]>
Commit | Line | Data |
---|---|---|
e97150df | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
12f7a505 PNA |
2 | /* |
3 | * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org> | |
4 | * | |
12f7a505 PNA |
5 | * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com> |
6 | */ | |
7 | #include <linux/init.h> | |
8 | #include <linux/module.h> | |
9 | #include <linux/kernel.h> | |
10 | #include <linux/skbuff.h> | |
11 | #include <linux/netlink.h> | |
12 | #include <linux/rculist.h> | |
13 | #include <linux/slab.h> | |
14 | #include <linux/types.h> | |
15 | #include <linux/list.h> | |
16 | #include <linux/errno.h> | |
4b380c42 | 17 | #include <linux/capability.h> |
12f7a505 PNA |
18 | #include <net/netlink.h> |
19 | #include <net/sock.h> | |
20 | ||
21 | #include <net/netfilter/nf_conntrack_helper.h> | |
22 | #include <net/netfilter/nf_conntrack_expect.h> | |
23 | #include <net/netfilter/nf_conntrack_ecache.h> | |
24 | ||
25 | #include <linux/netfilter/nfnetlink.h> | |
26 | #include <linux/netfilter/nfnetlink_conntrack.h> | |
27 | #include <linux/netfilter/nfnetlink_cthelper.h> | |
28 | ||
29 | MODULE_LICENSE("GPL"); | |
30 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); | |
31 | MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers"); | |
32 | ||
83d90219 LZ |
33 | struct nfnl_cthelper { |
34 | struct list_head list; | |
35 | struct nf_conntrack_helper helper; | |
36 | }; | |
37 | ||
38 | static LIST_HEAD(nfnl_cthelper_list); | |
39 | ||
12f7a505 PNA |
40 | static int |
41 | nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff, | |
42 | struct nf_conn *ct, enum ip_conntrack_info ctinfo) | |
43 | { | |
44 | const struct nf_conn_help *help; | |
45 | struct nf_conntrack_helper *helper; | |
46 | ||
47 | help = nfct_help(ct); | |
48 | if (help == NULL) | |
49 | return NF_DROP; | |
50 | ||
e2361cb9 | 51 | /* rcu_read_lock()ed by nf_hook_thresh */ |
12f7a505 PNA |
52 | helper = rcu_dereference(help->helper); |
53 | if (helper == NULL) | |
54 | return NF_DROP; | |
55 | ||
9332ef9d | 56 | /* This is a user-space helper not yet configured, skip. */ |
12f7a505 PNA |
57 | if ((helper->flags & |
58 | (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) == | |
59 | NF_CT_HELPER_F_USERSPACE) | |
60 | return NF_ACCEPT; | |
61 | ||
62 | /* If the user-space helper is not available, don't block traffic. */ | |
63 | return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS; | |
64 | } | |
65 | ||
66 | static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = { | |
67 | [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, }, | |
68 | [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, }, | |
69 | }; | |
70 | ||
71 | static int | |
72 | nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple, | |
73 | const struct nlattr *attr) | |
74 | { | |
130ffbc2 | 75 | int err; |
12f7a505 PNA |
76 | struct nlattr *tb[NFCTH_TUPLE_MAX+1]; |
77 | ||
8cb08174 JB |
78 | err = nla_parse_nested_deprecated(tb, NFCTH_TUPLE_MAX, attr, |
79 | nfnl_cthelper_tuple_pol, NULL); | |
130ffbc2 DB |
80 | if (err < 0) |
81 | return err; | |
12f7a505 PNA |
82 | |
83 | if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM]) | |
84 | return -EINVAL; | |
85 | ||
78146572 IW |
86 | /* Not all fields are initialized so first zero the tuple */ |
87 | memset(tuple, 0, sizeof(struct nf_conntrack_tuple)); | |
88 | ||
fe31d1a8 | 89 | tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM])); |
12f7a505 PNA |
90 | tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]); |
91 | ||
92 | return 0; | |
93 | } | |
94 | ||
