]> git.ipfire.org Git - thirdparty/kernel/stable.git/blame - net/netfilter/nfnetlink_cthelper.c
projects / thirdparty / kernel / stable.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
netlink: pass extended ACK struct to parsing functions
[thirdparty/kernel/stable.git] / net / netfilter / nfnetlink_cthelper.c
CommitLineData
12f7a505
PNA		 1/*
2 * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation (or any later at your option).
7 *
8 * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com>
9 */
10#include <linux/init.h>
11#include <linux/module.h>
12#include <linux/kernel.h>
13#include <linux/skbuff.h>
14#include <linux/netlink.h>
15#include <linux/rculist.h>
16#include <linux/slab.h>
17#include <linux/types.h>
18#include <linux/list.h>
19#include <linux/errno.h>
20#include <net/netlink.h>
21#include <net/sock.h>
22
23#include <net/netfilter/nf_conntrack_helper.h>
24#include <net/netfilter/nf_conntrack_expect.h>
25#include <net/netfilter/nf_conntrack_ecache.h>
26
27#include <linux/netfilter/nfnetlink.h>
28#include <linux/netfilter/nfnetlink_conntrack.h>
29#include <linux/netfilter/nfnetlink_cthelper.h>
30
31MODULE_LICENSE("GPL");
32MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
33MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers");
34
83d90219
LZ		 35struct nfnl_cthelper {
36 struct list_head list;
37 struct nf_conntrack_helper helper;
38};
39
40static LIST_HEAD(nfnl_cthelper_list);
41
12f7a505
PNA		 42static int
43nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff,
44 struct nf_conn *ct, enum ip_conntrack_info ctinfo)
45{
46 const struct nf_conn_help *help;
47 struct nf_conntrack_helper *helper;
48
49 help = nfct_help(ct);
50 if (help == NULL)
51 return NF_DROP;
52
e2361cb9 53 /* rcu_read_lock()ed by nf_hook_thresh */
12f7a505
PNA		 54 helper = rcu_dereference(help->helper);
55 if (helper == NULL)
56 return NF_DROP;
57
9332ef9d 58 /* This is a user-space helper not yet configured, skip. */
12f7a505
PNA		 59 if ((helper->flags &
60 (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) ==
61 NF_CT_HELPER_F_USERSPACE)
62 return NF_ACCEPT;
63
64 /* If the user-space helper is not available, don't block traffic. */
65 return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS;
66}
67
68static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = {
69 [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, },
70 [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, },
71};
72
73static int
74nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
75 const struct nlattr *attr)
76{
130ffbc2 77 int err;
12f7a505
PNA		 78 struct nlattr *tb[NFCTH_TUPLE_MAX+1];
79
fceb6435
JB		 80 err = nla_parse_nested(tb, NFCTH_TUPLE_MAX, attr,
81 nfnl_cthelper_tuple_pol, NULL);
130ffbc2
DB		 82 if (err < 0)
83 return err;
12f7a505
PNA		 84
85 if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
86 return -EINVAL;
87
78146572
IW		 88 /* Not all fields are initialized so first zero the tuple */
89 memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
90
fe31d1a8 91 tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
12f7a505
PNA		 92 tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
93
94 return 0;
95}
96
97static int
98nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
99{
b18c5d15 100 struct nf_conn_help *help = nfct_help(ct);
12f7a505 101
7be54ca4
PNA		 102 if (attr == NULL)
103 return -EINVAL;
104
12f7a505
PNA		 105 if (help->helper->data_len == 0)
106 return -EINVAL;
107
b18c5d15 108 memcpy(help->data, nla_data(attr), help->helper->data_len);
12f7a505
PNA		 109 return 0;
110}
111
112static int
113nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct)
114{
115 const struct nf_conn_help *help = nfct_help(ct);
116
