net/netfilter/nf_conntrack_netlink.c

   1 /* Connection tracking via netlink socket. Allows for user space
   2  * protocol helpers and general trouble making from userspace.
   3  *
   4  * (C) 2001 by Jay Schulist <jschlst@samba.org>
   5  * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
   6  * (C) 2003 by Patrick Mchardy <kaber@trash.net>
   7  * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
   8  *
   9  * Initial connection tracking via netlink development funded and
  10  * generally made possible by Network Robots, Inc. (www.networkrobots.com)
  11  *
  12  * Further development of this code funded by Astaro AG (http://www.astaro.com)
  13  *
  14  * This software may be used and distributed according to the terms
  15  * of the GNU General Public License, incorporated herein by reference.
  16  */
  17
  18 #include <linux/init.h>
  19 #include <linux/module.h>
  20 #include <linux/kernel.h>
  21 #include <linux/rculist.h>
  22 #include <linux/rculist_nulls.h>
  23 #include <linux/types.h>
  24 #include <linux/timer.h>
  25 #include <linux/security.h>
  26 #include <linux/skbuff.h>
  27 #include <linux/errno.h>
  28 #include <linux/netlink.h>
  29 #include <linux/spinlock.h>
  30 #include <linux/interrupt.h>
  31 #include <linux/slab.h>
  32 #include <linux/siphash.h>
  33
  34 #include <linux/netfilter.h>
  35 #include <net/netlink.h>
  36 #include <net/sock.h>
  37 #include <net/netfilter/nf_conntrack.h>
  38 #include <net/netfilter/nf_conntrack_core.h>
  39 #include <net/netfilter/nf_conntrack_expect.h>
  40 #include <net/netfilter/nf_conntrack_helper.h>
  41 #include <net/netfilter/nf_conntrack_seqadj.h>
  42 #include <net/netfilter/nf_conntrack_l4proto.h>
  43 #include <net/netfilter/nf_conntrack_tuple.h>
  44 #include <net/netfilter/nf_conntrack_acct.h>
  45 #include <net/netfilter/nf_conntrack_zones.h>
  46 #include <net/netfilter/nf_conntrack_timestamp.h>
  47 #include <net/netfilter/nf_conntrack_labels.h>
  48 #include <net/netfilter/nf_conntrack_synproxy.h>
  49 #ifdef CONFIG_NF_NAT_NEEDED
  50 #include <net/netfilter/nf_nat_core.h>
  51 #include <net/netfilter/nf_nat_l4proto.h>
  52 #include <net/netfilter/nf_nat_helper.h>
  53 #endif
  54
  55 #include <linux/netfilter/nfnetlink.h>
  56 #include <linux/netfilter/nfnetlink_conntrack.h>
  57
  58 MODULE_LICENSE("GPL");
  59
  60 static int ctnetlink_dump_tuples_proto(struct sk_buff *skb,
  61                                 const struct nf_conntrack_tuple *tuple,
  62                                 const struct nf_conntrack_l4proto *l4proto)
  63 {
  64         int ret = 0;
  65         struct nlattr *nest_parms;
  66
  67         nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
  68         if (!nest_parms)
  69                 goto nla_put_failure;
  70         if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum))
  71                 goto nla_put_failure;
  72
  73         if (likely(l4proto->tuple_to_nlattr))
  74                 ret = l4proto->tuple_to_nlattr(skb, tuple);
  75
  76         nla_nest_end(skb, nest_parms);
  77
  78         return ret;
  79
  80 nla_put_failure:
  81         return -1;
  82 }
  83
  84 static int ipv4_tuple_to_nlattr(struct sk_buff *skb,
  85                                 const struct nf_conntrack_tuple *tuple)
  86 {
  87         if (nla_put_in_addr(skb, CTA_IP_V4_SRC, tuple->src.u3.ip) ||
  88             nla_put_in_addr(skb, CTA_IP_V4_DST, tuple->dst.u3.ip))
  89                 return -EMSGSIZE;
  90         return 0;
  91 }
  92
  93 static int ipv6_tuple_to_nlattr(struct sk_buff *skb,
  94                                 const struct nf_conntrack_tuple *tuple)
  95 {
  96         if (nla_put_in6_addr(skb, CTA_IP_V6_SRC, &tuple->src.u3.in6) ||
  97             nla_put_in6_addr(skb, CTA_IP_V6_DST, &tuple->dst.u3.in6))
  98                 return -EMSGSIZE;
  99         return 0;
 100 }
 101
 102 static int ctnetlink_dump_tuples_ip(struct sk_buff *skb,
 103                                     const struct nf_conntrack_tuple *tuple)
 104 {
 105         int ret = 0;
 106         struct nlattr *nest_parms;
 107
 108         nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);
 109         if (!nest_parms)
 110                 goto nla_put_failure;
 111
 112         switch (tuple->src.l3num) {
 113         case NFPROTO_IPV4:
 114                 ret = ipv4_tuple_to_nlattr(skb, tuple);
 115                 break;
 116         case NFPROTO_IPV6:
 117                 ret = ipv6_tuple_to_nlattr(skb, tuple);
 118                 break;
 119         }
 120
 121         nla_nest_end(skb, nest_parms);
 122
 123         return ret;
 124
 125 nla_put_failure:
 126         return -1;
 127 }
 128
 129 static int ctnetlink_dump_tuples(struct sk_buff *skb,
 130                                  const struct nf_conntrack_tuple *tuple)
 131 {
 132         const struct nf_conntrack_l4proto *l4proto;
 133         int ret;
 134
 135         rcu_read_lock();
 136         ret = ctnetlink_dump_tuples_ip(skb, tuple);
 137
 138         if (ret >= 0) {
 139                 l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
 140                                                tuple->dst.protonum);
 141                 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
 142         }
 143         rcu_read_unlock();
 144         return ret;
 145 }
 146
 147 static int ctnetlink_dump_zone_id(struct sk_buff *skb, int attrtype,
 148                                   const struct nf_conntrack_zone *zone, int dir)
 149 {
 150         if (zone->id == NF_CT_DEFAULT_ZONE_ID || zone->dir != dir)
 151                 return 0;
 152         if (nla_put_be16(skb, attrtype, htons(zone->id)))
 153                 goto nla_put_failure;
 154         return 0;
 155
 156 nla_put_failure:
 157         return -1;
 158 }
 159
 160 static int ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
 161 {
 162         if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status)))
 163                 goto nla_put_failure;
 164         return 0;
 165
 166 nla_put_failure:
 167         return -1;
 168 }
 169
 170 static int ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
 171 {
 172         long timeout = nf_ct_expires(ct) / HZ;
 173
 174         if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout)))
 175                 goto nla_put_failure;
 176         return 0;
 177
 178 nla_put_failure:
 179         return -1;
 180 }
 181
 182 static int ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct)
 183 {
 184         const struct nf_conntrack_l4proto *l4proto;
 185         struct nlattr *nest_proto;
 186         int ret;
 187
 188         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 189         if (!l4proto->to_nlattr)
 190                 return 0;
 191
 192         nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
 193         if (!nest_proto)
 194                 goto nla_put_failure;
 195
 196         ret = l4proto->to_nlattr(skb, nest_proto, ct);
 197
 198         nla_nest_end(skb, nest_proto);
 199
 200         return ret;
 201
 202 nla_put_failure:
 203         return -1;
 204 }
 205
 206 static int ctnetlink_dump_helpinfo(struct sk_buff *skb,
 207                                    const struct nf_conn *ct)
 208 {
 209         struct nlattr *nest_helper;
 210         const struct nf_conn_help *help = nfct_help(ct);
 211         struct nf_conntrack_helper *helper;
 212
 213         if (!help)
 214                 return 0;
 215
 216         rcu_read_lock();
 217         helper = rcu_dereference(help->helper);
 218         if (!helper)
 219                 goto out;
 220
 221         nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
 222         if (!nest_helper)
 223                 goto nla_put_failure;
 224         if (nla_put_string(skb, CTA_HELP_NAME, helper->name))
 225                 goto nla_put_failure;
 226
 227         if (helper->to_nlattr)
 228                 helper->to_nlattr(skb, ct);
 229
 230         nla_nest_end(skb, nest_helper);
 231 out:
 232         rcu_read_unlock();
 233         return 0;
 234
 235 nla_put_failure:
 236         rcu_read_unlock();
 237         return -1;
 238 }
 239
 240 static int
 241 dump_counters(struct sk_buff *skb, struct nf_conn_acct *acct,
 242               enum ip_conntrack_dir dir, int type)
 243 {
 244         enum ctattr_type attr = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
 245         struct nf_conn_counter *counter = acct->counter;
 246         struct nlattr *nest_count;
 247         u64 pkts, bytes;
 248
 249         if (type == IPCTNL_MSG_CT_GET_CTRZERO) {
 250                 pkts = atomic64_xchg(&counter[dir].packets, 0);
 251                 bytes = atomic64_xchg(&counter[dir].bytes, 0);
 252         } else {
 253                 pkts = atomic64_read(&counter[dir].packets);
 254                 bytes = atomic64_read(&counter[dir].bytes);
 255         }
 256
 257         nest_count = nla_nest_start(skb, attr | NLA_F_NESTED);
 258         if (!nest_count)
 259                 goto nla_put_failure;
 260
 261         if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts),
 262                          CTA_COUNTERS_PAD) ||
 263             nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes),
 264                          CTA_COUNTERS_PAD))
 265                 goto nla_put_failure;
 266
 267         nla_nest_end(skb, nest_count);
 268
 269         return 0;
 270
 271 nla_put_failure:
 272         return -1;
 273 }
 274
 275 static int
 276 ctnetlink_dump_acct(struct sk_buff *skb, const struct nf_conn *ct, int type)
 277 {
 278         struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 279
 280         if (!acct)
 281                 return 0;
 282
 283         if (dump_counters(skb, acct, IP_CT_DIR_ORIGINAL, type) < 0)
 284                 return -1;
 285         if (dump_counters(skb, acct, IP_CT_DIR_REPLY, type) < 0)
 286                 return -1;
 287
 288         return 0;
 289 }
 290
 291 static int
 292 ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)
 293 {
 294         struct nlattr *nest_count;
 295         const struct nf_conn_tstamp *tstamp;
 296
 297         tstamp = nf_conn_tstamp_find(ct);
 298         if (!tstamp)
 299                 return 0;
 300
 301         nest_count = nla_nest_start(skb, CTA_TIMESTAMP | NLA_F_NESTED);
 302         if (!nest_count)
 303                 goto nla_put_failure;
 304
 305         if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start),
 306                          CTA_TIMESTAMP_PAD) ||
 307             (tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP,
 308                                                cpu_to_be64(tstamp->stop),
 309                                                CTA_TIMESTAMP_PAD)))
 310                 goto nla_put_failure;
 311         nla_nest_end(skb, nest_count);
 312
 313         return 0;
 314
 315 nla_put_failure:
 316         return -1;
 317 }
 318
 319 #ifdef CONFIG_NF_CONNTRACK_MARK
 320 static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
 321 {
 322         if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark)))
 323                 goto nla_put_failure;
 324         return 0;
 325
 326 nla_put_failure:
 327         return -1;
 328 }
 329 #else
 330 #define ctnetlink_dump_mark(a, b) (0)
 331 #endif
 332
 333 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 334 static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
 335 {
 336         struct nlattr *nest_secctx;
 337         int len, ret;
 338         char *secctx;
 339
 340         ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
 341         if (ret)
 342                 return 0;
 343
 344         ret = -1;
 345         nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
 346         if (!nest_secctx)
 347                 goto nla_put_failure;
 348
 349         if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))
 350                 goto nla_put_failure;
 351         nla_nest_end(skb, nest_secctx);
 352
 353         ret = 0;
 354 nla_put_failure:
 355         security_release_secctx(secctx, len);
 356         return ret;
 357 }
 358 #else
 359 #define ctnetlink_dump_secctx(a, b) (0)
 360 #endif
 361
 362 #ifdef CONFIG_NF_CONNTRACK_LABELS
 363 static inline int ctnetlink_label_size(const struct nf_conn *ct)
 364 {
 365         struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 366
 367         if (!labels)
 368                 return 0;
 369         return nla_total_size(sizeof(labels->bits));
 370 }
 371
 372 static int
 373 ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
 374 {
 375         struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 376         unsigned int i;
 377
 378         if (!labels)
 379                 return 0;
 380
 381         i = 0;
 382         do {
 383                 if (labels->bits[i] != 0)
 384                         return nla_put(skb, CTA_LABELS, sizeof(labels->bits),
 385                                        labels->bits);
 386                 i++;
 387         } while (i < ARRAY_SIZE(labels->bits));
 388
 389         return 0;
 390 }
 391 #else
 392 #define ctnetlink_dump_labels(a, b) (0)
 393 #define ctnetlink_label_size(a) (0)
 394 #endif
 395
 396 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
 397
 398 static int ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)
 399 {