95 | static int | |
96 | nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct) | |
97 | { | |
b18c5d15 | 98 | struct nf_conn_help *help = nfct_help(ct); |
e14575fa | 99 | const struct nf_conntrack_helper *helper; |
12f7a505 | 100 | |
7be54ca4 PNA |
101 | if (attr == NULL) |
102 | return -EINVAL; | |
103 | ||
e14575fa FW |
104 | helper = rcu_dereference(help->helper); |
105 | if (!helper || helper->data_len == 0) | |
12f7a505 PNA |
106 | return -EINVAL; |
107 | ||
703acd70 | 108 | nla_memcpy(help->data, attr, sizeof(help->data)); |
12f7a505 PNA |
109 | return 0; |
110 | } | |
111 | ||
112 | static int | |
113 | nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct) | |
114 | { | |
115 | const struct nf_conn_help *help = nfct_help(ct); | |
e14575fa | 116 | const struct nf_conntrack_helper *helper; |
12f7a505 | 117 | |
e14575fa FW |
118 | helper = rcu_dereference(help->helper); |
119 | if (helper && helper->data_len && | |
120 | nla_put(skb, CTA_HELP_INFO, helper->data_len, &help->data)) | |
12f7a505 PNA |
121 | goto nla_put_failure; |
122 | ||
123 | return 0; | |
124 | ||
125 | nla_put_failure: | |
126 | return -ENOSPC; | |
127 | } | |
128 | ||
129 | static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = { | |
130 | [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING, | |
131 | .len = NF_CT_HELPER_NAME_LEN-1 }, | |
132 | [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, }, | |
133 | [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, }, | |
134 | }; | |
135 | ||
136 | static int | |
137 | nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy, | |
138 | const struct nlattr *attr) | |
139 | { | |
130ffbc2 | 140 | int err; |
12f7a505 PNA |
141 | struct nlattr *tb[NFCTH_POLICY_MAX+1]; |
142 | ||
8cb08174 JB |
143 | err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr, |
144 | nfnl_cthelper_expect_pol, NULL); | |
130ffbc2 DB |
145 | if (err < 0) |
146 | return err; | |
12f7a505 PNA |
147 | |
148 | if (!tb[NFCTH_POLICY_NAME] || | |
149 | !tb[NFCTH_POLICY_EXPECT_MAX] || | |
150 | !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) | |
151 | return -EINVAL; | |
152 | ||
872f6903 | 153 | nla_strscpy(expect_policy->name, |
4b83a904 | 154 | tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN); |
12f7a505 PNA |
155 | expect_policy->max_expected = |
156 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); | |
92f73221 GF |
157 | if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) |
158 | return -EINVAL; | |
159 | ||
12f7a505 PNA |
160 | expect_policy->timeout = |
161 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); | |
162 | ||
163 | return 0; | |
164 | } | |
165 | ||
166 | static const struct nla_policy | |
167 | nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = { | |
168 | [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, }, | |
169 | }; | |
170 | ||
171 | static int | |
172 | nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, | |
173 | const struct nlattr *attr) | |
174 | { | |
175 | int i, ret; | |
176 | struct nf_conntrack_expect_policy *expect_policy; | |
177 | struct nlattr *tb[NFCTH_POLICY_SET_MAX+1]; | |
ae5c6821 | 178 | unsigned int class_max; |
12f7a505 | 179 | |
8cb08174 JB |
180 | ret = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr, |
181 | nfnl_cthelper_expect_policy_set, | |
182 | NULL); | |
130ffbc2 DB |
183 | if (ret < 0) |
184 | return ret; | |
12f7a505 PNA |
185 | |
186 | if (!tb[NFCTH_POLICY_SET_NUM]) | |
187 | return -EINVAL; | |
188 | ||
ae5c6821 LZ |
189 | class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); |