117 if (help->helper->data_len &&
118 nla_put(skb, CTA_HELP_INFO, help->helper->data_len, &help->data))
119 goto nla_put_failure;
120
121 return 0;
122
123nla_put_failure:
124 return -ENOSPC;
125}
126
127static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = {
128 [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING,
129 .len = NF_CT_HELPER_NAME_LEN-1 },
130 [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, },
131 [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, },
132};
133
134static int
135nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
136 const struct nlattr *attr)
137{
130ffbc2 138 int err;
12f7a505
PNA		 139 struct nlattr *tb[NFCTH_POLICY_MAX+1];
140
fceb6435
JB		 141 err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr,
142 nfnl_cthelper_expect_pol, NULL);
130ffbc2
DB		 143 if (err < 0)
144 return err;
12f7a505
PNA		 145
146 if (!tb[NFCTH_POLICY_NAME] ||
147 !tb[NFCTH_POLICY_EXPECT_MAX] ||
148 !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
149 return -EINVAL;
150
151 strncpy(expect_policy->name,
152 nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
153 expect_policy->max_expected =
154 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
155 expect_policy->timeout =
156 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
157
158 return 0;
159}
160
161static const struct nla_policy
162nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = {
163 [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, },
164};
165
166static int
167nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
168 const struct nlattr *attr)
169{
170 int i, ret;
171 struct nf_conntrack_expect_policy *expect_policy;
172 struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
ae5c6821 173 unsigned int class_max;
12f7a505 174
130ffbc2 175 ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
fceb6435 176 nfnl_cthelper_expect_policy_set, NULL);
130ffbc2
DB		 177 if (ret < 0)
178 return ret;
12f7a505
PNA		 179
180 if (!tb[NFCTH_POLICY_SET_NUM])
181 return -EINVAL;
182
ae5c6821
LZ		 183 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
184 if (class_max == 0)
185 return -EINVAL;
186 if (class_max > NF_CT_MAX_EXPECT_CLASSES)
12f7a505
PNA		 187 return -EOVERFLOW;
188
189 expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
ae5c6821 190 class_max, GFP_KERNEL);
12f7a505
PNA		 191 if (expect_policy == NULL)
192 return -ENOMEM;
193
ae5c6821 194 for (i = 0; i < class_max; i++) {
12f7a505
PNA		 195 if (!tb[NFCTH_POLICY_SET+i])
196 goto err;
197
198 ret = nfnl_cthelper_expect_policy(&expect_policy[i],
199 tb[NFCTH_POLICY_SET+i]);
200 if (ret < 0)
201 goto err;
202 }
ae5c6821
LZ		 203
204 helper->expect_class_max = class_max - 1;
12f7a505
PNA		 205 helper->expect_policy = expect_policy;
206 return 0;
207err:
208 kfree(expect_policy);
209 return -EINVAL;
210}
211
212static int
213nfnl_cthelper_create(const struct nlattr * const tb[],
214 struct nf_conntrack_tuple *tuple)
215{
216 struct nf_conntrack_helper *helper;
83d90219 217 struct nfnl_cthelper *nfcth;
12f7a505
PNA		 218 int ret;
219
220 if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN])
221 return -EINVAL;
222
83d90219
LZ		 223 nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL);
224 if (nfcth == NULL)
12f7a505 225 return -ENOMEM;
83d90219 226 helper = &nfcth->helper;
12f7a505
PNA		 227
228 ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]);
229 if (ret < 0)
f83bf8da 230 goto err1;
12f7a505
PNA		 231
232 strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
233 helper->data_len = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
234 helper->flags |= NF_CT_HELPER_F_USERSPACE;
235 memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));
236