 400         struct nlattr *nest_parms;
 401
 402         if (!(ct->status & IPS_EXPECTED))
 403                 return 0;
 404
 405         nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);
 406         if (!nest_parms)
 407                 goto nla_put_failure;
 408         if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
 409                 goto nla_put_failure;
 410         nla_nest_end(skb, nest_parms);
 411
 412         return 0;
 413
 414 nla_put_failure:
 415         return -1;
 416 }
 417
 418 static int
 419 dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type)
 420 {
 421         struct nlattr *nest_parms;
 422
 423         nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
 424         if (!nest_parms)
 425                 goto nla_put_failure;
 426
 427         if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS,
 428                          htonl(seq->correction_pos)) ||
 429             nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE,
 430                          htonl(seq->offset_before)) ||
 431             nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER,
 432                          htonl(seq->offset_after)))
 433                 goto nla_put_failure;
 434
 435         nla_nest_end(skb, nest_parms);
 436
 437         return 0;
 438
 439 nla_put_failure:
 440         return -1;
 441 }
 442
 443 static int ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, struct nf_conn *ct)
 444 {
 445         struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
 446         struct nf_ct_seqadj *seq;
 447
 448         if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj)
 449                 return 0;
 450
 451         spin_lock_bh(&ct->lock);
 452         seq = &seqadj->seq[IP_CT_DIR_ORIGINAL];
 453         if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1)
 454                 goto err;
 455
 456         seq = &seqadj->seq[IP_CT_DIR_REPLY];
 457         if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1)
 458                 goto err;
 459
 460         spin_unlock_bh(&ct->lock);
 461         return 0;
 462 err:
 463         spin_unlock_bh(&ct->lock);
 464         return -1;
 465 }
 466
 467 static int ctnetlink_dump_ct_synproxy(struct sk_buff *skb, struct nf_conn *ct)
 468 {
 469         struct nf_conn_synproxy *synproxy = nfct_synproxy(ct);
 470         struct nlattr *nest_parms;
 471
 472         if (!synproxy)
 473                 return 0;
 474
 475         nest_parms = nla_nest_start(skb, CTA_SYNPROXY | NLA_F_NESTED);
 476         if (!nest_parms)
 477                 goto nla_put_failure;
 478
 479         if (nla_put_be32(skb, CTA_SYNPROXY_ISN, htonl(synproxy->isn)) ||
 480             nla_put_be32(skb, CTA_SYNPROXY_ITS, htonl(synproxy->its)) ||
 481             nla_put_be32(skb, CTA_SYNPROXY_TSOFF, htonl(synproxy->tsoff)))
 482                 goto nla_put_failure;
 483
 484         nla_nest_end(skb, nest_parms);
 485
 486         return 0;
 487
 488 nla_put_failure:
 489         return -1;
 490 }
 491
 492 static int ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
 493 {
 494         __be32 id = (__force __be32)nf_ct_get_id(ct);
 495
 496         if (nla_put_be32(skb, CTA_ID, id))
 497                 goto nla_put_failure;
 498         return 0;
 499
 500 nla_put_failure:
 501         return -1;
 502 }
 503
 504 static int ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
 505 {
 506         if (nla_put_be32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use))))
 507                 goto nla_put_failure;
 508         return 0;
 509
 510 nla_put_failure:
 511         return -1;
 512 }
 513
 514 static int
 515 ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
 516                     struct nf_conn *ct)
 517 {
 518         const struct nf_conntrack_zone *zone;
 519         struct nlmsghdr *nlh;
 520         struct nfgenmsg *nfmsg;
 521         struct nlattr *nest_parms;
 522         unsigned int flags = portid ? NLM_F_MULTI : 0, event;
 523
 524         event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW);
 525         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
 526         if (nlh == NULL)
 527                 goto nlmsg_failure;
 528
 529         nfmsg = nlmsg_data(nlh);
 530         nfmsg->nfgen_family = nf_ct_l3num(ct);
 531         nfmsg->version      = NFNETLINK_V0;
 532         nfmsg->res_id       = 0;
 533
 534         zone = nf_ct_zone(ct);
 535
 536         nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
 537         if (!nest_parms)
 538                 goto nla_put_failure;
 539         if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
 540                 goto nla_put_failure;
 541         if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
 542                                    NF_CT_ZONE_DIR_ORIG) < 0)
 543                 goto nla_put_failure;
 544         nla_nest_end(skb, nest_parms);
 545
 546         nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
 547         if (!nest_parms)
 548                 goto nla_put_failure;
 549         if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
 550                 goto nla_put_failure;
 551         if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
 552                                    NF_CT_ZONE_DIR_REPL) < 0)
 553                 goto nla_put_failure;
 554         nla_nest_end(skb, nest_parms);
 555
 556         if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone,
 557                                    NF_CT_DEFAULT_ZONE_DIR) < 0)
 558                 goto nla_put_failure;
 559
 560         if (ctnetlink_dump_status(skb, ct) < 0 ||
 561             ctnetlink_dump_acct(skb, ct, type) < 0 ||
 562             ctnetlink_dump_timestamp(skb, ct) < 0 ||
 563             ctnetlink_dump_helpinfo(skb, ct) < 0 ||
 564             ctnetlink_dump_mark(skb, ct) < 0 ||
 565             ctnetlink_dump_secctx(skb, ct) < 0 ||
 566             ctnetlink_dump_labels(skb, ct) < 0 ||
 567             ctnetlink_dump_id(skb, ct) < 0 ||
 568             ctnetlink_dump_use(skb, ct) < 0 ||
 569             ctnetlink_dump_master(skb, ct) < 0 ||
 570             ctnetlink_dump_ct_seq_adj(skb, ct) < 0 ||
 571             ctnetlink_dump_ct_synproxy(skb, ct) < 0)
 572                 goto nla_put_failure;
 573
 574         if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) &&
 575             (ctnetlink_dump_timeout(skb, ct) < 0 ||
 576              ctnetlink_dump_protoinfo(skb, ct) < 0))
 577                 goto nla_put_failure;
 578
 579         nlmsg_end(skb, nlh);
 580         return skb->len;
 581
 582 nlmsg_failure:
 583 nla_put_failure:
 584         nlmsg_cancel(skb, nlh);
 585         return -1;
 586 }
 587
 588 static const struct nla_policy cta_ip_nla_policy[CTA_IP_MAX + 1] = {
 589         [CTA_IP_V4_SRC] = { .type = NLA_U32 },
 590         [CTA_IP_V4_DST] = { .type = NLA_U32 },
 591         [CTA_IP_V6_SRC] = { .len = sizeof(__be32) * 4 },
 592         [CTA_IP_V6_DST] = { .len = sizeof(__be32) * 4 },
 593 };
 594
 595 #if defined(CONFIG_NETFILTER_NETLINK_GLUE_CT) || defined(CONFIG_NF_CONNTRACK_EVENTS)
 596 static size_t ctnetlink_proto_size(const struct nf_conn *ct)
 597 {
 598         const struct nf_conntrack_l4proto *l4proto;
 599         size_t len, len4 = 0;
 600
 601         len = nla_policy_len(cta_ip_nla_policy, CTA_IP_MAX + 1);
 602         len *= 3u; /* ORIG, REPLY, MASTER */
 603
 604         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 605         len += l4proto->nlattr_size;
 606         if (l4proto->nlattr_tuple_size) {
 607                 len4 = l4proto->nlattr_tuple_size();
 608                 len4 *= 3u; /* ORIG, REPLY, MASTER */
 609         }
 610
 611         return len + len4;
 612 }
 613 #endif
 614
 615 static inline size_t ctnetlink_acct_size(const struct nf_conn *ct)
 616 {
 617         if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT))
 618                 return 0;
 619         return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */
 620                + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */
 621                + 2 * nla_total_size_64bit(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */
 622                ;
 623 }
 624
 625 static inline int ctnetlink_secctx_size(const struct nf_conn *ct)
 626 {
 627 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 628         int len, ret;
 629
 630         ret = security_secid_to_secctx(ct->secmark, NULL, &len);
 631         if (ret)
 632                 return 0;
 633
 634         return nla_total_size(0) /* CTA_SECCTX */
 635                + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */
 636 #else
 637         return 0;
 638 #endif
 639 }
 640
 641 static inline size_t ctnetlink_timestamp_size(const struct nf_conn *ct)
 642 {
 643 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
 644         if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP))
 645                 return 0;
 646         return nla_total_size(0) + 2 * nla_total_size_64bit(sizeof(uint64_t));
 647 #else
 648         return 0;
 649 #endif
 650 }
 651
 652 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 653 static size_t ctnetlink_nlmsg_size(const struct nf_conn *ct)
 654 {
 655         return NLMSG_ALIGN(sizeof(struct nfgenmsg))
 656                + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
 657                + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
 658                + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
 659                + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
 660                + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
 661                + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */
 662                + ctnetlink_acct_size(ct)
 663                + ctnetlink_timestamp_size(ct)
 664                + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
 665                + nla_total_size(0) /* CTA_PROTOINFO */
 666                + nla_total_size(0) /* CTA_HELP */
 667                + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
 668                + ctnetlink_secctx_size(ct)
 669 #ifdef CONFIG_NF_NAT_NEEDED
 670                + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
 671                + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
 672 #endif
 673 #ifdef CONFIG_NF_CONNTRACK_MARK
 674                + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
 675 #endif
 676 #ifdef CONFIG_NF_CONNTRACK_ZONES
 677                + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE|CTA_TUPLE_ZONE */
 678 #endif
 679                + ctnetlink_proto_size(ct)
 680                + ctnetlink_label_size(ct)
 681                ;
 682 }
 683
 684 static int
 685 ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
 686 {
 687         const struct nf_conntrack_zone *zone;
 688         struct net *net;
 689         struct nlmsghdr *nlh;
 690         struct nfgenmsg *nfmsg;
 691         struct nlattr *nest_parms;
 692         struct nf_conn *ct = item->ct;
 693         struct sk_buff *skb;
 694         unsigned int type;
 695         unsigned int flags = 0, group;
 696         int err;
 697
 698         if (events & (1 << IPCT_DESTROY)) {
 699                 type = IPCTNL_MSG_CT_DELETE;
 700                 group = NFNLGRP_CONNTRACK_DESTROY;
 701         } else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) {
 702                 type = IPCTNL_MSG_CT_NEW;
 703                 flags = NLM_F_CREATE|NLM_F_EXCL;
 704                 group = NFNLGRP_CONNTRACK_NEW;
 705         } else if (events) {
 706                 type = IPCTNL_MSG_CT_NEW;
 707                 group = NFNLGRP_CONNTRACK_UPDATE;
 708         } else
 709                 return 0;
 710
 711         net = nf_ct_net(ct);
 712         if (!item->report && !nfnetlink_has_listeners(net, group))
 713                 return 0;
 714
 715         skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);
 716         if (skb == NULL)
 717                 goto errout;
 718
 719         type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type);
 720         nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
 721         if (nlh == NULL)
 722                 goto nlmsg_failure;
 723
 724         nfmsg = nlmsg_data(nlh);
 725         nfmsg->nfgen_family = nf_ct_l3num(ct);
 726         nfmsg->version  = NFNETLINK_V0;
 727         nfmsg->res_id   = 0;
 728
 729         zone = nf_ct_zone(ct);
 730
 731         nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
 732         if (!nest_parms)
 733                 goto nla_put_failure;
 734         if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
 735                 goto nla_put_failure;
 736         if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
 737                                    NF_CT_ZONE_DIR_ORIG) < 0)
 738                 goto nla_put_failure;
 739         nla_nest_end(skb, nest_parms);
 740
 741         nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
 742         if (!nest_parms)
 743                 goto nla_put_failure;
 744         if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
 745                 goto nla_put_failure;
 746         if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
 747                                    NF_CT_ZONE_DIR_REPL) < 0)
