 static int 1490 ctnetlink_parse_tuple(const struct nlattr * const cda[], 1491 struct nf_conntrack_tuple *tuple, u32 type, 1492 u_int8_t l3num, struct nf_conntrack_zone *zone) 1493 { 1494 return ctnetlink_parse_tuple_filter(cda, tuple, type, l3num, zone, 1495 CTA_FILTER_FLAG(ALL)); 1496 } 1497 1498 static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = { 1499 [CTA_HELP_NAME] = { .type = NLA_NUL_STRING, 1500 .len = NF_CT_HELPER_NAME_LEN - 1 }, 1501 }; 1502 1503 static int ctnetlink_parse_help(const struct nlattr *attr, char **helper_name, 1504 struct nlattr **helpinfo) 1505 { 1506 int err; 1507 struct nlattr *tb[CTA_HELP_MAX+1]; 1508 1509 err = nla_parse_nested_deprecated(tb, CTA_HELP_MAX, attr, 1510 help_nla_policy, NULL); 1511 if (err < 0) 1512 return err; 1513 1514 if (!tb[CTA_HELP_NAME]) 1515 return -EINVAL; 1516 1517 *helper_name = nla_data(tb[CTA_HELP_NAME]); 1518 1519 if (tb[CTA_HELP_INFO]) 1520 *helpinfo = tb[CTA_HELP_INFO]; 1521 1522 return 0; 1523 } 1524 1525 static const struct nla_policy ct_nla_policy[CTA_MAX+1] = { 1526 [CTA_TUPLE_ORIG] = { .type = NLA_NESTED }, 1527 [CTA_TUPLE_REPLY] = { .type = NLA_NESTED }, 1528 [CTA_STATUS] = { .type = NLA_U32 }, 1529 [CTA_PROTOINFO] = { .type = NLA_NESTED }, 1530 [CTA_HELP] = { .type = NLA_NESTED }, 1531 [CTA_NAT_SRC] = { .type = NLA_NESTED }, 1532 [CTA_TIMEOUT] = { .type = NLA_U32 }, 1533 [CTA_MARK] = { .type = NLA_U32 }, 1534 [CTA_ID] = { .type = NLA_U32 }, 1535 [CTA_NAT_DST] = { .type = NLA_NESTED }, 1536 [CTA_TUPLE_MASTER] = { .type = NLA_NESTED }, 1537 [CTA_NAT_SEQ_ADJ_ORIG] = { .type = NLA_NESTED }, 1538 [CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED }, 1539 [CTA_ZONE] = { .type = NLA_U16 }, 1540 [CTA_MARK_MASK] = { .type = NLA_U32 }, 1541 [CTA_LABELS] = { .type = NLA_BINARY, 1542 .len = NF_CT_LABELS_MAX_SIZE }, 1543 [CTA_LABELS_MASK] = { .type = NLA_BINARY, 1544 .len = NF_CT_LABELS_MAX_SIZE }, 1545 [CTA_FILTER] = { .type = NLA_NESTED }, 1546 [CTA_STATUS_MASK] = { .type = NLA_U32 }, 1547 }; 1548 1549 static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data) 1550 { 1551 if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) 1552 return 0; 1553 1554 return ctnetlink_filter_match(ct, data); 1555 } 1556 1557 static int ctnetlink_flush_conntrack(struct net *net, 1558 const struct nlattr * const cda[], 1559 u32 portid, int report, u8 family) 1560 { 1561 struct ctnetlink_filter *filter = NULL; 1562 1563 if (ctnetlink_needs_filter(family, cda)) { 1564 if (cda[CTA_FILTER]) 1565 return -EOPNOTSUPP; 1566 1567 filter = ctnetlink_alloc_filter(cda, family); 1568 if (IS_ERR(filter)) 1569 return PTR_ERR(filter); 1570 } 1571 1572 nf_ct_iterate_cleanup_net(net, ctnetlink_flush_iterate, filter, 1573 portid, report); 1574 kfree(filter); 1575 1576 return 0; 1577 } 1578 1579 static int ctnetlink_del_conntrack(struct sk_buff *skb, 1580 const struct nfnl_info *info, 1581 const struct nlattr * const cda[]) 1582 { 1583 u8 family = info->nfmsg->nfgen_family; 1584 struct nf_conntrack_tuple_hash *h; 1585 struct nf_conntrack_tuple tuple; 1586 struct nf_conntrack_zone zone; 1587 struct nf_conn *ct; 1588 int err; 1589 1590 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone); 1591 if (err < 0) 1592 return err; 1593 1594 if (cda[CTA_TUPLE_ORIG]) 1595 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, 1596 family, &zone); 1597 else if (cda[CTA_TUPLE_REPLY]) 1598 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, 1599 family, &zone); 1600 else { 1601 u_int8_t u3 = info->nfmsg->version ? family : AF_UNSPEC; 1602 1603 return ctnetlink_flush_conntrack(info->net, cda, 1604 NETLINK_CB(skb).portid, 1605 nlmsg_report(info->nlh), u3); 1606 } 1607 1608 if (err < 0) 1609 return err; 1610 1611 h = nf_conntrack_find_get(info->net, &zone, &tuple); 1612 if (!h) 1613 return -ENOENT; 1614 1615 ct = nf_ct_tuplehash_to_ctrack(h); 1616 1617 if (test_bit(IPS_OFFLOAD_BIT, &ct->status)) { 1618 nf_ct_put(ct); 1619 return -EBUSY; 1620 } 1621 1622 if (cda[CTA_ID]) { 1623 __be32 id = nla_get_be32(cda[CTA_ID]); 1624 1625 if (id != (__force __be32)nf_ct_get_id(ct)) { 1626 nf_ct_put(ct); 1627 return -ENOENT; 1628 } 1629 } 1630 1631 nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(info->nlh)); 1632 nf_ct_put(ct); 1633 1634 return 0; 1635 } 1636 1637 static int ctnetlink_get_conntrack(struct sk_buff *skb, 1638 const struct nfnl_info *info, 1639 const struct nlattr * const cda[]) 1640 { 1641 u_int8_t u3 = info->nfmsg->nfgen_family; 1642 struct nf_conntrack_tuple_hash *h; 1643 struct nf_conntrack_tuple tuple; 1644 struct nf_conntrack_zone zone; 1645 struct sk_buff *skb2; 1646 struct nf_conn *ct; 1647 int err; 1648 1649 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1650 struct netlink_dump_control c = { 1651 .start = ctnetlink_start, 1652 .dump = ctnetlink_dump_table, 1653 .done = ctnetlink_done, 1654 .data = (void *)cda, 1655 }; 1656 1657 return netlink_dump_start(info->sk, skb, info->nlh, &c); 1658 } 1659 1660 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone); 1661 if (err < 0) 1662 return err; 1663 1664 if (cda[CTA_TUPLE_ORIG]) 1665 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, 1666 u3, &zone); 1667 else if (cda[CTA_TUPLE_REPLY]) 1668 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, 1669 u3, &zone); 1670 else 1671 return -EINVAL; 1672 1673 if (err < 0) 1674 return err; 1675 1676 h = nf_conntrack_find_get(info->net, &zone, &tuple); 1677 if (!h) 1678 return -ENOENT; 1679 1680 ct = nf_ct_tuplehash_to_ctrack(h); 1681 1682 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1683 if (!skb2) { 1684 nf_ct_put(ct); 1685 return -ENOMEM; 1686 } 1687 1688 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, 1689 info->nlh->nlmsg_seq, 1690 NFNL_MSG_TYPE(info->nlh->nlmsg_type), ct, 1691 true, 0); 1692 nf_ct_put(ct); 1693 if (err <= 0) { 1694 kfree_skb(skb2); 1695 return -ENOMEM; 1696 } 1697 1698 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 1699 } 1700 1701 static int ctnetlink_done_list(struct netlink_callback *cb) 1702 { 1703 struct ctnetlink_list_dump_ctx *ctx = (void *)cb->ctx; 1704 1705 if (ctx->last) 1706 nf_ct_put(ctx->last); 1707 1708 return 0; 1709 } 1710 1711 static int 1712 ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying) 1713 { 1714 struct ctnetlink_list_dump_ctx *ctx = (void *)cb->ctx; 1715 struct nf_conn *ct, *last; 1716 struct nf_conntrack_tuple_hash *h; 1717 struct hlist_nulls_node *n; 1718 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 1719 u_int8_t l3proto = nfmsg->nfgen_family; 1720 int res; 1721 int cpu; 1722 struct hlist_nulls_head *list; 1723 struct net *net = sock_net(skb->sk); 1724 1725 if (ctx->done) 1726 return 0; 1727 1728 last = ctx->last; 1729 1730 for (cpu = ctx->cpu; cpu < nr_cpu_ids; cpu++) { 1731 struct ct_pcpu *pcpu; 1732 1733 if (!cpu_possible(cpu)) 1734 continue; 1735 1736 pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu); 1737 spin_lock_bh(&pcpu->lock); 1738 list = dying ? &pcpu->dying : &pcpu->unconfirmed; 1739 restart: 1740 hlist_nulls_for_each_entry(h, n, list, hnnode) { 1741 ct = nf_ct_tuplehash_to_ctrack(h); 1742 if (l3proto && nf_ct_l3num(ct) != l3proto) 1743 continue; 1744 if (ctx->last) { 1745 if (ct != last) 1746 continue; 1747 ctx->last = NULL; 1748 } 1749 1750 /* We can't dump extension info for the unconfirmed 1751 * list because unconfirmed conntracks can have 1752 * ct->ext reallocated (and thus freed). 