1 /* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
7 * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
9 * Initial connection tracking via netlink development funded and
10 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
12 * Further development of this code funded by Astaro AG (http://www.astaro.com)
14 * This software may be used and distributed according to the terms
15 * of the GNU General Public License, incorporated herein by reference.
18 #include <linux/init.h>
19 #include <linux/module.h>
20 #include <linux/kernel.h>
21 #include <linux/rculist.h>
22 #include <linux/rculist_nulls.h>
23 #include <linux/types.h>
24 #include <linux/timer.h>
25 #include <linux/security.h>
26 #include <linux/skbuff.h>
27 #include <linux/errno.h>
28 #include <linux/netlink.h>
29 #include <linux/spinlock.h>
30 #include <linux/interrupt.h>
31 #include <linux/slab.h>
32 #include <linux/siphash.h>
34 #include <linux/netfilter.h>
35 #include <net/netlink.h>
37 #include <net/netfilter/nf_conntrack.h>
38 #include <net/netfilter/nf_conntrack_core.h>
39 #include <net/netfilter/nf_conntrack_expect.h>
40 #include <net/netfilter/nf_conntrack_helper.h>
41 #include <net/netfilter/nf_conntrack_seqadj.h>
42 #include <net/netfilter/nf_conntrack_l4proto.h>
43 #include <net/netfilter/nf_conntrack_tuple.h>
44 #include <net/netfilter/nf_conntrack_acct.h>
45 #include <net/netfilter/nf_conntrack_zones.h>
46 #include <net/netfilter/nf_conntrack_timestamp.h>
47 #include <net/netfilter/nf_conntrack_labels.h>
48 #include <net/netfilter/nf_conntrack_synproxy.h>
49 #if IS_ENABLED(CONFIG_NF_NAT)
50 #include <net/netfilter/nf_nat.h>
51 #include <net/netfilter/nf_nat_helper.h>
54 #include <linux/netfilter/nfnetlink.h>
55 #include <linux/netfilter/nfnetlink_conntrack.h>
57 #include "nf_internals.h"
59 MODULE_LICENSE("GPL");
61 struct ctnetlink_list_dump_ctx
{
67 static int ctnetlink_dump_tuples_proto(struct sk_buff
*skb
,
68 const struct nf_conntrack_tuple
*tuple
,
69 const struct nf_conntrack_l4proto
*l4proto
)
72 struct nlattr
*nest_parms
;
74 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_PROTO
);
77 if (nla_put_u8(skb
, CTA_PROTO_NUM
, tuple
->dst
.protonum
))
80 if (likely(l4proto
->tuple_to_nlattr
))
81 ret
= l4proto
->tuple_to_nlattr(skb
, tuple
);
83 nla_nest_end(skb
, nest_parms
);
91 static int ipv4_tuple_to_nlattr(struct sk_buff
*skb
,
92 const struct nf_conntrack_tuple
*tuple
)
94 if (nla_put_in_addr(skb
, CTA_IP_V4_SRC
, tuple
->src
.u3
.ip
) ||
95 nla_put_in_addr(skb
, CTA_IP_V4_DST
, tuple
->dst
.u3
.ip
))
100 static int ipv6_tuple_to_nlattr(struct sk_buff
*skb
,
101 const struct nf_conntrack_tuple
*tuple
)
103 if (nla_put_in6_addr(skb
, CTA_IP_V6_SRC
, &tuple
->src
.u3
.in6
) ||
104 nla_put_in6_addr(skb
, CTA_IP_V6_DST
, &tuple
->dst
.u3
.in6
))
109 static int ctnetlink_dump_tuples_ip(struct sk_buff
*skb
,
110 const struct nf_conntrack_tuple
*tuple
)
113 struct nlattr
*nest_parms
;
115 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_IP
);
117 goto nla_put_failure
;
119 switch (tuple
->src
.l3num
) {
121 ret
= ipv4_tuple_to_nlattr(skb
, tuple
);
124 ret
= ipv6_tuple_to_nlattr(skb
, tuple
);
128 nla_nest_end(skb
, nest_parms
);
136 static int ctnetlink_dump_tuples(struct sk_buff
*skb
,
137 const struct nf_conntrack_tuple
*tuple
)
139 const struct nf_conntrack_l4proto
*l4proto
;
143 ret
= ctnetlink_dump_tuples_ip(skb
, tuple
);
146 l4proto
= nf_ct_l4proto_find(tuple
->dst
.protonum
);
147 ret
= ctnetlink_dump_tuples_proto(skb
, tuple
, l4proto
);
153 static int ctnetlink_dump_zone_id(struct sk_buff
*skb
, int attrtype
,
154 const struct nf_conntrack_zone
*zone
, int dir
)
156 if (zone
->id
== NF_CT_DEFAULT_ZONE_ID
|| zone
->dir
!= dir
)
158 if (nla_put_be16(skb
, attrtype
, htons(zone
->id
)))
159 goto nla_put_failure
;
166 static int ctnetlink_dump_status(struct sk_buff
*skb
, const struct nf_conn
*ct
)
168 if (nla_put_be32(skb
, CTA_STATUS
, htonl(ct
->status
)))
169 goto nla_put_failure
;
176 static int ctnetlink_dump_timeout(struct sk_buff
*skb
, const struct nf_conn
*ct
,
181 if (nf_ct_is_confirmed(ct
))
182 timeout
= nf_ct_expires(ct
) / HZ
;
184 timeout
= ct
->timeout
/ HZ
;
186 if (skip_zero
&& timeout
== 0)
189 if (nla_put_be32(skb
, CTA_TIMEOUT
, htonl(timeout
)))
190 goto nla_put_failure
;
197 static int ctnetlink_dump_protoinfo(struct sk_buff
*skb
, struct nf_conn
*ct
,
200 const struct nf_conntrack_l4proto
*l4proto
;
201 struct nlattr
*nest_proto
;
204 l4proto
= nf_ct_l4proto_find(nf_ct_protonum(ct
));
205 if (!l4proto
->to_nlattr
)
208 nest_proto
= nla_nest_start(skb
, CTA_PROTOINFO
);
210 goto nla_put_failure
;
212 ret
= l4proto
->to_nlattr(skb
, nest_proto
, ct
, destroy
);
214 nla_nest_end(skb
, nest_proto
);
222 static int ctnetlink_dump_helpinfo(struct sk_buff
*skb
,
223 const struct nf_conn
*ct
)
225 struct nlattr
*nest_helper
;
226 const struct nf_conn_help
*help
= nfct_help(ct
);
227 struct nf_conntrack_helper
*helper
;
233 helper
= rcu_dereference(help
->helper
);
237 nest_helper
= nla_nest_start(skb
, CTA_HELP
);
239 goto nla_put_failure
;
240 if (nla_put_string(skb
, CTA_HELP_NAME
, helper
->name
))
241 goto nla_put_failure
;
243 if (helper
->to_nlattr
)
244 helper
->to_nlattr(skb
, ct
);
246 nla_nest_end(skb
, nest_helper
);
257 dump_counters(struct sk_buff
*skb
, struct nf_conn_acct
*acct
,
258 enum ip_conntrack_dir dir
, int type
)
260 enum ctattr_type attr
= dir
? CTA_COUNTERS_REPLY
: CTA_COUNTERS_ORIG
;
261 struct nf_conn_counter
*counter
= acct
->counter
;
262 struct nlattr
*nest_count
;
265 if (type
== IPCTNL_MSG_CT_GET_CTRZERO
) {
266 pkts
= atomic64_xchg(&counter
[dir
].packets
, 0);
267 bytes
= atomic64_xchg(&counter
[dir
].bytes
, 0);
269 pkts
= atomic64_read(&counter
[dir
].packets
);
270 bytes
= atomic64_read(&counter
[dir
].bytes
);
273 nest_count
= nla_nest_start(skb
, attr
);
275 goto nla_put_failure
;
277 if (nla_put_be64(skb
, CTA_COUNTERS_PACKETS
, cpu_to_be64(pkts
),
279 nla_put_be64(skb
, CTA_COUNTERS_BYTES
, cpu_to_be64(bytes
),
281 goto nla_put_failure
;
283 nla_nest_end(skb
, nest_count
);
292 ctnetlink_dump_acct(struct sk_buff
*skb
, const struct nf_conn
*ct
, int type
)
294 struct nf_conn_acct
*acct
= nf_conn_acct_find(ct
);
299 if (dump_counters(skb
, acct
, IP_CT_DIR_ORIGINAL
, type
) < 0)
301 if (dump_counters(skb
, acct
, IP_CT_DIR_REPLY
, type
) < 0)
308 ctnetlink_dump_timestamp(struct sk_buff
*skb
, const struct nf_conn
*ct
)
310 struct nlattr
*nest_count
;
311 const struct nf_conn_tstamp
*tstamp
;
313 tstamp
= nf_conn_tstamp_find(ct
);
317 nest_count
= nla_nest_start(skb
, CTA_TIMESTAMP
);
319 goto nla_put_failure
;
321 if (nla_put_be64(skb
, CTA_TIMESTAMP_START
, cpu_to_be64(tstamp
->start
),
322 CTA_TIMESTAMP_PAD
) ||
323 (tstamp
->stop
!= 0 && nla_put_be64(skb
, CTA_TIMESTAMP_STOP
,
324 cpu_to_be64(tstamp
->stop
),
326 goto nla_put_failure
;
327 nla_nest_end(skb
, nest_count
);
335 #ifdef CONFIG_NF_CONNTRACK_MARK
336 static int ctnetlink_dump_mark(struct sk_buff
*skb
, const struct nf_conn
*ct
,
339 u32 mark
= READ_ONCE(ct
->mark
);
344 if (nla_put_be32(skb
, CTA_MARK
, htonl(mark
)))
345 goto nla_put_failure
;
352 #define ctnetlink_dump_mark(a, b, c) (0)
355 #ifdef CONFIG_NF_CONNTRACK_SECMARK
356 static int ctnetlink_dump_secctx(struct sk_buff
*skb
, const struct nf_conn
*ct
)
358 struct nlattr
*nest_secctx
;
362 ret
= security_secid_to_secctx(ct
->secmark
, &secctx
, &len
);
367 nest_secctx
= nla_nest_start(skb
, CTA_SECCTX
);
369 goto nla_put_failure
;
371 if (nla_put_string(skb
, CTA_SECCTX_NAME
, secctx
))
372 goto nla_put_failure
;
373 nla_nest_end(skb
, nest_secctx
);
377 security_release_secctx(secctx
, len
);
381 #define ctnetlink_dump_secctx(a, b) (0)
384 #ifdef CONFIG_NF_CONNTRACK_LABELS
385 static inline int ctnetlink_label_size(const struct nf_conn
*ct
)
387 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
391 return nla_total_size(sizeof(labels
->bits
));
395 ctnetlink_dump_labels(struct sk_buff
*skb
, const struct nf_conn
*ct
)
397 struct nf_conn_labels
*labels
= nf_ct_labels_find(ct
);
405 if (labels
->bits
[i
] != 0)
406 return nla_put(skb
, CTA_LABELS
, sizeof(labels
->bits
),
409 } while (i
< ARRAY_SIZE(labels
->bits
));
414 #define ctnetlink_dump_labels(a, b) (0)
415 #define ctnetlink_label_size(a) (0)
418 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
420 static int ctnetlink_dump_master(struct sk_buff
*skb
, const struct nf_conn
*ct
)
422 struct nlattr
*nest_parms
;
424 if (!(ct
->status
& IPS_EXPECTED
))
427 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_MASTER
);
429 goto nla_put_failure
;
430 if (ctnetlink_dump_tuples(skb
, master_tuple(ct
)) < 0)
431 goto nla_put_failure
;
432 nla_nest_end(skb
, nest_parms
);
441 dump_ct_seq_adj(struct sk_buff
*skb
, const struct nf_ct_seqadj
*seq
, int type
)
443 struct nlattr
*nest_parms
;
445 nest_parms
= nla_nest_start(skb
, type
);
447 goto nla_put_failure
;
449 if (nla_put_be32(skb
, CTA_SEQADJ_CORRECTION_POS
,
450 htonl(seq
->correction_pos
)) ||
451 nla_put_be32(skb
, CTA_SEQADJ_OFFSET_BEFORE
,
452 htonl(seq
->offset_before
)) ||
453 nla_put_be32(skb
, CTA_SEQADJ_OFFSET_AFTER
,
454 htonl(seq
->offset_after
)))
455 goto nla_put_failure
;
457 nla_nest_end(skb
, nest_parms
);
465 static int ctnetlink_dump_ct_seq_adj(struct sk_buff
*skb
, struct nf_conn
*ct
)
467 struct nf_conn_seqadj
*seqadj
= nfct_seqadj(ct
);
468 struct nf_ct_seqadj
*seq
;
470 if (!(ct
->status
& IPS_SEQ_ADJUST
) || !seqadj
)
473 spin_lock_bh(&ct
->lock
);
474 seq
= &seqadj
->seq
[IP_CT_DIR_ORIGINAL
];
475 if (dump_ct_seq_adj(skb
, seq
, CTA_SEQ_ADJ_ORIG
) == -1)
478 seq
= &seqadj
->seq
[IP_CT_DIR_REPLY
];
479 if (dump_ct_seq_adj(skb
, seq
, CTA_SEQ_ADJ_REPLY
) == -1)
482 spin_unlock_bh(&ct
->lock
);
485 spin_unlock_bh(&ct
->lock
);
489 static int ctnetlink_dump_ct_synproxy(struct sk_buff
*skb
, struct nf_conn
*ct
)
491 struct nf_conn_synproxy
*synproxy
= nfct_synproxy(ct
);
492 struct nlattr
*nest_parms
;
497 nest_parms
= nla_nest_start(skb
, CTA_SYNPROXY
);
499 goto nla_put_failure
;
501 if (nla_put_be32(skb
, CTA_SYNPROXY_ISN
, htonl(synproxy
->isn
)) ||
502 nla_put_be32(skb
, CTA_SYNPROXY_ITS
, htonl(synproxy
->its
)) ||
503 nla_put_be32(skb
, CTA_SYNPROXY_TSOFF
, htonl(synproxy
->tsoff
)))
504 goto nla_put_failure
;
506 nla_nest_end(skb
, nest_parms
);
514 static int ctnetlink_dump_id(struct sk_buff
*skb
, const struct nf_conn
*ct
)
516 __be32 id
= (__force __be32
)nf_ct_get_id(ct
);
518 if (nla_put_be32(skb
, CTA_ID
, id
))
519 goto nla_put_failure
;
526 static int ctnetlink_dump_use(struct sk_buff
*skb
, const struct nf_conn
*ct
)
528 if (nla_put_be32(skb
, CTA_USE
, htonl(refcount_read(&ct
->ct_general
.use
))))
529 goto nla_put_failure
;
536 /* all these functions access ct->ext. Caller must either hold a reference
537 * on ct or prevent its deletion by holding either the bucket spinlock or
538 * pcpu dying list lock.