 748                 goto nla_put_failure;
 749         nla_nest_end(skb, nest_parms);
 750
 751         if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone,
 752                                    NF_CT_DEFAULT_ZONE_DIR) < 0)
 753                 goto nla_put_failure;
 754
 755         if (ctnetlink_dump_id(skb, ct) < 0)
 756                 goto nla_put_failure;
 757
 758         if (ctnetlink_dump_status(skb, ct) < 0)
 759                 goto nla_put_failure;
 760
 761         if (events & (1 << IPCT_DESTROY)) {
 762                 if (ctnetlink_dump_acct(skb, ct, type) < 0 ||
 763                     ctnetlink_dump_timestamp(skb, ct) < 0)
 764                         goto nla_put_failure;
 765         } else {
 766                 if (ctnetlink_dump_timeout(skb, ct) < 0)
 767                         goto nla_put_failure;
 768
 769                 if (events & (1 << IPCT_PROTOINFO)
 770                     && ctnetlink_dump_protoinfo(skb, ct) < 0)
 771                         goto nla_put_failure;
 772
 773                 if ((events & (1 << IPCT_HELPER) || nfct_help(ct))
 774                     && ctnetlink_dump_helpinfo(skb, ct) < 0)
 775                         goto nla_put_failure;
 776
 777 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 778                 if ((events & (1 << IPCT_SECMARK) || ct->secmark)
 779                     && ctnetlink_dump_secctx(skb, ct) < 0)
 780                         goto nla_put_failure;
 781 #endif
 782                 if (events & (1 << IPCT_LABEL) &&
 783                      ctnetlink_dump_labels(skb, ct) < 0)
 784                         goto nla_put_failure;
 785
 786                 if (events & (1 << IPCT_RELATED) &&
 787                     ctnetlink_dump_master(skb, ct) < 0)
 788                         goto nla_put_failure;
 789
 790                 if (events & (1 << IPCT_SEQADJ) &&
 791                     ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
 792                         goto nla_put_failure;
 793
 794                 if (events & (1 << IPCT_SYNPROXY) &&
 795                     ctnetlink_dump_ct_synproxy(skb, ct) < 0)
 796                         goto nla_put_failure;
 797         }
 798
 799 #ifdef CONFIG_NF_CONNTRACK_MARK
 800         if ((events & (1 << IPCT_MARK) || ct->mark)
 801             && ctnetlink_dump_mark(skb, ct) < 0)
 802                 goto nla_put_failure;
 803 #endif
 804         nlmsg_end(skb, nlh);
 805         err = nfnetlink_send(skb, net, item->portid, group, item->report,
 806                              GFP_ATOMIC);
 807         if (err == -ENOBUFS || err == -EAGAIN)
 808                 return -ENOBUFS;
 809
 810         return 0;
 811
 812 nla_put_failure:
 813         nlmsg_cancel(skb, nlh);
 814 nlmsg_failure:
 815         kfree_skb(skb);
 816 errout:
 817         if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)
 818                 return -ENOBUFS;
 819
 820         return 0;
 821 }
 822 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
 823
 824 static int ctnetlink_done(struct netlink_callback *cb)
 825 {
 826         if (cb->args[1])
 827                 nf_ct_put((struct nf_conn *)cb->args[1]);
 828         kfree(cb->data);
 829         return 0;
 830 }
 831
 832 struct ctnetlink_filter {
 833         struct {
 834                 u_int32_t val;
 835                 u_int32_t mask;
 836         } mark;
 837 };
 838
 839 static struct ctnetlink_filter *
 840 ctnetlink_alloc_filter(const struct nlattr * const cda[])
 841 {
 842 #ifdef CONFIG_NF_CONNTRACK_MARK
 843         struct ctnetlink_filter *filter;
 844
 845         filter = kzalloc(sizeof(*filter), GFP_KERNEL);
 846         if (filter == NULL)
 847                 return ERR_PTR(-ENOMEM);
 848
 849         filter->mark.val = ntohl(nla_get_be32(cda[CTA_MARK]));
 850         filter->mark.mask = ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
 851
 852         return filter;
 853 #else
 854         return ERR_PTR(-EOPNOTSUPP);
 855 #endif
 856 }
 857
 858 static int ctnetlink_start(struct netlink_callback *cb)
 859 {
 860         const struct nlattr * const *cda = cb->data;
 861         struct ctnetlink_filter *filter = NULL;
 862
 863         if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
 864                 filter = ctnetlink_alloc_filter(cda);
 865                 if (IS_ERR(filter))
 866                         return PTR_ERR(filter);
 867         }
 868
 869         cb->data = filter;
 870         return 0;
 871 }
 872
 873 static int ctnetlink_filter_match(struct nf_conn *ct, void *data)
 874 {
 875         struct ctnetlink_filter *filter = data;
 876
 877         if (filter == NULL)
 878                 return 1;
 879
 880 #ifdef CONFIG_NF_CONNTRACK_MARK
 881         if ((ct->mark & filter->mark.mask) == filter->mark.val)
 882                 return 1;
 883 #endif
 884
 885         return 0;
 886 }
 887
 888 static int
 889 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 890 {
 891         struct net *net = sock_net(skb->sk);
 892         struct nf_conn *ct, *last;
 893         struct nf_conntrack_tuple_hash *h;
 894         struct hlist_nulls_node *n;
 895         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 896         u_int8_t l3proto = nfmsg->nfgen_family;
 897         struct nf_conn *nf_ct_evict[8];
 898         int res, i;
 899         spinlock_t *lockp;
 900
 901         last = (struct nf_conn *)cb->args[1];
 902         i = 0;
 903
 904         local_bh_disable();
 905         for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
 906 restart:
 907                 while (i) {
 908                         i--;
 909                         if (nf_ct_should_gc(nf_ct_evict[i]))
 910                                 nf_ct_kill(nf_ct_evict[i]);
 911                         nf_ct_put(nf_ct_evict[i]);
 912                 }
 913
 914                 lockp = &nf_conntrack_locks[cb->args[0] % CONNTRACK_LOCKS];
 915                 nf_conntrack_lock(lockp);
 916                 if (cb->args[0] >= nf_conntrack_htable_size) {
 917                         spin_unlock(lockp);
 918                         goto out;
 919                 }
 920                 hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]],
 921                                            hnnode) {
 922                         if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
 923                                 continue;
 924                         ct = nf_ct_tuplehash_to_ctrack(h);
 925                         if (nf_ct_is_expired(ct)) {
 926                                 if (i < ARRAY_SIZE(nf_ct_evict) &&
 927                                     atomic_inc_not_zero(&ct->ct_general.use))
 928                                         nf_ct_evict[i++] = ct;
 929                                 continue;
 930                         }
 931
 932                         if (!net_eq(net, nf_ct_net(ct)))
 933                                 continue;
 934
 935                         /* Dump entries of a given L3 protocol number.
 936                          * If it is not specified, ie. l3proto == 0,
 937                          * then dump everything. */
 938                         if (l3proto && nf_ct_l3num(ct) != l3proto)
 939                                 continue;
 940                         if (cb->args[1]) {
 941                                 if (ct != last)
 942                                         continue;
 943                                 cb->args[1] = 0;
 944                         }
 945                         if (!ctnetlink_filter_match(ct, cb->data))
 946                                 continue;
 947
 948                         rcu_read_lock();
 949                         res =
 950                         ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
 951                                             cb->nlh->nlmsg_seq,
 952                                             NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
 953                                             ct);
 954                         rcu_read_unlock();
 955                         if (res < 0) {
 956                                 nf_conntrack_get(&ct->ct_general);
 957                                 cb->args[1] = (unsigned long)ct;
 958                                 spin_unlock(lockp);
 959                                 goto out;
 960                         }
 961                 }
 962                 spin_unlock(lockp);
 963                 if (cb->args[1]) {
 964                         cb->args[1] = 0;
 965                         goto restart;
 966                 }
 967         }
 968 out:
 969         local_bh_enable();
 970         if (last) {
 971                 /* nf ct hash resize happened, now clear the leftover. */
 972                 if ((struct nf_conn *)cb->args[1] == last)
 973                         cb->args[1] = 0;
 974
 975                 nf_ct_put(last);
 976         }
 977
 978         while (i) {
 979                 i--;
 980                 if (nf_ct_should_gc(nf_ct_evict[i]))
 981                         nf_ct_kill(nf_ct_evict[i]);
 982                 nf_ct_put(nf_ct_evict[i]);
 983         }
 984
 985         return skb->len;
 986 }
 987
 988 static int ipv4_nlattr_to_tuple(struct nlattr *tb[],
 989                                 struct nf_conntrack_tuple *t)
 990 {
 991         if (!tb[CTA_IP_V4_SRC] || !tb[CTA_IP_V4_DST])
 992                 return -EINVAL;
 993
 994         t->src.u3.ip = nla_get_in_addr(tb[CTA_IP_V4_SRC]);
 995         t->dst.u3.ip = nla_get_in_addr(tb[CTA_IP_V4_DST]);
 996
 997         return 0;
 998 }
 999
1000 static int ipv6_nlattr_to_tuple(struct nlattr *tb[],
1001                                 struct nf_conntrack_tuple *t)
1002 {
1003         if (!tb[CTA_IP_V6_SRC] || !tb[CTA_IP_V6_DST])
1004                 return -EINVAL;
1005
1006         t->src.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_SRC]);
1007         t->dst.u3.in6 = nla_get_in6_addr(tb[CTA_IP_V6_DST]);
1008
1009         return 0;
1010 }
1011
1012 static int ctnetlink_parse_tuple_ip(struct nlattr *attr,
1013                                     struct nf_conntrack_tuple *tuple)
1014 {
1015         struct nlattr *tb[CTA_IP_MAX+1];
1016         int ret = 0;
1017
1018         ret = nla_parse_nested(tb, CTA_IP_MAX, attr, NULL, NULL);
1019         if (ret < 0)
1020                 return ret;
1021
1022         ret = nla_validate_nested(attr, CTA_IP_MAX,
1023                                   cta_ip_nla_policy, NULL);
1024         if (ret)
1025                 return ret;
1026
1027         switch (tuple->src.l3num) {
1028         case NFPROTO_IPV4:
1029                 ret = ipv4_nlattr_to_tuple(tb, tuple);
1030                 break;
1031         case NFPROTO_IPV6:
1032                 ret = ipv6_nlattr_to_tuple(tb, tuple);
1033                 break;
1034         }
1035
1036         return ret;
1037 }
1038
1039 static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
1040         [CTA_PROTO_NUM] = { .type = NLA_U8 },
1041 };
1042
1043 static int ctnetlink_parse_tuple_proto(struct nlattr *attr,
1044                                        struct nf_conntrack_tuple *tuple)
1045 {
1046         const struct nf_conntrack_l4proto *l4proto;
1047         struct nlattr *tb[CTA_PROTO_MAX+1];
1048         int ret = 0;
1049
1050         ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy,
1051                                NULL);
1052         if (ret < 0)
1053                 return ret;
1054
1055         if (!tb[CTA_PROTO_NUM])
1056                 return -EINVAL;
1057         tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);
1058
1059         rcu_read_lock();
1060         l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
1061
1062         if (likely(l4proto->nlattr_to_tuple)) {
1063                 ret = nla_validate_nested(attr, CTA_PROTO_MAX,
1064                                           l4proto->nla_policy, NULL);
1065                 if (ret == 0)
1066                         ret = l4proto->nlattr_to_tuple(tb, tuple);
1067         }
1068
1069         rcu_read_unlock();
1070
1071         return ret;
1072 }
1073
1074 static int
1075 ctnetlink_parse_zone(const struct nlattr *attr,
1076                      struct nf_conntrack_zone *zone)
1077 {
1078         nf_ct_zone_init(zone, NF_CT_DEFAULT_ZONE_ID,
1079                         NF_CT_DEFAULT_ZONE_DIR, 0);
1080 #ifdef CONFIG_NF_CONNTRACK_ZONES
1081         if (attr)
1082                 zone->id = ntohs(nla_get_be16(attr));
1083 #else
1084         if (attr)
1085                 return -EOPNOTSUPP;
1086 #endif
1087         return 0;
1088 }
1089
1090 static int
1091 ctnetlink_parse_tuple_zone(struct nlattr *attr, enum ctattr_type type,
1092                            struct nf_conntrack_zone *zone)
1093 {
1094         int ret;
1095
1096         if (zone->id != NF_CT_DEFAULT_ZONE_ID)
1097                 return -EINVAL;
1098
1099         ret = ctnetlink_parse_zone(attr, zone);
1100         if (ret < 0)
1101                 return ret;
1102
1103         if (type == CTA_TUPLE_REPLY)
1104                 zone->dir = NF_CT_ZONE_DIR_REPL;
1105         else
1106                 zone->dir = NF_CT_ZONE_DIR_ORIG;
1107
1108         return 0;
1109 }
1110
1111 static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
1112         [CTA_TUPLE_IP]          = { .type = NLA_NESTED },