237 helper->me = THIS_MODULE;
238 helper->help = nfnl_userspace_cthelper;
239 helper->from_nlattr = nfnl_cthelper_from_nlattr;
240 helper->to_nlattr = nfnl_cthelper_to_nlattr;
241
242 /* Default to queue number zero, this can be updated at any time. */
243 if (tb[NFCTH_QUEUE_NUM])
244 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
245
246 if (tb[NFCTH_STATUS]) {
247 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
248
249 switch(status) {
250 case NFCT_HELPER_STATUS_ENABLED:
251 helper->flags |= NF_CT_HELPER_F_CONFIGURED;
252 break;
253 case NFCT_HELPER_STATUS_DISABLED:
254 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED;
255 break;
256 }
257 }
258
259 ret = nf_conntrack_helper_register(helper);
260 if (ret < 0)
f83bf8da 261 goto err2;
12f7a505 262
83d90219 263 list_add_tail(&nfcth->list, &nfnl_cthelper_list);
12f7a505 264 return 0;
f83bf8da
JC		 265err2:
266 kfree(helper->expect_policy);
267err1:
83d90219 268 kfree(nfcth);
12f7a505
PNA		 269 return ret;
270}
271
2c422257
PNA		 272static int
273nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy,
274 struct nf_conntrack_expect_policy *new_policy,
275 const struct nlattr *attr)
276{
277 struct nlattr *tb[NFCTH_POLICY_MAX + 1];
278 int err;
279
280 err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr,
fceb6435 281 nfnl_cthelper_expect_pol, NULL);
2c422257
PNA		 282 if (err < 0)
283 return err;
284
285 if (!tb[NFCTH_POLICY_NAME] ||
286 !tb[NFCTH_POLICY_EXPECT_MAX] ||
287 !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
288 return -EINVAL;
289
290 if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name))
291 return -EBUSY;
292
293 new_policy->max_expected =
294 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
295 new_policy->timeout =
296 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
297
298 return 0;
299}
300
301static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
302 struct nf_conntrack_helper *helper)
303{
304 struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1];
305 struct nf_conntrack_expect_policy *policy;
306 int i, err;
307
308 /* Check first that all policy attributes are well-formed, so we don't
309 * leave things in inconsistent state on errors.
310 */
311 for (i = 0; i < helper->expect_class_max + 1; i++) {
312
313 if (!tb[NFCTH_POLICY_SET + i])
314 return -EINVAL;
315
316 err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
317 &new_policy[i],
318 tb[NFCTH_POLICY_SET + i]);
319 if (err < 0)
320 return err;
321 }
322 /* Now we can safely update them. */
323 for (i = 0; i < helper->expect_class_max + 1; i++) {
324 policy = (struct nf_conntrack_expect_policy *)
325 &helper->expect_policy[i];
326 policy->max_expected = new_policy->max_expected;
327 policy->timeout = new_policy->timeout;
328 }
329
330 return 0;
331}
332
333static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper,
334 const struct nlattr *attr)
335{
336 struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1];
337 unsigned int class_max;
338 int err;
339
340 err = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
fceb6435 341 nfnl_cthelper_expect_policy_set, NULL);
2c422257
PNA		 342 if (err < 0)
343 return err;
344
345 if (!tb[NFCTH_POLICY_SET_NUM])
346 return -EINVAL;
347
348 class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
349 if (helper->expect_class_max + 1 != class_max)
350 return -EBUSY;
351
352 return nfnl_cthelper_update_policy_all(tb, helper);
353}
354
12f7a505
PNA		 355static int
356nfnl_cthelper_update(const struct nlattr * const tb[],
357 struct nf_conntrack_helper *helper)
358{
359 int ret;
360
361 if (tb[NFCTH_PRIV_DATA_LEN])
362 return -EBUSY;
363
364 if (tb[NFCTH_POLICY]) {
2c422257 365 ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);