190 | if (class_max == 0) | |
191 | return -EINVAL; | |
192 | if (class_max > NF_CT_MAX_EXPECT_CLASSES) | |
12f7a505 PNA |
193 | return -EOVERFLOW; |
194 | ||
6396bb22 KC |
195 | expect_policy = kcalloc(class_max, |
196 | sizeof(struct nf_conntrack_expect_policy), | |
197 | GFP_KERNEL); | |
12f7a505 PNA |
198 | if (expect_policy == NULL) |
199 | return -ENOMEM; | |
200 | ||
ae5c6821 | 201 | for (i = 0; i < class_max; i++) { |
12f7a505 PNA |
202 | if (!tb[NFCTH_POLICY_SET+i]) |
203 | goto err; | |
204 | ||
205 | ret = nfnl_cthelper_expect_policy(&expect_policy[i], | |
206 | tb[NFCTH_POLICY_SET+i]); | |
207 | if (ret < 0) | |
208 | goto err; | |
209 | } | |
ae5c6821 LZ |
210 | |
211 | helper->expect_class_max = class_max - 1; | |
12f7a505 PNA |
212 | helper->expect_policy = expect_policy; |
213 | return 0; | |
214 | err: | |
215 | kfree(expect_policy); | |
216 | return -EINVAL; | |
217 | } | |
218 | ||
219 | static int | |
220 | nfnl_cthelper_create(const struct nlattr * const tb[], | |
221 | struct nf_conntrack_tuple *tuple) | |
222 | { | |
223 | struct nf_conntrack_helper *helper; | |
83d90219 | 224 | struct nfnl_cthelper *nfcth; |
157ffffe | 225 | unsigned int size; |
12f7a505 PNA |
226 | int ret; |
227 | ||
228 | if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN]) | |
229 | return -EINVAL; | |
230 | ||
83d90219 LZ |
231 | nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL); |
232 | if (nfcth == NULL) | |
12f7a505 | 233 | return -ENOMEM; |
83d90219 | 234 | helper = &nfcth->helper; |
12f7a505 PNA |
235 | |
236 | ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]); | |
237 | if (ret < 0) | |
f83bf8da | 238 | goto err1; |
12f7a505 | 239 | |
872f6903 | 240 | nla_strscpy(helper->name, |
4b83a904 | 241 | tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN); |
157ffffe | 242 | size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); |
c593642c | 243 | if (size > sizeof_field(struct nf_conn_help, data)) { |
157ffffe FW |
244 | ret = -ENOMEM; |
245 | goto err2; | |
246 | } | |
703acd70 | 247 | helper->data_len = size; |
157ffffe | 248 | |
12f7a505 PNA |
249 | helper->flags |= NF_CT_HELPER_F_USERSPACE; |
250 | memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple)); | |
251 | ||
252 | helper->me = THIS_MODULE; | |
253 | helper->help = nfnl_userspace_cthelper; | |
254 | helper->from_nlattr = nfnl_cthelper_from_nlattr; | |
255 | helper->to_nlattr = nfnl_cthelper_to_nlattr; | |
256 | ||
257 | /* Default to queue number zero, this can be updated at any time. */ | |
258 | if (tb[NFCTH_QUEUE_NUM]) | |
259 | helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); | |
260 | ||
261 | if (tb[NFCTH_STATUS]) { | |
262 | int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); | |
263 | ||
264 | switch(status) { | |
265 | case NFCT_HELPER_STATUS_ENABLED: | |
266 | helper->flags |= NF_CT_HELPER_F_CONFIGURED; | |
267 | break; | |
268 | case NFCT_HELPER_STATUS_DISABLED: | |
269 | helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; | |
270 | break; | |
271 | } | |
272 | } | |
273 | ||
274 | ret = nf_conntrack_helper_register(helper); | |
275 | if (ret < 0) | |
f83bf8da | 276 | goto err2; |
12f7a505 | 277 | |
83d90219 | 278 | list_add_tail(&nfcth->list, &nfnl_cthelper_list); |
12f7a505 | 279 | return 0; |
f83bf8da JC |
280 | err2: |
281 | kfree(helper->expect_policy); | |
282 | err1: | |
83d90219 | 283 | kfree(nfcth); |
12f7a505 PNA |
284 | return ret; |
285 | } | |
286 | ||
2c422257 PNA |
287 | static int |
288 | nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy, | |