1753 * 1754 * In the dying list case ct->ext can't be free'd 1755 * until after we drop pcpu->lock. 1756 */ 1757 res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid, 1758 cb->nlh->nlmsg_seq, 1759 NFNL_MSG_TYPE(cb->nlh->nlmsg_type), 1760 ct, dying, 0); 1761 if (res < 0) { 1762 if (!refcount_inc_not_zero(&ct->ct_general.use)) 1763 continue; 1764 ctx->cpu = cpu; 1765 ctx->last = ct; 1766 spin_unlock_bh(&pcpu->lock); 1767 goto out; 1768 } 1769 } 1770 if (ctx->last) { 1771 ctx->last = NULL; 1772 goto restart; 1773 } 1774 spin_unlock_bh(&pcpu->lock); 1775 } 1776 ctx->done = true; 1777 out: 1778 if (last) 1779 nf_ct_put(last); 1780 1781 return skb->len; 1782 } 1783 1784 static int 1785 ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb) 1786 { 1787 return ctnetlink_dump_list(skb, cb, true); 1788 } 1789 1790 static int ctnetlink_get_ct_dying(struct sk_buff *skb, 1791 const struct nfnl_info *info, 1792 const struct nlattr * const cda[]) 1793 { 1794 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1795 struct netlink_dump_control c = { 1796 .dump = ctnetlink_dump_dying, 1797 .done = ctnetlink_done_list, 1798 }; 1799 return netlink_dump_start(info->sk, skb, info->nlh, &c); 1800 } 1801 1802 return -EOPNOTSUPP; 1803 } 1804 1805 static int 1806 ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb) 1807 { 1808 return ctnetlink_dump_list(skb, cb, false); 1809 } 1810 1811 static int ctnetlink_get_ct_unconfirmed(struct sk_buff *skb, 1812 const struct nfnl_info *info, 1813 const struct nlattr * const cda[]) 1814 { 1815 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 1816 struct netlink_dump_control c = { 1817 .dump = ctnetlink_dump_unconfirmed, 1818 .done = ctnetlink_done_list, 1819 }; 1820 return netlink_dump_start(info->sk, skb, info->nlh, &c); 1821 } 1822 1823 return -EOPNOTSUPP; 1824 } 1825 1826 #if IS_ENABLED(CONFIG_NF_NAT) 1827 static int 1828 ctnetlink_parse_nat_setup(struct nf_conn *ct, 1829 enum nf_nat_manip_type manip, 1830 const struct nlattr *attr) 1831 __must_hold(RCU) 1832 { 1833 const struct nf_nat_hook *nat_hook; 1834 int err; 1835 1836 nat_hook = rcu_dereference(nf_nat_hook); 1837 if (!nat_hook) { 1838 #ifdef CONFIG_MODULES 1839 rcu_read_unlock(); 1840 nfnl_unlock(NFNL_SUBSYS_CTNETLINK); 1841 if (request_module("nf-nat") < 0) { 1842 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1843 rcu_read_lock(); 1844 return -EOPNOTSUPP; 1845 } 1846 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1847 rcu_read_lock(); 1848 nat_hook = rcu_dereference(nf_nat_hook); 1849 if (nat_hook) 1850 return -EAGAIN; 1851 #endif 1852 return -EOPNOTSUPP; 1853 } 1854 1855 err = nat_hook->parse_nat_setup(ct, manip, attr); 1856 if (err == -EAGAIN) { 1857 #ifdef CONFIG_MODULES 1858 rcu_read_unlock(); 1859 nfnl_unlock(NFNL_SUBSYS_CTNETLINK); 1860 if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) { 1861 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1862 rcu_read_lock(); 1863 return -EOPNOTSUPP; 1864 } 1865 nfnl_lock(NFNL_SUBSYS_CTNETLINK); 1866 rcu_read_lock(); 1867 #else 1868 err = -EOPNOTSUPP; 1869 #endif 1870 } 1871 return err; 1872 } 1873 #endif 1874 1875 static void 1876 __ctnetlink_change_status(struct nf_conn *ct, unsigned long on, 1877 unsigned long off) 1878 { 1879 unsigned int bit; 1880 1881 /* Ignore these unchangable bits */ 1882 on &= ~IPS_UNCHANGEABLE_MASK; 1883 off &= ~IPS_UNCHANGEABLE_MASK; 1884 1885 for (bit = 0; bit < __IPS_MAX_BIT; bit++) { 1886 if (on & (1 << bit)) 1887 set_bit(bit, &ct->status); 1888 else if (off & (1 << bit)) 1889 clear_bit(bit, &ct->status); 1890 } 1891 } 1892 1893 static int 1894 ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[]) 1895 { 1896 unsigned long d; 1897 unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS])); 1898 d = ct->status ^ status; 1899 1900 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING)) 1901 /* unchangeable */ 1902 return -EBUSY; 1903 1904 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY)) 1905 /* SEEN_REPLY bit can only be set */ 1906 return -EBUSY; 1907 1908 if (d & IPS_ASSURED && !(status & IPS_ASSURED)) 1909 /* ASSURED bit can only be set */ 1910 return -EBUSY; 1911 1912 __ctnetlink_change_status(ct, status, 0); 1913 return 0; 1914 } 1915 1916 static int 1917 ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[]) 1918 { 1919 #if IS_ENABLED(CONFIG_NF_NAT) 1920 int ret; 1921 1922 if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC]) 1923 return 0; 1924 1925 ret = ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_DST, 1926 cda[CTA_NAT_DST]); 1927 if (ret < 0) 1928 return ret; 1929 1930 return ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_SRC, 1931 cda[CTA_NAT_SRC]); 1932 #else 1933 if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC]) 1934 return 0; 1935 return -EOPNOTSUPP; 1936 #endif 1937 } 1938 1939 static int ctnetlink_change_helper(struct nf_conn *ct, 1940 const struct nlattr * const cda[]) 1941 { 1942 struct nf_conntrack_helper *helper; 1943 struct nf_conn_help *help = nfct_help(ct); 1944 char *helpname = NULL; 1945 struct nlattr *helpinfo = NULL; 1946 int err; 1947 1948 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo); 1949 if (err < 0) 1950 return err; 1951 1952 /* don't change helper of sibling connections */ 1953 if (ct->master) { 1954 /* If we try to change the helper to the same thing twice, 1955 * treat the second attempt as a no-op instead of returning 1956 * an error. 1957 */ 1958 err = -EBUSY; 1959 if (help) { 1960 rcu_read_lock(); 1961 helper = rcu_dereference(help->helper); 1962 if (helper && !strcmp(helper->name, helpname)) 1963 err = 0; 1964 rcu_read_unlock(); 1965 } 1966 1967 return err; 1968 } 1969 1970 if (!strcmp(helpname, "")) { 1971 if (help && help->helper) { 1972 /* we had a helper before ... */ 1973 nf_ct_remove_expectations(ct); 1974 RCU_INIT_POINTER(help->helper, NULL); 1975 } 1976 1977 return 0; 1978 } 1979 1980 rcu_read_lock(); 1981 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct), 1982 nf_ct_protonum(ct)); 1983 if (helper == NULL) { 1984 rcu_read_unlock(); 1985 return -EOPNOTSUPP; 1986 } 1987 1988 if (help) { 1989 if (help->helper == helper) { 1990 /* update private helper data if allowed. */ 1991 if (helper->from_nlattr) 1992 helper->from_nlattr(helpinfo, ct); 1993 err = 0; 1994 } else 1995 err = -EBUSY; 1996 } else { 1997 /* we cannot set a helper for an existing conntrack */ 1998 err = -EOPNOTSUPP; 1999 } 2000 2001 rcu_read_unlock(); 2002 return err; 2003 } 2004 2005 static int ctnetlink_change_timeout(struct nf_conn *ct, 2006 const struct nlattr * const cda[]) 2007 { 2008 u64 timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ; 2009 2010 if (timeout > INT_MAX) 2011 timeout = INT_MAX; 2012 WRITE_ONCE(ct->timeout, nfct_time_stamp + (u32)timeout); 2013 2014 if (test_bit(IPS_DYING_BIT, &ct->status)) 2015 return -ETIME; 2016 2017 return 0; 2018 } 2019 2020 #if defined(CONFIG_NF_CONNTRACK_MARK) 2021 static void ctnetlink_change_mark(struct nf_conn *ct, 2022 const struct nlattr * const cda[]) 2023 { 2024 u32 mark, newmark, mask = 0; 2025 2026 if (cda[CTA_MARK_MASK]) 2027 mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK])); 2028 2029 mark = ntohl(nla_get_be32(cda[CTA_MARK])); 2030 newmark = (ct->mark & mask) ^ mark; 2031 if (newmark != ct->mark) 2032 ct->mark = newmark; 2033 } 2034 #endif 2035 2036 static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = { 2037 [CTA_PROTOINFO_TCP] = { .type = NLA_NESTED }, 2038 [CTA_PROTOINFO_DCCP] = { .type = NLA_NESTED }, 2039 [CTA_PROTOINFO_SCTP] = { .type = NLA_NESTED }, 2040 }; 2041 2042 static int ctnetlink_change_protoinfo(struct nf_conn *ct, 2043 const struct nlattr * const cda[]) 2044 { 2045 const struct nlattr *attr = cda[CTA_PROTOINFO]; 2046 const struct nf_conntrack_l4proto *l4proto; 2047 struct nlattr *tb[CTA_PROTOINFO_MAX+1]; 2048 int err = 0; 2049 2050 err = nla_parse_nested_deprecated(tb, CTA_PROTOINFO_MAX, attr, 2051 protoinfo_policy, NULL); 2052 if (err < 0) 2053 return err; 2054 2055 l4proto = nf_ct_l4proto_find(nf_ct_protonum(ct)); 2056 if (l4proto->from_nlattr) 2057 err = l4proto->from_nlattr(tb, ct); 2058 2059 return err; 2060 } 2061 2062 static const struct nla_policy seqadj_policy[CTA_SEQADJ_MAX+1] = { 2063 [CTA_SEQADJ_CORRECTION_POS] = { .type = NLA_U32 }, 2064 [CTA_SEQADJ_OFFSET_BEFORE] = { .type = NLA_U32 }, 2065 [CTA_SEQADJ_OFFSET_AFTER] = { .type = NLA_U32 }, 2066 }; 2067 2068 static int change_seq_adj(struct nf_ct_seqadj *seq, 2069 const struct nlattr * const attr) 2070 { 2071 int err; 2072 struct nlattr *cda[CTA_SEQADJ_MAX+1]; 2073 2074 err = nla_parse_nested_deprecated(cda, CTA_SEQADJ_MAX, attr, 2075 seqadj_policy, NULL); 2076 if (err < 0) 2077 return err; 2078 2079 if (!cda[CTA_SEQADJ_CORRECTION_POS]) 2080 return -EINVAL; 2081 2082 seq->correction_pos = 2083 ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS])); 2084 2085 if (!cda[CTA_SEQADJ_OFFSET_BEFORE]) 2086 return -EINVAL; 2087 2088 seq->offset_before = 2089 ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE])); 2090 2091 if (!cda[CTA_SEQADJ_OFFSET_AFTER]) 2092 return -EINVAL; 2093 2094 seq->offset_after = 2095 ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER])); 2096 2097 return 0; 2098 } 2099 2100 static int 2101 ctnetlink_change_seq_adj(struct nf_conn *ct, 2102 const struct nlattr * const cda[]) 2103 { 2104 struct nf_conn_seqadj *seqadj = nfct_seqadj(ct); 2105 int ret = 0; 2106 2107 if (!seqadj) 2108 return 0; 2109 2110 spin_lock_bh(&ct->lock); 2111 if (cda[CTA_SEQ_ADJ_ORIG]) { 2112 ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL], 2113 cda[CTA_SEQ_ADJ_ORIG]); 2114 if (ret < 0) 2115 goto err; 2116 2117 