540 static int ctnetlink_dump_extinfo(struct sk_buff
*skb
,
541 struct nf_conn
*ct
, u32 type
)
543 if (ctnetlink_dump_acct(skb
, ct
, type
) < 0 ||
544 ctnetlink_dump_timestamp(skb
, ct
) < 0 ||
545 ctnetlink_dump_helpinfo(skb
, ct
) < 0 ||
546 ctnetlink_dump_labels(skb
, ct
) < 0 ||
547 ctnetlink_dump_ct_seq_adj(skb
, ct
) < 0 ||
548 ctnetlink_dump_ct_synproxy(skb
, ct
) < 0)
554 static int ctnetlink_dump_info(struct sk_buff
*skb
, struct nf_conn
*ct
)
556 if (ctnetlink_dump_status(skb
, ct
) < 0 ||
557 ctnetlink_dump_mark(skb
, ct
, true) < 0 ||
558 ctnetlink_dump_secctx(skb
, ct
) < 0 ||
559 ctnetlink_dump_id(skb
, ct
) < 0 ||
560 ctnetlink_dump_use(skb
, ct
) < 0 ||
561 ctnetlink_dump_master(skb
, ct
) < 0)
564 if (!test_bit(IPS_OFFLOAD_BIT
, &ct
->status
) &&
565 (ctnetlink_dump_timeout(skb
, ct
, false) < 0 ||
566 ctnetlink_dump_protoinfo(skb
, ct
, false) < 0))
573 ctnetlink_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
574 struct nf_conn
*ct
, bool extinfo
, unsigned int flags
)
576 const struct nf_conntrack_zone
*zone
;
577 struct nlmsghdr
*nlh
;
578 struct nlattr
*nest_parms
;
582 flags
|= NLM_F_MULTI
;
583 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
, IPCTNL_MSG_CT_NEW
);
584 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, nf_ct_l3num(ct
),
589 zone
= nf_ct_zone(ct
);
591 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_ORIG
);
593 goto nla_put_failure
;
594 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_ORIGINAL
)) < 0)
595 goto nla_put_failure
;
596 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
597 NF_CT_ZONE_DIR_ORIG
) < 0)
598 goto nla_put_failure
;
599 nla_nest_end(skb
, nest_parms
);
601 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_REPLY
);
603 goto nla_put_failure
;
604 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_REPLY
)) < 0)
605 goto nla_put_failure
;
606 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
607 NF_CT_ZONE_DIR_REPL
) < 0)
608 goto nla_put_failure
;
609 nla_nest_end(skb
, nest_parms
);
611 if (ctnetlink_dump_zone_id(skb
, CTA_ZONE
, zone
,
612 NF_CT_DEFAULT_ZONE_DIR
) < 0)
613 goto nla_put_failure
;
615 if (ctnetlink_dump_info(skb
, ct
) < 0)
616 goto nla_put_failure
;
617 if (extinfo
&& ctnetlink_dump_extinfo(skb
, ct
, type
) < 0)
618 goto nla_put_failure
;
625 nlmsg_cancel(skb
, nlh
);
629 static const struct nla_policy cta_ip_nla_policy
[CTA_IP_MAX
+ 1] = {
630 [CTA_IP_V4_SRC
] = { .type
= NLA_U32
},
631 [CTA_IP_V4_DST
] = { .type
= NLA_U32
},
632 [CTA_IP_V6_SRC
] = { .len
= sizeof(__be32
) * 4 },
633 [CTA_IP_V6_DST
] = { .len
= sizeof(__be32
) * 4 },
636 #if defined(CONFIG_NETFILTER_NETLINK_GLUE_CT) || defined(CONFIG_NF_CONNTRACK_EVENTS)
637 static size_t ctnetlink_proto_size(const struct nf_conn
*ct
)
639 const struct nf_conntrack_l4proto
*l4proto
;
640 size_t len
, len4
= 0;
642 len
= nla_policy_len(cta_ip_nla_policy
, CTA_IP_MAX
+ 1);
643 len
*= 3u; /* ORIG, REPLY, MASTER */
645 l4proto
= nf_ct_l4proto_find(nf_ct_protonum(ct
));
646 len
+= l4proto
->nlattr_size
;
647 if (l4proto
->nlattr_tuple_size
) {
648 len4
= l4proto
->nlattr_tuple_size();
649 len4
*= 3u; /* ORIG, REPLY, MASTER */
656 static inline size_t ctnetlink_acct_size(const struct nf_conn
*ct
)
658 if (!nf_ct_ext_exist(ct
, NF_CT_EXT_ACCT
))
660 return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */
661 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */
662 + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */
666 static inline int ctnetlink_secctx_size(const struct nf_conn
*ct
)
668 #ifdef CONFIG_NF_CONNTRACK_SECMARK
671 ret
= security_secid_to_secctx(ct
->secmark
, NULL
, &len
);
675 return nla_total_size(0) /* CTA_SECCTX */
676 + nla_total_size(sizeof(char) * len
); /* CTA_SECCTX_NAME */
682 static inline size_t ctnetlink_timestamp_size(const struct nf_conn
*ct
)
684 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
685 if (!nf_ct_ext_exist(ct
, NF_CT_EXT_TSTAMP
))
687 return nla_total_size(0) + 2 * nla_total_size_64bit(sizeof(uint64_t));
693 #ifdef CONFIG_NF_CONNTRACK_EVENTS
694 static size_t ctnetlink_nlmsg_size(const struct nf_conn
*ct
)
696 return NLMSG_ALIGN(sizeof(struct nfgenmsg
))
697 + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
698 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
699 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
700 + 3 * nla_total_size(sizeof(u_int8_t
)) /* CTA_PROTO_NUM */
701 + nla_total_size(sizeof(u_int32_t
)) /* CTA_ID */
702 + nla_total_size(sizeof(u_int32_t
)) /* CTA_STATUS */
703 + ctnetlink_acct_size(ct
)
704 + ctnetlink_timestamp_size(ct
)
705 + nla_total_size(sizeof(u_int32_t
)) /* CTA_TIMEOUT */
706 + nla_total_size(0) /* CTA_PROTOINFO */
707 + nla_total_size(0) /* CTA_HELP */
708 + nla_total_size(NF_CT_HELPER_NAME_LEN
) /* CTA_HELP_NAME */
709 + ctnetlink_secctx_size(ct
)
710 #if IS_ENABLED(CONFIG_NF_NAT)
711 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
712 + 6 * nla_total_size(sizeof(u_int32_t
)) /* CTA_NAT_SEQ_OFFSET */
714 #ifdef CONFIG_NF_CONNTRACK_MARK
715 + nla_total_size(sizeof(u_int32_t
)) /* CTA_MARK */
717 #ifdef CONFIG_NF_CONNTRACK_ZONES
718 + nla_total_size(sizeof(u_int16_t
)) /* CTA_ZONE|CTA_TUPLE_ZONE */
720 + ctnetlink_proto_size(ct
)
721 + ctnetlink_label_size(ct
)
726 ctnetlink_conntrack_event(unsigned int events
, const struct nf_ct_event
*item
)
728 const struct nf_conntrack_zone
*zone
;
730 struct nlmsghdr
*nlh
;
731 struct nlattr
*nest_parms
;
732 struct nf_conn
*ct
= item
->ct
;
735 unsigned int flags
= 0, group
;
738 if (events
& (1 << IPCT_DESTROY
)) {
739 type
= IPCTNL_MSG_CT_DELETE
;
740 group
= NFNLGRP_CONNTRACK_DESTROY
;
741 } else if (events
& ((1 << IPCT_NEW
) | (1 << IPCT_RELATED
))) {
742 type
= IPCTNL_MSG_CT_NEW
;
743 flags
= NLM_F_CREATE
|NLM_F_EXCL
;
744 group
= NFNLGRP_CONNTRACK_NEW
;
746 type
= IPCTNL_MSG_CT_NEW
;
747 group
= NFNLGRP_CONNTRACK_UPDATE
;
752 if (!item
->report
&& !nfnetlink_has_listeners(net
, group
))
755 skb
= nlmsg_new(ctnetlink_nlmsg_size(ct
), GFP_ATOMIC
);
759 type
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
, type
);
760 nlh
= nfnl_msg_put(skb
, item
->portid
, 0, type
, flags
, nf_ct_l3num(ct
),
765 zone
= nf_ct_zone(ct
);
767 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_ORIG
);
769 goto nla_put_failure
;
770 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_ORIGINAL
)) < 0)
771 goto nla_put_failure
;
772 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
773 NF_CT_ZONE_DIR_ORIG
) < 0)
774 goto nla_put_failure
;
775 nla_nest_end(skb
, nest_parms
);
777 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_REPLY
);
779 goto nla_put_failure
;
780 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_REPLY
)) < 0)
781 goto nla_put_failure
;
782 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
783 NF_CT_ZONE_DIR_REPL
) < 0)
784 goto nla_put_failure
;
785 nla_nest_end(skb
, nest_parms
);
787 if (ctnetlink_dump_zone_id(skb
, CTA_ZONE
, zone
,
788 NF_CT_DEFAULT_ZONE_DIR
) < 0)
789 goto nla_put_failure
;
791 if (ctnetlink_dump_id(skb
, ct
) < 0)
792 goto nla_put_failure
;
794 if (ctnetlink_dump_status(skb
, ct
) < 0)
795 goto nla_put_failure
;
797 if (events
& (1 << IPCT_DESTROY
)) {
798 if (ctnetlink_dump_timeout(skb
, ct
, true) < 0)
799 goto nla_put_failure
;
801 if (ctnetlink_dump_acct(skb
, ct
, type
) < 0 ||
802 ctnetlink_dump_timestamp(skb
, ct
) < 0 ||
803 ctnetlink_dump_protoinfo(skb
, ct
, true) < 0)
804 goto nla_put_failure
;
806 if (ctnetlink_dump_timeout(skb
, ct
, false) < 0)
807 goto nla_put_failure
;
809 if (events
& (1 << IPCT_PROTOINFO
) &&
810 ctnetlink_dump_protoinfo(skb
, ct
, false) < 0)
811 goto nla_put_failure
;
813 if ((events
& (1 << IPCT_HELPER
) || nfct_help(ct
))
814 && ctnetlink_dump_helpinfo(skb
, ct
) < 0)
815 goto nla_put_failure
;
817 #ifdef CONFIG_NF_CONNTRACK_SECMARK
818 if ((events
& (1 << IPCT_SECMARK
) || ct
->secmark
)
819 && ctnetlink_dump_secctx(skb
, ct
) < 0)
820 goto nla_put_failure
;
822 if (events
& (1 << IPCT_LABEL
) &&
823 ctnetlink_dump_labels(skb
, ct
) < 0)
824 goto nla_put_failure
;
826 if (events
& (1 << IPCT_RELATED
) &&
827 ctnetlink_dump_master(skb
, ct
) < 0)
828 goto nla_put_failure
;
830 if (events
& (1 << IPCT_SEQADJ
) &&
831 ctnetlink_dump_ct_seq_adj(skb
, ct
) < 0)
832 goto nla_put_failure
;
834 if (events
& (1 << IPCT_SYNPROXY
) &&
835 ctnetlink_dump_ct_synproxy(skb
, ct
) < 0)
836 goto nla_put_failure
;
839 #ifdef CONFIG_NF_CONNTRACK_MARK
840 if (ctnetlink_dump_mark(skb
, ct
, events
& (1 << IPCT_MARK
)))
841 goto nla_put_failure
;
844 err
= nfnetlink_send(skb
, net
, item
->portid
, group
, item
->report
,
846 if (err
== -ENOBUFS
|| err
== -EAGAIN
)
852 nlmsg_cancel(skb
, nlh
);
856 if (nfnetlink_set_err(net
, 0, group
, -ENOBUFS
) > 0)
861 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
863 static int ctnetlink_done(struct netlink_callback
*cb
)
866 nf_ct_put((struct nf_conn
*)cb
->args
[1]);
871 struct ctnetlink_filter_u32
{
876 struct ctnetlink_filter
{
879 u_int32_t orig_flags
;
880 u_int32_t reply_flags
;
882 struct nf_conntrack_tuple orig
;
883 struct nf_conntrack_tuple reply
;
884 struct nf_conntrack_zone zone
;
886 struct ctnetlink_filter_u32 mark
;
887 struct ctnetlink_filter_u32 status
;
890 static const struct nla_policy cta_filter_nla_policy
[CTA_FILTER_MAX
+ 1] = {
891 [CTA_FILTER_ORIG_FLAGS
] = { .type
= NLA_U32
},
892 [CTA_FILTER_REPLY_FLAGS
] = { .type
= NLA_U32
},
895 static int ctnetlink_parse_filter(const struct nlattr
*attr
,
896 struct ctnetlink_filter
*filter
)
898 struct nlattr
*tb
[CTA_FILTER_MAX
+ 1];
901 ret
= nla_parse_nested(tb
, CTA_FILTER_MAX
, attr
, cta_filter_nla_policy
,
906 if (tb
[CTA_FILTER_ORIG_FLAGS
]) {
907 filter
->orig_flags
= nla_get_u32(tb
[CTA_FILTER_ORIG_FLAGS
]);
908 if (filter
->orig_flags
& ~CTA_FILTER_F_ALL
)
912 if (tb
[CTA_FILTER_REPLY_FLAGS
]) {
913 filter
->reply_flags
= nla_get_u32(tb
[CTA_FILTER_REPLY_FLAGS
]);
914 if (filter
->reply_flags
& ~CTA_FILTER_F_ALL
)
921 static int ctnetlink_parse_zone(const struct nlattr
*attr
,
922 struct nf_conntrack_zone
*zone
);
923 static int ctnetlink_parse_tuple_filter(const struct nlattr
* const cda
[],
924 struct nf_conntrack_tuple
*tuple
,
925 u32 type
, u_int8_t l3num
,
926 struct nf_conntrack_zone
*zone
,
929 static int ctnetlink_filter_parse_mark(struct ctnetlink_filter_u32
*mark
,
930 const struct nlattr
* const cda
[])
932 #ifdef CONFIG_NF_CONNTRACK_MARK
934 mark
->val
= ntohl(nla_get_be32(cda
[CTA_MARK
]));
936 if (cda
[CTA_MARK_MASK
])
937 mark
->mask
= ntohl(nla_get_be32(cda
[CTA_MARK_MASK
]));
939 mark
->mask
= 0xffffffff;
940 } else if (cda
[CTA_MARK_MASK
]) {
947 static int ctnetlink_filter_parse_status(struct ctnetlink_filter_u32
*status
,
948 const struct nlattr
* const cda
[])
950 if (cda
[CTA_STATUS
]) {
951 status
->val
= ntohl(nla_get_be32(cda
[CTA_STATUS
]));
952 if (cda
[CTA_STATUS_MASK
])
953 status
->mask
= ntohl(nla_get_be32(cda
[CTA_STATUS_MASK
]));
955 status
->mask
= status
->val
;
957 /* status->val == 0? always true, else always false. */
958 if (status
->mask
== 0)
960 } else if (cda
[CTA_STATUS_MASK
]) {
964 /* CTA_STATUS is NLA_U32, if this fires UAPI needs to be extended */
965 BUILD_BUG_ON(__IPS_MAX_BIT
>= 32);
969 static struct ctnetlink_filter
*
970 ctnetlink_alloc_filter(const struct nlattr
* const cda
[], u8 family
)
972 struct ctnetlink_filter
*filter
;
975 #ifndef CONFIG_NF_CONNTRACK_MARK
976 if (cda
[CTA_MARK
] || cda
[CTA_MARK_MASK
])
977 return ERR_PTR(-EOPNOTSUPP
);
980 filter
= kzalloc(sizeof(*filter
), GFP_KERNEL
);
982 return ERR_PTR(-ENOMEM
);
984 filter
->family
= family
;
986 err
= ctnetlink_filter_parse_mark(&filter
->mark
, cda
);
990 err
= ctnetlink_filter_parse_status(&filter
->status
, cda
);
994 if (!cda
[CTA_FILTER
])
997 err
= ctnetlink_parse_zone(cda
[CTA_ZONE
], &filter
->zone
);
1001 err
= ctnetlink_parse_filter(cda
[CTA_FILTER
], filter
);
1005 if (filter
->orig_flags
) {
1006 if (!cda
[CTA_TUPLE_ORIG
]) {
1011 err
= ctnetlink_parse_tuple_filter(cda
, &filter
->orig
,
1015 filter
->orig_flags
);
1020 if (filter
->reply_flags
) {
1021 if (!cda
[CTA_TUPLE_REPLY
]) {
1026 err
= ctnetlink_parse_tuple_filter(cda
, &filter
->reply
,
1030 filter
->reply_flags
);
1040 return ERR_PTR(err
);
1043 static bool ctnetlink_needs_filter(u8 family
, const struct nlattr
* const *cda
)
1045 return family
|| cda
[CTA_MARK
] || cda
[CTA_FILTER
] || cda
[CTA_STATUS
];
1048 static int ctnetlink_start(struct netlink_callback
*cb
)
1050 const struct nlattr
* const *cda
= cb
->data
;
1051 struct ctnetlink_filter
*filter
= NULL
;
1052 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1053 u8 family
= nfmsg
->nfgen_family
;
1055 if (ctnetlink_needs_filter(family
, cda
)) {
1056 filter
= ctnetlink_alloc_filter(cda
, family
);
1058 return PTR_ERR(filter
);
1065 static int ctnetlink_filter_match_tuple(struct nf_conntrack_tuple
*filter_tuple
,
1066 struct nf_conntrack_tuple
*ct_tuple
,
1067 u_int32_t flags
, int family
)
1071 if ((flags
& CTA_FILTER_FLAG(CTA_IP_SRC
)) &&
1072 filter_tuple
->src
.u3
.ip
!= ct_tuple
->src
.u3
.ip
)
1075 if ((flags
& CTA_FILTER_FLAG(CTA_IP_DST
)) &&
1076 filter_tuple
->dst
.u3
.ip
!= ct_tuple
->dst
.u3
.ip
)
1080 if ((flags
& CTA_FILTER_FLAG(CTA_IP_SRC
)) &&
1081 !ipv6_addr_cmp(&filter_tuple
->src
.u3
.in6
,
1082 &ct_tuple
->src
.u3
.in6
))
1085 if ((flags
& CTA_FILTER_FLAG(CTA_IP_DST
)) &&
1086 !ipv6_addr_cmp(&filter_tuple
->dst
.u3
.in6
,
1087 &ct_tuple
->dst
.u3
.in6
))
1092 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_NUM
)) &&
1093 filter_tuple
->dst
.protonum
!= ct_tuple
->dst
.protonum
)
1096 switch (ct_tuple
->dst
.protonum
) {
1099 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_SRC_PORT
)) &&
1100 filter_tuple
->src
.u
.tcp
.port
!= ct_tuple
->src
.u
.tcp
.port
)
1103 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_DST_PORT
)) &&
1104 filter_tuple
->dst
.u
.tcp
.port
!= ct_tuple
->dst
.u
.tcp
.port
)
1108 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_ICMP_TYPE
)) &&
1109 filter_tuple
->dst
.u
.icmp
.type
!= ct_tuple
->dst
.u
.icmp
.type
)
1111 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_ICMP_CODE
)) &&
1112 filter_tuple
->dst
.u
.icmp
.code
!= ct_tuple
->dst
.u
.icmp
.code
)
1114 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_ICMP_ID
)) &&
1115 filter_tuple
->src
.u
.icmp
.id
!= ct_tuple
->src
.u
.icmp
.id
)
1118 case IPPROTO_ICMPV6
:
1119 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_TYPE
)) &&
1120 filter_tuple
->dst
.u
.icmp
.type
!= ct_tuple
->dst
.u
.icmp
.type
)
1122 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_CODE
)) &&
1123 filter_tuple
->dst
.u
.icmp
.code
!= ct_tuple
->dst
.u
.icmp
.code
)
1125 if ((flags
& CTA_FILTER_FLAG(CTA_PROTO_ICMPV6_ID
)) &&
1126 filter_tuple
->src
.u
.icmp
.id
!= ct_tuple
->src
.u
.icmp
.id
)
1134 static int ctnetlink_filter_match(struct nf_conn
*ct
, void *data
)
1136 struct ctnetlink_filter
*filter
= data
;
1137 struct nf_conntrack_tuple
*tuple
;
1143 /* Match entries of a given L3 protocol number.