1113         [CTA_TUPLE_PROTO]       = { .type = NLA_NESTED },
1114         [CTA_TUPLE_ZONE]        = { .type = NLA_U16 },
1115 };
1116
1117 static int
1118 ctnetlink_parse_tuple(const struct nlattr * const cda[],
1119                       struct nf_conntrack_tuple *tuple, u32 type,
1120                       u_int8_t l3num, struct nf_conntrack_zone *zone)
1121 {
1122         struct nlattr *tb[CTA_TUPLE_MAX+1];
1123         int err;
1124
1125         memset(tuple, 0, sizeof(*tuple));
1126
1127         err = nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy,
1128                                NULL);
1129         if (err < 0)
1130                 return err;
1131
1132         if (!tb[CTA_TUPLE_IP])
1133                 return -EINVAL;
1134
1135         if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6)
1136                 return -EOPNOTSUPP;
1137         tuple->src.l3num = l3num;
1138
1139         err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
1140         if (err < 0)
1141                 return err;
1142
1143         if (!tb[CTA_TUPLE_PROTO])
1144                 return -EINVAL;
1145
1146         err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);
1147         if (err < 0)
1148                 return err;
1149
1150         if (tb[CTA_TUPLE_ZONE]) {
1151                 if (!zone)
1152                         return -EINVAL;
1153
1154                 err = ctnetlink_parse_tuple_zone(tb[CTA_TUPLE_ZONE],
1155                                                  type, zone);
1156                 if (err < 0)
1157                         return err;
1158         }
1159
1160         /* orig and expect tuples get DIR_ORIGINAL */
1161         if (type == CTA_TUPLE_REPLY)
1162                 tuple->dst.dir = IP_CT_DIR_REPLY;
1163         else
1164                 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
1165
1166         return 0;
1167 }
1168
1169 static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = {
1170         [CTA_HELP_NAME]         = { .type = NLA_NUL_STRING,
1171                                     .len = NF_CT_HELPER_NAME_LEN - 1 },
1172 };
1173
1174 static int ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,
1175                                 struct nlattr **helpinfo)
1176 {
1177         int err;
1178         struct nlattr *tb[CTA_HELP_MAX+1];
1179
1180         err = nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy, NULL);
1181         if (err < 0)
1182                 return err;
1183
1184         if (!tb[CTA_HELP_NAME])
1185                 return -EINVAL;
1186
1187         *helper_name = nla_data(tb[CTA_HELP_NAME]);
1188
1189         if (tb[CTA_HELP_INFO])
1190                 *helpinfo = tb[CTA_HELP_INFO];
1191
1192         return 0;
1193 }
1194
1195 static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
1196         [CTA_TUPLE_ORIG]        = { .type = NLA_NESTED },
1197         [CTA_TUPLE_REPLY]       = { .type = NLA_NESTED },
1198         [CTA_STATUS]            = { .type = NLA_U32 },
1199         [CTA_PROTOINFO]         = { .type = NLA_NESTED },
1200         [CTA_HELP]              = { .type = NLA_NESTED },
1201         [CTA_NAT_SRC]           = { .type = NLA_NESTED },
1202         [CTA_TIMEOUT]           = { .type = NLA_U32 },
1203         [CTA_MARK]              = { .type = NLA_U32 },
1204         [CTA_ID]                = { .type = NLA_U32 },
1205         [CTA_NAT_DST]           = { .type = NLA_NESTED },
1206         [CTA_TUPLE_MASTER]      = { .type = NLA_NESTED },
1207         [CTA_NAT_SEQ_ADJ_ORIG]  = { .type = NLA_NESTED },
1208         [CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED },
1209         [CTA_ZONE]              = { .type = NLA_U16 },
1210         [CTA_MARK_MASK]         = { .type = NLA_U32 },
1211         [CTA_LABELS]            = { .type = NLA_BINARY,
1212                                     .len = NF_CT_LABELS_MAX_SIZE },
1213         [CTA_LABELS_MASK]       = { .type = NLA_BINARY,
1214                                     .len = NF_CT_LABELS_MAX_SIZE },
1215 };
1216
1217 static int ctnetlink_flush_iterate(struct nf_conn *ct, void *data)
1218 {
1219         return ctnetlink_filter_match(ct, data);
1220 }
1221
1222 static int ctnetlink_flush_conntrack(struct net *net,
1223                                      const struct nlattr * const cda[],
1224                                      u32 portid, int report)
1225 {
1226         struct ctnetlink_filter *filter = NULL;
1227
1228         if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
1229                 filter = ctnetlink_alloc_filter(cda);
1230                 if (IS_ERR(filter))
1231                         return PTR_ERR(filter);
1232         }
1233
1234         nf_ct_iterate_cleanup_net(net, ctnetlink_flush_iterate, filter,
1235                                   portid, report);
1236         kfree(filter);
1237
1238         return 0;
1239 }
1240
1241 static int ctnetlink_del_conntrack(struct net *net, struct sock *ctnl,
1242                                    struct sk_buff *skb,
1243                                    const struct nlmsghdr *nlh,
1244                                    const struct nlattr * const cda[],
1245                                    struct netlink_ext_ack *extack)
1246 {
1247         struct nf_conntrack_tuple_hash *h;
1248         struct nf_conntrack_tuple tuple;
1249         struct nf_conn *ct;
1250         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1251         u_int8_t u3 = nfmsg->nfgen_family;
1252         struct nf_conntrack_zone zone;
1253         int err;
1254
1255         err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
1256         if (err < 0)
1257                 return err;
1258
1259         if (cda[CTA_TUPLE_ORIG])
1260                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
1261                                             u3, &zone);
1262         else if (cda[CTA_TUPLE_REPLY])
1263                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
1264                                             u3, &zone);
1265         else {
1266                 return ctnetlink_flush_conntrack(net, cda,
1267                                                  NETLINK_CB(skb).portid,
1268                                                  nlmsg_report(nlh));
1269         }
1270
1271         if (err < 0)
1272                 return err;
1273
1274         h = nf_conntrack_find_get(net, &zone, &tuple);
1275         if (!h)
1276                 return -ENOENT;
1277
1278         ct = nf_ct_tuplehash_to_ctrack(h);
1279
1280         if (cda[CTA_ID]) {
1281                 __be32 id = nla_get_be32(cda[CTA_ID]);
1282
1283                 if (id != (__force __be32)nf_ct_get_id(ct)) {
1284                         nf_ct_put(ct);
1285                         return -ENOENT;
1286                 }
1287         }
1288
1289         nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(nlh));
1290         nf_ct_put(ct);
1291
1292         return 0;
1293 }
1294
1295 static int ctnetlink_get_conntrack(struct net *net, struct sock *ctnl,
1296                                    struct sk_buff *skb,
1297                                    const struct nlmsghdr *nlh,
1298                                    const struct nlattr * const cda[],
1299                                    struct netlink_ext_ack *extack)
1300 {
1301         struct nf_conntrack_tuple_hash *h;
1302         struct nf_conntrack_tuple tuple;
1303         struct nf_conn *ct;
1304         struct sk_buff *skb2 = NULL;
1305         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
1306         u_int8_t u3 = nfmsg->nfgen_family;
1307         struct nf_conntrack_zone zone;
1308         int err;
1309
1310         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1311                 struct netlink_dump_control c = {
1312                         .start = ctnetlink_start,
1313                         .dump = ctnetlink_dump_table,
1314                         .done = ctnetlink_done,
1315                         .data = (void *)cda,
1316                 };
1317
1318                 return netlink_dump_start(ctnl, skb, nlh, &c);
1319         }
1320
1321         err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
1322         if (err < 0)
1323                 return err;
1324
1325         if (cda[CTA_TUPLE_ORIG])
1326                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG,
1327                                             u3, &zone);
1328         else if (cda[CTA_TUPLE_REPLY])
1329                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY,
1330                                             u3, &zone);
1331         else
1332                 return -EINVAL;
1333
1334         if (err < 0)
1335                 return err;
1336
1337         h = nf_conntrack_find_get(net, &zone, &tuple);
1338         if (!h)
1339                 return -ENOENT;
1340
1341         ct = nf_ct_tuplehash_to_ctrack(h);
1342
1343         err = -ENOMEM;
1344         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1345         if (skb2 == NULL) {
1346                 nf_ct_put(ct);
1347                 return -ENOMEM;
1348         }
1349
1350         rcu_read_lock();
1351         err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
1352                                   NFNL_MSG_TYPE(nlh->nlmsg_type), ct);
1353         rcu_read_unlock();
1354         nf_ct_put(ct);
1355         if (err <= 0)
1356                 goto free;
1357
1358         err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
1359         if (err < 0)
1360                 goto out;
1361
1362         return 0;
1363
1364 free:
1365         kfree_skb(skb2);
1366 out:
1367         /* this avoids a loop in nfnetlink. */
1368         return err == -EAGAIN ? -ENOBUFS : err;
1369 }
1370
1371 static int ctnetlink_done_list(struct netlink_callback *cb)
1372 {
1373         if (cb->args[1])
1374                 nf_ct_put((struct nf_conn *)cb->args[1]);
1375         return 0;
1376 }
1377
1378 static int
1379 ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb, bool dying)
1380 {
1381         struct nf_conn *ct, *last;
1382         struct nf_conntrack_tuple_hash *h;
1383         struct hlist_nulls_node *n;
1384         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
1385         u_int8_t l3proto = nfmsg->nfgen_family;
1386         int res;
1387         int cpu;
1388         struct hlist_nulls_head *list;
1389         struct net *net = sock_net(skb->sk);
1390
1391         if (cb->args[2])
1392                 return 0;
1393
1394         last = (struct nf_conn *)cb->args[1];
1395
1396         for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
1397                 struct ct_pcpu *pcpu;
1398
1399                 if (!cpu_possible(cpu))
1400                         continue;
1401
1402                 pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
1403                 spin_lock_bh(&pcpu->lock);
1404                 list = dying ? &pcpu->dying : &pcpu->unconfirmed;
1405 restart:
1406                 hlist_nulls_for_each_entry(h, n, list, hnnode) {
1407                         ct = nf_ct_tuplehash_to_ctrack(h);
1408                         if (l3proto && nf_ct_l3num(ct) != l3proto)
1409                                 continue;
1410                         if (cb->args[1]) {
1411                                 if (ct != last)
1412                                         continue;
1413                                 cb->args[1] = 0;
1414                         }
1415                         rcu_read_lock();
1416                         res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
1417                                                   cb->nlh->nlmsg_seq,
1418                                                   NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
1419                                                   ct);
1420                         rcu_read_unlock();
1421                         if (res < 0) {
1422                                 if (!atomic_inc_not_zero(&ct->ct_general.use))
1423                                         continue;
1424                                 cb->args[0] = cpu;
1425                                 cb->args[1] = (unsigned long)ct;
1426                                 spin_unlock_bh(&pcpu->lock);
1427                                 goto out;
1428                         }
1429                 }
1430                 if (cb->args[1]) {
1431                         cb->args[1] = 0;
1432                         goto restart;
1433                 }
1434                 spin_unlock_bh(&pcpu->lock);
1435         }
1436         cb->args[2] = 1;
1437 out:
1438         if (last)
1439                 nf_ct_put(last);
1440
1441         return skb->len;
1442 }
1443
1444 static int
1445 ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb)
1446 {
1447         return ctnetlink_dump_list(skb, cb, true);
1448 }
1449
1450 static int ctnetlink_get_ct_dying(struct net *net, struct sock *ctnl,
1451                                   struct sk_buff *skb,
1452                                   const struct nlmsghdr *nlh,
1453                                   const struct nlattr * const cda[],
1454                                   struct netlink_ext_ack *extack)
1455 {
1456         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1457                 struct netlink_dump_control c = {