289 | struct nf_conntrack_expect_policy *new_policy, | |
290 | const struct nlattr *attr) | |
291 | { | |
292 | struct nlattr *tb[NFCTH_POLICY_MAX + 1]; | |
293 | int err; | |
294 | ||
8cb08174 JB |
295 | err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr, |
296 | nfnl_cthelper_expect_pol, NULL); | |
2c422257 PNA |
297 | if (err < 0) |
298 | return err; | |
299 | ||
300 | if (!tb[NFCTH_POLICY_NAME] || | |
301 | !tb[NFCTH_POLICY_EXPECT_MAX] || | |
302 | !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) | |
303 | return -EINVAL; | |
304 | ||
305 | if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name)) | |
306 | return -EBUSY; | |
307 | ||
308 | new_policy->max_expected = | |
309 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); | |
92f73221 GF |
310 | if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT) |
311 | return -EINVAL; | |
312 | ||
2c422257 PNA |
313 | new_policy->timeout = |
314 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); | |
315 | ||
316 | return 0; | |
317 | } | |
318 | ||
319 | static int nfnl_cthelper_update_policy_all(struct nlattr *tb[], | |
320 | struct nf_conntrack_helper *helper) | |
321 | { | |
14463859 | 322 | struct nf_conntrack_expect_policy *new_policy; |
2c422257 | 323 | struct nf_conntrack_expect_policy *policy; |
14463859 GS |
324 | int i, ret = 0; |
325 | ||
326 | new_policy = kmalloc_array(helper->expect_class_max + 1, | |
327 | sizeof(*new_policy), GFP_KERNEL); | |
328 | if (!new_policy) | |
329 | return -ENOMEM; | |
2c422257 PNA |
330 | |
331 | /* Check first that all policy attributes are well-formed, so we don't | |
332 | * leave things in inconsistent state on errors. | |
333 | */ | |
334 | for (i = 0; i < helper->expect_class_max + 1; i++) { | |
335 | ||
14463859 GS |
336 | if (!tb[NFCTH_POLICY_SET + i]) { |
337 | ret = -EINVAL; | |
338 | goto err; | |
339 | } | |
2c422257 | 340 | |
14463859 | 341 | ret = nfnl_cthelper_update_policy_one(&helper->expect_policy[i], |
2c422257 PNA |
342 | &new_policy[i], |
343 | tb[NFCTH_POLICY_SET + i]); | |
14463859 GS |
344 | if (ret < 0) |
345 | goto err; | |
2c422257 PNA |
346 | } |
347 | /* Now we can safely update them. */ | |
348 | for (i = 0; i < helper->expect_class_max + 1; i++) { | |
349 | policy = (struct nf_conntrack_expect_policy *) | |
350 | &helper->expect_policy[i]; | |
351 | policy->max_expected = new_policy->max_expected; | |
352 | policy->timeout = new_policy->timeout; | |
353 | } | |
354 | ||
14463859 GS |
355 | err: |
356 | kfree(new_policy); | |
357 | return ret; | |
2c422257 PNA |
358 | } |
359 | ||
360 | static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper, | |
361 | const struct nlattr *attr) | |
362 | { | |
363 | struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1]; | |
364 | unsigned int class_max; | |
365 | int err; | |
366 | ||
8cb08174 JB |
367 | err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr, |
368 | nfnl_cthelper_expect_policy_set, | |
369 | NULL); | |
2c422257 PNA |
370 | if (err < 0) |
371 | return err; | |
372 | ||
373 | if (!tb[NFCTH_POLICY_SET_NUM]) | |
374 | return -EINVAL; | |
375 | ||
376 | class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); | |
377 | if (helper->expect_class_max + 1 != class_max) | |
378 | return -EBUSY; | |
379 | ||
380 | return nfnl_cthelper_update_policy_all(tb, helper); | |
381 | } | |
382 | ||
12f7a505 PNA |
383 | static int |
384 | nfnl_cthelper_update(const struct nlattr * const tb[], | |
385 | struct nf_conntrack_helper *helper) | |
386 | { | |
8971ee8b | 387 | u32 size; |
12f7a505 PNA |
388 | int ret; |