1144 * If it is not specified, ie. l3proto == 0,
1145 * then match everything.
1147 if (filter
->family
&& nf_ct_l3num(ct
) != filter
->family
)
1150 if (filter
->orig_flags
) {
1151 tuple
= nf_ct_tuple(ct
, IP_CT_DIR_ORIGINAL
);
1152 if (!ctnetlink_filter_match_tuple(&filter
->orig
, tuple
,
1158 if (filter
->reply_flags
) {
1159 tuple
= nf_ct_tuple(ct
, IP_CT_DIR_REPLY
);
1160 if (!ctnetlink_filter_match_tuple(&filter
->reply
, tuple
,
1161 filter
->reply_flags
,
1166 #ifdef CONFIG_NF_CONNTRACK_MARK
1167 if ((READ_ONCE(ct
->mark
) & filter
->mark
.mask
) != filter
->mark
.val
)
1170 status
= (u32
)READ_ONCE(ct
->status
);
1171 if ((status
& filter
->status
.mask
) != filter
->status
.val
)
1182 ctnetlink_dump_table(struct sk_buff
*skb
, struct netlink_callback
*cb
)
1184 unsigned int flags
= cb
->data
? NLM_F_DUMP_FILTERED
: 0;
1185 struct net
*net
= sock_net(skb
->sk
);
1186 struct nf_conn
*ct
, *last
;
1187 struct nf_conntrack_tuple_hash
*h
;
1188 struct hlist_nulls_node
*n
;
1189 struct nf_conn
*nf_ct_evict
[8];
1193 last
= (struct nf_conn
*)cb
->args
[1];
1197 for (; cb
->args
[0] < nf_conntrack_htable_size
; cb
->args
[0]++) {
1201 if (nf_ct_should_gc(nf_ct_evict
[i
]))
1202 nf_ct_kill(nf_ct_evict
[i
]);
1203 nf_ct_put(nf_ct_evict
[i
]);
1206 lockp
= &nf_conntrack_locks
[cb
->args
[0] % CONNTRACK_LOCKS
];
1207 nf_conntrack_lock(lockp
);
1208 if (cb
->args
[0] >= nf_conntrack_htable_size
) {
1212 hlist_nulls_for_each_entry(h
, n
, &nf_conntrack_hash
[cb
->args
[0]],
1214 ct
= nf_ct_tuplehash_to_ctrack(h
);
1215 if (nf_ct_is_expired(ct
)) {
1216 /* need to defer nf_ct_kill() until lock is released */
1217 if (i
< ARRAY_SIZE(nf_ct_evict
) &&
1218 refcount_inc_not_zero(&ct
->ct_general
.use
))
1219 nf_ct_evict
[i
++] = ct
;
1223 if (!net_eq(net
, nf_ct_net(ct
)))
1226 if (NF_CT_DIRECTION(h
) != IP_CT_DIR_ORIGINAL
)
1234 if (!ctnetlink_filter_match(ct
, cb
->data
))
1238 ctnetlink_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
1240 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
1243 nf_conntrack_get(&ct
->ct_general
);
1244 cb
->args
[1] = (unsigned long)ct
;
1258 /* nf ct hash resize happened, now clear the leftover. */
1259 if ((struct nf_conn
*)cb
->args
[1] == last
)
1267 if (nf_ct_should_gc(nf_ct_evict
[i
]))
1268 nf_ct_kill(nf_ct_evict
[i
]);
1269 nf_ct_put(nf_ct_evict
[i
]);
1275 static int ipv4_nlattr_to_tuple(struct nlattr
*tb
[],
1276 struct nf_conntrack_tuple
*t
,
1279 if (flags
& CTA_FILTER_FLAG(CTA_IP_SRC
)) {
1280 if (!tb
[CTA_IP_V4_SRC
])
1283 t
->src
.u3
.ip
= nla_get_in_addr(tb
[CTA_IP_V4_SRC
]);
1286 if (flags
& CTA_FILTER_FLAG(CTA_IP_DST
)) {
1287 if (!tb
[CTA_IP_V4_DST
])
1290 t
->dst
.u3
.ip
= nla_get_in_addr(tb
[CTA_IP_V4_DST
]);
1296 static int ipv6_nlattr_to_tuple(struct nlattr
*tb
[],
1297 struct nf_conntrack_tuple
*t
,
1300 if (flags
& CTA_FILTER_FLAG(CTA_IP_SRC
)) {
1301 if (!tb
[CTA_IP_V6_SRC
])
1304 t
->src
.u3
.in6
= nla_get_in6_addr(tb
[CTA_IP_V6_SRC
]);
1307 if (flags
& CTA_FILTER_FLAG(CTA_IP_DST
)) {
1308 if (!tb
[CTA_IP_V6_DST
])
1311 t
->dst
.u3
.in6
= nla_get_in6_addr(tb
[CTA_IP_V6_DST
]);
1317 static int ctnetlink_parse_tuple_ip(struct nlattr
*attr
,
1318 struct nf_conntrack_tuple
*tuple
,
1321 struct nlattr
*tb
[CTA_IP_MAX
+1];
1324 ret
= nla_parse_nested_deprecated(tb
, CTA_IP_MAX
, attr
, NULL
, NULL
);
1328 ret
= nla_validate_nested_deprecated(attr
, CTA_IP_MAX
,
1329 cta_ip_nla_policy
, NULL
);
1333 switch (tuple
->src
.l3num
) {
1335 ret
= ipv4_nlattr_to_tuple(tb
, tuple
, flags
);
1338 ret
= ipv6_nlattr_to_tuple(tb
, tuple
, flags
);
1345 static const struct nla_policy proto_nla_policy
[CTA_PROTO_MAX
+1] = {
1346 [CTA_PROTO_NUM
] = { .type
= NLA_U8
},
1349 static int ctnetlink_parse_tuple_proto(struct nlattr
*attr
,
1350 struct nf_conntrack_tuple
*tuple
,
1353 const struct nf_conntrack_l4proto
*l4proto
;
1354 struct nlattr
*tb
[CTA_PROTO_MAX
+1];
1357 ret
= nla_parse_nested_deprecated(tb
, CTA_PROTO_MAX
, attr
,
1358 proto_nla_policy
, NULL
);
1362 if (!(flags
& CTA_FILTER_FLAG(CTA_PROTO_NUM
)))
1365 if (!tb
[CTA_PROTO_NUM
])
1368 tuple
->dst
.protonum
= nla_get_u8(tb
[CTA_PROTO_NUM
]);
1371 l4proto
= nf_ct_l4proto_find(tuple
->dst
.protonum
);
1373 if (likely(l4proto
->nlattr_to_tuple
)) {
1374 ret
= nla_validate_nested_deprecated(attr
, CTA_PROTO_MAX
,
1375 l4proto
->nla_policy
,
1378 ret
= l4proto
->nlattr_to_tuple(tb
, tuple
, flags
);
1387 ctnetlink_parse_zone(const struct nlattr
*attr
,
1388 struct nf_conntrack_zone
*zone
)
1390 nf_ct_zone_init(zone
, NF_CT_DEFAULT_ZONE_ID
,
1391 NF_CT_DEFAULT_ZONE_DIR
, 0);
1392 #ifdef CONFIG_NF_CONNTRACK_ZONES
1394 zone
->id
= ntohs(nla_get_be16(attr
));
1403 ctnetlink_parse_tuple_zone(struct nlattr
*attr
, enum ctattr_type type
,
1404 struct nf_conntrack_zone
*zone
)
1408 if (zone
->id
!= NF_CT_DEFAULT_ZONE_ID
)
1411 ret
= ctnetlink_parse_zone(attr
, zone
);
1415 if (type
== CTA_TUPLE_REPLY
)
1416 zone
->dir
= NF_CT_ZONE_DIR_REPL
;
1418 zone
->dir
= NF_CT_ZONE_DIR_ORIG
;
1423 static const struct nla_policy tuple_nla_policy
[CTA_TUPLE_MAX
+1] = {
1424 [CTA_TUPLE_IP
] = { .type
= NLA_NESTED
},
1425 [CTA_TUPLE_PROTO
] = { .type
= NLA_NESTED
},
1426 [CTA_TUPLE_ZONE
] = { .type
= NLA_U16
},
1429 #define CTA_FILTER_F_ALL_CTA_PROTO \
1430 (CTA_FILTER_F_CTA_PROTO_SRC_PORT | \
1431 CTA_FILTER_F_CTA_PROTO_DST_PORT | \
1432 CTA_FILTER_F_CTA_PROTO_ICMP_TYPE | \
1433 CTA_FILTER_F_CTA_PROTO_ICMP_CODE | \
1434 CTA_FILTER_F_CTA_PROTO_ICMP_ID | \
1435 CTA_FILTER_F_CTA_PROTO_ICMPV6_TYPE | \
1436 CTA_FILTER_F_CTA_PROTO_ICMPV6_CODE | \
1437 CTA_FILTER_F_CTA_PROTO_ICMPV6_ID)
1440 ctnetlink_parse_tuple_filter(const struct nlattr
* const cda
[],
1441 struct nf_conntrack_tuple
*tuple
, u32 type
,
1442 u_int8_t l3num
, struct nf_conntrack_zone
*zone
,
1445 struct nlattr
*tb
[CTA_TUPLE_MAX
+1];
1448 memset(tuple
, 0, sizeof(*tuple
));
1450 err
= nla_parse_nested_deprecated(tb
, CTA_TUPLE_MAX
, cda
[type
],
1451 tuple_nla_policy
, NULL
);
1455 if (l3num
!= NFPROTO_IPV4
&& l3num
!= NFPROTO_IPV6
)
1457 tuple
->src
.l3num
= l3num
;
1459 if (flags
& CTA_FILTER_FLAG(CTA_IP_DST
) ||
1460 flags
& CTA_FILTER_FLAG(CTA_IP_SRC
)) {
1461 if (!tb
[CTA_TUPLE_IP
])
1464 err
= ctnetlink_parse_tuple_ip(tb
[CTA_TUPLE_IP
], tuple
, flags
);
1469 if (flags
& CTA_FILTER_FLAG(CTA_PROTO_NUM
)) {
1470 if (!tb
[CTA_TUPLE_PROTO
])
1473 err
= ctnetlink_parse_tuple_proto(tb
[CTA_TUPLE_PROTO
], tuple
, flags
);
1476 } else if (flags
& CTA_FILTER_FLAG(ALL_CTA_PROTO
)) {
1477 /* Can't manage proto flags without a protonum */
1481 if ((flags
& CTA_FILTER_FLAG(CTA_TUPLE_ZONE
)) && tb
[CTA_TUPLE_ZONE
]) {
1485 err
= ctnetlink_parse_tuple_zone(tb
[CTA_TUPLE_ZONE
],
1491 /* orig and expect tuples get DIR_ORIGINAL */
1492 if (type
== CTA_TUPLE_REPLY
)
1493 tuple
->dst
.dir
= IP_CT_DIR_REPLY
;
1495 tuple
->dst
.dir
= IP_CT_DIR_ORIGINAL
;
1501 ctnetlink_parse_tuple(const struct nlattr
* const cda
[],
1502 struct nf_conntrack_tuple
*tuple
, u32 type
,
1503 u_int8_t l3num
, struct nf_conntrack_zone
*zone
)
1505 return ctnetlink_parse_tuple_filter(cda
, tuple
, type
, l3num
, zone
,
1506 CTA_FILTER_FLAG(ALL
));
1509 static const struct nla_policy help_nla_policy
[CTA_HELP_MAX
+1] = {
1510 [CTA_HELP_NAME
] = { .type
= NLA_NUL_STRING
,
1511 .len
= NF_CT_HELPER_NAME_LEN
- 1 },
1514 static int ctnetlink_parse_help(const struct nlattr
*attr
, char **helper_name
,
1515 struct nlattr
**helpinfo
)
1518 struct nlattr
*tb
[CTA_HELP_MAX
+1];
1520 err
= nla_parse_nested_deprecated(tb
, CTA_HELP_MAX
, attr
,
1521 help_nla_policy
, NULL
);
1525 if (!tb
[CTA_HELP_NAME
])
1528 *helper_name
= nla_data(tb
[CTA_HELP_NAME
]);
1530 if (tb
[CTA_HELP_INFO
])
1531 *helpinfo
= tb
[CTA_HELP_INFO
];
1536 static const struct nla_policy ct_nla_policy
[CTA_MAX
+1] = {
1537 [CTA_TUPLE_ORIG
] = { .type
= NLA_NESTED
},
1538 [CTA_TUPLE_REPLY
] = { .type
= NLA_NESTED
},
1539 [CTA_STATUS
] = { .type
= NLA_U32
},
1540 [CTA_PROTOINFO
] = { .type
= NLA_NESTED
},
1541 [CTA_HELP
] = { .type
= NLA_NESTED
},
1542 [CTA_NAT_SRC
] = { .type
= NLA_NESTED
},
1543 [CTA_TIMEOUT
] = { .type
= NLA_U32
},
1544 [CTA_MARK
] = { .type
= NLA_U32
},
1545 [CTA_ID
] = { .type
= NLA_U32
},
1546 [CTA_NAT_DST
] = { .type
= NLA_NESTED
},
1547 [CTA_TUPLE_MASTER
] = { .type
= NLA_NESTED
},
1548 [CTA_NAT_SEQ_ADJ_ORIG
] = { .type
= NLA_NESTED
},
1549 [CTA_NAT_SEQ_ADJ_REPLY
] = { .type
= NLA_NESTED
},
1550 [CTA_ZONE
] = { .type
= NLA_U16
},
1551 [CTA_MARK_MASK
] = { .type
= NLA_U32
},
1552 [CTA_LABELS
] = { .type
= NLA_BINARY
,
1553 .len
= NF_CT_LABELS_MAX_SIZE
},
1554 [CTA_LABELS_MASK
] = { .type
= NLA_BINARY
,
1555 .len
= NF_CT_LABELS_MAX_SIZE
},
1556 [CTA_FILTER
] = { .type
= NLA_NESTED
},
1557 [CTA_STATUS_MASK
] = { .type
= NLA_U32
},
1560 static int ctnetlink_flush_iterate(struct nf_conn
*ct
, void *data
)
1562 return ctnetlink_filter_match(ct
, data
);
1565 static int ctnetlink_flush_conntrack(struct net
*net
,
1566 const struct nlattr
* const cda
[],
1567 u32 portid
, int report
, u8 family
)
1569 struct ctnetlink_filter
*filter
= NULL
;
1570 struct nf_ct_iter_data iter
= {
1576 if (ctnetlink_needs_filter(family
, cda
)) {
1577 if (cda
[CTA_FILTER
])
1580 filter
= ctnetlink_alloc_filter(cda
, family
);
1582 return PTR_ERR(filter
);
1587 nf_ct_iterate_cleanup_net(ctnetlink_flush_iterate
, &iter
);
1593 static int ctnetlink_del_conntrack(struct sk_buff
*skb
,
1594 const struct nfnl_info
*info
,
1595 const struct nlattr
* const cda
[])
1597 u8 family
= info
->nfmsg
->nfgen_family
;
1598 struct nf_conntrack_tuple_hash
*h
;
1599 struct nf_conntrack_tuple tuple
;
1600 struct nf_conntrack_zone zone
;
1604 err
= ctnetlink_parse_zone(cda
[CTA_ZONE
], &zone
);
1608 if (cda
[CTA_TUPLE_ORIG
])
1609 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_ORIG
,
1611 else if (cda
[CTA_TUPLE_REPLY
])
1612 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_REPLY
,
1615 u_int8_t u3
= info
->nfmsg
->version
? family
: AF_UNSPEC
;
1617 return ctnetlink_flush_conntrack(info