1458                         .dump = ctnetlink_dump_dying,
1459                         .done = ctnetlink_done_list,
1460                 };
1461                 return netlink_dump_start(ctnl, skb, nlh, &c);
1462         }
1463
1464         return -EOPNOTSUPP;
1465 }
1466
1467 static int
1468 ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb)
1469 {
1470         return ctnetlink_dump_list(skb, cb, false);
1471 }
1472
1473 static int ctnetlink_get_ct_unconfirmed(struct net *net, struct sock *ctnl,
1474                                         struct sk_buff *skb,
1475                                         const struct nlmsghdr *nlh,
1476                                         const struct nlattr * const cda[],
1477                                         struct netlink_ext_ack *extack)
1478 {
1479         if (nlh->nlmsg_flags & NLM_F_DUMP) {
1480                 struct netlink_dump_control c = {
1481                         .dump = ctnetlink_dump_unconfirmed,
1482                         .done = ctnetlink_done_list,
1483                 };
1484                 return netlink_dump_start(ctnl, skb, nlh, &c);
1485         }
1486
1487         return -EOPNOTSUPP;
1488 }
1489
1490 #ifdef CONFIG_NF_NAT_NEEDED
1491 static int
1492 ctnetlink_parse_nat_setup(struct nf_conn *ct,
1493                           enum nf_nat_manip_type manip,
1494                           const struct nlattr *attr)
1495 {
1496         struct nf_nat_hook *nat_hook;
1497         int err;
1498
1499         nat_hook = rcu_dereference(nf_nat_hook);
1500         if (!nat_hook) {
1501 #ifdef CONFIG_MODULES
1502                 rcu_read_unlock();
1503                 nfnl_unlock(NFNL_SUBSYS_CTNETLINK);
1504                 if (request_module("nf-nat") < 0) {
1505                         nfnl_lock(NFNL_SUBSYS_CTNETLINK);
1506                         rcu_read_lock();
1507                         return -EOPNOTSUPP;
1508                 }
1509                 nfnl_lock(NFNL_SUBSYS_CTNETLINK);
1510                 rcu_read_lock();
1511                 nat_hook = rcu_dereference(nf_nat_hook);
1512                 if (nat_hook)
1513                         return -EAGAIN;
1514 #endif
1515                 return -EOPNOTSUPP;
1516         }
1517
1518         err = nat_hook->parse_nat_setup(ct, manip, attr);
1519         if (err == -EAGAIN) {
1520 #ifdef CONFIG_MODULES
1521                 rcu_read_unlock();
1522                 nfnl_unlock(NFNL_SUBSYS_CTNETLINK);
1523                 if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {
1524                         nfnl_lock(NFNL_SUBSYS_CTNETLINK);
1525                         rcu_read_lock();
1526                         return -EOPNOTSUPP;
1527                 }
1528                 nfnl_lock(NFNL_SUBSYS_CTNETLINK);
1529                 rcu_read_lock();
1530 #else
1531                 err = -EOPNOTSUPP;
1532 #endif
1533         }
1534         return err;
1535 }
1536 #endif
1537
1538 static void
1539 __ctnetlink_change_status(struct nf_conn *ct, unsigned long on,
1540                           unsigned long off)
1541 {
1542         unsigned int bit;
1543
1544         /* Ignore these unchangable bits */
1545         on &= ~IPS_UNCHANGEABLE_MASK;
1546         off &= ~IPS_UNCHANGEABLE_MASK;
1547
1548         for (bit = 0; bit < __IPS_MAX_BIT; bit++) {
1549                 if (on & (1 << bit))
1550                         set_bit(bit, &ct->status);
1551                 else if (off & (1 << bit))
1552                         clear_bit(bit, &ct->status);
1553         }
1554 }
1555
1556 static int
1557 ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])
1558 {
1559         unsigned long d;
1560         unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
1561         d = ct->status ^ status;
1562
1563         if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
1564                 /* unchangeable */
1565                 return -EBUSY;
1566
1567         if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
1568                 /* SEEN_REPLY bit can only be set */
1569                 return -EBUSY;
1570
1571         if (d & IPS_ASSURED && !(status & IPS_ASSURED))
1572                 /* ASSURED bit can only be set */
1573                 return -EBUSY;
1574
1575         __ctnetlink_change_status(ct, status, 0);
1576         return 0;
1577 }
1578
1579 static int
1580 ctnetlink_setup_nat(struct nf_conn *ct, const struct nlattr * const cda[])
1581 {
1582 #ifdef CONFIG_NF_NAT_NEEDED
1583         int ret;
1584
1585         if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC])
1586                 return 0;
1587
1588         ret = ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_DST,
1589                                         cda[CTA_NAT_DST]);
1590         if (ret < 0)
1591                 return ret;
1592
1593         return ctnetlink_parse_nat_setup(ct, NF_NAT_MANIP_SRC,
1594                                          cda[CTA_NAT_SRC]);
1595 #else
1596         if (!cda[CTA_NAT_DST] && !cda[CTA_NAT_SRC])
1597                 return 0;
1598         return -EOPNOTSUPP;
1599 #endif
1600 }
1601
1602 static int ctnetlink_change_helper(struct nf_conn *ct,
1603                                    const struct nlattr * const cda[])
1604 {
1605         struct nf_conntrack_helper *helper;
1606         struct nf_conn_help *help = nfct_help(ct);
1607         char *helpname = NULL;
1608         struct nlattr *helpinfo = NULL;
1609         int err;
1610
1611         err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
1612         if (err < 0)
1613                 return err;
1614
1615         /* don't change helper of sibling connections */
1616         if (ct->master) {
1617                 /* If we try to change the helper to the same thing twice,
1618                  * treat the second attempt as a no-op instead of returning
1619                  * an error.
1620                  */
1621                 err = -EBUSY;
1622                 if (help) {
1623                         rcu_read_lock();
1624                         helper = rcu_dereference(help->helper);
1625                         if (helper && !strcmp(helper->name, helpname))
1626                                 err = 0;
1627                         rcu_read_unlock();
1628                 }
1629
1630                 return err;
1631         }
1632
1633         if (!strcmp(helpname, "")) {
1634                 if (help && help->helper) {
1635                         /* we had a helper before ... */
1636                         nf_ct_remove_expectations(ct);
1637                         RCU_INIT_POINTER(help->helper, NULL);
1638                 }
1639
1640                 return 0;
1641         }
1642
1643         rcu_read_lock();
1644         helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
1645                                             nf_ct_protonum(ct));
1646         if (helper == NULL) {
1647                 rcu_read_unlock();
1648                 return -EOPNOTSUPP;
1649         }
1650
1651         if (help) {
1652                 if (help->helper == helper) {
1653                         /* update private helper data if allowed. */
1654                         if (helper->from_nlattr)
1655                                 helper->from_nlattr(helpinfo, ct);
1656                         err = 0;
1657                 } else
1658                         err = -EBUSY;
1659         } else {
1660                 /* we cannot set a helper for an existing conntrack */
1661                 err = -EOPNOTSUPP;
1662         }
1663
1664         rcu_read_unlock();
1665         return err;
1666 }
1667
1668 static int ctnetlink_change_timeout(struct nf_conn *ct,
1669                                     const struct nlattr * const cda[])
1670 {
1671         u64 timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
1672
1673         if (timeout > INT_MAX)
1674                 timeout = INT_MAX;
1675         ct->timeout = nfct_time_stamp + (u32)timeout;
1676
1677         if (test_bit(IPS_DYING_BIT, &ct->status))
1678                 return -ETIME;
1679
1680         return 0;
1681 }
1682
1683 static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = {
1684         [CTA_PROTOINFO_TCP]     = { .type = NLA_NESTED },
1685         [CTA_PROTOINFO_DCCP]    = { .type = NLA_NESTED },
1686         [CTA_PROTOINFO_SCTP]    = { .type = NLA_NESTED },
1687 };
1688
1689 static int ctnetlink_change_protoinfo(struct nf_conn *ct,
1690                                       const struct nlattr * const cda[])
1691 {
1692         const struct nlattr *attr = cda[CTA_PROTOINFO];
1693         const struct nf_conntrack_l4proto *l4proto;
1694         struct nlattr *tb[CTA_PROTOINFO_MAX+1];
1695         int err = 0;
1696
1697         err = nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy,
1698                                NULL);
1699         if (err < 0)
1700                 return err;
1701
1702         rcu_read_lock();
1703         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
1704         if (l4proto->from_nlattr)
1705                 err = l4proto->from_nlattr(tb, ct);
1706         rcu_read_unlock();
1707
1708         return err;
1709 }
1710
1711 static const struct nla_policy seqadj_policy[CTA_SEQADJ_MAX+1] = {
1712         [CTA_SEQADJ_CORRECTION_POS]     = { .type = NLA_U32 },
1713         [CTA_SEQADJ_OFFSET_BEFORE]      = { .type = NLA_U32 },
1714         [CTA_SEQADJ_OFFSET_AFTER]       = { .type = NLA_U32 },
1715 };
1716
1717 static int change_seq_adj(struct nf_ct_seqadj *seq,
1718                           const struct nlattr * const attr)
1719 {
1720         int err;
1721         struct nlattr *cda[CTA_SEQADJ_MAX+1];
1722
1723         err = nla_parse_nested(cda, CTA_SEQADJ_MAX, attr, seqadj_policy, NULL);
1724         if (err < 0)
1725                 return err;
1726
1727         if (!cda[CTA_SEQADJ_CORRECTION_POS])
1728                 return -EINVAL;
1729
1730         seq->correction_pos =
1731                 ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS]));
1732
1733         if (!cda[CTA_SEQADJ_OFFSET_BEFORE])
1734                 return -EINVAL;
1735
1736         seq->offset_before =
1737                 ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE]));
1738
1739         if (!cda[CTA_SEQADJ_OFFSET_AFTER])
1740                 return -EINVAL;
1741
1742         seq->offset_after =
1743                 ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER]));
1744
1745         return 0;
1746 }
1747
1748 static int
1749 ctnetlink_change_seq_adj(struct nf_conn *ct,
1750                          const struct nlattr * const cda[])
1751 {
1752         struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
1753         int ret = 0;
1754
1755         if (!seqadj)
1756                 return 0;
1757
1758         spin_lock_bh(&ct->lock);
1759         if (cda[CTA_SEQ_ADJ_ORIG]) {
1760                 ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL],
1761                                      cda[CTA_SEQ_ADJ_ORIG]);
1762                 if (ret < 0)
1763                         goto err;
1764
1765                 set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
1766         }
1767
1768         if (cda[CTA_SEQ_ADJ_REPLY]) {
1769                 ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY],
1770                                      cda[CTA_SEQ_ADJ_REPLY]);
1771                 if (ret < 0)
1772                         goto err;
1773
1774                 set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
1775         }
1776
1777         spin_unlock_bh(&ct->lock);
1778         return 0;
1779 err:
1780         spin_unlock_bh(&ct->lock);
1781         return ret;
1782 }
1783
1784 static const struct nla_policy synproxy_policy[CTA_SYNPROXY_MAX + 1] = {
1785         [CTA_SYNPROXY_ISN]      = { .type = NLA_U32 },
1786         [CTA_SYNPROXY_ITS]      = { .type = NLA_U32 },
1787         [CTA_SYNPROXY_TSOFF]    = { .type = NLA_U32 },
1788 };
1789
1790 static int ctnetlink_change_synproxy(struct nf_conn *ct,
1791                                      const struct nlattr * const cda[])
1792 {
1793         struct nf_conn_synproxy *synproxy = nfct_synproxy(ct);
1794         struct nlattr *tb[CTA_SYNPROXY_MAX + 1];
1795         int err;
1796
1797         if (!synproxy)
1798                 return 0;
1799
1800         err = nla_parse_nested(tb, CTA_SYNPROXY_MAX, cda[CTA_SYNPROXY],
1801                                synproxy_policy, NULL);
1802         if (err < 0)
1803                 return err;
1804
1805         if (!tb[CTA_SYNPROXY_ISN] ||
1806             !tb[CTA_SYNPROXY_ITS] ||
1807             !tb[CTA_SYNPROXY_TSOFF])
1808                 return -EINVAL;
1809
1810         synproxy->isn = ntohl(nla_get_be32(tb[CTA_SYNPROXY_ISN]));
1811         synproxy->its = ntohl(nla_get_be32(tb[CTA_SYNPROXY_ITS]));
1812         synproxy->tsoff = ntohl(nla_get_be32(tb[CTA_SYNPROXY_TSOFF]));
1813
1814         return 0;
1815 }
1816
1817 static int
1818 ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[])
1819 {
1820 #ifdef CONFIG_NF_CONNTRACK_LABELS
1821         size_t len = nla_len(cda[CTA_LABELS]);
1822         const void *mask = cda[CTA_LABELS_MASK];
1823
1824         if (len & (sizeof(u32)-1)) /* must be multiple of u32 */
1825                 return -EINVAL;
1826
1827         if (mask) {