set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); 2118 } 2119 2120 if (cda[CTA_SEQ_ADJ_REPLY]) { 2121 ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY], 2122 cda[CTA_SEQ_ADJ_REPLY]); 2123 if (ret < 0) 2124 goto err; 2125 2126 set_bit(IPS_SEQ_ADJUST_BIT, &ct->status); 2127 } 2128 2129 spin_unlock_bh(&ct->lock); 2130 return 0; 2131 err: 2132 spin_unlock_bh(&ct->lock); 2133 return ret; 2134 } 2135 2136 static const struct nla_policy synproxy_policy[CTA_SYNPROXY_MAX + 1] = { 2137 [CTA_SYNPROXY_ISN] = { .type = NLA_U32 }, 2138 [CTA_SYNPROXY_ITS] = { .type = NLA_U32 }, 2139 [CTA_SYNPROXY_TSOFF] = { .type = NLA_U32 }, 2140 }; 2141 2142 static int ctnetlink_change_synproxy(struct nf_conn *ct, 2143 const struct nlattr * const cda[]) 2144 { 2145 struct nf_conn_synproxy *synproxy = nfct_synproxy(ct); 2146 struct nlattr *tb[CTA_SYNPROXY_MAX + 1]; 2147 int err; 2148 2149 if (!synproxy) 2150 return 0; 2151 2152 err = nla_parse_nested_deprecated(tb, CTA_SYNPROXY_MAX, 2153 cda[CTA_SYNPROXY], synproxy_policy, 2154 NULL); 2155 if (err < 0) 2156 return err; 2157 2158 if (!tb[CTA_SYNPROXY_ISN] || 2159 !tb[CTA_SYNPROXY_ITS] || 2160 !tb[CTA_SYNPROXY_TSOFF]) 2161 return -EINVAL; 2162 2163 synproxy->isn = ntohl(nla_get_be32(tb[CTA_SYNPROXY_ISN])); 2164 synproxy->its = ntohl(nla_get_be32(tb[CTA_SYNPROXY_ITS])); 2165 synproxy->tsoff = ntohl(nla_get_be32(tb[CTA_SYNPROXY_TSOFF])); 2166 2167 return 0; 2168 } 2169 2170 static int 2171 ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[]) 2172 { 2173 #ifdef CONFIG_NF_CONNTRACK_LABELS 2174 size_t len = nla_len(cda[CTA_LABELS]); 2175 const void *mask = cda[CTA_LABELS_MASK]; 2176 2177 if (len & (sizeof(u32)-1)) /* must be multiple of u32 */ 2178 return -EINVAL; 2179 2180 if (mask) { 2181 if (nla_len(cda[CTA_LABELS_MASK]) == 0 || 2182 nla_len(cda[CTA_LABELS_MASK]) != len) 2183 return -EINVAL; 2184 mask = nla_data(cda[CTA_LABELS_MASK]); 2185 } 2186 2187 len /= sizeof(u32); 2188 2189 return nf_connlabels_replace(ct, nla_data(cda[CTA_LABELS]), mask, len); 2190 #else 2191 return -EOPNOTSUPP; 2192 #endif 2193 } 2194 2195 static int 2196 ctnetlink_change_conntrack(struct nf_conn *ct, 2197 const struct nlattr * const cda[]) 2198 { 2199 int err; 2200 2201 /* only allow NAT changes and master assignation for new conntracks */ 2202 if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER]) 2203 return -EOPNOTSUPP; 2204 2205 if (cda[CTA_HELP]) { 2206 err = ctnetlink_change_helper(ct, cda); 2207 if (err < 0) 2208 return err; 2209 } 2210 2211 if (cda[CTA_TIMEOUT]) { 2212 err = ctnetlink_change_timeout(ct, cda); 2213 if (err < 0) 2214 return err; 2215 } 2216 2217 if (cda[CTA_STATUS]) { 2218 err = ctnetlink_change_status(ct, cda); 2219 if (err < 0) 2220 return err; 2221 } 2222 2223 if (cda[CTA_PROTOINFO]) { 2224 err = ctnetlink_change_protoinfo(ct, cda); 2225 if (err < 0) 2226 return err; 2227 } 2228 2229 #if defined(CONFIG_NF_CONNTRACK_MARK) 2230 if (cda[CTA_MARK]) 2231 ctnetlink_change_mark(ct, cda); 2232 #endif 2233 2234 if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) { 2235 err = ctnetlink_change_seq_adj(ct, cda); 2236 if (err < 0) 2237 return err; 2238 } 2239 2240 if (cda[CTA_SYNPROXY]) { 2241 err = ctnetlink_change_synproxy(ct, cda); 2242 if (err < 0) 2243 return err; 2244 } 2245 2246 if (cda[CTA_LABELS]) { 2247 err = ctnetlink_attach_labels(ct, cda); 2248 if (err < 0) 2249 return err; 2250 } 2251 2252 return 0; 2253 } 2254 2255 static struct nf_conn * 2256 ctnetlink_create_conntrack(struct net *net, 2257 const struct nf_conntrack_zone *zone, 2258 const struct nlattr * const cda[], 2259 struct nf_conntrack_tuple *otuple, 2260 struct nf_conntrack_tuple *rtuple, 2261 u8 u3) 2262 { 2263 struct nf_conn *ct; 2264 int err = -EINVAL; 2265 struct nf_conntrack_helper *helper; 2266 struct nf_conn_tstamp *tstamp; 2267 u64 timeout; 2268 2269 ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC); 2270 if (IS_ERR(ct)) 2271 return ERR_PTR(-ENOMEM); 2272 2273 if (!cda[CTA_TIMEOUT]) 2274 goto err1; 2275 2276 timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ; 2277 if (timeout > INT_MAX) 2278 timeout = INT_MAX; 2279 ct->timeout = (u32)timeout + nfct_time_stamp; 2280 2281 rcu_read_lock(); 2282 if (cda[CTA_HELP]) { 2283 char *helpname = NULL; 2284 struct nlattr *helpinfo = NULL; 2285 2286 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo); 2287 if (err < 0) 2288 goto err2; 2289 2290 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct), 2291 nf_ct_protonum(ct)); 2292 if (helper == NULL) { 2293 rcu_read_unlock(); 2294 #ifdef CONFIG_MODULES 2295 if (request_module("nfct-helper-%s", helpname) < 0) { 2296 err = -EOPNOTSUPP; 2297 goto err1; 2298 } 2299 2300 rcu_read_lock(); 2301 helper = __nf_conntrack_helper_find(helpname, 2302 nf_ct_l3num(ct), 2303 nf_ct_protonum(ct)); 2304 if (helper) { 2305 err = -EAGAIN; 2306 goto err2; 2307 } 2308 rcu_read_unlock(); 2309 #endif 2310 err = -EOPNOTSUPP; 2311 goto err1; 2312 } else { 2313 struct nf_conn_help *help; 2314 2315 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC); 2316 if (help == NULL) { 2317 err = -ENOMEM; 2318 goto err2; 2319 } 2320 /* set private helper data if allowed. */ 2321 if (helper->from_nlattr) 2322 helper->from_nlattr(helpinfo, ct); 2323 2324 /* disable helper auto-assignment for this entry */ 2325 ct->status |= IPS_HELPER; 2326 RCU_INIT_POINTER(help->helper, helper); 2327 } 2328 } else { 2329 /* try an implicit helper assignation */ 2330 err = __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC); 2331 if (err < 0) 2332 goto err2; 2333 } 2334 2335 err = ctnetlink_setup_nat(ct, cda); 2336 if (err < 0) 2337 goto err2; 2338 2339 nf_ct_acct_ext_add(ct, GFP_ATOMIC); 2340 nf_ct_tstamp_ext_add(ct, GFP_ATOMIC); 2341 nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC); 2342 nf_ct_labels_ext_add(ct); 2343 nfct_seqadj_ext_add(ct); 2344 nfct_synproxy_ext_add(ct); 2345 2346 /* we must add conntrack extensions before confirmation. */ 2347 ct->status |= IPS_CONFIRMED; 2348 2349 if (cda[CTA_STATUS]) { 2350 err = ctnetlink_change_status(ct, cda); 2351 if (err < 0) 2352 goto err2; 2353 } 2354 2355 if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) { 2356 err = ctnetlink_change_seq_adj(ct, cda); 2357 if (err < 0) 2358 goto err2; 2359 } 2360 2361 memset(&ct->proto, 0, sizeof(ct->proto)); 2362 if (cda[CTA_PROTOINFO]) { 2363 err = ctnetlink_change_protoinfo(ct, cda); 2364 if (err < 0) 2365 goto err2; 2366 } 2367 2368 if (cda[CTA_SYNPROXY]) { 2369 err = ctnetlink_change_synproxy(ct, cda); 2370 if (err < 0) 2371 goto err2; 2372 } 2373 2374 #if defined(CONFIG_NF_CONNTRACK_MARK) 2375 if (cda[CTA_MARK]) 2376 ctnetlink_change_mark(ct, cda); 2377 #endif 2378 2379 /* setup master conntrack: this is a confirmed expectation */ 2380 if (cda[CTA_TUPLE_MASTER]) { 2381 struct nf_conntrack_tuple master; 2382 struct nf_conntrack_tuple_hash *master_h; 2383 struct nf_conn *master_ct; 2384 2385 err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, 2386 u3, NULL); 2387 if (err < 0) 2388 goto err2; 2389 2390 master_h = nf_conntrack_find_get(net, zone, &master); 2391 if (master_h == NULL) { 2392 err = -ENOENT; 2393 goto err2; 2394 } 2395 master_ct = nf_ct_tuplehash_to_ctrack(master_h); 2396 __set_bit(IPS_EXPECTED_BIT, &ct->status); 2397 ct->master = master_ct; 2398 } 2399 tstamp = nf_conn_tstamp_find(ct); 2400 if (tstamp) 2401 tstamp->start = ktime_get_real_ns(); 2402 2403 err = nf_conntrack_hash_check_insert(ct); 2404 if (err < 0) 2405 goto err2; 2406 2407 rcu_read_unlock(); 2408 2409 return ct; 2410 2411 err2: 2412 rcu_read_unlock(); 2413 err1: 2414 nf_conntrack_free(ct); 2415 return ERR_PTR(err); 2416 } 2417 2418 static int ctnetlink_new_conntrack(struct sk_buff *skb, 2419 const struct nfnl_info *info, 2420 const struct nlattr * const cda[]) 2421 { 2422 struct nf_conntrack_tuple otuple, rtuple; 2423 struct nf_conntrack_tuple_hash *h = NULL; 2424 u_int8_t u3 = info->nfmsg->nfgen_family; 2425 struct nf_conntrack_zone zone; 2426 struct nf_conn *ct; 2427 int err; 2428 2429 err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone); 2430 if (err < 0) 2431 return err; 2432 2433 if (cda[CTA_TUPLE_ORIG]) { 2434 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, 2435 u3, &zone); 2436 if (err < 0) 2437 return err; 2438 } 2439 2440 if (cda[CTA_TUPLE_REPLY]) { 2441 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, 2442 u3, &zone); 2443 if (err < 0) 2444 return err; 2445 } 2446 2447 if (cda[CTA_TUPLE_ORIG]) 2448 h = nf_conntrack_find_get(info->net, &zone, &otuple); 2449 else if (cda[CTA_TUPLE_REPLY]) 2450 h = nf_conntrack_find_get(info->net, &zone, &rtuple); 2451 2452 if (h == NULL) { 2453 err = -ENOENT; 2454 if (info->nlh->nlmsg_flags & NLM_F_CREATE) { 2455 enum ip_conntrack_events events; 2456 2457 if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY]) 2458 return -EINVAL; 2459 if (otuple.dst.protonum != rtuple.dst.protonum) 2460 return -EINVAL; 2461 2462 ct = ctnetlink_create_conntrack(info->net, &zone, cda, 2463 &otuple, &rtuple, u3); 2464 if (IS_ERR(ct)) 2465 return PTR_ERR(ct); 2466 2467 err = 0; 2468 if (test_bit(IPS_EXPECTED_BIT, &ct->status)) 2469 events = 1 << IPCT_RELATED; 2470 else 2471 events = 1 << IPCT_NEW; 2472 2473 if (cda[CTA_LABELS] && 2474 ctnetlink_attach_labels(ct, cda) == 0) 2475 events |= (1 << IPCT_LABEL); 2476 2477 nf_conntrack_eventmask_report((1 << IPCT_REPLY) | 2478 (1 << IPCT_ASSURED) | 2479 (1 << IPCT_HELPER) | 2480 (1 << IPCT_PROTOINFO) | 2481 (1 << IPCT_SEQADJ) | 2482 (1 << IPCT_MARK) | 2483 (1 << IPCT_SYNPROXY) | 2484 events, 2485 ct, NETLINK_CB(skb).portid, 2486 nlmsg_report(info->nlh)); 2487 nf_ct_put(ct); 2488 } 2489 2490 return err; 2491 } 2492 /* implicit 'else' */ 2493 2494 err = -EEXIST; 2495 ct = nf_ct_tuplehash_to_ctrack(h); 2496 if (!