->net
, cda
,
1618 NETLINK_CB(skb
).portid
,
1619 nlmsg_report(info
->nlh
), u3
);
1625 h
= nf_conntrack_find_get(info
->net
, &zone
, &tuple
);
1629 ct
= nf_ct_tuplehash_to_ctrack(h
);
1632 __be32 id
= nla_get_be32(cda
[CTA_ID
]);
1634 if (id
!= (__force __be32
)nf_ct_get_id(ct
)) {
1640 nf_ct_delete(ct
, NETLINK_CB(skb
).portid
, nlmsg_report(info
->nlh
));
1646 static int ctnetlink_get_conntrack(struct sk_buff
*skb
,
1647 const struct nfnl_info
*info
,
1648 const struct nlattr
* const cda
[])
1650 u_int8_t u3
= info
->nfmsg
->nfgen_family
;
1651 struct nf_conntrack_tuple_hash
*h
;
1652 struct nf_conntrack_tuple tuple
;
1653 struct nf_conntrack_zone zone
;
1654 struct sk_buff
*skb2
;
1658 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1659 struct netlink_dump_control c
= {
1660 .start
= ctnetlink_start
,
1661 .dump
= ctnetlink_dump_table
,
1662 .done
= ctnetlink_done
,
1663 .data
= (void *)cda
,
1666 return netlink_dump_start(info
->sk
, skb
, info
->nlh
, &c
);
1669 err
= ctnetlink_parse_zone(cda
[CTA_ZONE
], &zone
);
1673 if (cda
[CTA_TUPLE_ORIG
])
1674 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_ORIG
,
1676 else if (cda
[CTA_TUPLE_REPLY
])
1677 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_TUPLE_REPLY
,
1685 h
= nf_conntrack_find_get(info
->net
, &zone
, &tuple
);
1689 ct
= nf_ct_tuplehash_to_ctrack(h
);
1691 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
1697 err
= ctnetlink_fill_info(skb2
, NETLINK_CB(skb
).portid
,
1698 info
->nlh
->nlmsg_seq
,
1699 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
), ct
,
1707 return nfnetlink_unicast(skb2
, info
->net
, NETLINK_CB(skb
).portid
);
1710 static int ctnetlink_done_list(struct netlink_callback
*cb
)
1712 struct ctnetlink_list_dump_ctx
*ctx
= (void *)cb
->ctx
;
1715 nf_ct_put(ctx
->last
);
1720 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1721 static int ctnetlink_dump_one_entry(struct sk_buff
*skb
,
1722 struct netlink_callback
*cb
,
1726 struct ctnetlink_list_dump_ctx
*ctx
= (void *)cb
->ctx
;
1727 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
1728 u8 l3proto
= nfmsg
->nfgen_family
;
1731 if (l3proto
&& nf_ct_l3num(ct
) != l3proto
)
1735 if (ct
!= ctx
->last
)
1741 /* We can't dump extension info for the unconfirmed
1742 * list because unconfirmed conntracks can have
1743 * ct->ext reallocated (and thus freed).
1745 * In the dying list case ct->ext can't be free'd
1746 * until after we drop pcpu->lock.
1748 res
= ctnetlink_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
1750 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
1753 if (!refcount_inc_not_zero(&ct
->ct_general
.use
))
1764 ctnetlink_dump_unconfirmed(struct sk_buff
*skb
, struct netlink_callback
*cb
)
1770 ctnetlink_dump_dying(struct sk_buff
*skb
, struct netlink_callback
*cb
)
1772 struct ctnetlink_list_dump_ctx
*ctx
= (void *)cb
->ctx
;
1773 struct nf_conn
*last
= ctx
->last
;
1774 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1775 const struct net
*net
= sock_net(skb
->sk
);
1776 struct nf_conntrack_net_ecache
*ecache_net
;
1777 struct nf_conntrack_tuple_hash
*h
;
1778 struct hlist_nulls_node
*n
;
1786 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1787 ecache_net
= nf_conn_pernet_ecache(net
);
1788 spin_lock_bh(&ecache_net
->dying_lock
);
1790 hlist_nulls_for_each_entry(h
, n
, &ecache_net
->dying_list
, hnnode
) {
1794 ct
= nf_ct_tuplehash_to_ctrack(h
);
1795 if (last
&& last
!= ct
)
1798 res
= ctnetlink_dump_one_entry(skb
, cb
, ct
, true);
1800 spin_unlock_bh(&ecache_net
->dying_lock
);
1809 spin_unlock_bh(&ecache_net
->dying_lock
);
1817 static int ctnetlink_get_ct_dying(struct sk_buff
*skb
,
1818 const struct nfnl_info
*info
,
1819 const struct nlattr
* const cda
[])
1821 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1822 struct netlink_dump_control c
= {
1823 .dump
= ctnetlink_dump_dying
,
1824 .done
= ctnetlink_done_list
,
1826 return netlink_dump_start(info
->sk
, skb
, info
->nlh
, &c
);
1832 static int ctnetlink_get_ct_unconfirmed(struct sk_buff
*skb
,
1833 const struct nfnl_info
*info
,
1834 const struct nlattr
* const cda
[])
1836 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
1837 struct netlink_dump_control c
= {
1838 .dump
= ctnetlink_dump_unconfirmed
,
1839 .done
= ctnetlink_done_list
,
1841 return netlink_dump_start(info
->sk
, skb
, info
->nlh
, &c
);
1847 #if IS_ENABLED(CONFIG_NF_NAT)
1849 ctnetlink_parse_nat_setup(struct nf_conn
*ct
,
1850 enum nf_nat_manip_type manip
,
1851 const struct nlattr
*attr
)
1854 const struct nf_nat_hook
*nat_hook
;
1857 nat_hook
= rcu_dereference(nf_nat_hook
);
1859 #ifdef CONFIG_MODULES
1861 nfnl_unlock(NFNL_SUBSYS_CTNETLINK
);
1862 if (request_module("nf-nat") < 0) {
1863 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1867 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1869 nat_hook
= rcu_dereference(nf_nat_hook
);
1876 err
= nat_hook
->parse_nat_setup(ct
, manip
, attr
);
1877 if (err
== -EAGAIN
) {
1878 #ifdef CONFIG_MODULES
1880 nfnl_unlock(NFNL_SUBSYS_CTNETLINK
);
1881 if (request_module("nf-nat-%u", nf_ct_l3num(ct
)) < 0) {
1882 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1886 nfnl_lock(NFNL_SUBSYS_CTNETLINK
);
1897 ctnetlink_change_status(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
1899 return nf_ct_change_status_common(ct
, ntohl(nla_get_be32(cda
[CTA_STATUS
])));
1903 ctnetlink_setup_nat(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
1905 #if IS_ENABLED(CONFIG_NF_NAT)
1908 if (!cda
[CTA_NAT_DST
] && !cda
[CTA_NAT_SRC
])
1911 ret
= ctnetlink_parse_nat_setup(ct
, NF_NAT_MANIP_DST
,
1916 return ctnetlink_parse_nat_setup(ct
, NF_NAT_MANIP_SRC
,
1919 if (!cda
[CTA_NAT_DST
] && !cda
[CTA_NAT_SRC
])
1925 static int ctnetlink_change_helper(struct nf_conn
*ct
,
1926 const struct nlattr
* const cda
[])
1928 struct nf_conntrack_helper
*helper
;
1929 struct nf_conn_help
*help
= nfct_help(ct
);
1930 char *helpname
= NULL
;
1931 struct nlattr
*helpinfo
= NULL
;
1934 err
= ctnetlink_parse_help(cda
[CTA_HELP
], &helpname
, &helpinfo
);
1938 /* don't change helper of sibling connections */
1940 /* If we try to change the helper to the same thing twice,
1941 * treat the second attempt as a no-op instead of returning
1947 helper
= rcu_dereference(help
->helper
);
1948 if (helper
&& !strcmp(helper
->name
, helpname
))
1956 if (!strcmp(helpname
, "")) {
1957 if (help
&& help
->helper
) {
1958 /* we had a helper before ... */
1959 nf_ct_remove_expectations(ct
);
1960 RCU_INIT_POINTER(help
->helper
, NULL
);
1967 helper
= __nf_conntrack_helper_find(helpname
, nf_ct_l3num(ct
),
1968 nf_ct_protonum(ct
));
1969 if (helper
== NULL
) {
1975 if (rcu_access_pointer(help
->helper
) == helper
) {
1976 /* update private helper data if allowed. */
1977 if (helper
->from_nlattr
)
1978 helper
->from_nlattr(helpinfo
, ct
);
1983 /* we cannot set a helper for an existing conntrack */
1991 static int ctnetlink_change_timeout(struct nf_conn
*ct
,
1992 const struct nlattr
* const cda
[])
1994 return __nf_ct_change_timeout(ct
, (u64
)ntohl(nla_get_be32(cda
[CTA_TIMEOUT
])) * HZ
);
1997 #if defined(CONFIG_NF_CONNTRACK_MARK)
1998 static void ctnetlink_change_mark(struct nf_conn
*ct
,
1999 const struct nlattr
* const cda
[])
2001 u32 mark
, newmark
, mask
= 0;
2003 if (cda
[CTA_MARK_MASK
])
2004 mask
= ~ntohl(nla_get_be32(cda
[CTA_MARK_MASK
]));
2006 mark
= ntohl(nla_get_be32(cda
[CTA_MARK
]));
2007 newmark
= (READ_ONCE(ct
->mark
) & mask
) ^ mark
;
2008 if (newmark
!= READ_ONCE(ct
->mark
))
2009 WRITE_ONCE(ct
->mark
, newmark
);
2013 static const struct nla_policy protoinfo_policy
[CTA_PROTOINFO_MAX
+1] = {
2014 [CTA_PROTOINFO_TCP
] = { .type
= NLA_NESTED
},
2015 [CTA_PROTOINFO_DCCP
] = { .type
= NLA_NESTED
},
2016 [CTA_PROTOINFO_SCTP
] = { .type
= NLA_NESTED
},
2019 static int ctnetlink_change_protoinfo(struct nf_conn
*ct
,
2020 const struct nlattr
* const cda
[])
2022 const struct nlattr
*attr
= cda
[CTA_PROTOINFO
];
2023 const struct nf_conntrack_l4proto
*l4proto
;
2024 struct nlattr
*tb
[CTA_PROTOINFO_MAX
+1];
2027 err
= nla_parse_nested_deprecated(tb
, CTA_PROTOINFO_MAX
, attr
,
2028 protoinfo_policy
, NULL
);
2032 l4proto
= nf_ct_l4proto_find(nf_ct_protonum(ct
));
2033 if (l4proto
->from_nlattr
)
2034 err
= l4proto
->from_nlattr(tb
, ct
);
2039 static const struct nla_policy seqadj_policy
[CTA_SEQADJ_MAX
+1] = {
2040 [CTA_SEQADJ_CORRECTION_POS
] = { .type
= NLA_U32
},
2041 [CTA_SEQADJ_OFFSET_BEFORE
] = { .type
= NLA_U32
},
2042 [CTA_SEQADJ_OFFSET_AFTER
] = { .type
= NLA_U32
},
2045 static int change_seq_adj(struct nf_ct_seqadj
*seq
,
2046 const struct nlattr
* const attr
)
2049 struct nlattr
*cda
[CTA_SEQADJ_MAX
+1];
2051 err
= nla_parse_nested_deprecated(cda
, CTA_SEQADJ_MAX
, attr
,
2052 seqadj_policy
, NULL
);
2056 if (!cda
[CTA_SEQADJ_CORRECTION_POS
])
2059 seq
->correction_pos
=
2060 ntohl(nla_get_be32(cda
[CTA_SEQADJ_CORRECTION_POS
]));
2062 if (!cda
[CTA_SEQADJ_OFFSET_BEFORE
])
2065 seq
->offset_before
=
2066 ntohl(nla_get_be32(cda
[CTA_SEQADJ_OFFSET_BEFORE
]));
2068 if (!cda
[CTA_SEQADJ_OFFSET_AFTER
])
2072 ntohl(nla_get_be32(cda
[CTA_SEQADJ_OFFSET_AFTER
]));
2078 ctnetlink_change_seq_adj(struct nf_conn
*ct
,
2079 const struct nlattr
* const cda
[])
2081 struct nf_conn_seqadj
*seqadj
= nfct_seqadj(ct
);
2087 spin_lock_bh(&ct
->lock
);
2088 if (cda
[CTA_SEQ_ADJ_ORIG
]) {
2089 ret
= change_seq_adj(&seqadj
->seq
[IP_CT_DIR_ORIGINAL
],
2090 cda
[CTA_SEQ_ADJ_ORIG
]);
2094 set_bit(IPS_SEQ_ADJUST_BIT
, &ct
->status
);
2097 if (cda
[CTA_SEQ_ADJ_REPLY
]) {
2098 ret
= change_seq_adj(&seqadj
->seq
[IP_CT_DIR_REPLY
],
2099 cda
[CTA_SEQ_ADJ_REPLY
]);
2103 set_bit(IPS_SEQ_ADJUST_BIT
, &ct
->status
);
2106 spin_unlock_bh(&ct
->lock
);
2109 spin_unlock_bh(&ct
->lock
);
2113 static const struct nla_policy synproxy_policy
[CTA_SYNPROXY_MAX
+ 1] = {
2114 [CTA_SYNPROXY_ISN
] = { .type
= NLA_U32
},
2115 [CTA_SYNPROXY_ITS
] = { .type
= NLA_U32
},