1828                 if (nla_len(cda[CTA_LABELS_MASK]) == 0 ||
1829                     nla_len(cda[CTA_LABELS_MASK]) != len)
1830                         return -EINVAL;
1831                 mask = nla_data(cda[CTA_LABELS_MASK]);
1832         }
1833
1834         len /= sizeof(u32);
1835
1836         return nf_connlabels_replace(ct, nla_data(cda[CTA_LABELS]), mask, len);
1837 #else
1838         return -EOPNOTSUPP;
1839 #endif
1840 }
1841
1842 static int
1843 ctnetlink_change_conntrack(struct nf_conn *ct,
1844                            const struct nlattr * const cda[])
1845 {
1846         int err;
1847
1848         /* only allow NAT changes and master assignation for new conntracks */
1849         if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])
1850                 return -EOPNOTSUPP;
1851
1852         if (cda[CTA_HELP]) {
1853                 err = ctnetlink_change_helper(ct, cda);
1854                 if (err < 0)
1855                         return err;
1856         }
1857
1858         if (cda[CTA_TIMEOUT]) {
1859                 err = ctnetlink_change_timeout(ct, cda);
1860                 if (err < 0)
1861                         return err;
1862         }
1863
1864         if (cda[CTA_STATUS]) {
1865                 err = ctnetlink_change_status(ct, cda);
1866                 if (err < 0)
1867                         return err;
1868         }
1869
1870         if (cda[CTA_PROTOINFO]) {
1871                 err = ctnetlink_change_protoinfo(ct, cda);
1872                 if (err < 0)
1873                         return err;
1874         }
1875
1876 #if defined(CONFIG_NF_CONNTRACK_MARK)
1877         if (cda[CTA_MARK])
1878                 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1879 #endif
1880
1881         if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
1882                 err = ctnetlink_change_seq_adj(ct, cda);
1883                 if (err < 0)
1884                         return err;
1885         }
1886
1887         if (cda[CTA_SYNPROXY]) {
1888                 err = ctnetlink_change_synproxy(ct, cda);
1889                 if (err < 0)
1890                         return err;
1891         }
1892
1893         if (cda[CTA_LABELS]) {
1894                 err = ctnetlink_attach_labels(ct, cda);
1895                 if (err < 0)
1896                         return err;
1897         }
1898
1899         return 0;
1900 }
1901
1902 static struct nf_conn *
1903 ctnetlink_create_conntrack(struct net *net,
1904                            const struct nf_conntrack_zone *zone,
1905                            const struct nlattr * const cda[],
1906                            struct nf_conntrack_tuple *otuple,
1907                            struct nf_conntrack_tuple *rtuple,
1908                            u8 u3)
1909 {
1910         struct nf_conn *ct;
1911         int err = -EINVAL;
1912         struct nf_conntrack_helper *helper;
1913         struct nf_conn_tstamp *tstamp;
1914         u64 timeout;
1915
1916         ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
1917         if (IS_ERR(ct))
1918                 return ERR_PTR(-ENOMEM);
1919
1920         if (!cda[CTA_TIMEOUT])
1921                 goto err1;
1922
1923         timeout = (u64)ntohl(nla_get_be32(cda[CTA_TIMEOUT])) * HZ;
1924         if (timeout > INT_MAX)
1925                 timeout = INT_MAX;
1926         ct->timeout = (u32)timeout + nfct_time_stamp;
1927
1928         rcu_read_lock();
1929         if (cda[CTA_HELP]) {
1930                 char *helpname = NULL;
1931                 struct nlattr *helpinfo = NULL;
1932
1933                 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
1934                 if (err < 0)
1935                         goto err2;
1936
1937                 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
1938                                                     nf_ct_protonum(ct));
1939                 if (helper == NULL) {
1940                         rcu_read_unlock();
1941 #ifdef CONFIG_MODULES
1942                         if (request_module("nfct-helper-%s", helpname) < 0) {
1943                                 err = -EOPNOTSUPP;
1944                                 goto err1;
1945                         }
1946
1947                         rcu_read_lock();
1948                         helper = __nf_conntrack_helper_find(helpname,
1949                                                             nf_ct_l3num(ct),
1950                                                             nf_ct_protonum(ct));
1951                         if (helper) {
1952                                 err = -EAGAIN;
1953                                 goto err2;
1954                         }
1955                         rcu_read_unlock();
1956 #endif
1957                         err = -EOPNOTSUPP;
1958                         goto err1;
1959                 } else {
1960                         struct nf_conn_help *help;
1961
1962                         help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1963                         if (help == NULL) {
1964                                 err = -ENOMEM;
1965                                 goto err2;
1966                         }
1967                         /* set private helper data if allowed. */
1968                         if (helper->from_nlattr)
1969                                 helper->from_nlattr(helpinfo, ct);
1970
1971                         /* not in hash table yet so not strictly necessary */
1972                         RCU_INIT_POINTER(help->helper, helper);
1973                 }
1974         } else {
1975                 /* try an implicit helper assignation */
1976                 err = __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);
1977                 if (err < 0)
1978                         goto err2;
1979         }
1980
1981         err = ctnetlink_setup_nat(ct, cda);
1982         if (err < 0)
1983                 goto err2;
1984
1985         nf_ct_acct_ext_add(ct, GFP_ATOMIC);
1986         nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
1987         nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
1988         nf_ct_labels_ext_add(ct);
1989         nfct_seqadj_ext_add(ct);
1990         nfct_synproxy_ext_add(ct);
1991
1992         /* we must add conntrack extensions before confirmation. */
1993         ct->status |= IPS_CONFIRMED;
1994
1995         if (cda[CTA_STATUS]) {
1996                 err = ctnetlink_change_status(ct, cda);
1997                 if (err < 0)
1998                         goto err2;
1999         }
2000
2001         if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
2002                 err = ctnetlink_change_seq_adj(ct, cda);
2003                 if (err < 0)
2004                         goto err2;
2005         }
2006
2007         memset(&ct->proto, 0, sizeof(ct->proto));
2008         if (cda[CTA_PROTOINFO]) {
2009                 err = ctnetlink_change_protoinfo(ct, cda);
2010                 if (err < 0)
2011                         goto err2;
2012         }
2013
2014         if (cda[CTA_SYNPROXY]) {
2015                 err = ctnetlink_change_synproxy(ct, cda);
2016                 if (err < 0)
2017                         goto err2;
2018         }
2019
2020 #if defined(CONFIG_NF_CONNTRACK_MARK)
2021         if (cda[CTA_MARK])
2022                 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
2023 #endif
2024
2025         /* setup master conntrack: this is a confirmed expectation */
2026         if (cda[CTA_TUPLE_MASTER]) {
2027                 struct nf_conntrack_tuple master;
2028                 struct nf_conntrack_tuple_hash *master_h;
2029                 struct nf_conn *master_ct;
2030
2031                 err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER,
2032                                             u3, NULL);
2033                 if (err < 0)
2034                         goto err2;
2035
2036                 master_h = nf_conntrack_find_get(net, zone, &master);
2037                 if (master_h == NULL) {
2038                         err = -ENOENT;
2039                         goto err2;
2040                 }
2041                 master_ct = nf_ct_tuplehash_to_ctrack(master_h);
2042                 __set_bit(IPS_EXPECTED_BIT, &ct->status);
2043                 ct->master = master_ct;
2044         }
2045         tstamp = nf_conn_tstamp_find(ct);
2046         if (tstamp)
2047                 tstamp->start = ktime_get_real_ns();
2048
2049         err = nf_conntrack_hash_check_insert(ct);
2050         if (err < 0)
2051                 goto err3;
2052
2053         rcu_read_unlock();
2054
2055         return ct;
2056
2057 err3:
2058         if (ct->master)
2059                 nf_ct_put(ct->master);
2060 err2:
2061         rcu_read_unlock();
2062 err1:
2063         nf_conntrack_free(ct);
2064         return ERR_PTR(err);
2065 }
2066
2067 static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
2068                                    struct sk_buff *skb,
2069                                    const struct nlmsghdr *nlh,
2070                                    const struct nlattr * const cda[],
2071                                    struct netlink_ext_ack *extack)
2072 {
2073         struct nf_conntrack_tuple otuple, rtuple;
2074         struct nf_conntrack_tuple_hash *h = NULL;
2075         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2076         struct nf_conn *ct;
2077         u_int8_t u3 = nfmsg->nfgen_family;
2078         struct nf_conntrack_zone zone;
2079         int err;
2080
2081         err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
2082         if (err < 0)
2083                 return err;
2084
2085         if (cda[CTA_TUPLE_ORIG]) {
2086                 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG,
2087                                             u3, &zone);
2088                 if (err < 0)
2089                         return err;
2090         }
2091
2092         if (cda[CTA_TUPLE_REPLY]) {
2093                 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY,
2094                                             u3, &zone);
2095                 if (err < 0)
2096                         return err;
2097         }
2098
2099         if (cda[CTA_TUPLE_ORIG])
2100                 h = nf_conntrack_find_get(net, &zone, &otuple);
2101         else if (cda[CTA_TUPLE_REPLY])
2102                 h = nf_conntrack_find_get(net, &zone, &rtuple);
2103
2104         if (h == NULL) {
2105                 err = -ENOENT;
2106                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
2107                         enum ip_conntrack_events events;
2108
2109                         if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
2110                                 return -EINVAL;
2111                         if (otuple.dst.protonum != rtuple.dst.protonum)
2112                                 return -EINVAL;
2113
2114                         ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
2115                                                         &rtuple, u3);
2116                         if (IS_ERR(ct))
2117                                 return PTR_ERR(ct);
2118
2119                         err = 0;
2120                         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
2121                                 events = 1 << IPCT_RELATED;
2122                         else
2123                                 events = 1 << IPCT_NEW;
2124
2125                         if (cda[CTA_LABELS] &&
2126                             ctnetlink_attach_labels(ct, cda) == 0)
2127                                 events |= (1 << IPCT_LABEL);
2128
2129                         nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
2130                                                       (1 << IPCT_ASSURED) |
2131                                                       (1 << IPCT_HELPER) |
2132                                                       (1 << IPCT_PROTOINFO) |
2133                                                       (1 << IPCT_SEQADJ) |
2134                                                       (1 << IPCT_MARK) |
2135                                                       (1 << IPCT_SYNPROXY) |
2136                                                       events,
2137                                                       ct, NETLINK_CB(skb).portid,
2138                                                       nlmsg_report(nlh));
2139                         nf_ct_put(ct);
2140                 }
2141
2142                 return err;
2143         }
2144         /* implicit 'else' */
2145
2146         err = -EEXIST;
2147         ct = nf_ct_tuplehash_to_ctrack(h);
2148         if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
2149                 err = ctnetlink_change_conntrack(ct, cda);
2150                 if (err == 0) {
2151                         nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
2152                                                       (1 << IPCT_ASSURED) |
2153                                                       (1 << IPCT_HELPER) |
2154                                                       (1 << IPCT_LABEL) |
2155                                                       (1 << IPCT_PROTOINFO) |
2156                                                       (1 << IPCT_SEQADJ) |
2157                                                       (1 << IPCT_MARK) |