389 | ||
8971ee8b PNA |
390 | if (tb[NFCTH_PRIV_DATA_LEN]) { |
391 | size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); | |
392 | if (size != helper->data_len) | |
393 | return -EBUSY; | |
394 | } | |
12f7a505 PNA |
395 | |
396 | if (tb[NFCTH_POLICY]) { | |
2c422257 | 397 | ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]); |
12f7a505 PNA |
398 | if (ret < 0) |
399 | return ret; | |
400 | } | |
401 | if (tb[NFCTH_QUEUE_NUM]) | |
402 | helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); | |
403 | ||
404 | if (tb[NFCTH_STATUS]) { | |
405 | int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); | |
406 | ||
407 | switch(status) { | |
408 | case NFCT_HELPER_STATUS_ENABLED: | |
409 | helper->flags |= NF_CT_HELPER_F_CONFIGURED; | |
410 | break; | |
411 | case NFCT_HELPER_STATUS_DISABLED: | |
412 | helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; | |
413 | break; | |
414 | } | |
415 | } | |
416 | return 0; | |
417 | } | |
418 | ||
a6555365 PNA |
419 | static int nfnl_cthelper_new(struct sk_buff *skb, const struct nfnl_info *info, |
420 | const struct nlattr * const tb[]) | |
12f7a505 PNA |
421 | { |
422 | const char *helper_name; | |
423 | struct nf_conntrack_helper *cur, *helper = NULL; | |
424 | struct nf_conntrack_tuple tuple; | |
83d90219 LZ |
425 | struct nfnl_cthelper *nlcth; |
426 | int ret = 0; | |
12f7a505 | 427 | |
4b380c42 KC |
428 | if (!capable(CAP_NET_ADMIN)) |
429 | return -EPERM; | |
430 | ||
12f7a505 PNA |
431 | if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE]) |
432 | return -EINVAL; | |
433 | ||
434 | helper_name = nla_data(tb[NFCTH_NAME]); | |
435 | ||
436 | ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); | |
437 | if (ret < 0) | |
438 | return ret; | |
439 | ||
83d90219 LZ |
440 | list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { |
441 | cur = &nlcth->helper; | |
12f7a505 | 442 | |
83d90219 LZ |
443 | if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) |
444 | continue; | |
12f7a505 | 445 | |
83d90219 LZ |
446 | if ((tuple.src.l3num != cur->tuple.src.l3num || |
447 | tuple.dst.protonum != cur->tuple.dst.protonum)) | |
448 | continue; | |
12f7a505 | 449 | |
a6555365 | 450 | if (info->nlh->nlmsg_flags & NLM_F_EXCL) |
83d90219 | 451 | return -EEXIST; |
12f7a505 | 452 | |
83d90219 LZ |
453 | helper = cur; |
454 | break; | |
12f7a505 | 455 | } |
12f7a505 PNA |
456 | |
457 | if (helper == NULL) | |
458 | ret = nfnl_cthelper_create(tb, &tuple); | |
459 | else | |
460 | ret = nfnl_cthelper_update(tb, helper); | |
461 | ||
462 | return ret; | |
12f7a505 PNA |
463 | } |
464 | ||
465 | static int | |
466 | nfnl_cthelper_dump_tuple(struct sk_buff *skb, | |
467 | struct nf_conntrack_helper *helper) | |
468 | { | |
469 | struct nlattr *nest_parms; | |
470 | ||
ae0be8de | 471 | nest_parms = nla_nest_start(skb, NFCTH_TUPLE); |
12f7a505 PNA |
472 | if (nest_parms == NULL) |
473 | goto nla_put_failure; | |
474 | ||
475 | if (nla_put_be16(skb, NFCTH_TUPLE_L3PROTONUM, | |
476 | htons(helper->tuple.src.l3num))) | |
477 | goto nla_put_failure; | |
478 | ||
479 | if (nla_put_u8(skb, NFCTH_TUPLE_L4PROTONUM, helper->tuple.dst.protonum)) | |
480 | goto nla_put_failure; | |
481 | ||
482 | nla_nest_end(skb, nest_parms); | |
483 | return 0; | |
484 | ||
485 | nla_put_failure: | |
486 | return -1; | |
487 | } | |
488 | ||
489 | static int | |
490 | nfnl_cthelper_dump_policy(struct sk_buff *skb, | |
491 | struct nf_conntrack_helper *helper) | |
492 | { | |
493 | int i; | |
494 | struct nlattr *nest_parms1, *nest_parms2; | |
495 | ||