2116 [CTA_SYNPROXY_TSOFF
] = { .type
= NLA_U32
},
2119 static int ctnetlink_change_synproxy(struct nf_conn
*ct
,
2120 const struct nlattr
* const cda
[])
2122 struct nf_conn_synproxy
*synproxy
= nfct_synproxy(ct
);
2123 struct nlattr
*tb
[CTA_SYNPROXY_MAX
+ 1];
2129 err
= nla_parse_nested_deprecated(tb
, CTA_SYNPROXY_MAX
,
2130 cda
[CTA_SYNPROXY
], synproxy_policy
,
2135 if (!tb
[CTA_SYNPROXY_ISN
] ||
2136 !tb
[CTA_SYNPROXY_ITS
] ||
2137 !tb
[CTA_SYNPROXY_TSOFF
])
2140 synproxy
->isn
= ntohl(nla_get_be32(tb
[CTA_SYNPROXY_ISN
]));
2141 synproxy
->its
= ntohl(nla_get_be32(tb
[CTA_SYNPROXY_ITS
]));
2142 synproxy
->tsoff
= ntohl(nla_get_be32(tb
[CTA_SYNPROXY_TSOFF
]));
2148 ctnetlink_attach_labels(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
2150 #ifdef CONFIG_NF_CONNTRACK_LABELS
2151 size_t len
= nla_len(cda
[CTA_LABELS
]);
2152 const void *mask
= cda
[CTA_LABELS_MASK
];
2154 if (len
& (sizeof(u32
)-1)) /* must be multiple of u32 */
2158 if (nla_len(cda
[CTA_LABELS_MASK
]) == 0 ||
2159 nla_len(cda
[CTA_LABELS_MASK
]) != len
)
2161 mask
= nla_data(cda
[CTA_LABELS_MASK
]);
2166 return nf_connlabels_replace(ct
, nla_data(cda
[CTA_LABELS
]), mask
, len
);
2173 ctnetlink_change_conntrack(struct nf_conn
*ct
,
2174 const struct nlattr
* const cda
[])
2178 /* only allow NAT changes and master assignation for new conntracks */
2179 if (cda
[CTA_NAT_SRC
] || cda
[CTA_NAT_DST
] || cda
[CTA_TUPLE_MASTER
])
2182 if (cda
[CTA_HELP
]) {
2183 err
= ctnetlink_change_helper(ct
, cda
);
2188 if (cda
[CTA_TIMEOUT
]) {
2189 err
= ctnetlink_change_timeout(ct
, cda
);
2194 if (cda
[CTA_STATUS
]) {
2195 err
= ctnetlink_change_status(ct
, cda
);
2200 if (cda
[CTA_PROTOINFO
]) {
2201 err
= ctnetlink_change_protoinfo(ct
, cda
);
2206 #if defined(CONFIG_NF_CONNTRACK_MARK)
2208 ctnetlink_change_mark(ct
, cda
);
2211 if (cda
[CTA_SEQ_ADJ_ORIG
] || cda
[CTA_SEQ_ADJ_REPLY
]) {
2212 err
= ctnetlink_change_seq_adj(ct
, cda
);
2217 if (cda
[CTA_SYNPROXY
]) {
2218 err
= ctnetlink_change_synproxy(ct
, cda
);
2223 if (cda
[CTA_LABELS
]) {
2224 err
= ctnetlink_attach_labels(ct
, cda
);
2232 static struct nf_conn
*
2233 ctnetlink_create_conntrack(struct net
*net
,
2234 const struct nf_conntrack_zone
*zone
,
2235 const struct nlattr
* const cda
[],
2236 struct nf_conntrack_tuple
*otuple
,
2237 struct nf_conntrack_tuple
*rtuple
,
2242 struct nf_conntrack_helper
*helper
;
2243 struct nf_conn_tstamp
*tstamp
;
2246 ct
= nf_conntrack_alloc(net
, zone
, otuple
, rtuple
, GFP_ATOMIC
);
2248 return ERR_PTR(-ENOMEM
);
2250 if (!cda
[CTA_TIMEOUT
])
2254 if (cda
[CTA_HELP
]) {
2255 char *helpname
= NULL
;
2256 struct nlattr
*helpinfo
= NULL
;
2258 err
= ctnetlink_parse_help(cda
[CTA_HELP
], &helpname
, &helpinfo
);
2262 helper
= __nf_conntrack_helper_find(helpname
, nf_ct_l3num(ct
),
2263 nf_ct_protonum(ct
));
2264 if (helper
== NULL
) {
2266 #ifdef CONFIG_MODULES
2267 if (request_module("nfct-helper-%s", helpname
) < 0) {
2273 helper
= __nf_conntrack_helper_find(helpname
,
2275 nf_ct_protonum(ct
));
2285 struct nf_conn_help
*help
;
2287 help
= nf_ct_helper_ext_add(ct
, GFP_ATOMIC
);
2292 /* set private helper data if allowed. */
2293 if (helper
->from_nlattr
)
2294 helper
->from_nlattr(helpinfo
, ct
);
2296 /* disable helper auto-assignment for this entry */
2297 ct
->status
|= IPS_HELPER
;
2298 RCU_INIT_POINTER(help
->helper
, helper
);
2302 err
= ctnetlink_setup_nat(ct
, cda
);
2306 nf_ct_acct_ext_add(ct
, GFP_ATOMIC
);
2307 nf_ct_tstamp_ext_add(ct
, GFP_ATOMIC
);
2308 nf_ct_ecache_ext_add(ct
, 0, 0, GFP_ATOMIC
);
2309 nf_ct_labels_ext_add(ct
);
2310 nfct_seqadj_ext_add(ct
);
2311 nfct_synproxy_ext_add(ct
);
2313 /* we must add conntrack extensions before confirmation. */
2314 ct
->status
|= IPS_CONFIRMED
;
2316 timeout
= (u64
)ntohl(nla_get_be32(cda
[CTA_TIMEOUT
])) * HZ
;
2317 __nf_ct_set_timeout(ct
, timeout
);
2319 if (cda
[CTA_STATUS
]) {
2320 err
= ctnetlink_change_status(ct
, cda
);
2325 if (cda
[CTA_SEQ_ADJ_ORIG
] || cda
[CTA_SEQ_ADJ_REPLY
]) {
2326 err
= ctnetlink_change_seq_adj(ct
, cda
);
2331 memset(&ct
->proto
, 0, sizeof(ct
->proto
));
2332 if (cda
[CTA_PROTOINFO
]) {
2333 err
= ctnetlink_change_protoinfo(ct
, cda
);
2338 if (cda
[CTA_SYNPROXY
]) {
2339 err
= ctnetlink_change_synproxy(ct
, cda
);
2344 #if defined(CONFIG_NF_CONNTRACK_MARK)
2346 ctnetlink_change_mark(ct
, cda
);
2349 /* setup master conntrack: this is a confirmed expectation */
2350 if (cda
[CTA_TUPLE_MASTER
]) {
2351 struct nf_conntrack_tuple master
;
2352 struct nf_conntrack_tuple_hash
*master_h
;
2353 struct nf_conn
*master_ct
;
2355 err
= ctnetlink_parse_tuple(cda
, &master
, CTA_TUPLE_MASTER
,
2360 master_h
= nf_conntrack_find_get(net
, zone
, &master
);
2361 if (master_h
== NULL
) {
2365 master_ct
= nf_ct_tuplehash_to_ctrack(master_h
);
2366 __set_bit(IPS_EXPECTED_BIT
, &ct
->status
);
2367 ct
->master
= master_ct
;
2369 tstamp
= nf_conn_tstamp_find(ct
);
2371 tstamp
->start
= ktime_get_real_ns();
2373 err
= nf_conntrack_hash_check_insert(ct
);
2383 nf_ct_put(ct
->master
);
2387 nf_conntrack_free(ct
);
2388 return ERR_PTR(err
);
2391 static int ctnetlink_new_conntrack(struct sk_buff
*skb
,
2392 const struct nfnl_info
*info
,
2393 const struct nlattr
* const cda
[])
2395 struct nf_conntrack_tuple otuple
, rtuple
;
2396 struct nf_conntrack_tuple_hash
*h
= NULL
;
2397 u_int8_t u3
= info
->nfmsg
->nfgen_family
;
2398 struct nf_conntrack_zone zone
;
2402 err
= ctnetlink_parse_zone(cda
[CTA_ZONE
], &zone
);
2406 if (cda
[CTA_TUPLE_ORIG
]) {
2407 err
= ctnetlink_parse_tuple(cda
, &otuple
, CTA_TUPLE_ORIG
,
2413 if (cda
[CTA_TUPLE_REPLY
]) {
2414 err
= ctnetlink_parse_tuple(cda
, &rtuple
, CTA_TUPLE_REPLY
,
2420 if (cda
[CTA_TUPLE_ORIG
])
2421 h
= nf_conntrack_find_get(info
->net
, &zone
, &otuple
);
2422 else if (cda
[CTA_TUPLE_REPLY
])
2423 h
= nf_conntrack_find_get(info
->net
, &zone
, &rtuple
);
2427 if (info
->nlh
->nlmsg_flags
& NLM_F_CREATE
) {
2428 enum ip_conntrack_events events
;
2430 if (!cda
[CTA_TUPLE_ORIG
] || !cda
[CTA_TUPLE_REPLY
])
2432 if (otuple
.dst
.protonum
!= rtuple
.dst
.protonum
)
2435 ct
= ctnetlink_create_conntrack(info
->net
, &zone
, cda
,
2436 &otuple
, &rtuple
, u3
);
2441 if (test_bit(IPS_EXPECTED_BIT
, &ct
->status
))
2442 events
= 1 << IPCT_RELATED
;
2444 events
= 1 << IPCT_NEW
;
2446 if (cda
[CTA_LABELS
] &&
2447 ctnetlink_attach_labels(ct
, cda
) == 0)
2448 events
|= (1 << IPCT_LABEL
);
2450 nf_conntrack_eventmask_report((1 << IPCT_REPLY
) |
2451 (1 << IPCT_ASSURED
) |
2452 (1 << IPCT_HELPER
) |
2453 (1 << IPCT_PROTOINFO
) |
2454 (1 << IPCT_SEQADJ
) |
2456 (1 << IPCT_SYNPROXY
) |
2458 ct
, NETLINK_CB(skb
).portid
,
2459 nlmsg_report(info
->nlh
));
2465 /* implicit 'else' */
2468 ct
= nf_ct_tuplehash_to_ctrack(h
);
2469 if (!(info
->nlh
->nlmsg_flags
& NLM_F_EXCL
)) {
2470 err
= ctnetlink_change_conntrack(ct
, cda
);
2472 nf_conntrack_eventmask_report((1 << IPCT_REPLY
) |
2473 (1 << IPCT_ASSURED
) |
2474 (1 << IPCT_HELPER
) |
2476 (1 << IPCT_PROTOINFO
) |
2477 (1 << IPCT_SEQADJ
) |
2479 (1 << IPCT_SYNPROXY
),
2480 ct
, NETLINK_CB(skb
).portid
,
2481 nlmsg_report(info
->nlh
));
2490 ctnetlink_ct_stat_cpu_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
,
2491 __u16 cpu
, const struct ip_conntrack_stat
*st
)
2493 struct nlmsghdr
*nlh
;
2494 unsigned int flags
= portid
? NLM_F_MULTI
: 0, event
;
2496 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
,
2497 IPCTNL_MSG_CT_GET_STATS_CPU
);
2498 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, AF_UNSPEC
,
2499 NFNETLINK_V0
, htons(cpu
));
2503 if (nla_put_be32(skb
, CTA_STATS_FOUND
, htonl(st
->found
)) ||
2504 nla_put_be32(skb
, CTA_STATS_INVALID
, htonl(st
->invalid
)) ||
2505 nla_put_be32(skb
, CTA_STATS_INSERT
, htonl(st
->insert
)) ||
2506 nla_put_be32(skb
, CTA_STATS_INSERT_FAILED
,
2507 htonl(st
->insert_failed
)) ||
2508 nla_put_be32(skb
, CTA_STATS_DROP
, htonl(st
->drop
)) ||
2509 nla_put_be32(skb
, CTA_STATS_EARLY_DROP
, htonl(st
->early_drop
)) ||
2510 nla_put_be32(skb
, CTA_STATS_ERROR
, htonl(st
->error
)) ||
2511 nla_put_be32(skb
, CTA_STATS_SEARCH_RESTART
,
2512 htonl(st
->search_restart
)) ||
2513 nla_put_be32(skb
, CTA_STATS_CLASH_RESOLVE
,
2514 htonl(st
->clash_resolve
)) ||
2515 nla_put_be32(skb
, CTA_STATS_CHAIN_TOOLONG
,
2516 htonl(st
->chaintoolong
)))
2517 goto nla_put_failure
;
2519 nlmsg_end(skb
, nlh
);
2524 nlmsg_cancel(skb
, nlh
);
2529 ctnetlink_ct_stat_cpu_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
2532 struct net
*net
= sock_net(skb
->sk
);
2534 if (cb
->args
[0] == nr_cpu_ids
)
2537 for (cpu
= cb
->args
[0]; cpu
< nr_cpu_ids
; cpu
++) {
2538 const struct ip_conntrack_stat
*st
;
2540 if (!cpu_possible(cpu
))
2543 st
= per_cpu_ptr(net
->ct
.stat
, cpu
);
2544 if (ctnetlink_ct_stat_cpu_fill_info(skb
,
2545 NETLINK_CB(cb
->skb
).portid
,
2555 static int ctnetlink_stat_ct_cpu(struct sk_buff
*skb
,
2556 const struct nfnl_info
*info
,
2557 const struct nlattr
* const cda
[])
2559 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
2560 struct netlink_dump_control c
= {
2561 .dump
= ctnetlink_ct_stat_cpu_dump
,
2563 return netlink_dump_start(info
->sk
, skb
, info
->nlh
, &c
);
2570 ctnetlink_stat_ct_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
2573 unsigned int flags
= portid
? NLM_F_MULTI
: 0, event
;
2574 unsigned int nr_conntracks
;
2575 struct nlmsghdr
*nlh
;
2577 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
, IPCTNL_MSG_CT_GET_STATS
);
2578 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, AF_UNSPEC
,
2583 nr_conntracks
= nf_conntrack_count(net
);
2584 if (nla_put_be32(skb
, CTA_STATS_GLOBAL_ENTRIES
, htonl(nr_conntracks
)))
2585 goto nla_put_failure
;
2587 if (nla_put_be32(skb
, CTA_STATS_GLOBAL_MAX_ENTRIES
, htonl(nf_conntrack_max
)))
2588 goto nla_put_failure
;
2590 nlmsg_end(skb
, nlh
);
2595 nlmsg_cancel(skb
, nlh
);
2599 static int ctnetlink_stat_ct(struct sk_buff
*skb
, const struct nfnl_info
*info
,
2600 const struct nlattr