12f7a505
PNA		 366 if (ret < 0)
367 return ret;
368 }
369 if (tb[NFCTH_QUEUE_NUM])
370 helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
371
372 if (tb[NFCTH_STATUS]) {
373 int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
374
375 switch(status) {
376 case NFCT_HELPER_STATUS_ENABLED:
377 helper->flags |= NF_CT_HELPER_F_CONFIGURED;
378 break;
379 case NFCT_HELPER_STATUS_DISABLED:
380 helper->flags &= ~NF_CT_HELPER_F_CONFIGURED;
381 break;
382 }
383 }
384 return 0;
385}
386
7b8002a1
PNA		 387static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
388 struct sk_buff *skb, const struct nlmsghdr *nlh,
389 const struct nlattr * const tb[])
12f7a505
PNA		 390{
391 const char *helper_name;
392 struct nf_conntrack_helper *cur, *helper = NULL;
393 struct nf_conntrack_tuple tuple;
83d90219
LZ		 394 struct nfnl_cthelper *nlcth;
395 int ret = 0;
12f7a505
PNA		 396
397 if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
398 return -EINVAL;
399
400 helper_name = nla_data(tb[NFCTH_NAME]);
401
402 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
403 if (ret < 0)
404 return ret;
405
83d90219
LZ		 406 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
407 cur = &nlcth->helper;
12f7a505 408
83d90219
LZ		 409 if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
410 continue;
12f7a505 411
83d90219
LZ		 412 if ((tuple.src.l3num != cur->tuple.src.l3num ||
413 tuple.dst.protonum != cur->tuple.dst.protonum))
414 continue;
12f7a505 415
83d90219
LZ		 416 if (nlh->nlmsg_flags & NLM_F_EXCL)
417 return -EEXIST;
12f7a505 418
83d90219
LZ		 419 helper = cur;
420 break;
12f7a505 421 }
12f7a505
PNA		 422
423 if (helper == NULL)
424 ret = nfnl_cthelper_create(tb, &tuple);
425 else
426 ret = nfnl_cthelper_update(tb, helper);
427
428 return ret;
12f7a505
PNA		 429}
430
431static int
432nfnl_cthelper_dump_tuple(struct sk_buff *skb,
433 struct nf_conntrack_helper *helper)
434{
435 struct nlattr *nest_parms;
436
437 nest_parms = nla_nest_start(skb, NFCTH_TUPLE | NLA_F_NESTED);
438 if (nest_parms == NULL)
439 goto nla_put_failure;
440
441 if (nla_put_be16(skb, NFCTH_TUPLE_L3PROTONUM,
442 htons(helper->tuple.src.l3num)))
443 goto nla_put_failure;
444
445 if (nla_put_u8(skb, NFCTH_TUPLE_L4PROTONUM, helper->tuple.dst.protonum))
446 goto nla_put_failure;
447
448 nla_nest_end(skb, nest_parms);
449 return 0;
450
451nla_put_failure:
452 return -1;
453}
454
455static int
456nfnl_cthelper_dump_policy(struct sk_buff *skb,
457 struct nf_conntrack_helper *helper)
458{
459 int i;
460 struct nlattr *nest_parms1, *nest_parms2;
461
462 nest_parms1 = nla_nest_start(skb, NFCTH_POLICY | NLA_F_NESTED);
463 if (nest_parms1 == NULL)
464 goto nla_put_failure;
465
466 if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
ae5c6821 467 htonl(helper->expect_class_max + 1)))
12f7a505
PNA		 468 goto nla_put_failure;
469
ae5c6821 470 for (i = 0; i < helper->expect_class_max + 1; i++) {
12f7a505
PNA		 471 nest_parms2 = nla_nest_start(skb,
472 (NFCTH_POLICY_SET+i) | NLA_F_NESTED);
473 if (nest_parms2 == NULL)
474 goto nla_put_failure;
475
476 if (nla_put_string(skb, NFCTH_POLICY_NAME,
477 helper->expect_policy[i].name))
478 goto nla_put_failure;
479
480 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_MAX,
481 htonl(helper->expect_policy[i].max_expected)))
482 goto nla_put_failure;
483
484 if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_TIMEOUT,
485 htonl(helper->expect_policy[i].timeout)))
486 goto nla_put_failure;
487
488 nla_nest_end(skb, nest_parms2);
489 }
490 nla_nest_end(skb, nest_parms1);
491 return 0;
492
493nla_put_failure:
494 return -1;
495}
496
497static int
15e47304 498nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
12f7a505