2158                                                       (1 << IPCT_SYNPROXY),
2159                                                       ct, NETLINK_CB(skb).portid,
2160                                                       nlmsg_report(nlh));
2161                 }
2162         }
2163
2164         nf_ct_put(ct);
2165         return err;
2166 }
2167
2168 static int
2169 ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
2170                                 __u16 cpu, const struct ip_conntrack_stat *st)
2171 {
2172         struct nlmsghdr *nlh;
2173         struct nfgenmsg *nfmsg;
2174         unsigned int flags = portid ? NLM_F_MULTI : 0, event;
2175
2176         event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK,
2177                               IPCTNL_MSG_CT_GET_STATS_CPU);
2178         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
2179         if (nlh == NULL)
2180                 goto nlmsg_failure;
2181
2182         nfmsg = nlmsg_data(nlh);
2183         nfmsg->nfgen_family = AF_UNSPEC;
2184         nfmsg->version      = NFNETLINK_V0;
2185         nfmsg->res_id       = htons(cpu);
2186
2187         if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
2188             nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||
2189             nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||
2190             nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||
2191             nla_put_be32(skb, CTA_STATS_INSERT_FAILED,
2192                                 htonl(st->insert_failed)) ||
2193             nla_put_be32(skb, CTA_STATS_DROP, htonl(st->drop)) ||
2194             nla_put_be32(skb, CTA_STATS_EARLY_DROP, htonl(st->early_drop)) ||
2195             nla_put_be32(skb, CTA_STATS_ERROR, htonl(st->error)) ||
2196             nla_put_be32(skb, CTA_STATS_SEARCH_RESTART,
2197                                 htonl(st->search_restart)))
2198                 goto nla_put_failure;
2199
2200         nlmsg_end(skb, nlh);
2201         return skb->len;
2202
2203 nla_put_failure:
2204 nlmsg_failure:
2205         nlmsg_cancel(skb, nlh);
2206         return -1;
2207 }
2208
2209 static int
2210 ctnetlink_ct_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)
2211 {
2212         int cpu;
2213         struct net *net = sock_net(skb->sk);
2214
2215         if (cb->args[0] == nr_cpu_ids)
2216                 return 0;
2217
2218         for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
2219                 const struct ip_conntrack_stat *st;
2220
2221                 if (!cpu_possible(cpu))
2222                         continue;
2223
2224                 st = per_cpu_ptr(net->ct.stat, cpu);
2225                 if (ctnetlink_ct_stat_cpu_fill_info(skb,
2226                                                     NETLINK_CB(cb->skb).portid,
2227                                                     cb->nlh->nlmsg_seq,
2228                                                     cpu, st) < 0)
2229                                 break;
2230         }
2231         cb->args[0] = cpu;
2232
2233         return skb->len;
2234 }
2235
2236 static int ctnetlink_stat_ct_cpu(struct net *net, struct sock *ctnl,
2237                                  struct sk_buff *skb,
2238                                  const struct nlmsghdr *nlh,
2239                                  const struct nlattr * const cda[],
2240                                  struct netlink_ext_ack *extack)
2241 {
2242         if (nlh->nlmsg_flags & NLM_F_DUMP) {
2243                 struct netlink_dump_control c = {
2244                         .dump = ctnetlink_ct_stat_cpu_dump,
2245                 };
2246                 return netlink_dump_start(ctnl, skb, nlh, &c);
2247         }
2248
2249         return 0;
2250 }
2251
2252 static int
2253 ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
2254                             struct net *net)
2255 {
2256         struct nlmsghdr *nlh;
2257         struct nfgenmsg *nfmsg;
2258         unsigned int flags = portid ? NLM_F_MULTI : 0, event;
2259         unsigned int nr_conntracks = atomic_read(&net->ct.count);
2260
2261         event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_GET_STATS);
2262         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
2263         if (nlh == NULL)
2264                 goto nlmsg_failure;
2265
2266         nfmsg = nlmsg_data(nlh);
2267         nfmsg->nfgen_family = AF_UNSPEC;
2268         nfmsg->version      = NFNETLINK_V0;
2269         nfmsg->res_id       = 0;
2270
2271         if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))
2272                 goto nla_put_failure;
2273
2274         if (nla_put_be32(skb, CTA_STATS_GLOBAL_MAX_ENTRIES, htonl(nf_conntrack_max)))
2275                 goto nla_put_failure;
2276
2277         nlmsg_end(skb, nlh);
2278         return skb->len;
2279
2280 nla_put_failure:
2281 nlmsg_failure:
2282         nlmsg_cancel(skb, nlh);
2283         return -1;
2284 }
2285
2286 static int ctnetlink_stat_ct(struct net *net, struct sock *ctnl,
2287                              struct sk_buff *skb, const struct nlmsghdr *nlh,
2288                              const struct nlattr * const cda[],
2289                              struct netlink_ext_ack *extack)
2290 {
2291         struct sk_buff *skb2;
2292         int err;
2293
2294         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2295         if (skb2 == NULL)
2296                 return -ENOMEM;
2297
2298         err = ctnetlink_stat_ct_fill_info(skb2, NETLINK_CB(skb).portid,
2299                                           nlh->nlmsg_seq,
2300                                           NFNL_MSG_TYPE(nlh->nlmsg_type),
2301                                           sock_net(skb->sk));
2302         if (err <= 0)
2303                 goto free;
2304
2305         err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
2306         if (err < 0)
2307                 goto out;
2308
2309         return 0;
2310
2311 free:
2312         kfree_skb(skb2);
2313 out:
2314         /* this avoids a loop in nfnetlink. */
2315         return err == -EAGAIN ? -ENOBUFS : err;
2316 }
2317
2318 static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
2319         [CTA_EXPECT_MASTER]     = { .type = NLA_NESTED },
2320         [CTA_EXPECT_TUPLE]      = { .type = NLA_NESTED },
2321         [CTA_EXPECT_MASK]       = { .type = NLA_NESTED },
2322         [CTA_EXPECT_TIMEOUT]    = { .type = NLA_U32 },
2323         [CTA_EXPECT_ID]         = { .type = NLA_U32 },
2324         [CTA_EXPECT_HELP_NAME]  = { .type = NLA_NUL_STRING,
2325                                     .len = NF_CT_HELPER_NAME_LEN - 1 },
2326         [CTA_EXPECT_ZONE]       = { .type = NLA_U16 },
2327         [CTA_EXPECT_FLAGS]      = { .type = NLA_U32 },
2328         [CTA_EXPECT_CLASS]      = { .type = NLA_U32 },
2329         [CTA_EXPECT_NAT]        = { .type = NLA_NESTED },
2330         [CTA_EXPECT_FN]         = { .type = NLA_NUL_STRING },
2331 };
2332
2333 static struct nf_conntrack_expect *
2334 ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,
2335                        struct nf_conntrack_helper *helper,
2336                        struct nf_conntrack_tuple *tuple,
2337                        struct nf_conntrack_tuple *mask);
2338
2339 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
2340 static size_t
2341 ctnetlink_glue_build_size(const struct nf_conn *ct)
2342 {
2343         return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
2344                + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
2345                + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
2346                + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
2347                + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
2348                + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */
2349                + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
2350                + nla_total_size(0) /* CTA_PROTOINFO */
2351                + nla_total_size(0) /* CTA_HELP */
2352                + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
2353                + ctnetlink_secctx_size(ct)
2354 #ifdef CONFIG_NF_NAT_NEEDED
2355                + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
2356                + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
2357 #endif
2358 #ifdef CONFIG_NF_CONNTRACK_MARK
2359                + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
2360 #endif
2361 #ifdef CONFIG_NF_CONNTRACK_ZONES
2362                + nla_total_size(sizeof(u_int16_t)) /* CTA_ZONE|CTA_TUPLE_ZONE */
2363 #endif
2364                + ctnetlink_proto_size(ct)
2365                ;
2366 }
2367
2368 static struct nf_conn *ctnetlink_glue_get_ct(const struct sk_buff *skb,
2369                                              enum ip_conntrack_info *ctinfo)
2370 {
2371         return nf_ct_get(skb, ctinfo);
2372 }
2373
2374 static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct)
2375 {
2376         const struct nf_conntrack_zone *zone;
2377         struct nlattr *nest_parms;
2378
2379         zone = nf_ct_zone(ct);
2380
2381         nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
2382         if (!nest_parms)
2383                 goto nla_put_failure;
2384         if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
2385                 goto nla_put_failure;
2386         if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
2387                                    NF_CT_ZONE_DIR_ORIG) < 0)
2388                 goto nla_put_failure;
2389         nla_nest_end(skb, nest_parms);
2390
2391         nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
2392         if (!nest_parms)
2393                 goto nla_put_failure;
2394         if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
2395                 goto nla_put_failure;
2396         if (ctnetlink_dump_zone_id(skb, CTA_TUPLE_ZONE, zone,
2397                                    NF_CT_ZONE_DIR_REPL) < 0)
2398                 goto nla_put_failure;
2399         nla_nest_end(skb, nest_parms);
2400
2401         if (ctnetlink_dump_zone_id(skb, CTA_ZONE, zone,
2402                                    NF_CT_DEFAULT_ZONE_DIR) < 0)
2403                 goto nla_put_failure;
2404
2405         if (ctnetlink_dump_id(skb, ct) < 0)
2406                 goto nla_put_failure;
2407
2408         if (ctnetlink_dump_status(skb, ct) < 0)
2409                 goto nla_put_failure;
2410
2411         if (ctnetlink_dump_timeout(skb, ct) < 0)
2412                 goto nla_put_failure;
2413
2414         if (ctnetlink_dump_protoinfo(skb, ct) < 0)
2415                 goto nla_put_failure;
2416
2417         if (ctnetlink_dump_helpinfo(skb, ct) < 0)
2418                 goto nla_put_failure;
2419
2420 #ifdef CONFIG_NF_CONNTRACK_SECMARK
2421         if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0)
2422                 goto nla_put_failure;
2423 #endif
2424         if (ct->master && ctnetlink_dump_master(skb, ct) < 0)
2425                 goto nla_put_failure;
2426
2427         if ((ct->status & IPS_SEQ_ADJUST) &&
2428             ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
2429                 goto nla_put_failure;
2430
2431         if (ctnetlink_dump_ct_synproxy(skb, ct) < 0)
2432                 goto nla_put_failure;
2433
2434 #ifdef CONFIG_NF_CONNTRACK_MARK
2435         if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)
2436                 goto nla_put_failure;
2437 #endif
2438         if (ctnetlink_dump_labels(skb, ct) < 0)
2439                 goto nla_put_failure;
2440         return 0;
2441
2442 nla_put_failure:
2443         return -ENOSPC;
2444 }
2445
2446 static int
2447 ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct,
2448                      enum ip_conntrack_info ctinfo,
2449                      u_int16_t ct_attr, u_int16_t ct_info_attr)
2450 {
2451         struct nlattr *nest_parms;
2452
2453         nest_parms = nla_nest_start(skb, ct_attr | NLA_F_NESTED);
2454         if (!nest_parms)
2455                 goto nla_put_failure;
2456
2457         if (__ctnetlink_glue_build(skb, ct) < 0)
2458                 goto nla_put_failure;
2459
2460         nla_nest_end(skb, nest_parms);
2461
2462         if (nla_put_be32(skb, ct_info_attr, htonl(ctinfo)))
2463                 goto nla_put_failure;
2464
2465         return 0;
2466
2467 nla_put_failure:
2468         return -ENOSPC;
2469 }
2470
2471 static int
2472 ctnetlink_update_status(struct nf_conn *ct, const struct nlattr * const cda[])
2473 {
2474         unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
2475         unsigned long d = ct->status ^ status;
2476
2477         if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
2478                 /* SEEN_REPLY bit can only be set */
2479                 return -EBUSY;
2480
2481         if (d & IPS_ASSURED && !(status & IPS_ASSURED))
2482                 /* ASSURED bit can only be set */
2483                 return -EBUSY;
2484
2485         /* This check is less strict than ctnetlink_change_status()
2486          * because callers often flip IPS_EXPECTED bits when sending
2487          * an NFQA_CT attribute to the kernel.  So ignore the
2488          * unchangeable bits but do not error out. Also user programs
2489          * are allowed to clear the bits that they are allowed to change.