* const cda
[])
2602 struct sk_buff
*skb2
;
2605 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
2609 err
= ctnetlink_stat_ct_fill_info(skb2
, NETLINK_CB(skb
).portid
,
2610 info
->nlh
->nlmsg_seq
,
2611 NFNL_MSG_TYPE(info
->nlh
->nlmsg_type
),
2618 return nfnetlink_unicast(skb2
, info
->net
, NETLINK_CB(skb
).portid
);
2621 static const struct nla_policy exp_nla_policy
[CTA_EXPECT_MAX
+1] = {
2622 [CTA_EXPECT_MASTER
] = { .type
= NLA_NESTED
},
2623 [CTA_EXPECT_TUPLE
] = { .type
= NLA_NESTED
},
2624 [CTA_EXPECT_MASK
] = { .type
= NLA_NESTED
},
2625 [CTA_EXPECT_TIMEOUT
] = { .type
= NLA_U32
},
2626 [CTA_EXPECT_ID
] = { .type
= NLA_U32
},
2627 [CTA_EXPECT_HELP_NAME
] = { .type
= NLA_NUL_STRING
,
2628 .len
= NF_CT_HELPER_NAME_LEN
- 1 },
2629 [CTA_EXPECT_ZONE
] = { .type
= NLA_U16
},
2630 [CTA_EXPECT_FLAGS
] = { .type
= NLA_U32
},
2631 [CTA_EXPECT_CLASS
] = { .type
= NLA_U32
},
2632 [CTA_EXPECT_NAT
] = { .type
= NLA_NESTED
},
2633 [CTA_EXPECT_FN
] = { .type
= NLA_NUL_STRING
},
2636 static struct nf_conntrack_expect
*
2637 ctnetlink_alloc_expect(const struct nlattr
*const cda
[], struct nf_conn
*ct
,
2638 struct nf_conntrack_helper
*helper
,
2639 struct nf_conntrack_tuple
*tuple
,
2640 struct nf_conntrack_tuple
*mask
);
2642 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
2644 ctnetlink_glue_build_size(const struct nf_conn
*ct
)
2646 return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
2647 + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
2648 + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
2649 + 3 * nla_total_size(sizeof(u_int8_t
)) /* CTA_PROTO_NUM */
2650 + nla_total_size(sizeof(u_int32_t
)) /* CTA_ID */
2651 + nla_total_size(sizeof(u_int32_t
)) /* CTA_STATUS */
2652 + nla_total_size(sizeof(u_int32_t
)) /* CTA_TIMEOUT */
2653 + nla_total_size(0) /* CTA_PROTOINFO */
2654 + nla_total_size(0) /* CTA_HELP */
2655 + nla_total_size(NF_CT_HELPER_NAME_LEN
) /* CTA_HELP_NAME */
2656 + ctnetlink_secctx_size(ct
)
2657 + ctnetlink_acct_size(ct
)
2658 + ctnetlink_timestamp_size(ct
)
2659 #if IS_ENABLED(CONFIG_NF_NAT)
2660 + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
2661 + 6 * nla_total_size(sizeof(u_int32_t
)) /* CTA_NAT_SEQ_OFFSET */
2663 #ifdef CONFIG_NF_CONNTRACK_MARK
2664 + nla_total_size(sizeof(u_int32_t
)) /* CTA_MARK */
2666 #ifdef CONFIG_NF_CONNTRACK_ZONES
2667 + nla_total_size(sizeof(u_int16_t
)) /* CTA_ZONE|CTA_TUPLE_ZONE */
2669 + ctnetlink_proto_size(ct
)
2673 static int __ctnetlink_glue_build(struct sk_buff
*skb
, struct nf_conn
*ct
)
2675 const struct nf_conntrack_zone
*zone
;
2676 struct nlattr
*nest_parms
;
2678 zone
= nf_ct_zone(ct
);
2680 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_ORIG
);
2682 goto nla_put_failure
;
2683 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_ORIGINAL
)) < 0)
2684 goto nla_put_failure
;
2685 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
2686 NF_CT_ZONE_DIR_ORIG
) < 0)
2687 goto nla_put_failure
;
2688 nla_nest_end(skb
, nest_parms
);
2690 nest_parms
= nla_nest_start(skb
, CTA_TUPLE_REPLY
);
2692 goto nla_put_failure
;
2693 if (ctnetlink_dump_tuples(skb
, nf_ct_tuple(ct
, IP_CT_DIR_REPLY
)) < 0)
2694 goto nla_put_failure
;
2695 if (ctnetlink_dump_zone_id(skb
, CTA_TUPLE_ZONE
, zone
,
2696 NF_CT_ZONE_DIR_REPL
) < 0)
2697 goto nla_put_failure
;
2698 nla_nest_end(skb
, nest_parms
);
2700 if (ctnetlink_dump_zone_id(skb
, CTA_ZONE
, zone
,
2701 NF_CT_DEFAULT_ZONE_DIR
) < 0)
2702 goto nla_put_failure
;
2704 if (ctnetlink_dump_id(skb
, ct
) < 0)
2705 goto nla_put_failure
;
2707 if (ctnetlink_dump_status(skb
, ct
) < 0)
2708 goto nla_put_failure
;
2710 if (ctnetlink_dump_timeout(skb
, ct
, false) < 0)
2711 goto nla_put_failure
;
2713 if (ctnetlink_dump_protoinfo(skb
, ct
, false) < 0)
2714 goto nla_put_failure
;
2716 if (ctnetlink_dump_acct(skb
, ct
, IPCTNL_MSG_CT_GET
) < 0 ||
2717 ctnetlink_dump_timestamp(skb
, ct
) < 0)
2718 goto nla_put_failure
;
2720 if (ctnetlink_dump_helpinfo(skb
, ct
) < 0)
2721 goto nla_put_failure
;
2723 #ifdef CONFIG_NF_CONNTRACK_SECMARK
2724 if (ct
->secmark
&& ctnetlink_dump_secctx(skb
, ct
) < 0)
2725 goto nla_put_failure
;
2727 if (ct
->master
&& ctnetlink_dump_master(skb
, ct
) < 0)
2728 goto nla_put_failure
;
2730 if ((ct
->status
& IPS_SEQ_ADJUST
) &&
2731 ctnetlink_dump_ct_seq_adj(skb
, ct
) < 0)
2732 goto nla_put_failure
;
2734 if (ctnetlink_dump_ct_synproxy(skb
, ct
) < 0)
2735 goto nla_put_failure
;
2737 #ifdef CONFIG_NF_CONNTRACK_MARK
2738 if (ctnetlink_dump_mark(skb
, ct
, true) < 0)
2739 goto nla_put_failure
;
2741 if (ctnetlink_dump_labels(skb
, ct
) < 0)
2742 goto nla_put_failure
;
2750 ctnetlink_glue_build(struct sk_buff
*skb
, struct nf_conn
*ct
,
2751 enum ip_conntrack_info ctinfo
,
2752 u_int16_t ct_attr
, u_int16_t ct_info_attr
)
2754 struct nlattr
*nest_parms
;
2756 nest_parms
= nla_nest_start(skb
, ct_attr
);
2758 goto nla_put_failure
;
2760 if (__ctnetlink_glue_build(skb
, ct
) < 0)
2761 goto nla_put_failure
;
2763 nla_nest_end(skb
, nest_parms
);
2765 if (nla_put_be32(skb
, ct_info_attr
, htonl(ctinfo
)))
2766 goto nla_put_failure
;
2775 ctnetlink_update_status(struct nf_conn
*ct
, const struct nlattr
* const cda
[])
2777 unsigned int status
= ntohl(nla_get_be32(cda
[CTA_STATUS
]));
2778 unsigned long d
= ct
->status
^ status
;
2780 if (d
& IPS_SEEN_REPLY
&& !(status
& IPS_SEEN_REPLY
))
2781 /* SEEN_REPLY bit can only be set */
2784 if (d
& IPS_ASSURED
&& !(status
& IPS_ASSURED
))
2785 /* ASSURED bit can only be set */
2788 /* This check is less strict than ctnetlink_change_status()
2789 * because callers often flip IPS_EXPECTED bits when sending
2790 * an NFQA_CT attribute to the kernel. So ignore the
2791 * unchangeable bits but do not error out. Also user programs
2792 * are allowed to clear the bits that they are allowed to change.
2794 __nf_ct_change_status(ct
, status
, ~status
);
2799 ctnetlink_glue_parse_ct(const struct nlattr
*cda
[], struct nf_conn
*ct
)
2803 if (cda
[CTA_TIMEOUT
]) {
2804 err
= ctnetlink_change_timeout(ct
, cda
);
2808 if (cda
[CTA_STATUS
]) {
2809 err
= ctnetlink_update_status(ct
, cda
);
2813 if (cda
[CTA_HELP
]) {
2814 err
= ctnetlink_change_helper(ct
, cda
);
2818 if (cda
[CTA_LABELS
]) {
2819 err
= ctnetlink_attach_labels(ct
, cda
);
2823 #if defined(CONFIG_NF_CONNTRACK_MARK)
2824 if (cda
[CTA_MARK
]) {
2825 ctnetlink_change_mark(ct
, cda
);
2832 ctnetlink_glue_parse(const struct nlattr
*attr
, struct nf_conn
*ct
)
2834 struct nlattr
*cda
[CTA_MAX
+1];
2837 ret
= nla_parse_nested_deprecated(cda
, CTA_MAX
, attr
, ct_nla_policy
,
2842 return ctnetlink_glue_parse_ct((const struct nlattr
**)cda
, ct
);
2845 static int ctnetlink_glue_exp_parse(const struct nlattr
* const *cda
,
2846 const struct nf_conn
*ct
,
2847 struct nf_conntrack_tuple
*tuple
,
2848 struct nf_conntrack_tuple
*mask
)
2852 err
= ctnetlink_parse_tuple(cda
, tuple
, CTA_EXPECT_TUPLE
,
2853 nf_ct_l3num(ct
), NULL
);
2857 return ctnetlink_parse_tuple(cda
, mask
, CTA_EXPECT_MASK
,
2858 nf_ct_l3num(ct
), NULL
);
2862 ctnetlink_glue_attach_expect(const struct nlattr
*attr
, struct nf_conn
*ct
,
2863 u32 portid
, u32 report
)
2865 struct nlattr
*cda
[CTA_EXPECT_MAX
+1];
2866 struct nf_conntrack_tuple tuple
, mask
;
2867 struct nf_conntrack_helper
*helper
= NULL
;
2868 struct nf_conntrack_expect
*exp
;
2871 err
= nla_parse_nested_deprecated(cda
, CTA_EXPECT_MAX
, attr
,
2872 exp_nla_policy
, NULL
);
2876 err
= ctnetlink_glue_exp_parse((const struct nlattr
* const *)cda
,
2881 if (cda
[CTA_EXPECT_HELP_NAME
]) {
2882 const char *helpname
= nla_data(cda
[CTA_EXPECT_HELP_NAME
]);
2884 helper
= __nf_conntrack_helper_find(helpname
, nf_ct_l3num(ct
),
2885 nf_ct_protonum(ct
));
2890 exp
= ctnetlink_alloc_expect((const struct nlattr
* const *)cda
, ct
,
2891 helper
, &tuple
, &mask
);
2893 return PTR_ERR(exp
);
2895 err
= nf_ct_expect_related_report(exp
, portid
, report
, 0);
2896 nf_ct_expect_put(exp
);
2900 static void ctnetlink_glue_seqadj(struct sk_buff
*skb
, struct nf_conn
*ct
,
2901 enum ip_conntrack_info ctinfo
, int diff
)
2903 if (!(ct
->status
& IPS_NAT_MASK
))
2906 nf_ct_tcp_seqadj_set(skb
, ct
, ctinfo
, diff
);
2909 static const struct nfnl_ct_hook ctnetlink_glue_hook
= {
2910 .build_size
= ctnetlink_glue_build_size
,
2911 .build
= ctnetlink_glue_build
,
2912 .parse
= ctnetlink_glue_parse
,
2913 .attach_expect
= ctnetlink_glue_attach_expect
,
2914 .seq_adjust
= ctnetlink_glue_seqadj
,
2916 #endif /* CONFIG_NETFILTER_NETLINK_GLUE_CT */
2918 /***********************************************************************
2920 ***********************************************************************/
2922 static int ctnetlink_exp_dump_tuple(struct sk_buff
*skb
,
2923 const struct nf_conntrack_tuple
*tuple
,
2926 struct nlattr
*nest_parms
;
2928 nest_parms
= nla_nest_start(skb
, type
);
2930 goto nla_put_failure
;
2931 if (ctnetlink_dump_tuples(skb
, tuple
) < 0)
2932 goto nla_put_failure
;
2933 nla_nest_end(skb
, nest_parms
);
2941 static int ctnetlink_exp_dump_mask(struct sk_buff
*skb
,
2942 const struct nf_conntrack_tuple
*tuple
,
2943 const struct nf_conntrack_tuple_mask
*mask
)
2945 const struct nf_conntrack_l4proto
*l4proto
;
2946 struct nf_conntrack_tuple m
;
2947 struct nlattr
*nest_parms
;
2950 memset(&m
, 0xFF, sizeof(m
));
2951 memcpy(&m
.src
.u3
, &mask
->src
.u3
, sizeof(m
.src
.u3
));
2952 m
.src
.u
.all
= mask
->src
.u
.all
;
2953 m
.src
.l3num
= tuple
->src
.l3num
;
2954 m
.dst
.protonum
= tuple
->dst
.protonum
;
2956 nest_parms
= nla_nest_start(skb
, CTA_EXPECT_MASK
);
2958 goto nla_put_failure
;
2961 ret
= ctnetlink_dump_tuples_ip(skb
, &m
);
2963 l4proto
= nf_ct_l4proto_find(tuple
->dst
.protonum
);
2964 ret
= ctnetlink_dump_tuples_proto(skb
, &m
, l4proto
);
2968 if (unlikely(ret
< 0))
2969 goto nla_put_failure
;
2971 nla_nest_end(skb
, nest_parms
);
2979 static const union nf_inet_addr any_addr
;
2981 static __be32
nf_expect_get_id(const struct nf_conntrack_expect
*exp