(info->nlh->nlmsg_flags & NLM_F_EXCL)) { 2497 err = ctnetlink_change_conntrack(ct, cda); 2498 if (err == 0) { 2499 nf_conntrack_eventmask_report((1 << IPCT_REPLY) | 2500 (1 << IPCT_ASSURED) | 2501 (1 << IPCT_HELPER) | 2502 (1 << IPCT_LABEL) | 2503 (1 << IPCT_PROTOINFO) | 2504 (1 << IPCT_SEQADJ) | 2505 (1 << IPCT_MARK) | 2506 (1 << IPCT_SYNPROXY), 2507 ct, NETLINK_CB(skb).portid, 2508 nlmsg_report(info->nlh)); 2509 } 2510 } 2511 2512 nf_ct_put(ct); 2513 return err; 2514 } 2515 2516 static int 2517 ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq, 2518 __u16 cpu, const struct ip_conntrack_stat *st) 2519 { 2520 struct nlmsghdr *nlh; 2521 unsigned int flags = portid ? NLM_F_MULTI : 0, event; 2522 2523 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, 2524 IPCTNL_MSG_CT_GET_STATS_CPU); 2525 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, 2526 NFNETLINK_V0, htons(cpu)); 2527 if (!nlh) 2528 goto nlmsg_failure; 2529 2530 if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) || 2531 nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) || 2532 nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) || 2533 nla_put_be32(skb, CTA_STATS_INSERT_FAILED, 2534 htonl(st->insert_failed)) || 2535 nla_put_be32(skb, CTA_STATS_DROP, htonl(st->drop)) || 2536 nla_put_be32(skb, CTA_STATS_EARLY_DROP, htonl(st->early_drop)) || 2537 nla_put_be32(skb, CTA_STATS_ERROR, htonl(st->error)) || 2538 nla_put_be32(skb, CTA_STATS_SEARCH_RESTART, 2539 htonl(st->search_restart)) || 2540 nla_put_be32(skb, CTA_STATS_CLASH_RESOLVE, 2541 htonl(st->clash_resolve)) || 2542 nla_put_be32(skb, CTA_STATS_CHAIN_TOOLONG, 2543 htonl(st->chaintoolong))) 2544 goto nla_put_failure; 2545 2546 nlmsg_end(skb, nlh); 2547 return skb->len; 2548 2549 nla_put_failure: 2550 nlmsg_failure: 2551 nlmsg_cancel(skb, nlh); 2552 return -1; 2553 } 2554 2555 static int 2556 ctnetlink_ct_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb) 2557 { 2558 int cpu; 2559 struct net *net = sock_net(skb->sk); 2560 2561 if (cb->args[0] == nr_cpu_ids) 2562 return 0; 2563 2564 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) { 2565 const struct ip_conntrack_stat *st; 2566 2567 if (!cpu_possible(cpu)) 2568 continue; 2569 2570 st = per_cpu_ptr(net->ct.stat, cpu); 2571 if (ctnetlink_ct_stat_cpu_fill_info(skb, 2572 NETLINK_CB(cb->skb).portid, 2573 cb->nlh->nlmsg_seq, 2574 cpu, st) < 0) 2575 break; 2576 } 2577 cb->args[0] = cpu; 2578 2579 return skb->len; 2580 } 2581 2582 static int ctnetlink_stat_ct_cpu(struct sk_buff *skb, 2583 const struct nfnl_info *info, 2584 const struct nlattr * const cda[]) 2585 { 2586 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 2587 struct netlink_dump_control c = { 2588 .dump = ctnetlink_ct_stat_cpu_dump, 2589 }; 2590 return netlink_dump_start(info->sk, skb, info->nlh, &c); 2591 } 2592 2593 return 0; 2594 } 2595 2596 static int 2597 ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, 2598 struct net *net) 2599 { 2600 unsigned int flags = portid ? NLM_F_MULTI : 0, event; 2601 unsigned int nr_conntracks; 2602 struct nlmsghdr *nlh; 2603 2604 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_GET_STATS); 2605 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, 2606 NFNETLINK_V0, 0); 2607 if (!nlh) 2608 goto nlmsg_failure; 2609 2610 nr_conntracks = nf_conntrack_count(net); 2611 if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks))) 2612 goto nla_put_failure; 2613 2614 if (nla_put_be32(skb, CTA_STATS_GLOBAL_MAX_ENTRIES, htonl(nf_conntrack_max))) 2615 goto nla_put_failure; 2616 2617 nlmsg_end(skb, nlh); 2618 return skb->len; 2619 2620 nla_put_failure: 2621 nlmsg_failure: 2622 nlmsg_cancel(skb, nlh); 2623 return -1; 2624 } 2625 2626 static int ctnetlink_stat_ct(struct sk_buff *skb, const struct nfnl_info *info, 2627 const struct nlattr * const cda[]) 2628 { 2629 struct sk_buff *skb2; 2630 int err; 2631 2632 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2633 if (skb2 == NULL) 2634 return -ENOMEM; 2635 2636 err = ctnetlink_stat_ct_fill_info(skb2, NETLINK_CB(skb).portid, 2637 info->nlh->nlmsg_seq, 2638 NFNL_MSG_TYPE(info->nlh->nlmsg_type), 2639 sock_net(skb->sk)); 2640 if (err <= 0) { 2641 kfree_skb(skb2); 2642 return -ENOMEM; 2643 } 2644 2645 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 2646 } 2647 2648 static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = { 2649 [CTA_EXPECT_MASTER] = { .type = NLA_NESTED }, 2650 [CTA_EXPECT_TUPLE] = { .type = NLA_NESTED }, 2651 [CTA_EXPECT_MASK] = { .type = NLA_NESTED }, 2652 [CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 }, 2653 [CTA_EXPECT_ID] = { .type = NLA_U32 }, 2654 [CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING, 2655 .len = NF_CT_HELPER_NAME_LEN - 1 }, 2656 [CTA_EXPECT_ZONE] = { .type = NLA_U16 }, 2657 [CTA_EXPECT_FLAGS] = { .type = NLA_U32 }, 2658 [CTA_EXPECT_CLASS] = { .type = NLA_U32 }, 2659 [CTA_EXPECT_NAT] = { .type = NLA_NESTED }, 2660 [CTA_EXPECT_FN] = { .type = NLA_NUL_STRING }, 2661 }; 2662 2663 static struct nf_conntrack_expect * 2664 ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct, 2665 struct nf_conntrack_helper *helper, 2666 struct nf_conntrack_tuple *tuple, 2667 struct nf_conntrack_tuple *mask); 2668 2669 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT 2670 static size_t 2671 ctnetlink_glue_build_size(const struct nf_conn *ct) 2672 { 2673 return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */ 2674 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */ 2675 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */ 2676 + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */ 2677 + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */ 2678 + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */ 2679 + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */ 2680 + nla_total_size(0) /* CTA_PROTOINFO */ 2681 + nla_total_size(0) /* CTA_HELP */ 2682 + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */ 2683 + ctnetlink_secctx_size(ct) 2684 + ctnetlink_acct_size(ct) 2685 + ctnetlink_timestamp_size(ct) 2686 #if IS_ENABLED(CONFIG_NF_NAT) 2687 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */ 2688 + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */ 2689 #endif 2690 #ifdef CONFIG_NF_CONNTRACK_MARK 2691 + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */ 2692 #endif 2693 #ifdef CONFIG_NF_CONNTRACK_ZONES 2694 + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE|CTA_TUPLE_ZONE */ 2695 #endif 2696 + ctnetlink_proto_size(ct) 2697 ; 2698 } 2699 2700 static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct) 2701 { 2702 const struct nf_conntrack_zone *zone; 2703 struct nlattr *nest_parms; 2704 2705 zone = nf_ct_zone(ct); 2706 2707 nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); 2708 if (!nest_parms) 2709 goto nla_put_failure; 2710 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0) 2711 goto nla_put_failure; 2712 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 2713 NF_CT_ZONE_DIR_ORIG) < 0) 2714 goto nla_put_failure; 2715 nla_nest_end(skb, nest_parms); 2716 2717 nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY); 2718 if (!nest_parms) 2719 goto nla_put_failure; 2720 if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0) 2721 goto nla_put_failure; 2722 if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone, 