ae0be8de | 496 | nest_parms1 = nla_nest_start(skb, NFCTH_POLICY); |
12f7a505 PNA |
497 | if (nest_parms1 == NULL) |
498 | goto nla_put_failure; | |
499 | ||
500 | if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM, | |
ae5c6821 | 501 | htonl(helper->expect_class_max + 1))) |
12f7a505 PNA |
502 | goto nla_put_failure; |
503 | ||
ae5c6821 | 504 | for (i = 0; i < helper->expect_class_max + 1; i++) { |
ae0be8de | 505 | nest_parms2 = nla_nest_start(skb, (NFCTH_POLICY_SET + i)); |
12f7a505 PNA |
506 | if (nest_parms2 == NULL) |
507 | goto nla_put_failure; | |
508 | ||
509 | if (nla_put_string(skb, NFCTH_POLICY_NAME, | |
510 | helper->expect_policy[i].name)) | |
511 | goto nla_put_failure; | |
512 | ||
513 | if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_MAX, | |
514 | htonl(helper->expect_policy[i].max_expected))) | |
515 | goto nla_put_failure; | |
516 | ||
517 | if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_TIMEOUT, | |
518 | htonl(helper->expect_policy[i].timeout))) | |
519 | goto nla_put_failure; | |
520 | ||
521 | nla_nest_end(skb, nest_parms2); | |
522 | } | |
523 | nla_nest_end(skb, nest_parms1); | |
524 | return 0; | |
525 | ||
526 | nla_put_failure: | |
527 | return -1; | |
528 | } | |
529 | ||
530 | static int | |
15e47304 | 531 | nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, |
12f7a505 PNA |
532 | int event, struct nf_conntrack_helper *helper) |
533 | { | |
534 | struct nlmsghdr *nlh; | |
15e47304 | 535 | unsigned int flags = portid ? NLM_F_MULTI : 0; |
12f7a505 PNA |
536 | int status; |
537 | ||
dedb67c4 | 538 | event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event); |
19c28b13 PNA |
539 | nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, |
540 | NFNETLINK_V0, 0); | |
541 | if (!nlh) | |
12f7a505 PNA |
542 | goto nlmsg_failure; |
543 | ||
12f7a505 PNA |
544 | if (nla_put_string(skb, NFCTH_NAME, helper->name)) |
545 | goto nla_put_failure; | |
546 | ||
547 | if (nla_put_be32(skb, NFCTH_QUEUE_NUM, htonl(helper->queue_num))) | |
548 | goto nla_put_failure; | |
549 | ||
550 | if (nfnl_cthelper_dump_tuple(skb, helper) < 0) | |
551 | goto nla_put_failure; | |
552 | ||
553 | if (nfnl_cthelper_dump_policy(skb, helper) < 0) | |
554 | goto nla_put_failure; | |
555 | ||
556 | if (nla_put_be32(skb, NFCTH_PRIV_DATA_LEN, htonl(helper->data_len))) | |
557 | goto nla_put_failure; | |
558 | ||
559 | if (helper->flags & NF_CT_HELPER_F_CONFIGURED) | |
560 | status = NFCT_HELPER_STATUS_ENABLED; | |
561 | else | |
562 | status = NFCT_HELPER_STATUS_DISABLED; | |
563 | ||
564 | if (nla_put_be32(skb, NFCTH_STATUS, htonl(status))) | |
565 | goto nla_put_failure; | |
566 | ||
567 | nlmsg_end(skb, nlh); | |
568 | return skb->len; | |
569 | ||
570 | nlmsg_failure: | |
571 | nla_put_failure: | |
572 | nlmsg_cancel(skb, nlh); | |
573 | return -1; | |
574 | } | |
575 | ||
576 | static int | |
577 | nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) | |
578 | { | |
579 | struct nf_conntrack_helper *cur, *last; | |
12f7a505 PNA |
580 | |
581 | rcu_read_lock(); | |
582 | last = (struct nf_conntrack_helper *)cb->args[1]; | |
583 | for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) { | |
584 | restart: | |
b67bfe0d | 585 | hlist_for_each_entry_rcu(cur, |
12f7a505 PNA |
586 | &nf_ct_helper_hash[cb->args[0]], hnode) { |
587 | ||
588 | /* skip non-userspace conntrack helpers. */ | |
589 | if (!(cur->flags & NF_CT_HELPER_F_USERSPACE)) | |
590 | continue; | |
591 | ||
592 | if (cb->args[1]) { | |
593 | if (cur != last) | |
594 | continue; | |
595 | cb->args[1] = 0; | |
596 | } | |