)
2983 static siphash_aligned_key_t exp_id_seed
;
2984 unsigned long a
, b
, c
, d
;
2986 net_get_random_once(&exp_id_seed
, sizeof(exp_id_seed
));
2988 a
= (unsigned long)exp
;
2989 b
= (unsigned long)exp
->helper
;
2990 c
= (unsigned long)exp
->master
;
2991 d
= (unsigned long)siphash(&exp
->tuple
, sizeof(exp
->tuple
), &exp_id_seed
);
2994 return (__force __be32
)siphash_4u64((u64
)a
, (u64
)b
, (u64
)c
, (u64
)d
, &exp_id_seed
);
2996 return (__force __be32
)siphash_4u32((u32
)a
, (u32
)b
, (u32
)c
, (u32
)d
, &exp_id_seed
);
3001 ctnetlink_exp_dump_expect(struct sk_buff
*skb
,
3002 const struct nf_conntrack_expect
*exp
)
3004 struct nf_conn
*master
= exp
->master
;
3005 long timeout
= ((long)exp
->timeout
.expires
- (long)jiffies
) / HZ
;
3006 struct nf_conn_help
*help
;
3007 #if IS_ENABLED(CONFIG_NF_NAT)
3008 struct nlattr
*nest_parms
;
3009 struct nf_conntrack_tuple nat_tuple
= {};
3011 struct nf_ct_helper_expectfn
*expfn
;
3016 if (ctnetlink_exp_dump_tuple(skb
, &exp
->tuple
, CTA_EXPECT_TUPLE
) < 0)
3017 goto nla_put_failure
;
3018 if (ctnetlink_exp_dump_mask(skb
, &exp
->tuple
, &exp
->mask
) < 0)
3019 goto nla_put_failure
;
3020 if (ctnetlink_exp_dump_tuple(skb
,
3021 &master
->tuplehash
[IP_CT_DIR_ORIGINAL
].tuple
,
3022 CTA_EXPECT_MASTER
) < 0)
3023 goto nla_put_failure
;
3025 #if IS_ENABLED(CONFIG_NF_NAT)
3026 if (!nf_inet_addr_cmp(&exp
->saved_addr
, &any_addr
) ||
3027 exp
->saved_proto
.all
) {
3028 nest_parms
= nla_nest_start(skb
, CTA_EXPECT_NAT
);
3030 goto nla_put_failure
;
3032 if (nla_put_be32(skb
, CTA_EXPECT_NAT_DIR
, htonl(exp
->dir
)))
3033 goto nla_put_failure
;
3035 nat_tuple
.src
.l3num
= nf_ct_l3num(master
);
3036 nat_tuple
.src
.u3
= exp
->saved_addr
;
3037 nat_tuple
.dst
.protonum
= nf_ct_protonum(master
);
3038 nat_tuple
.src
.u
= exp
->saved_proto
;
3040 if (ctnetlink_exp_dump_tuple(skb
, &nat_tuple
,
3041 CTA_EXPECT_NAT_TUPLE
) < 0)
3042 goto nla_put_failure
;
3043 nla_nest_end(skb
, nest_parms
);
3046 if (nla_put_be32(skb
, CTA_EXPECT_TIMEOUT
, htonl(timeout
)) ||
3047 nla_put_be32(skb
, CTA_EXPECT_ID
, nf_expect_get_id(exp
)) ||
3048 nla_put_be32(skb
, CTA_EXPECT_FLAGS
, htonl(exp
->flags
)) ||
3049 nla_put_be32(skb
, CTA_EXPECT_CLASS
, htonl(exp
->class)))
3050 goto nla_put_failure
;
3051 help
= nfct_help(master
);
3053 struct nf_conntrack_helper
*helper
;
3055 helper
= rcu_dereference(help
->helper
);
3057 nla_put_string(skb
, CTA_EXPECT_HELP_NAME
, helper
->name
))
3058 goto nla_put_failure
;
3060 expfn
= nf_ct_helper_expectfn_find_by_symbol(exp
->expectfn
);
3061 if (expfn
!= NULL
&&
3062 nla_put_string(skb
, CTA_EXPECT_FN
, expfn
->name
))
3063 goto nla_put_failure
;
3072 ctnetlink_exp_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
,
3073 int event
, const struct nf_conntrack_expect
*exp
)
3075 struct nlmsghdr
*nlh
;
3076 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
3078 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP
, event
);
3079 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
,
3080 exp
->tuple
.src
.l3num
, NFNETLINK_V0
, 0);
3084 if (ctnetlink_exp_dump_expect(skb
, exp
) < 0)
3085 goto nla_put_failure
;
3087 nlmsg_end(skb
, nlh
);
3092 nlmsg_cancel(skb
, nlh
);
3096 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3098 ctnetlink_expect_event(unsigned int events
, const struct nf_exp_event
*item
)
3100 struct nf_conntrack_expect
*exp
= item
->exp
;
3101 struct net
*net
= nf_ct_exp_net(exp
);
3102 struct nlmsghdr
*nlh
;
3103 struct sk_buff
*skb
;
3104 unsigned int type
, group
;
3107 if (events
& (1 << IPEXP_DESTROY
)) {
3108 type
= IPCTNL_MSG_EXP_DELETE
;
3109 group
= NFNLGRP_CONNTRACK_EXP_DESTROY
;
3110 } else if (events
& (1 << IPEXP_NEW
)) {
3111 type
= IPCTNL_MSG_EXP_NEW
;
3112 flags
= NLM_F_CREATE
|NLM_F_EXCL
;
3113 group
= NFNLGRP_CONNTRACK_EXP_NEW
;
3117 if (!item
->report
&& !nfnetlink_has_listeners(net
, group
))
3120 skb
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_ATOMIC
);
3124 type
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP
, type
);
3125 nlh
= nfnl_msg_put(skb
, item
->portid
, 0, type
, flags
,
3126 exp
->tuple
.src
.l3num
, NFNETLINK_V0
, 0);
3130 if (ctnetlink_exp_dump_expect(skb
, exp
) < 0)
3131 goto nla_put_failure
;
3133 nlmsg_end(skb
, nlh
);
3134 nfnetlink_send(skb
, net
, item
->portid
, group
, item
->report
, GFP_ATOMIC
);
3138 nlmsg_cancel(skb
, nlh
);
3142 nfnetlink_set_err(net
, 0, 0, -ENOBUFS
);
3146 static int ctnetlink_exp_done(struct netlink_callback
*cb
)
3149 nf_ct_expect_put((struct nf_conntrack_expect
*)cb
->args
[1]);
3154 ctnetlink_exp_dump_table(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3156 struct net
*net
= sock_net(skb
->sk
);
3157 struct nf_conntrack_expect
*exp
, *last
;
3158 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
3159 u_int8_t l3proto
= nfmsg
->nfgen_family
;
3162 last
= (struct nf_conntrack_expect
*)cb
->args
[1];
3163 for (; cb
->args
[0] < nf_ct_expect_hsize
; cb
->args
[0]++) {
3165 hlist_for_each_entry_rcu(exp
, &nf_ct_expect_hash
[cb
->args
[0]],
3167 if (l3proto
&& exp
->tuple
.src
.l3num
!= l3proto
)
3170 if (!net_eq(nf_ct_net(exp
->master
), net
))
3178 if (ctnetlink_exp_fill_info(skb
,
3179 NETLINK_CB(cb
->skb
).portid
,
3183 if (!refcount_inc_not_zero(&exp
->use
))
3185 cb
->args
[1] = (unsigned long)exp
;
3197 nf_ct_expect_put(last
);
3203 ctnetlink_exp_ct_dump_table(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3205 struct nf_conntrack_expect
*exp
, *last
;
3206 struct nfgenmsg
*nfmsg
= nlmsg_data(cb
->nlh
);
3207 struct nf_conn
*ct
= cb
->data
;
3208 struct nf_conn_help
*help
= nfct_help(ct
);
3209 u_int8_t l3proto
= nfmsg
->nfgen_family
;
3215 last
= (struct nf_conntrack_expect
*)cb
->args
[1];
3217 hlist_for_each_entry_rcu(exp
, &help
->expectations
, lnode
) {
3218 if (l3proto
&& exp
->tuple
.src
.l3num
!= l3proto
)
3225 if (ctnetlink_exp_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
3229 if (!refcount_inc_not_zero(&exp
->use
))
3231 cb
->args
[1] = (unsigned long)exp
;
3243 nf_ct_expect_put(last
);
3248 static int ctnetlink_dump_exp_ct(struct net
*net
, struct sock
*ctnl
,
3249 struct sk_buff
*skb
,
3250 const struct nlmsghdr
*nlh
,
3251 const struct nlattr
* const cda
[],
3252 struct netlink_ext_ack
*extack
)
3255 struct nfgenmsg
*nfmsg
= nlmsg_data(nlh
);
3256 u_int8_t u3
= nfmsg
->nfgen_family
;
3257 struct nf_conntrack_tuple tuple
;
3258 struct nf_conntrack_tuple_hash
*h
;
3260 struct nf_conntrack_zone zone
;
3261 struct netlink_dump_control c
= {
3262 .dump
= ctnetlink_exp_ct_dump_table
,
3263 .done
= ctnetlink_exp_done
,
3266 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_MASTER
,
3271 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3275 h
= nf_conntrack_find_get(net
, &zone
, &tuple
);
3279 ct
= nf_ct_tuplehash_to_ctrack(h
);
3280 /* No expectation linked to this connection tracking. */
3281 if (!nfct_help(ct
)) {
3288 err
= netlink_dump_start(ctnl
, skb
, nlh
, &c
);
3294 static int ctnetlink_get_expect(struct sk_buff
*skb
,
3295 const struct nfnl_info
*info
,
3296 const struct nlattr
* const cda
[])
3298 u_int8_t u3
= info
->nfmsg
->nfgen_family
;
3299 struct nf_conntrack_tuple tuple
;
3300 struct nf_conntrack_expect
*exp
;
3301 struct nf_conntrack_zone zone
;
3302 struct sk_buff
*skb2
;
3305 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3306 if (cda
[CTA_EXPECT_MASTER
])
3307 return ctnetlink_dump_exp_ct(info
->net
, info
->sk
, skb
,
3311 struct netlink_dump_control c
= {
3312 .dump
= ctnetlink_exp_dump_table
,
3313 .done
= ctnetlink_exp_done
,
3315 return netlink_dump_start(info
->sk
, skb
, info
->nlh
, &c
);
3319 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3323 if (cda
[CTA_EXPECT_TUPLE
])
3324 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3326 else if (cda
[CTA_EXPECT_MASTER
])
3327 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_MASTER
,
3335 exp
= nf_ct_expect_find_get(info
->net
, &zone
, &tuple
);
3339 if (cda
[CTA_EXPECT_ID
]) {
3340 __be32 id
= nla_get_be32(cda
[CTA_EXPECT_ID
]);
3342 if (id
!= nf_expect_get_id(exp
)) {
3343 nf_ct_expect_put(exp
);
3348 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
3350 nf_ct_expect_put(exp
);
3355 err
= ctnetlink_exp_fill_info(skb2
, NETLINK_CB(skb
).portid
,
3356 info
->nlh
->nlmsg_seq
, IPCTNL_MSG_EXP_NEW
,
3359 nf_ct_expect_put(exp
);
3365 return nfnetlink_unicast(skb2
, info
->net
, NETLINK_CB(skb
).portid
);
3368 static bool expect_iter_name(struct nf_conntrack_expect
*exp
, void *data
)
3370 struct nf_conntrack_helper
*helper
;
3371 const struct nf_conn_help
*m_help
;
3372 const char *name
= data
;
3374 m_help
= nfct_help(exp
->master
);
3376 helper
= rcu_dereference(m_help
->helper
);
3380 return strcmp(helper
->name
, name
) == 0;
3383 static bool expect_iter_all(struct nf_conntrack_expect
*exp
, void *data
)
3388 static int ctnetlink_del_expect(struct sk_buff
*skb
,
3389 const struct nfnl_info
*info
,
3390 const struct nlattr
* const cda
[])
3392 u_int8_t u3
= info
->nfmsg
->nfgen_family
;
3393 struct nf_conntrack_expect
*exp
;
3394 struct nf_conntrack_tuple tuple
;
3395 struct nf_conntrack_zone zone
;
3398 if (cda
[CTA_EXPECT_TUPLE
]) {
3399 /* delete a single expect by tuple */
3400 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3404 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3409 /* bump usage count to 2 */
3410 exp
= nf_ct_expect_find_get(info
->net
, &zone
, &tuple
);
3414 if (cda
[CTA_EXPECT_ID
]) {
3415 __be32 id
= nla_get_be32(cda
[CTA_EXPECT_ID
]);
3416 if (ntohl(id
) != (u32
)(unsigned long)exp
) {
3417 nf_ct_expect_put(exp
);
3422 /* after list removal, usage count == 1 */
3423 spin_lock_bh(&nf_conntrack_expect_lock
);
3424 if (del_timer(&exp
->timeout
)) {
3425 nf_ct_unlink_expect_report(exp
, NETLINK_CB(skb
).portid
,
3426 nlmsg_report(info
->nlh
));
3427 nf_ct_expect_put(exp
);
3429 spin_unlock_bh(&nf_conntrack_expect_lock
);
3430 /* have to put what we 'get' above.