2723 NF_CT_ZONE_DIR_REPL) < 0) 2724 goto nla_put_failure; 2725 nla_nest_end(skb, nest_parms); 2726 2727 if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone, 2728 NF_CT_DEFAULT_ZONE_DIR) < 0) 2729 goto nla_put_failure; 2730 2731 if (ctnetlink_dump_id(skb, ct) < 0) 2732 goto nla_put_failure; 2733 2734 if (ctnetlink_dump_status(skb, ct) < 0) 2735 goto nla_put_failure; 2736 2737 if (ctnetlink_dump_timeout(skb, ct, false) < 0) 2738 goto nla_put_failure; 2739 2740 if (ctnetlink_dump_protoinfo(skb, ct, false) < 0) 2741 goto nla_put_failure; 2742 2743 if (ctnetlink_dump_acct(skb, ct, IPCTNL_MSG_CT_GET) < 0 || 2744 ctnetlink_dump_timestamp(skb, ct) < 0) 2745 goto nla_put_failure; 2746 2747 if (ctnetlink_dump_helpinfo(skb, ct) < 0) 2748 goto nla_put_failure; 2749 2750 #ifdef CONFIG_NF_CONNTRACK_SECMARK 2751 if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0) 2752 goto nla_put_failure; 2753 #endif 2754 if (ct->master && ctnetlink_dump_master(skb, ct) < 0) 2755 goto nla_put_failure; 2756 2757 if ((ct->status & IPS_SEQ_ADJUST) && 2758 ctnetlink_dump_ct_seq_adj(skb, ct) < 0) 2759 goto nla_put_failure; 2760 2761 if (ctnetlink_dump_ct_synproxy(skb, ct) < 0) 2762 goto nla_put_failure; 2763 2764 #ifdef CONFIG_NF_CONNTRACK_MARK 2765 if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0) 2766 goto nla_put_failure; 2767 #endif 2768 if (ctnetlink_dump_labels(skb, ct) < 0) 2769 goto nla_put_failure; 2770 return 0; 2771 2772 nla_put_failure: 2773 return -ENOSPC; 2774 } 2775 2776 static int 2777 ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct, 2778 enum ip_conntrack_info ctinfo, 2779 u_int16_t ct_attr, u_int16_t ct_info_attr) 2780 { 2781 struct nlattr *nest_parms; 2782 2783 nest_parms = nla_nest_start(skb, ct_attr); 2784 if (!nest_parms) 2785 goto nla_put_failure; 2786 2787 if (__ctnetlink_glue_build(skb, ct) < 0) 2788 goto nla_put_failure; 2789 2790 nla_nest_end(skb, nest_parms); 2791 2792 if (nla_put_be32(skb, ct_info_attr, htonl(ctinfo))) 2793 goto nla_put_failure; 2794 2795 return 0; 2796 2797 nla_put_failure: 2798 return -ENOSPC; 2799 } 2800 2801 static int 2802 ctnetlink_update_status(struct nf_conn *ct, const struct nlattr * const cda[]) 2803 { 2804 unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS])); 2805 unsigned long d = ct->status ^ status; 2806 2807 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY)) 2808 /* SEEN_REPLY bit can only be set */ 2809 return -EBUSY; 2810 2811 if (d & IPS_ASSURED && !(status & IPS_ASSURED)) 2812 /* ASSURED bit can only be set */ 2813 return -EBUSY; 2814 2815 /* This check is less strict than ctnetlink_change_status() 2816 * because callers often flip IPS_EXPECTED bits when sending 2817 * an NFQA_CT attribute to the kernel. So ignore the 2818 * unchangeable bits but do not error out. Also user programs 2819 * are allowed to clear the bits that they are allowed to change. 2820 */ 2821 __ctnetlink_change_status(ct, status, ~status); 2822 return 0; 2823 } 2824 2825 static int 2826 ctnetlink_glue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct) 2827 { 2828 int err; 2829 2830 if (cda[CTA_TIMEOUT]) { 2831 err = ctnetlink_change_timeout(ct, cda); 2832 if (err < 0) 2833 return err; 2834 } 2835 if (cda[CTA_STATUS]) { 2836 err = ctnetlink_update_status(ct, cda); 2837 if (err < 0) 2838 return err; 2839 } 2840 if (cda[CTA_HELP]) { 2841 err = ctnetlink_change_helper(ct, cda); 2842 if (err < 0) 2843 return err; 2844 } 2845 if (cda[CTA_LABELS]) { 2846 err = ctnetlink_attach_labels(ct, cda); 2847 if (err < 0) 2848 return err; 2849 } 2850 #if defined(CONFIG_NF_CONNTRACK_MARK) 2851 if (cda[CTA_MARK]) { 2852 ctnetlink_change_mark(ct, cda); 2853 } 2854 #endif 2855 return 0; 2856 } 2857 2858 static int 2859 ctnetlink_glue_parse(const struct nlattr *attr, struct nf_conn *ct) 2860 { 2861 struct nlattr *cda[CTA_MAX+1]; 2862 int ret; 2863 2864 ret = nla_parse_nested_deprecated(cda, CTA_MAX, attr, ct_nla_policy, 2865 NULL); 2866 if (ret < 0) 2867 return ret; 2868 2869 return ctnetlink_glue_parse_ct((const struct nlattr **)cda, ct); 2870 } 2871 2872 static int ctnetlink_glue_exp_parse(const struct nlattr * const *cda, 2873 const struct nf_conn *ct, 2874 struct nf_conntrack_tuple *tuple, 2875 struct nf_conntrack_tuple *mask) 2876 { 2877 int err; 2878 2879 err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE, 2880 nf_ct_l3num(ct), NULL); 2881 if (err < 0) 2882 return err; 2883 2884 return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK, 2885 nf_ct_l3num(ct), NULL); 2886 } 2887 2888 static int 2889 ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct, 2890 u32 portid, u32 report) 2891 { 2892 struct nlattr *cda[CTA_EXPECT_MAX+1]; 2893 struct nf_conntrack_tuple tuple, mask; 2894 struct nf_conntrack_helper *helper = NULL; 2895 struct nf_conntrack_expect *exp; 2896 int err; 2897 2898 err = nla_parse_nested_deprecated(cda, CTA_EXPECT_MAX, attr, 2899 exp_nla_policy, NULL); 2900 if (err < 0) 2901 return err; 2902 2903 err = ctnetlink_glue_exp_parse((const struct nlattr * const *)cda, 2904 ct, &tuple, &mask); 2905 if (err < 0) 2906 return err; 2907 2908 if (cda[CTA_EXPECT_HELP_NAME]) { 2909 const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]); 2910 2911 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct), 2912 nf_ct_protonum(ct)); 2913 if (helper == NULL) 2914 return -EOPNOTSUPP; 2915 } 2916 2917 exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct, 2918 helper, &tuple, &mask); 2919 if (IS_ERR(exp)) 2920 return PTR_ERR(exp); 2921 2922 err = nf_ct_expect_related_report(exp, portid, report, 0); 2923 nf_ct_expect_put(exp); 2924 return err; 2925 } 2926 2927 static void ctnetlink_glue_seqadj(struct sk_buff *skb, struct nf_conn *ct, 2928 enum ip_conntrack_info ctinfo, int diff) 2929 { 2930 if (!(ct->status & IPS_NAT_MASK)) 2931 return; 2932 2933 nf_ct_tcp_seqadj_set(skb, ct, ctinfo, diff); 2934 } 2935 2936 static const struct nfnl_ct_hook ctnetlink_glue_hook = { 2937 .build_size = ctnetlink_glue_build_size, 2938 .build = ctnetlink_glue_build, 2939 .parse = ctnetlink_glue_parse, 2940 .attach_expect = ctnetlink_glue_attach_expect, 2941 .seq_adjust = ctnetlink_glue_seqadj, 2942 }; 2943 #endif /* CONFIG_NETFILTER_NETLINK_GLUE_CT */ 2944 2945 /*********************************************************************** 2946 * EXPECT 2947 ***********************************************************************/ 2948 2949 static int ctnetlink_exp_dump_tuple(struct sk_buff *skb, 2950 const struct nf_conntrack_tuple *tuple, 2951 u32 type) 2952 { 2953 struct nlattr *nest_parms; 2954 2955 nest_parms = nla_nest_start(skb, type); 2956 if (!nest_parms) 2957 goto nla_put_failure; 2958 if (ctnetlink_dump_tuples(skb, tuple) < 0) 2959 goto nla_put_failure; 2960 nla_nest_end(skb, nest_parms); 2961 2962 return 0; 2963 2964 nla_put_failure: 2965 return -1; 2966 } 2967 2968 static int ctnetlink_exp_dump_mask(struct sk_buff *skb, 2969 const struct nf_conntrack_tuple *tuple, 2970 const struct nf_conntrack_tuple_mask *mask) 2971 { 2972 const struct nf_conntrack_l4proto *l4proto; 2973 struct nf_conntrack_tuple m; 2974 struct nlattr *nest_parms; 2975 int ret; 2976 2977 memset(&m, 0xFF, sizeof(m)); 2978 memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3)); 2979 m.src.u.all = mask->src.u.all; 2980 m.src.l3num = tuple->src.l3num; 2981 m.dst.protonum = tuple->dst.protonum; 2982 2983 nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK); 2984 if (!nest_parms) 2985 goto nla_put_failure; 2986 2987 rcu_read_lock(); 2988 ret = ctnetlink_dump_tuples_ip(skb, &m); 2989 if (ret >= 0) { 2990 l4proto = nf_ct_l4proto_find(tuple->dst.protonum); 2991 ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto); 2992 } 2993 rcu_read_unlock(); 2994 2995 if (unlikely(ret < 0)) 2996 goto nla_put_failure; 2997 2998 nla_nest_end(skb, nest_parms); 2999 3000 return 0; 3001 3002 nla_put_failure: 3003 return -1; 3004 } 3005 3006 static const union nf_inet_addr any_addr; 3007 3008 static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp) 3009 { 3010 static siphash_aligned_key_t exp_id_seed; 3011 unsigned long a, b, c, d; 3012 3013 net_get_random_once(&exp_id_seed, sizeof(exp_id_seed)); 3014 3015 a = (unsigned long)exp; 3016 b = (unsigned long)exp->helper; 3017 c = (unsigned long)exp->master; 3018 d = (unsigned long)siphash(&exp->tuple, sizeof(exp->tuple), &exp_id_seed); 3019 3020 #ifdef CONFIG_64BIT 3021 return (__force __be32)siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &exp_id_seed); 3022 #else 3023 return (__force __be32)siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &exp_id_seed); 3024 #endif 3025 } 3026 3027 static int 3028 ctnetlink_exp_dump_expect(struct sk_buff *skb, 3029 const struct nf_conntrack_expect *exp) 3030 { 3031 struct nf_conn *master = exp->master; 3032 long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ; 3033 struct nf_conn_help *help; 3034 #if IS_ENABLED(CONFIG_NF_NAT) 3035 struct nlattr *nest_parms; 3036 struct nf_conntrack_tuple nat_tuple = {}; 3037 #endif 3038 struct nf_ct_helper_expectfn *expfn; 3039 3040 if (timeout < 0) 3041 timeout = 0; 3042 3043 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0) 3044 goto nla_put_failure; 3045 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0) 3046 goto nla_put_failure; 3047 if (ctnetlink_exp_dump_tuple(skb, 3048 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple, 3049 CTA_EXPECT_MASTER) < 0) 3050 goto nla_put_failure; 3051 3052 #if IS_ENABLED(CONFIG_NF_NAT) 3053 if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) || 3054 exp->saved_proto.all) { 3055 nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT); 3056 if (!nest_parms) 3057 goto nla_put_failure; 3058 3059 if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir))) 3060 goto nla_put_failure; 3061 3062 nat_tuple.src.l3num = nf_ct_l3num(master); 3063 nat_tuple.src.u3 = exp->saved_addr; 3064 nat_tuple.dst.protonum = nf_ct_protonum(master); 3065 nat_tuple.src.u = exp->saved_proto; 3066 3067 if (ctnetlink_exp_dump_tuple(skb, &nat_tuple, 3068 CTA_EXPECT_NAT_TUPLE) < 0) 3069 goto nla_put_failure; 3070 nla_nest_end(skb, nest_parms); 3071 } 3072 #endif 3073 if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) || 3074 nla_put_be32(skb, CTA_EXPECT_ID, nf_expect_get_id(exp)) || 3075 nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) || 3076 nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class))) 3077 goto nla_put_failure; 3078 help = nfct_help(master); 3079 if (help) { 3080 struct nf_conntrack_helper *helper; 3081 3082 helper = rcu_dereference(help->helper); 3083 if (helper && 3084 nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name)) 3085 goto nla_put_failure; 3086 } 3087 expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn); 3088 if (expfn != NULL && 3089 nla_put_string(skb, CTA_EXPECT_FN, expfn->name)) 3090 goto nla_put_failure; 3091 3092 return 0; 3093 3094 nla_put_failure: 3095 return -1; 3096 } 3097 3098 static int 3099 ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq, 3100 int event, const struct nf_conntrack_expect *exp) 3101 { 3102 struct nlmsghdr *nlh; 3103 unsigned int flags = portid ? NLM_F_MULTI : 0; 3104 3105 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, event); 3106 nlh = nfnl_msg_put(skb, portid, seq, event, flags, 3107 exp->tuple.src.l3num, NFNETLINK_V0, 0); 3108 if (!nlh) 3109 goto nlmsg_failure; 3110 3111 if (ctnetlink_exp_dump_expect(skb, exp) < 0) 3112 goto nla_put_failure; 3113 3114 nlmsg_end(skb, nlh); 3115 return skb->len; 3116 3117 nlmsg_failure: 3118 nla_put_failure: 3119 nlmsg_cancel(skb, nlh); 3120 return -1; 3121 } 3122 3123 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3124 static int 3125 ctnetlink_expect_event(unsigned int events, const struct nf_exp_event *item) 3126 { 3127 struct nf_conntrack_expect *exp = item->exp; 3128 struct net *net = nf_ct_exp_net(exp); 3129 struct nlmsghdr *nlh; 3130 struct sk_buff *skb; 3131 unsigned int type, group; 3132 int flags = 0; 3133 3134 if (events & (1 << IPEXP_DESTROY)) { 3135 type = IPCTNL_MSG_EXP_DELETE; 3136 group = NFNLGRP_CONNTRACK_EXP_DESTROY; 3137 } else if (events & (1 << IPEXP_NEW)) { 3138 type = IPCTNL_MSG_EXP_NEW; 3139 flags = NLM_F_CREATE|NLM_F_EXCL; 3140 group = NFNLGRP_CONNTRACK_EXP_NEW; 3141 } else 3142 return 0; 3143 3144 if (!item->report && !nfnetlink_has_listeners(net, group)) 3145 return 0; 3146 3147 skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 3148 if (skb == NULL) 3149 goto errout; 3150 3151 type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, type); 3152 nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, 3153 exp->tuple.src.l3num, NFNETLINK_V0, 0); 3154 if (!nlh) 3155 goto nlmsg_failure; 3156 3157 if (ctnetlink_exp_dump_expect(skb, exp) < 0) 3158 goto nla_put_failure; 3159 3160 nlmsg_end(skb, nlh); 3161 nfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC); 3162 return 0; 3163 3164 nla_put_failure: 3165 nlmsg_cancel(skb, nlh); 3166 nlmsg_failure: 3167 kfree_skb(skb); 3168 errout: 3169 nfnetlink_set_err(net, 0, 0, -ENOBUFS); 3170 return 0; 3171 } 3172 #endif 3173 static int ctnetlink_exp_done(struct netlink_callback *cb) 3174 { 3175 if (cb->args[1]) 3176 nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]); 3177 return 0; 3178 } 3179 3180 static int 3181 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 3182 { 3183 struct net *net = sock_net(skb->sk); 3184 struct nf_conntrack_expect *exp, *last; 3185 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3186 u_int8_t l3proto = nfmsg->nfgen_family; 3187 3188 rcu_read_lock(); 3189 last = (struct nf_conntrack_expect *)cb->args[1]; 3190 for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) { 3191 restart: 3192 hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]], 3193 hnode) { 3194 if (l3proto && exp->tuple.src.l3num != l3proto) 3195 continue; 3196 3197 if (!net_eq(nf_ct_net(exp->master), net)) 3198 continue; 3199 3200 if (cb->args[1]) { 3201 if (exp != last) 3202 continue; 3203 cb->args[1] = 0; 3204 } 3205 if (ctnetlink_exp_fill_info(skb, 3206 NETLINK_CB(cb->skb).portid, 3207 cb->nlh->nlmsg_seq, 3208 IPCTNL_MSG_EXP_NEW, 3209 exp) < 0) { 3210 if (!refcount_inc_not_zero(&exp->use)) 3211 continue; 3212 cb->args[1] = (unsigned long)exp; 3213 goto out; 3214 } 3215 } 3216 if (cb->args[1]) { 3217 cb->args[1] = 0; 3218 goto restart; 3219 } 3220 } 3221 out: 3222 rcu_read_unlock(); 3223 if (last) 3224 nf_ct_expect_put(last); 3225 3226 return skb->len; 3227 } 3228 3229 static int 3230 ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 3231 { 3232 struct nf_conntrack_expect *exp, *last; 3233 struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); 3234 struct nf_conn *ct = cb->data; 3235 struct nf_conn_help *help = nfct_help(ct); 3236 u_int8_t l3proto = nfmsg->nfgen_family; 3237 3238 if (cb->args[0]) 3239 return 0; 3240 3241 rcu_read_lock(); 3242 last = (struct nf_conntrack_expect *)cb->args[1]; 3243 restart: 3244 hlist_for_each_entry_rcu(exp, &help->expectations, lnode) { 3245 if (l3proto && exp->tuple.src.l3num != l3proto) 3246 continue; 3247 if (cb->args[1]) { 3248 if (exp != last) 3249 continue; 3250 cb->args[1] = 0; 3251 } 3252 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).portid, 3253 cb->nlh->nlmsg_seq, 3254 IPCTNL_MSG_EXP_NEW, 3255 exp) < 0) { 3256 if (!refcount_inc_not_zero(&exp->use)) 3257 continue; 3258 cb->args[1] = (unsigned long)exp; 3259 goto out; 3260 } 3261 } 3262 if (cb->args[1]) { 3263 cb->args[1] = 0; 3264 goto restart; 3265 } 3266 cb->args[0] = 1; 3267 out: 3268 rcu_read_unlock(); 3269 if (last) 3270 nf_ct_expect_put(last); 3271 3272 return skb->len; 3273 } 3274 3275 static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, 3276 struct sk_buff *skb, 3277 const struct nlmsghdr *nlh, 3278 const struct nlattr * const cda[], 3279 struct netlink_ext_ack *extack) 3280 { 3281 int err; 3282 struct nfgenmsg *nfmsg = nlmsg_data(nlh); 3283 u_int8_t u3 = nfmsg->nfgen_family; 3284 struct nf_conntrack_tuple tuple; 3285 struct nf_conntrack_tuple_hash *h; 3286 struct nf_conn *ct; 3287 struct nf_conntrack_zone zone; 3288 struct netlink_dump_control c = { 3289 .dump = ctnetlink_exp_ct_dump_table, 3290 .done = ctnetlink_exp_done, 3291 }; 3292 3293 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, 3294 u3, NULL); 3295 if (err < 0) 3296 return err; 3297 3298 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3299 if (err < 0) 3300 return err; 3301 3302 h = nf_conntrack_find_get(net, &zone, &tuple); 3303 if (!h) 3304 return -ENOENT; 3305 3306 ct = nf_ct_tuplehash_to_ctrack(h); 3307 /* No expectation linked to this connection tracking. */ 3308 if (!nfct_help(ct)) { 3309 nf_ct_put(ct); 3310 return 0; 3311 } 3312 3313 c.data = ct; 3314 3315 err = netlink_dump_start(ctnl, skb, nlh, &c); 3316 nf_ct_put(ct); 3317 3318 return err; 3319 } 3320 3321 static int ctnetlink_get_expect(struct sk_buff *skb, 3322 const struct nfnl_info *info, 3323 const struct nlattr * const cda[]) 3324 { 3325 u_int8_t u3 = info->nfmsg->nfgen_family; 3326 struct nf_conntrack_tuple tuple; 3327 struct