597 | if (nfnl_cthelper_fill_info(skb, | |
15e47304 | 598 | NETLINK_CB(cb->skb).portid, |
12f7a505 PNA |
599 | cb->nlh->nlmsg_seq, |
600 | NFNL_MSG_TYPE(cb->nlh->nlmsg_type), | |
601 | NFNL_MSG_CTHELPER_NEW, cur) < 0) { | |
602 | cb->args[1] = (unsigned long)cur; | |
603 | goto out; | |
604 | } | |
605 | } | |
606 | } | |
607 | if (cb->args[1]) { | |
608 | cb->args[1] = 0; | |
609 | goto restart; | |
610 | } | |
611 | out: | |
612 | rcu_read_unlock(); | |
613 | return skb->len; | |
614 | } | |
615 | ||
a6555365 PNA |
616 | static int nfnl_cthelper_get(struct sk_buff *skb, const struct nfnl_info *info, |
617 | const struct nlattr * const tb[]) | |
12f7a505 | 618 | { |
83d90219 | 619 | int ret = -ENOENT; |
12f7a505 | 620 | struct nf_conntrack_helper *cur; |
12f7a505 PNA |
621 | struct sk_buff *skb2; |
622 | char *helper_name = NULL; | |
623 | struct nf_conntrack_tuple tuple; | |
83d90219 | 624 | struct nfnl_cthelper *nlcth; |
12f7a505 PNA |
625 | bool tuple_set = false; |
626 | ||
4b380c42 KC |
627 | if (!capable(CAP_NET_ADMIN)) |
628 | return -EPERM; | |
629 | ||
a6555365 | 630 | if (info->nlh->nlmsg_flags & NLM_F_DUMP) { |
12f7a505 PNA |
631 | struct netlink_dump_control c = { |
632 | .dump = nfnl_cthelper_dump_table, | |
633 | }; | |
a6555365 | 634 | return netlink_dump_start(info->sk, skb, info->nlh, &c); |
12f7a505 PNA |
635 | } |
636 | ||
637 | if (tb[NFCTH_NAME]) | |
638 | helper_name = nla_data(tb[NFCTH_NAME]); | |
639 | ||
640 | if (tb[NFCTH_TUPLE]) { | |
641 | ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); | |
642 | if (ret < 0) | |
643 | return ret; | |
644 | ||
645 | tuple_set = true; | |
646 | } | |
647 | ||
83d90219 LZ |
648 | list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { |
649 | cur = &nlcth->helper; | |
650 | if (helper_name && | |
651 | strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) | |
652 | continue; | |
12f7a505 | 653 | |
83d90219 LZ |
654 | if (tuple_set && |
655 | (tuple.src.l3num != cur->tuple.src.l3num || | |
656 | tuple.dst.protonum != cur->tuple.dst.protonum)) | |
657 | continue; | |
12f7a505 | 658 | |
83d90219 LZ |
659 | skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
660 | if (skb2 == NULL) { | |
661 | ret = -ENOMEM; | |
662 | break; | |
663 | } | |
12f7a505 | 664 | |
83d90219 | 665 | ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid, |
a6555365 PNA |
666 | info->nlh->nlmsg_seq, |
667 | NFNL_MSG_TYPE(info->nlh->nlmsg_type), | |
83d90219 LZ |
668 | NFNL_MSG_CTHELPER_NEW, cur); |
669 | if (ret <= 0) { | |
670 | kfree_skb(skb2); | |
671 | break; | |
672 | } | |
12f7a505 | 673 | |
e0241ae6 PNA |
674 | ret = nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); |
675 | break; | |
12f7a505 | 676 | } |
e0241ae6 | 677 | |
12f7a505 PNA |
678 | return ret; |
679 | } | |
680 | ||
a6555365 PNA |
681 | static int nfnl_cthelper_del(struct sk_buff *skb, const struct nfnl_info *info, |
682 | const struct nlattr * const tb[]) | |
12f7a505 PNA |
683 | { |
684 | char *helper_name = NULL; | |
685 | struct nf_conntrack_helper *cur; | |
12f7a505 PNA |
686 | struct nf_conntrack_tuple tuple; |
687 | bool tuple_set = false, found = false; | |
83d90219 LZ |
688 | struct nfnl_cthelper *nlcth, *n; |
689 | int j = 0, ret; | |
12f7a505 | 690 | |
4b380c42 KC |
691 | if (!capable(CAP_NET_ADMIN)) |
692 | return -EPERM; | |
693 | ||
12f7a505 PNA |
694 | if (tb[NFCTH_NAME]) |
695 | helper_name = nla_data(tb[NFCTH_NAME]); | |
696 | ||
697 | if (tb[NFCTH_TUPLE]) { | |
698 | ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]); | |
699 | if (ret < 0) | |
700 | return ret; | |