PNA		 499 int event, struct nf_conntrack_helper *helper)
500{
501 struct nlmsghdr *nlh;
502 struct nfgenmsg *nfmsg;
15e47304 503 unsigned int flags = portid ? NLM_F_MULTI : 0;
12f7a505
PNA		 504 int status;
505
506 event |= NFNL_SUBSYS_CTHELPER << 8;
15e47304 507 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
12f7a505
PNA		 508 if (nlh == NULL)
509 goto nlmsg_failure;
510
511 nfmsg = nlmsg_data(nlh);
512 nfmsg->nfgen_family = AF_UNSPEC;
513 nfmsg->version = NFNETLINK_V0;
514 nfmsg->res_id = 0;
515
516 if (nla_put_string(skb, NFCTH_NAME, helper->name))
517 goto nla_put_failure;
518
519 if (nla_put_be32(skb, NFCTH_QUEUE_NUM, htonl(helper->queue_num)))
520 goto nla_put_failure;
521
522 if (nfnl_cthelper_dump_tuple(skb, helper) < 0)
523 goto nla_put_failure;
524
525 if (nfnl_cthelper_dump_policy(skb, helper) < 0)
526 goto nla_put_failure;
527
528 if (nla_put_be32(skb, NFCTH_PRIV_DATA_LEN, htonl(helper->data_len)))
529 goto nla_put_failure;
530
531 if (helper->flags & NF_CT_HELPER_F_CONFIGURED)
532 status = NFCT_HELPER_STATUS_ENABLED;
533 else
534 status = NFCT_HELPER_STATUS_DISABLED;
535
536 if (nla_put_be32(skb, NFCTH_STATUS, htonl(status)))
537 goto nla_put_failure;
538
539 nlmsg_end(skb, nlh);
540 return skb->len;
541
542nlmsg_failure:
543nla_put_failure:
544 nlmsg_cancel(skb, nlh);
545 return -1;
546}
547
548static int
549nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
550{
551 struct nf_conntrack_helper *cur, *last;
12f7a505
PNA		 552
553 rcu_read_lock();
554 last = (struct nf_conntrack_helper *)cb->args[1];
555 for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) {
556restart:
b67bfe0d 557 hlist_for_each_entry_rcu(cur,
12f7a505
PNA		 558 &nf_ct_helper_hash[cb->args[0]], hnode) {
559
560 /* skip non-userspace conntrack helpers. */
561 if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
562 continue;
563
564 if (cb->args[1]) {
565 if (cur != last)
566 continue;
567 cb->args[1] = 0;
568 }
569 if (nfnl_cthelper_fill_info(skb,
15e47304 570 NETLINK_CB(cb->skb).portid,
12f7a505
PNA		 571 cb->nlh->nlmsg_seq,
572 NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
573 NFNL_MSG_CTHELPER_NEW, cur) < 0) {
574 cb->args[1] = (unsigned long)cur;
575 goto out;
576 }
577 }
578 }
579 if (cb->args[1]) {
580 cb->args[1] = 0;
581 goto restart;
582 }
583out:
584 rcu_read_unlock();
585 return skb->len;
586}
587
7b8002a1
PNA		 588static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
589 struct sk_buff *skb, const struct nlmsghdr *nlh,
590 const struct nlattr * const tb[])
12f7a505 591{
83d90219 592 int ret = -ENOENT;
12f7a505 593 struct nf_conntrack_helper *cur;
12f7a505
PNA		 594 struct sk_buff *skb2;
595 char *helper_name = NULL;
596 struct nf_conntrack_tuple tuple;
83d90219 597 struct nfnl_cthelper *nlcth;
12f7a505
PNA		 598 bool tuple_set = false;
599
600 if (nlh->nlmsg_flags & NLM_F_DUMP) {
601 struct netlink_dump_control c = {
602 .dump = nfnl_cthelper_dump_table,
603 };
604 return netlink_dump_start(nfnl, skb, nlh, &c);
605 }
606
607 if (tb[NFCTH_NAME])
608 helper_name = nla_data(tb[NFCTH_NAME]);
609
610 if (tb[NFCTH_TUPLE]) {
611 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
612 if (ret < 0)
613 return ret;
614
615 tuple_set = true;
616 }
617
83d90219
LZ		 618 list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
619 cur = &nlcth->helper;
620 if (helper_name &&
621 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
622 continue;
12f7a505 623
83d90219
LZ		 624 if (tuple_set &&
625 (tuple.src.l3num != cur->tuple.src.l3num ||
626 tuple.dst.protonum != cur->tuple.dst.protonum))
627 continue;
12f7a505 628
83d90219
LZ		 629 skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
630 if (skb2 == NULL) {
631 ret = -ENOMEM;
632 break;
633 }
12f7a505 634