nf_conntrack_expect *exp; 3328 struct nf_conntrack_zone zone; 3329 struct sk_buff *skb2; 3330 int err; 3331 3332 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3333 if (cda[CTA_EXPECT_MASTER]) 3334 return ctnetlink_dump_exp_ct(info->net, info->sk, skb, 3335 info->nlh, cda, 3336 info->extack); 3337 else { 3338 struct netlink_dump_control c = { 3339 .dump = ctnetlink_exp_dump_table, 3340 .done = ctnetlink_exp_done, 3341 }; 3342 return netlink_dump_start(info->sk, skb, info->nlh, &c); 3343 } 3344 } 3345 3346 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3347 if (err < 0) 3348 return err; 3349 3350 if (cda[CTA_EXPECT_TUPLE]) 3351 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3352 u3, NULL); 3353 else if (cda[CTA_EXPECT_MASTER]) 3354 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, 3355 u3, NULL); 3356 else 3357 return -EINVAL; 3358 3359 if (err < 0) 3360 return err; 3361 3362 exp = nf_ct_expect_find_get(info->net, &zone, &tuple); 3363 if (!exp) 3364 return -ENOENT; 3365 3366 if (cda[CTA_EXPECT_ID]) { 3367 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); 3368 3369 if (id != nf_expect_get_id(exp)) { 3370 nf_ct_expect_put(exp); 3371 return -ENOENT; 3372 } 3373 } 3374 3375 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3376 if (!skb2) { 3377 nf_ct_expect_put(exp); 3378 return -ENOMEM; 3379 } 3380 3381 rcu_read_lock(); 3382 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, 3383 info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, 3384 exp); 3385 rcu_read_unlock(); 3386 nf_ct_expect_put(exp); 3387 if (err <= 0) { 3388 kfree_skb(skb2); 3389 return -ENOMEM; 3390 } 3391 3392 return nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); 3393 } 3394 3395 static bool expect_iter_name(struct nf_conntrack_expect *exp, void *data) 3396 { 3397 const struct nf_conn_help *m_help; 3398 const char *name = data; 3399 3400 m_help = nfct_help(exp->master); 3401 3402 return strcmp(m_help->helper->name, name) == 0; 3403 } 3404 3405 static bool expect_iter_all(struct nf_conntrack_expect *exp, void *data) 3406 { 3407 return true; 3408 } 3409 3410 static int ctnetlink_del_expect(struct sk_buff *skb, 3411 const struct nfnl_info *info, 3412 const struct nlattr * const cda[]) 3413 { 3414 u_int8_t u3 = info->nfmsg->nfgen_family; 3415 struct nf_conntrack_expect *exp; 3416 struct nf_conntrack_tuple tuple; 3417 struct nf_conntrack_zone zone; 3418 int err; 3419 3420 if (cda[CTA_EXPECT_TUPLE]) { 3421 /* delete a single expect by tuple */ 3422 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3423 if (err < 0) 3424 return err; 3425 3426 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3427 u3, NULL); 3428 if (err < 0) 3429 return err; 3430 3431 /* bump usage count to 2 */ 3432 exp = nf_ct_expect_find_get(info->net, &zone, &tuple); 3433 if (!exp) 3434 return -ENOENT; 3435 3436 if (cda[CTA_EXPECT_ID]) { 3437 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); 3438 if (ntohl(id) != (u32)(unsigned long)exp) { 3439 nf_ct_expect_put(exp); 3440 return -ENOENT; 3441 } 3442 } 3443 3444 /* after list removal, usage count == 1 */ 3445 spin_lock_bh(&nf_conntrack_expect_lock); 3446 if (del_timer(&exp->timeout)) { 3447 nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, 3448 nlmsg_report(info->nlh)); 3449 nf_ct_expect_put(exp); 3450 } 3451 spin_unlock_bh(&nf_conntrack_expect_lock); 3452 /* have to put what we 'get' above. 3453 * after this line usage count == 0 */ 3454 nf_ct_expect_put(exp); 3455 } else if (cda[CTA_EXPECT_HELP_NAME]) { 3456 char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]); 3457 3458 nf_ct_expect_iterate_net(info->net, expect_iter_name, name, 3459 NETLINK_CB(skb).portid, 3460 nlmsg_report(info->nlh)); 3461 } else { 3462 /* This basically means we have to flush everything*/ 3463 nf_ct_expect_iterate_net(info->net, expect_iter_all, NULL, 3464 NETLINK_CB(skb).portid, 3465 nlmsg_report(info->nlh)); 3466 } 3467 3468 return 0; 3469 } 3470 static int 3471 ctnetlink_change_expect(struct nf_conntrack_expect *x, 3472 const struct nlattr * const cda[]) 3473 { 3474 if (cda[CTA_EXPECT_TIMEOUT]) { 3475 if (!del_timer(&x->timeout)) 3476 return -ETIME; 3477 3478 x->timeout.expires = jiffies + 3479 ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ; 3480 add_timer(&x->timeout); 3481 } 3482 return 0; 3483 } 3484 3485 static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = { 3486 [CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 }, 3487 [CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED }, 3488 }; 3489 3490 static int 3491 ctnetlink_parse_expect_nat(const struct nlattr *attr, 3492 struct nf_conntrack_expect *exp, 3493 u_int8_t u3) 3494 { 3495 #if IS_ENABLED(CONFIG_NF_NAT) 3496 struct nlattr *tb[CTA_EXPECT_NAT_MAX+1]; 3497 struct nf_conntrack_tuple nat_tuple = {}; 3498 int err; 3499 3500 err = nla_parse_nested_deprecated(tb, CTA_EXPECT_NAT_MAX, attr, 3501 exp_nat_nla_policy, NULL); 3502 if (err < 0) 3503 return err; 3504 3505 if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE]) 3506 return -EINVAL; 3507 3508 err = ctnetlink_parse_tuple((const struct nlattr * const *)tb, 3509 &nat_tuple, CTA_EXPECT_NAT_TUPLE, 3510 u3, NULL); 3511 if (err < 0) 3512 return err; 3513 3514 exp->saved_addr = nat_tuple.src.u3; 3515 exp->saved_proto = nat_tuple.src.u; 3516 exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR])); 3517 3518 return 0; 3519 #else 3520 return -EOPNOTSUPP; 3521 #endif 3522 } 3523 3524 static struct nf_conntrack_expect * 3525 ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, 3526 struct nf_conntrack_helper *helper, 3527 struct nf_conntrack_tuple *tuple, 3528 struct nf_conntrack_tuple *mask) 3529 { 3530 u_int32_t class = 0; 3531 struct nf_conntrack_expect *exp; 3532 struct nf_conn_help *help; 3533 int err; 3534 3535 help = nfct_help(ct); 3536 if (!help) 3537 return ERR_PTR(-EOPNOTSUPP); 3538 3539 if (cda[CTA_EXPECT_CLASS] && helper) { 3540 class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS])); 3541 if (class > helper->expect_class_max) 3542 return ERR_PTR(-EINVAL); 3543 } 3544 exp = nf_ct_expect_alloc(ct); 3545 if (!exp) 3546 return ERR_PTR(-ENOMEM); 3547 3548 if (cda[CTA_EXPECT_FLAGS]) { 3549 exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS])); 3550 exp->flags &= ~NF_CT_EXPECT_USERSPACE; 3551 } else { 3552 exp->flags = 0; 3553 } 3554 if (cda[CTA_EXPECT_FN]) { 3555 const char *name = nla_data(cda[CTA_EXPECT_FN]); 3556 struct nf_ct_helper_expectfn *expfn; 3557 3558 expfn = nf_ct_helper_expectfn_find_by_name(name); 3559 if (expfn == NULL) { 3560 err = -EINVAL; 3561 goto err_out; 3562 } 3563 exp->expectfn = expfn->expectfn; 3564 } else 3565 exp->expectfn = NULL; 3566 3567 exp->class = class; 3568 exp->master = ct; 3569 exp->helper = helper; 3570 exp->tuple = *tuple; 3571 exp->mask.src.u3 = mask->src.u3; 3572 exp->mask.src.u.all = mask->src.u.all; 3573 3574 if (cda[CTA_EXPECT_NAT]) { 3575 err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT], 3576 exp, nf_ct_l3num(ct)); 3577 if (err < 0) 3578 goto err_out; 3579 } 3580 return exp; 3581 err_out: 3582 nf_ct_expect_put(exp); 3583 return ERR_PTR(err); 3584 } 3585 3586 static int 3587 ctnetlink_create_expect(struct net *net, 3588 const struct nf_conntrack_zone *zone, 3589 const struct nlattr * const cda[], 3590 u_int8_t u3, u32 portid, int report) 3591 { 3592 struct nf_conntrack_tuple tuple, mask, master_tuple; 3593 struct nf_conntrack_tuple_hash *h = NULL; 3594 struct nf_conntrack_helper *helper = NULL; 3595 struct nf_conntrack_expect *exp; 3596 struct nf_conn *ct; 3597 int err; 3598 3599 /* caller guarantees that those three CTA_EXPECT_* exist */ 3600 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3601 u3, NULL); 3602 if (err < 0) 3603 return err; 3604 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, 3605 u3, NULL); 3606 if (err < 0) 3607 return err; 3608 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, 3609 u3, NULL); 3610 if (err < 0) 3611 return err; 3612 3613 /* Look for master conntrack of this expectation */ 3614 h = nf_conntrack_find_get(net, zone, &master_tuple); 3615 if (!h) 3616 return -ENOENT; 3617 ct = nf_ct_tuplehash_to_ctrack(h); 3618 3619 rcu_read_lock(); 3620 if (cda[CTA_EXPECT_HELP_NAME]) { 3621 const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]); 3622 3623 helper = __nf_conntrack_helper_find(helpname, u3, 3624 nf_ct_protonum(ct)); 3625 if (helper == NULL) { 3626 rcu_read_unlock(); 3627 #ifdef CONFIG_MODULES 3628 if (request_module("nfct-helper-%s", helpname) < 0) { 3629 err = -EOPNOTSUPP; 