3431 * after this line usage count == 0 */
3432 nf_ct_expect_put(exp
);
3433 } else if (cda
[CTA_EXPECT_HELP_NAME
]) {
3434 char *name
= nla_data(cda
[CTA_EXPECT_HELP_NAME
]);
3436 nf_ct_expect_iterate_net(info
->net
, expect_iter_name
, name
,
3437 NETLINK_CB(skb
).portid
,
3438 nlmsg_report(info
->nlh
));
3440 /* This basically means we have to flush everything*/
3441 nf_ct_expect_iterate_net(info
->net
, expect_iter_all
, NULL
,
3442 NETLINK_CB(skb
).portid
,
3443 nlmsg_report(info
->nlh
));
3449 ctnetlink_change_expect(struct nf_conntrack_expect
*x
,
3450 const struct nlattr
* const cda
[])
3452 if (cda
[CTA_EXPECT_TIMEOUT
]) {
3453 if (!del_timer(&x
->timeout
))
3456 x
->timeout
.expires
= jiffies
+
3457 ntohl(nla_get_be32(cda
[CTA_EXPECT_TIMEOUT
])) * HZ
;
3458 add_timer(&x
->timeout
);
3463 static const struct nla_policy exp_nat_nla_policy
[CTA_EXPECT_NAT_MAX
+1] = {
3464 [CTA_EXPECT_NAT_DIR
] = { .type
= NLA_U32
},
3465 [CTA_EXPECT_NAT_TUPLE
] = { .type
= NLA_NESTED
},
3469 ctnetlink_parse_expect_nat(const struct nlattr
*attr
,
3470 struct nf_conntrack_expect
*exp
,
3473 #if IS_ENABLED(CONFIG_NF_NAT)
3474 struct nlattr
*tb
[CTA_EXPECT_NAT_MAX
+1];
3475 struct nf_conntrack_tuple nat_tuple
= {};
3478 err
= nla_parse_nested_deprecated(tb
, CTA_EXPECT_NAT_MAX
, attr
,
3479 exp_nat_nla_policy
, NULL
);
3483 if (!tb
[CTA_EXPECT_NAT_DIR
] || !tb
[CTA_EXPECT_NAT_TUPLE
])
3486 err
= ctnetlink_parse_tuple((const struct nlattr
* const *)tb
,
3487 &nat_tuple
, CTA_EXPECT_NAT_TUPLE
,
3492 exp
->saved_addr
= nat_tuple
.src
.u3
;
3493 exp
->saved_proto
= nat_tuple
.src
.u
;
3494 exp
->dir
= ntohl(nla_get_be32(tb
[CTA_EXPECT_NAT_DIR
]));
3502 static struct nf_conntrack_expect
*
3503 ctnetlink_alloc_expect(const struct nlattr
* const cda
[], struct nf_conn
*ct
,
3504 struct nf_conntrack_helper
*helper
,
3505 struct nf_conntrack_tuple
*tuple
,
3506 struct nf_conntrack_tuple
*mask
)
3508 u_int32_t
class = 0;
3509 struct nf_conntrack_expect
*exp
;
3510 struct nf_conn_help
*help
;
3513 help
= nfct_help(ct
);
3515 return ERR_PTR(-EOPNOTSUPP
);
3517 if (cda
[CTA_EXPECT_CLASS
] && helper
) {
3518 class = ntohl(nla_get_be32(cda
[CTA_EXPECT_CLASS
]));
3519 if (class > helper
->expect_class_max
)
3520 return ERR_PTR(-EINVAL
);
3522 exp
= nf_ct_expect_alloc(ct
);
3524 return ERR_PTR(-ENOMEM
);
3526 if (cda
[CTA_EXPECT_FLAGS
]) {
3527 exp
->flags
= ntohl(nla_get_be32(cda
[CTA_EXPECT_FLAGS
]));
3528 exp
->flags
&= ~NF_CT_EXPECT_USERSPACE
;
3532 if (cda
[CTA_EXPECT_FN
]) {
3533 const char *name
= nla_data(cda
[CTA_EXPECT_FN
]);
3534 struct nf_ct_helper_expectfn
*expfn
;
3536 expfn
= nf_ct_helper_expectfn_find_by_name(name
);
3537 if (expfn
== NULL
) {
3541 exp
->expectfn
= expfn
->expectfn
;
3543 exp
->expectfn
= NULL
;
3547 exp
->helper
= helper
;
3548 exp
->tuple
= *tuple
;
3549 exp
->mask
.src
.u3
= mask
->src
.u3
;
3550 exp
->mask
.src
.u
.all
= mask
->src
.u
.all
;
3552 if (cda
[CTA_EXPECT_NAT
]) {
3553 err
= ctnetlink_parse_expect_nat(cda
[CTA_EXPECT_NAT
],
3554 exp
, nf_ct_l3num(ct
));
3560 nf_ct_expect_put(exp
);
3561 return ERR_PTR(err
);
3565 ctnetlink_create_expect(struct net
*net
,
3566 const struct nf_conntrack_zone
*zone
,
3567 const struct nlattr
* const cda
[],
3568 u_int8_t u3
, u32 portid
, int report
)
3570 struct nf_conntrack_tuple tuple
, mask
, master_tuple
;
3571 struct nf_conntrack_tuple_hash
*h
= NULL
;
3572 struct nf_conntrack_helper
*helper
= NULL
;
3573 struct nf_conntrack_expect
*exp
;
3577 /* caller guarantees that those three CTA_EXPECT_* exist */
3578 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3582 err
= ctnetlink_parse_tuple(cda
, &mask
, CTA_EXPECT_MASK
,
3586 err
= ctnetlink_parse_tuple(cda
, &master_tuple
, CTA_EXPECT_MASTER
,
3591 /* Look for master conntrack of this expectation */
3592 h
= nf_conntrack_find_get(net
, zone
, &master_tuple
);
3595 ct
= nf_ct_tuplehash_to_ctrack(h
);
3598 if (cda
[CTA_EXPECT_HELP_NAME
]) {
3599 const char *helpname
= nla_data(cda
[CTA_EXPECT_HELP_NAME
]);
3601 helper
= __nf_conntrack_helper_find(helpname
, u3
,
3602 nf_ct_protonum(ct
));
3603 if (helper
== NULL
) {
3605 #ifdef CONFIG_MODULES
3606 if (request_module("nfct-helper-%s", helpname
) < 0) {
3611 helper
= __nf_conntrack_helper_find(helpname
, u3
,
3612 nf_ct_protonum(ct
));
3624 exp
= ctnetlink_alloc_expect(cda
, ct
, helper
, &tuple
, &mask
);
3630 err
= nf_ct_expect_related_report(exp
, portid
, report
, 0);
3631 nf_ct_expect_put(exp
);
3639 static int ctnetlink_new_expect(struct sk_buff
*skb
,
3640 const struct nfnl_info
*info
,
3641 const struct nlattr
* const cda
[])
3643 u_int8_t u3
= info
->nfmsg
->nfgen_family
;
3644 struct nf_conntrack_tuple tuple
;
3645 struct nf_conntrack_expect
*exp
;
3646 struct nf_conntrack_zone zone
;
3649 if (!cda
[CTA_EXPECT_TUPLE
]
3650 || !cda
[CTA_EXPECT_MASK
]
3651 || !cda
[CTA_EXPECT_MASTER
])
3654 err
= ctnetlink_parse_zone(cda
[CTA_EXPECT_ZONE
], &zone
);
3658 err
= ctnetlink_parse_tuple(cda
, &tuple
, CTA_EXPECT_TUPLE
,
3663 spin_lock_bh(&nf_conntrack_expect_lock
);
3664 exp
= __nf_ct_expect_find(info
->net
, &zone
, &tuple
);
3666 spin_unlock_bh(&nf_conntrack_expect_lock
);
3668 if (info
->nlh
->nlmsg_flags
& NLM_F_CREATE
) {
3669 err
= ctnetlink_create_expect(info
->net
, &zone
, cda
, u3
,
3670 NETLINK_CB(skb
).portid
,
3671 nlmsg_report(info
->nlh
));
3677 if (!(info
->nlh
->nlmsg_flags
& NLM_F_EXCL
))
3678 err
= ctnetlink_change_expect(exp
, cda
);
3679 spin_unlock_bh(&nf_conntrack_expect_lock
);
3685 ctnetlink_exp_stat_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, int cpu
,
3686 const struct ip_conntrack_stat
*st
)
3688 struct nlmsghdr
*nlh
;
3689 unsigned int flags
= portid
? NLM_F_MULTI
: 0, event
;
3691 event
= nfnl_msg_type(NFNL_SUBSYS_CTNETLINK
,
3692 IPCTNL_MSG_EXP_GET_STATS_CPU
);
3693 nlh
= nfnl_msg_put(skb
, portid
, seq
, event
, flags
, AF_UNSPEC
,
3694 NFNETLINK_V0
, htons(cpu
));
3698 if (nla_put_be32(skb
, CTA_STATS_EXP_NEW
, htonl(st
->expect_new
)) ||
3699 nla_put_be32(skb
, CTA_STATS_EXP_CREATE
, htonl(st
->expect_create
)) ||
3700 nla_put_be32(skb
, CTA_STATS_EXP_DELETE
, htonl(st
->expect_delete
)))
3701 goto nla_put_failure
;
3703 nlmsg_end(skb
, nlh
);
3708 nlmsg_cancel(skb
, nlh
);
3713 ctnetlink_exp_stat_cpu_dump(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3716 struct net
*net
= sock_net(skb
->sk
);
3718 if (cb
->args
[0] == nr_cpu_ids
)
3721 for (cpu
= cb
->args
[0]; cpu
< nr_cpu_ids
; cpu
++) {
3722 const struct ip_conntrack_stat
*st
;
3724 if (!cpu_possible(cpu
))
3727 st
= per_cpu_ptr(net
->ct
.stat
, cpu
);
3728 if (ctnetlink_exp_stat_fill_info(skb
, NETLINK_CB(cb
->skb
).portid
,
3738 static int ctnetlink_stat_exp_cpu(struct sk_buff
*skb
,
3739 const struct nfnl_info
*info
,
3740 const struct nlattr
* const cda
[])
3742 if (info
->nlh
->nlmsg_flags
& NLM_F_DUMP
) {
3743 struct netlink_dump_control c
= {
3744 .dump
= ctnetlink_exp_stat_cpu_dump
,
3746 return netlink_dump_start(info
->sk
, skb
, info
->nlh
, &c
);
3752 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3753 static struct nf_ct_event_notifier ctnl_notifier
= {
3754 .ct_event
= ctnetlink_conntrack_event
,
3755 .exp_event
= ctnetlink_expect_event
,
3759 static const struct nfnl_callback ctnl_cb
[IPCTNL_MSG_MAX
] = {
3760 [IPCTNL_MSG_CT_NEW
] = {
3761 .call
= ctnetlink_new_conntrack
,
3762 .type
= NFNL_CB_MUTEX
,
3763 .attr_count
= CTA_MAX
,
3764 .policy
= ct_nla_policy
3766 [IPCTNL_MSG_CT_GET
] = {
3767 .call
= ctnetlink_get_conntrack
,
3768 .type
= NFNL_CB_MUTEX
,
3769 .attr_count
= CTA_MAX
,
3770 .policy
= ct_nla_policy
3772 [IPCTNL_MSG_CT_DELETE
] = {
3773 .call
= ctnetlink_del_conntrack
,
3774 .type
= NFNL_CB_MUTEX
,
3775 .attr_count
= CTA_MAX
,
3776 .policy
= ct_nla_policy
3778 [IPCTNL_MSG_CT_GET_CTRZERO
] = {
3779 .call
= ctnetlink_get_conntrack
,
3780 .type
= NFNL_CB_MUTEX
,
3781 .attr_count
= CTA_MAX
,
3782 .policy
= ct_nla_policy
3784 [IPCTNL_MSG_CT_GET_STATS_CPU
] = {
3785 .call
= ctnetlink_stat_ct_cpu
,
3786 .type
= NFNL_CB_MUTEX
,
3788 [IPCTNL_MSG_CT_GET_STATS
] = {
3789 .call
= ctnetlink_stat_ct
,
3790 .type
= NFNL_CB_MUTEX
,
3792 [IPCTNL_MSG_CT_GET_DYING
] = {
3793 .call
= ctnetlink_get_ct_dying
,
3794 .type
= NFNL_CB_MUTEX
,
3796 [IPCTNL_MSG_CT_GET_UNCONFIRMED
] = {
3797 .call
= ctnetlink_get_ct_unconfirmed
,
3798 .type
= NFNL_CB_MUTEX
,
3802 static const struct nfnl_callback ctnl_exp_cb
[IPCTNL_MSG_EXP_MAX
] = {
3803 [IPCTNL_MSG_EXP_GET
] = {
3804 .call
= ctnetlink_get_expect
,
3805 .type
= NFNL_CB_MUTEX
,
3806 .attr_count
= CTA_EXPECT_MAX
,
3807 .policy
= exp_nla_policy
3809 [IPCTNL_MSG_EXP_NEW
] = {
3810 .call
= ctnetlink_new_expect
,
3811 .type
= NFNL_CB_MUTEX
,
3812 .attr_count
= CTA_EXPECT_MAX
,
3813 .policy
= exp_nla_policy
3815 [IPCTNL_MSG_EXP_DELETE
] = {
3816 .call
= ctnetlink_del_expect
,
3817 .type
= NFNL_CB_MUTEX
,
3818 .attr_count
= CTA_EXPECT_MAX
,
3819 .policy
= exp_nla_policy
3821 [IPCTNL_MSG_EXP_GET_STATS_CPU
] = {
3822 .call
= ctnetlink_stat_exp_cpu
,
3823 .type
= NFNL_CB_MUTEX
,
3827 static const struct nfnetlink_subsystem ctnl_subsys
= {
3828 .name
= "conntrack",
3829 .subsys_id
= NFNL_SUBSYS_CTNETLINK
,
3830 .cb_count
= IPCTNL_MSG_MAX
,
3834 static const struct nfnetlink_subsystem ctnl_exp_subsys
= {
3835 .name
= "conntrack_expect",
3836 .subsys_id
= NFNL_SUBSYS_CTNETLINK_EXP
,
3837 .cb_count
= IPCTNL_MSG_EXP_MAX
,
3841 MODULE_ALIAS("ip_conntrack_netlink");
3842 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK
);
3843 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP
);
3845 static int __net_init
ctnetlink_net_init(struct net
*net
)
3847 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3848 nf_conntrack_register_notifier(net
, &ctnl_notifier
);
3853 static void ctnetlink_net_pre_exit(struct net
*net
)
3855 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3856 nf_conntrack_unregister_notifier(net
);
3860 static struct pernet_operations ctnetlink_net_ops
= {
3861 .init
= ctnetlink_net_init
,
3862 .pre_exit
= ctnetlink_net_pre_exit
,
3865 static int __init
ctnetlink_init(void)
3869 NL_ASSERT_DUMP_CTX_FITS(struct ctnetlink_list_dump_ctx
);
3871 ret
= nfnetlink_subsys_register(&ctnl_subsys
);
3873 pr_err("ctnetlink_init: cannot register with nfnetlink.\n");
3877 ret
= nfnetlink_subsys_register(&ctnl_exp_subsys
);
3879 pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n");
3880 goto err_unreg_subsys
;
3883 ret
= register_pernet_subsys(&ctnetlink_net_ops
);
3885 pr_err("ctnetlink_init: cannot register pernet operations\n");
3886 goto err_unreg_exp_subsys
;
3888 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
3889 /* setup interaction between nf_queue and nf_conntrack_netlink. */
3890 RCU_INIT_POINTER(nfnl_ct_hook
, &ctnetlink_glue_hook
);
3894 err_unreg_exp_subsys
:
3895 nfnetlink_subsys_unregister(&ctnl_exp_subsys
);
3897 nfnetlink_subsys_unregister(&ctnl_subsys
);
3902 static void __exit
ctnetlink_exit(void)
3904 unregister_pernet_subsys(&ctnetlink_net_ops
);
3905 nfnetlink_subsys_unregister(&ctnl_exp_subsys
);
3906 nfnetlink_subsys_unregister(&ctnl_subsys
);
3907 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
3908 RCU_INIT_POINTER(nfnl_ct_hook
, NULL
);
3913 module_init(ctnetlink_init
);
3914 module_exit(ctnetlink_exit
);