701 | ||
702 | tuple_set = true; | |
703 | } | |
704 | ||
9338d7b4 | 705 | ret = -ENOENT; |
83d90219 LZ |
706 | list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { |
707 | cur = &nlcth->helper; | |
708 | j++; | |
12f7a505 | 709 | |
83d90219 LZ |
710 | if (helper_name && |
711 | strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) | |
712 | continue; | |
12f7a505 | 713 | |
83d90219 LZ |
714 | if (tuple_set && |
715 | (tuple.src.l3num != cur->tuple.src.l3num || | |
716 | tuple.dst.protonum != cur->tuple.dst.protonum)) | |
717 | continue; | |
12f7a505 | 718 | |
9338d7b4 LZ |
719 | if (refcount_dec_if_one(&cur->refcnt)) { |
720 | found = true; | |
721 | nf_conntrack_helper_unregister(cur); | |
722 | kfree(cur->expect_policy); | |
83d90219 | 723 | |
9338d7b4 LZ |
724 | list_del(&nlcth->list); |
725 | kfree(nlcth); | |
726 | } else { | |
727 | ret = -EBUSY; | |
728 | } | |
12f7a505 | 729 | } |
83d90219 | 730 | |
12f7a505 | 731 | /* Make sure we return success if we flush and there is no helpers */ |
9338d7b4 | 732 | return (found || j == 0) ? 0 : ret; |
12f7a505 PNA |
733 | } |
734 | ||
735 | static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = { | |
736 | [NFCTH_NAME] = { .type = NLA_NUL_STRING, | |
737 | .len = NF_CT_HELPER_NAME_LEN-1 }, | |
738 | [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, | |
c049b345 JK |
739 | [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, }, |
740 | [NFCTH_STATUS] = { .type = NLA_U32, }, | |
12f7a505 PNA |
741 | }; |
742 | ||
743 | static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = { | |
50f2db9e PNA |
744 | [NFNL_MSG_CTHELPER_NEW] = { |
745 | .call = nfnl_cthelper_new, | |
746 | .type = NFNL_CB_MUTEX, | |
747 | .attr_count = NFCTH_MAX, | |
748 | .policy = nfnl_cthelper_policy | |
749 | }, | |
750 | [NFNL_MSG_CTHELPER_GET] = { | |
751 | .call = nfnl_cthelper_get, | |
752 | .type = NFNL_CB_MUTEX, | |
753 | .attr_count = NFCTH_MAX, | |
754 | .policy = nfnl_cthelper_policy | |
755 | }, | |
756 | [NFNL_MSG_CTHELPER_DEL] = { | |
757 | .call = nfnl_cthelper_del, | |
758 | .type = NFNL_CB_MUTEX, | |
759 | .attr_count = NFCTH_MAX, | |
760 | .policy = nfnl_cthelper_policy | |
761 | }, | |
12f7a505 PNA |
762 | }; |
763 | ||
764 | static const struct nfnetlink_subsystem nfnl_cthelper_subsys = { | |
765 | .name = "cthelper", | |
766 | .subsys_id = NFNL_SUBSYS_CTHELPER, | |
767 | .cb_count = NFNL_MSG_CTHELPER_MAX, | |
768 | .cb = nfnl_cthelper_cb, | |
769 | }; | |
770 | ||
771 | MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER); | |
772 | ||
773 | static int __init nfnl_cthelper_init(void) | |
774 | { | |
775 | int ret; | |
776 | ||
777 | ret = nfnetlink_subsys_register(&nfnl_cthelper_subsys); | |
778 | if (ret < 0) { | |
779 | pr_err("nfnl_cthelper: cannot register with nfnetlink.\n"); | |
780 | goto err_out; | |
781 | } | |
782 | return 0; | |
783 | err_out: | |
784 | return ret; | |
785 | } | |
786 | ||
787 | static void __exit nfnl_cthelper_exit(void) | |
788 | { | |
789 | struct nf_conntrack_helper *cur; | |
83d90219 | 790 | struct nfnl_cthelper *nlcth, *n; |
12f7a505 PNA |
791 | |
792 | nfnetlink_subsys_unregister(&nfnl_cthelper_subsys); | |
793 | ||
83d90219 LZ |
794 | list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { |
795 | cur = &nlcth->helper; | |
12f7a505 | 796 | |
83d90219 LZ |
797 | nf_conntrack_helper_unregister(cur); |
798 | kfree(cur->expect_policy); | |
799 | kfree(nlcth); | |
12f7a505 PNA |
800 | } |
801 | } | |
802 | ||
803 | module_init(nfnl_cthelper_init); | |
804 | module_exit(nfnl_cthelper_exit); |