3630 goto err_ct; 3631 } 3632 rcu_read_lock(); 3633 helper = __nf_conntrack_helper_find(helpname, u3, 3634 nf_ct_protonum(ct)); 3635 if (helper) { 3636 err = -EAGAIN; 3637 goto err_rcu; 3638 } 3639 rcu_read_unlock(); 3640 #endif 3641 err = -EOPNOTSUPP; 3642 goto err_ct; 3643 } 3644 } 3645 3646 exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask); 3647 if (IS_ERR(exp)) { 3648 err = PTR_ERR(exp); 3649 goto err_rcu; 3650 } 3651 3652 err = nf_ct_expect_related_report(exp, portid, report, 0); 3653 nf_ct_expect_put(exp); 3654 err_rcu: 3655 rcu_read_unlock(); 3656 err_ct: 3657 nf_ct_put(ct); 3658 return err; 3659 } 3660 3661 static int ctnetlink_new_expect(struct sk_buff *skb, 3662 const struct nfnl_info *info, 3663 const struct nlattr * const cda[]) 3664 { 3665 u_int8_t u3 = info->nfmsg->nfgen_family; 3666 struct nf_conntrack_tuple tuple; 3667 struct nf_conntrack_expect *exp; 3668 struct nf_conntrack_zone zone; 3669 int err; 3670 3671 if (!cda[CTA_EXPECT_TUPLE] 3672 || !cda[CTA_EXPECT_MASK] 3673 || !cda[CTA_EXPECT_MASTER]) 3674 return -EINVAL; 3675 3676 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone); 3677 if (err < 0) 3678 return err; 3679 3680 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, 3681 u3, NULL); 3682 if (err < 0) 3683 return err; 3684 3685 spin_lock_bh(&nf_conntrack_expect_lock); 3686 exp = __nf_ct_expect_find(info->net, &zone, &tuple); 3687 if (!exp) { 3688 spin_unlock_bh(&nf_conntrack_expect_lock); 3689 err = -ENOENT; 3690 if (info->nlh->nlmsg_flags & NLM_F_CREATE) { 3691 err = ctnetlink_create_expect(info->net, &zone, cda, u3, 3692 NETLINK_CB(skb).portid, 3693 nlmsg_report(info->nlh)); 3694 } 3695 return err; 3696 } 3697 3698 err = -EEXIST; 3699 if (!(info->nlh->nlmsg_flags & NLM_F_EXCL)) 3700 err = ctnetlink_change_expect(exp, cda); 3701 spin_unlock_bh(&nf_conntrack_expect_lock); 3702 3703 return err; 3704 } 3705 3706 static int 3707 ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu, 3708 const struct ip_conntrack_stat *st) 3709 { 3710 struct nlmsghdr *nlh; 3711 unsigned int flags = portid ? NLM_F_MULTI : 0, event; 3712 3713 event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, 3714 IPCTNL_MSG_EXP_GET_STATS_CPU); 3715 nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, 3716 NFNETLINK_V0, htons(cpu)); 3717 if (!nlh) 3718 goto nlmsg_failure; 3719 3720 if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) || 3721 nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) || 3722 nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete))) 3723 goto nla_put_failure; 3724 3725 nlmsg_end(skb, nlh); 3726 return skb->len; 3727 3728 nla_put_failure: 3729 nlmsg_failure: 3730 nlmsg_cancel(skb, nlh); 3731 return -1; 3732 } 3733 3734 static int 3735 ctnetlink_exp_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb) 3736 { 3737 int cpu; 3738 struct net *net = sock_net(skb->sk); 3739 3740 if (cb->args[0] == nr_cpu_ids) 3741 return 0; 3742 3743 for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) { 3744 const struct ip_conntrack_stat *st; 3745 3746 if (!cpu_possible(cpu)) 3747 continue; 3748 3749 st = per_cpu_ptr(net->ct.stat, cpu); 3750 if (ctnetlink_exp_stat_fill_info(skb, NETLINK_CB(cb->skb).portid, 3751 cb->nlh->nlmsg_seq, 3752 cpu, st) < 0) 3753 break; 3754 } 3755 cb->args[0] = cpu; 3756 3757 return skb->len; 3758 } 3759 3760 static int ctnetlink_stat_exp_cpu(struct sk_buff *skb, 3761 const struct nfnl_info *info, 3762 const struct nlattr * const cda[]) 3763 { 3764 if (info->nlh->nlmsg_flags & NLM_F_DUMP) { 3765 struct netlink_dump_control c = { 3766 .dump = ctnetlink_exp_stat_cpu_dump, 3767 }; 3768 return netlink_dump_start(info->sk, skb, info->nlh, &c); 3769 } 3770 3771 return 0; 3772 } 3773 3774 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3775 static struct nf_ct_event_notifier ctnl_notifier = { 3776 .ct_event = ctnetlink_conntrack_event, 3777 .exp_event = ctnetlink_expect_event, 3778 }; 3779 #endif 3780 3781 static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = { 3782 [IPCTNL_MSG_CT_NEW] = { 3783 .call = ctnetlink_new_conntrack, 3784 .type = NFNL_CB_MUTEX, 3785 .attr_count = CTA_MAX, 3786 .policy = ct_nla_policy 3787 }, 3788 [IPCTNL_MSG_CT_GET] = { 3789 .call = ctnetlink_get_conntrack, 3790 .type = NFNL_CB_MUTEX, 3791 .attr_count = CTA_MAX, 3792 .policy = ct_nla_policy 3793 }, 3794 [IPCTNL_MSG_CT_DELETE] = { 3795 .call = ctnetlink_del_conntrack, 3796 .type = NFNL_CB_MUTEX, 3797 .attr_count = CTA_MAX, 3798 .policy = ct_nla_policy 3799 }, 3800 [IPCTNL_MSG_CT_GET_CTRZERO] = { 3801 .call = ctnetlink_get_conntrack, 3802 .type = NFNL_CB_MUTEX, 3803 .attr_count = CTA_MAX, 3804 .policy = ct_nla_policy 3805 }, 3806 [IPCTNL_MSG_CT_GET_STATS_CPU] = { 3807 .call = ctnetlink_stat_ct_cpu, 3808 .type = NFNL_CB_MUTEX, 3809 }, 3810 [IPCTNL_MSG_CT_GET_STATS] = { 3811 .call = ctnetlink_stat_ct, 3812 .type = NFNL_CB_MUTEX, 3813 }, 3814 [IPCTNL_MSG_CT_GET_DYING] = { 3815 .call = ctnetlink_get_ct_dying, 3816 .type = NFNL_CB_MUTEX, 3817 }, 3818 [IPCTNL_MSG_CT_GET_UNCONFIRMED] = { 3819 .call = ctnetlink_get_ct_unconfirmed, 3820 .type = NFNL_CB_MUTEX, 3821 }, 3822 }; 3823 3824 static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = { 3825 [IPCTNL_MSG_EXP_GET] = { 3826 .call = ctnetlink_get_expect, 3827 .type = NFNL_CB_MUTEX, 3828 .attr_count = CTA_EXPECT_MAX, 3829 .policy = exp_nla_policy 3830 }, 3831 [IPCTNL_MSG_EXP_NEW] = { 3832 .call = ctnetlink_new_expect, 3833 .type = NFNL_CB_MUTEX, 3834 .attr_count = CTA_EXPECT_MAX, 3835 .policy = exp_nla_policy 3836 }, 3837 [IPCTNL_MSG_EXP_DELETE] = { 3838 .call = ctnetlink_del_expect, 3839 .type = NFNL_CB_MUTEX, 3840 .attr_count = CTA_EXPECT_MAX, 3841 .policy = exp_nla_policy 3842 }, 3843 [IPCTNL_MSG_EXP_GET_STATS_CPU] = { 3844 .call = ctnetlink_stat_exp_cpu, 3845 .type = NFNL_CB_MUTEX, 3846 }, 3847 }; 3848 3849 static const struct nfnetlink_subsystem ctnl_subsys = { 3850 .name = "conntrack", 3851 .subsys_id = NFNL_SUBSYS_CTNETLINK, 3852 .cb_count = IPCTNL_MSG_MAX, 3853 .cb = ctnl_cb, 3854 }; 3855 3856 static const struct nfnetlink_subsystem ctnl_exp_subsys = { 3857 .name = "conntrack_expect", 3858 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP, 3859 .cb_count = IPCTNL_MSG_EXP_MAX, 3860 .cb = ctnl_exp_cb, 3861 }; 3862 3863 MODULE_ALIAS("ip_conntrack_netlink"); 3864 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK); 3865 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP); 3866 3867 static int __net_init ctnetlink_net_init(struct net *net) 3868 { 3869 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3870 nf_conntrack_register_notifier(net, &ctnl_notifier); 3871 #endif 3872 return 0; 3873 } 3874 3875 static void ctnetlink_net_pre_exit(struct net *net) 3876 { 3877 #ifdef CONFIG_NF_CONNTRACK_EVENTS 3878 nf_conntrack_unregister_notifier(net); 3879 #endif 3880 } 3881 3882 static struct pernet_operations ctnetlink_net_ops = { 3883 .init = ctnetlink_net_init, 3884 .pre_exit = ctnetlink_net_pre_exit, 3885 }; 3886 3887 static int __init ctnetlink_init(void) 3888 { 3889 int ret; 3890 3891 BUILD_BUG_ON(sizeof(struct ctnetlink_list_dump_ctx) > sizeof_field(struct netlink_callback, ctx)); 3892 3893 ret = nfnetlink_subsys_register(&ctnl_subsys); 3894 if (ret < 0) { 3895 pr_err("ctnetlink_init: cannot register with nfnetlink.\n"); 3896 goto err_out; 3897 } 3898 3899 ret = nfnetlink_subsys_register(&ctnl_exp_subsys); 3900 if (ret < 0) { 3901 pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n"); 3902 goto err_unreg_subsys; 3903 } 3904 3905 ret = register_pernet_subsys(&ctnetlink_net_ops); 3906 if (ret < 0) { 3907 pr_err("ctnetlink_init: cannot register pernet operations\n"); 3908 goto err_unreg_exp_subsys; 3909 } 3910 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT 3911 /* setup interaction between nf_queue and nf_conntrack_netlink. */ 3912 RCU_INIT_POINTER(nfnl_ct_hook, &ctnetlink_glue_hook); 3913 #endif 3914 return 0; 3915 3916 err_unreg_exp_subsys: 3917 nfnetlink_subsys_unregister(&ctnl_exp_subsys); 3918 err_unreg_subsys: 3919 nfnetlink_subsys_unregister(&ctnl_subsys); 3920 err_out: 3921 return ret; 3922 } 3923 3924 static void __exit ctnetlink_exit(void) 3925 { 3926 unregister_pernet_subsys(&ctnetlink_net_ops); 3927 nfnetlink_subsys_unregister(&ctnl_exp_subsys); 3928 nfnetlink_subsys_unregister(&ctnl_subsys); 3929 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT 3930 RCU_INIT_POINTER(nfnl_ct_hook, NULL); 3931 #endif 3932 synchronize_rcu(); 3933 } 3934 3935 module_init(ctnetlink_init); 3936 module_exit(ctnetlink_exit); 3937