83d90219
LZ		 635 ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
636 nlh->nlmsg_seq,
637 NFNL_MSG_TYPE(nlh->nlmsg_type),
638 NFNL_MSG_CTHELPER_NEW, cur);
639 if (ret <= 0) {
640 kfree_skb(skb2);
641 break;
642 }
12f7a505 643
83d90219
LZ		 644 ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
645 MSG_DONTWAIT);
646 if (ret > 0)
647 ret = 0;
12f7a505 648
83d90219
LZ		 649 /* this avoids a loop in nfnetlink. */
650 return ret == -EAGAIN ? -ENOBUFS : ret;
12f7a505
PNA		 651 }
652 return ret;
653}
654
7b8002a1
PNA		 655static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
656 struct sk_buff *skb, const struct nlmsghdr *nlh,
657 const struct nlattr * const tb[])
12f7a505
PNA		 658{
659 char *helper_name = NULL;
660 struct nf_conntrack_helper *cur;
12f7a505
PNA		 661 struct nf_conntrack_tuple tuple;
662 bool tuple_set = false, found = false;
83d90219
LZ		 663 struct nfnl_cthelper *nlcth, *n;
664 int j = 0, ret;
12f7a505
PNA		 665
666 if (tb[NFCTH_NAME])
667 helper_name = nla_data(tb[NFCTH_NAME]);
668
669 if (tb[NFCTH_TUPLE]) {
670 ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
671 if (ret < 0)
672 return ret;
673
674 tuple_set = true;
675 }
676
83d90219
LZ		 677 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
678 cur = &nlcth->helper;
679 j++;
12f7a505 680
83d90219
LZ		 681 if (helper_name &&
682 strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
683 continue;
12f7a505 684
83d90219
LZ		 685 if (tuple_set &&
686 (tuple.src.l3num != cur->tuple.src.l3num ||
687 tuple.dst.protonum != cur->tuple.dst.protonum))
688 continue;
12f7a505 689
83d90219
LZ		 690 found = true;
691 nf_conntrack_helper_unregister(cur);
692 kfree(cur->expect_policy);
693
694 list_del(&nlcth->list);
695 kfree(nlcth);
12f7a505 696 }
83d90219 697
12f7a505
PNA		 698 /* Make sure we return success if we flush and there is no helpers */
699 return (found || j == 0) ? 0 : -ENOENT;
700}
701
702static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
703 [NFCTH_NAME] = { .type = NLA_NUL_STRING,
704 .len = NF_CT_HELPER_NAME_LEN-1 },
705 [NFCTH_QUEUE_NUM] = { .type = NLA_U32, },
706};
707
708static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = {
709 [NFNL_MSG_CTHELPER_NEW] = { .call = nfnl_cthelper_new,
710 .attr_count = NFCTH_MAX,
711 .policy = nfnl_cthelper_policy },
712 [NFNL_MSG_CTHELPER_GET] = { .call = nfnl_cthelper_get,
713 .attr_count = NFCTH_MAX,
714 .policy = nfnl_cthelper_policy },
715 [NFNL_MSG_CTHELPER_DEL] = { .call = nfnl_cthelper_del,
716 .attr_count = NFCTH_MAX,
717 .policy = nfnl_cthelper_policy },
718};
719
720static const struct nfnetlink_subsystem nfnl_cthelper_subsys = {
721 .name = "cthelper",
722 .subsys_id = NFNL_SUBSYS_CTHELPER,
723 .cb_count = NFNL_MSG_CTHELPER_MAX,
724 .cb = nfnl_cthelper_cb,
725};
726
727MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER);
728
729static int __init nfnl_cthelper_init(void)
730{
731 int ret;
732
733 ret = nfnetlink_subsys_register(&nfnl_cthelper_subsys);
734 if (ret < 0) {
735 pr_err("nfnl_cthelper: cannot register with nfnetlink.\n");
736 goto err_out;
737 }
738 return 0;
739err_out:
740 return ret;
741}
742
743static void __exit nfnl_cthelper_exit(void)
744{
745 struct nf_conntrack_helper *cur;
83d90219 746 struct nfnl_cthelper *nlcth, *n;
12f7a505
PNA		 747
748 nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
749
83d90219
LZ		 750 list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
751 cur = &nlcth->helper;
12f7a505 752
83d90219
LZ		 753 nf_conntrack_helper_unregister(cur);
754 kfree(cur->expect_policy);
755 kfree(nlcth);
12f7a505
PNA		 756 }
757}
758
759module_init(nfnl_cthelper_init);
760module_exit(nfnl_cthelper_exit);
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git