2490          */
2491         __ctnetlink_change_status(ct, status, ~status);
2492         return 0;
2493 }
2494
2495 static int
2496 ctnetlink_glue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)
2497 {
2498         int err;
2499
2500         if (cda[CTA_TIMEOUT]) {
2501                 err = ctnetlink_change_timeout(ct, cda);
2502                 if (err < 0)
2503                         return err;
2504         }
2505         if (cda[CTA_STATUS]) {
2506                 err = ctnetlink_update_status(ct, cda);
2507                 if (err < 0)
2508                         return err;
2509         }
2510         if (cda[CTA_HELP]) {
2511                 err = ctnetlink_change_helper(ct, cda);
2512                 if (err < 0)
2513                         return err;
2514         }
2515         if (cda[CTA_LABELS]) {
2516                 err = ctnetlink_attach_labels(ct, cda);
2517                 if (err < 0)
2518                         return err;
2519         }
2520 #if defined(CONFIG_NF_CONNTRACK_MARK)
2521         if (cda[CTA_MARK]) {
2522                 u32 mask = 0, mark, newmark;
2523                 if (cda[CTA_MARK_MASK])
2524                         mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
2525
2526                 mark = ntohl(nla_get_be32(cda[CTA_MARK]));
2527                 newmark = (ct->mark & mask) ^ mark;
2528                 if (newmark != ct->mark)
2529                         ct->mark = newmark;
2530         }
2531 #endif
2532         return 0;
2533 }
2534
2535 static int
2536 ctnetlink_glue_parse(const struct nlattr *attr, struct nf_conn *ct)
2537 {
2538         struct nlattr *cda[CTA_MAX+1];
2539         int ret;
2540
2541         ret = nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy, NULL);
2542         if (ret < 0)
2543                 return ret;
2544
2545         return ctnetlink_glue_parse_ct((const struct nlattr **)cda, ct);
2546 }
2547
2548 static int ctnetlink_glue_exp_parse(const struct nlattr * const *cda,
2549                                     const struct nf_conn *ct,
2550                                     struct nf_conntrack_tuple *tuple,
2551                                     struct nf_conntrack_tuple *mask)
2552 {
2553         int err;
2554
2555         err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE,
2556                                     nf_ct_l3num(ct), NULL);
2557         if (err < 0)
2558                 return err;
2559
2560         return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK,
2561                                      nf_ct_l3num(ct), NULL);
2562 }
2563
2564 static int
2565 ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
2566                              u32 portid, u32 report)
2567 {
2568         struct nlattr *cda[CTA_EXPECT_MAX+1];
2569         struct nf_conntrack_tuple tuple, mask;
2570         struct nf_conntrack_helper *helper = NULL;
2571         struct nf_conntrack_expect *exp;
2572         int err;
2573
2574         err = nla_parse_nested(cda, CTA_EXPECT_MAX, attr, exp_nla_policy,
2575                                NULL);
2576         if (err < 0)
2577                 return err;
2578
2579         err = ctnetlink_glue_exp_parse((const struct nlattr * const *)cda,
2580                                        ct, &tuple, &mask);
2581         if (err < 0)
2582                 return err;
2583
2584         if (cda[CTA_EXPECT_HELP_NAME]) {
2585                 const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
2586
2587                 helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
2588                                                     nf_ct_protonum(ct));
2589                 if (helper == NULL)
2590                         return -EOPNOTSUPP;
2591         }
2592
2593         exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,
2594                                      helper, &tuple, &mask);
2595         if (IS_ERR(exp))
2596                 return PTR_ERR(exp);
2597
2598         err = nf_ct_expect_related_report(exp, portid, report);
2599         nf_ct_expect_put(exp);
2600         return err;
2601 }
2602
2603 static void ctnetlink_glue_seqadj(struct sk_buff *skb, struct nf_conn *ct,
2604                                   enum ip_conntrack_info ctinfo, int diff)
2605 {
2606         if (!(ct->status & IPS_NAT_MASK))
2607                 return;
2608
2609         nf_ct_tcp_seqadj_set(skb, ct, ctinfo, diff);
2610 }
2611
2612 static struct nfnl_ct_hook ctnetlink_glue_hook = {
2613         .get_ct         = ctnetlink_glue_get_ct,
2614         .build_size     = ctnetlink_glue_build_size,
2615         .build          = ctnetlink_glue_build,
2616         .parse          = ctnetlink_glue_parse,
2617         .attach_expect  = ctnetlink_glue_attach_expect,
2618         .seq_adjust     = ctnetlink_glue_seqadj,
2619 };
2620 #endif /* CONFIG_NETFILTER_NETLINK_GLUE_CT */
2621
2622 /***********************************************************************
2623  * EXPECT
2624  ***********************************************************************/
2625
2626 static int ctnetlink_exp_dump_tuple(struct sk_buff *skb,
2627                                     const struct nf_conntrack_tuple *tuple,
2628                                     u32 type)
2629 {
2630         struct nlattr *nest_parms;
2631
2632         nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
2633         if (!nest_parms)
2634                 goto nla_put_failure;
2635         if (ctnetlink_dump_tuples(skb, tuple) < 0)
2636                 goto nla_put_failure;
2637         nla_nest_end(skb, nest_parms);
2638
2639         return 0;
2640
2641 nla_put_failure:
2642         return -1;
2643 }
2644
2645 static int ctnetlink_exp_dump_mask(struct sk_buff *skb,
2646                                    const struct nf_conntrack_tuple *tuple,
2647                                    const struct nf_conntrack_tuple_mask *mask)
2648 {
2649         const struct nf_conntrack_l4proto *l4proto;
2650         struct nf_conntrack_tuple m;
2651         struct nlattr *nest_parms;
2652         int ret;
2653
2654         memset(&m, 0xFF, sizeof(m));
2655         memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
2656         m.src.u.all = mask->src.u.all;
2657         m.src.l3num = tuple->src.l3num;
2658         m.dst.protonum = tuple->dst.protonum;
2659
2660         nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
2661         if (!nest_parms)
2662                 goto nla_put_failure;
2663
2664         rcu_read_lock();
2665         ret = ctnetlink_dump_tuples_ip(skb, &m);
2666         if (ret >= 0) {
2667                 l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
2668                                                tuple->dst.protonum);
2669         ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
2670         }
2671         rcu_read_unlock();
2672
2673         if (unlikely(ret < 0))
2674                 goto nla_put_failure;
2675
2676         nla_nest_end(skb, nest_parms);
2677
2678         return 0;
2679
2680 nla_put_failure:
2681         return -1;
2682 }
2683
2684 #if IS_ENABLED(CONFIG_NF_NAT)
2685 static const union nf_inet_addr any_addr;
2686 #endif
2687
2688 static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp)
2689 {
2690         static __read_mostly siphash_key_t exp_id_seed;
2691         unsigned long a, b, c, d;
2692
2693         net_get_random_once(&exp_id_seed, sizeof(exp_id_seed));
2694
2695         a = (unsigned long)exp;
2696         b = (unsigned long)exp->helper;
2697         c = (unsigned long)exp->master;
2698         d = (unsigned long)siphash(&exp->tuple, sizeof(exp->tuple), &exp_id_seed);
2699
2700 #ifdef CONFIG_64BIT
2701         return (__force __be32)siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &exp_id_seed);
2702 #else
2703         return (__force __be32)siphash_4u32((u32)a, (u32)b, (u32)c, (u32)d, &exp_id_seed);
2704 #endif
2705 }
2706
2707 static int
2708 ctnetlink_exp_dump_expect(struct sk_buff *skb,
2709                           const struct nf_conntrack_expect *exp)
2710 {
2711         struct nf_conn *master = exp->master;
2712         long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
2713         struct nf_conn_help *help;
2714 #ifdef CONFIG_NF_NAT_NEEDED
2715         struct nlattr *nest_parms;
2716         struct nf_conntrack_tuple nat_tuple = {};
2717 #endif
2718         struct nf_ct_helper_expectfn *expfn;
2719
2720         if (timeout < 0)
2721                 timeout = 0;
2722
2723         if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
2724                 goto nla_put_failure;
2725         if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
2726                 goto nla_put_failure;
2727         if (ctnetlink_exp_dump_tuple(skb,
2728                                  &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
2729                                  CTA_EXPECT_MASTER) < 0)
2730                 goto nla_put_failure;
2731
2732 #ifdef CONFIG_NF_NAT_NEEDED
2733         if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) ||
2734             exp->saved_proto.all) {
2735                 nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);
2736                 if (!nest_parms)
2737                         goto nla_put_failure;
2738
2739                 if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))
2740                         goto nla_put_failure;
2741
2742                 nat_tuple.src.l3num = nf_ct_l3num(master);
2743                 nat_tuple.src.u3 = exp->saved_addr;
2744                 nat_tuple.dst.protonum = nf_ct_protonum(master);
2745                 nat_tuple.src.u = exp->saved_proto;
2746
2747                 if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,
2748                                                 CTA_EXPECT_NAT_TUPLE) < 0)
2749                         goto nla_put_failure;
2750                 nla_nest_end(skb, nest_parms);
2751         }
2752 #endif
2753         if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||
2754             nla_put_be32(skb, CTA_EXPECT_ID, nf_expect_get_id(exp)) ||
2755             nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
2756             nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
2757                 goto nla_put_failure;
2758         help = nfct_help(master);
2759         if (help) {
2760                 struct nf_conntrack_helper *helper;
2761
2762                 helper = rcu_dereference(help->helper);
2763                 if (helper &&
2764                     nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))
2765                         goto nla_put_failure;
2766         }
2767         expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);
2768         if (expfn != NULL &&
2769             nla_put_string(skb, CTA_EXPECT_FN, expfn->name))
2770                 goto nla_put_failure;
2771
2772         return 0;
2773
2774 nla_put_failure:
2775         return -1;
2776 }
2777
2778 static int
2779 ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
2780                         int event, const struct nf_conntrack_expect *exp)
2781 {
2782         struct nlmsghdr *nlh;
2783         struct nfgenmsg *nfmsg;
2784         unsigned int flags = portid ? NLM_F_MULTI : 0;
2785
2786         event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, event);
2787         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
2788         if (nlh == NULL)
2789                 goto nlmsg_failure;
2790
2791         nfmsg = nlmsg_data(nlh);
2792         nfmsg->nfgen_family = exp->tuple.src.l3num;
2793         nfmsg->version      = NFNETLINK_V0;
2794         nfmsg->res_id       = 0;
2795
2796         if (ctnetlink_exp_dump_expect(skb, exp) < 0)
2797                 goto nla_put_failure;
2798
2799         nlmsg_end(skb, nlh);
2800         return skb->len;
2801
2802 nlmsg_failure:
2803 nla_put_failure:
2804         nlmsg_cancel(skb, nlh);
2805         return -1;
2806 }
2807
2808 #ifdef CONFIG_NF_CONNTRACK_EVENTS
2809 static int
2810 ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
2811 {
2812         struct nf_conntrack_expect *exp = item->exp;
2813         struct net *net = nf_ct_exp_net(exp);
2814         struct nlmsghdr *nlh;
2815         struct nfgenmsg *nfmsg;
2816         struct sk_buff *skb;
2817         unsigned int type, group;
2818         int flags = 0;
2819
2820         if (events & (1 << IPEXP_DESTROY)) {
2821                 type = IPCTNL_MSG_EXP_DELETE;
2822                 group = NFNLGRP_CONNTRACK_EXP_DESTROY;
2823         } else if (events & (1 << IPEXP_NEW)) {
2824                 type = IPCTNL_MSG_EXP_NEW;
2825                 flags = NLM_F_CREATE|NLM_F_EXCL;
2826                 group = NFNLGRP_CONNTRACK_EXP_NEW;
2827         } else
2828                 return 0;
2829
2830         if (!item->report && !nfnetlink_has_listeners(net, group))
2831                 return 0;
2832
2833         skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
2834         if (skb == NULL)
2835                 goto errout;
2836
2837         type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, type);
2838         nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
2839         if (nlh == NULL)
2840                 goto nlmsg_failure;
2841
2842         nfmsg = nlmsg_data(nlh);
2843         nfmsg->nfgen_family = exp->tuple.src.l3num;
2844         nfmsg->version      = NFNETLINK_V0;
2845         nfmsg->res_id       = 0;
2846
2847         if (ctnetlink_exp_dump_expect(skb, exp) < 0)
2848                 goto nla_put_failure;
2849
2850         nlmsg_end(skb, nlh);
2851         nfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC);
2852         return 0;
2853
2854 nla_put_failure:
2855         nlmsg_cancel(skb, nlh);
2856 nlmsg_failure:
2857         kfree_skb(skb);
2858 errout:
2859         nfnetlink_set_err(net, 0, 0, -ENOBUFS);
2860         return 0;
2861 }
2862 #endif
2863 static int ctnetlink_exp_done(struct netlink_callback *cb)
2864 {
2865         if (cb->args[1])
2866                 nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
2867         return 0;
2868 }
2869
2870 static int
2871 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
2872 {
2873         struct net *net = sock_net(skb->sk);
2874         struct nf_conntrack_expect *exp, *last;
2875         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2876         u_int8_t l3proto = nfmsg->nfgen_family;
2877
2878         rcu_read_lock();
2879         last = (struct nf_conntrack_expect *)cb->args[1];
2880         for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
2881 restart:
2882                 hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]],
2883                                          hnode) {
2884                         if (l3proto && exp->tuple.src.l3num != l3proto)
2885                                 continue;
2886
2887                         if (!net_eq(nf_ct_net(exp->master), net))
2888                                 continue;
2889
2890                         if (cb->args[1]) {
2891                                 if (exp != last)
2892                                         continue;
2893                                 cb->args[1] = 0;
2894                         }
2895                         if (ctnetlink_exp_fill_info(skb,
2896                                                     NETLINK_CB(cb->skb).portid,
2897                                                     cb->nlh->nlmsg_seq,
2898                                                     IPCTNL_MSG_EXP_NEW,
2899                                                     exp) < 0) {
2900                                 if (!refcount_inc_not_zero(&exp->use))
2901                                         continue;
2902                                 cb->args[1] = (unsigned long)exp;
2903                                 goto out;
2904                         }
2905                 }
2906                 if (cb->args[1]) {
2907                         cb->args[1] = 0;
2908                         goto restart;
2909                 }
2910         }
2911 out:
2912         rcu_read_unlock();
2913         if (last)
2914                 nf_ct_expect_put(last);
2915
2916         return skb->len;
2917 }
2918
2919 static int
2920 ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
2921 {
2922         struct nf_conntrack_expect *exp, *last;
2923         struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
2924         struct nf_conn *ct = cb->data;
2925         struct nf_conn_help *help = nfct_help(ct);
2926         u_int8_t l3proto = nfmsg->nfgen_family;
2927
2928         if (cb->args[0])
2929                 return 0;
2930
2931         rcu_read_lock();
2932         last = (struct nf_conntrack_expect *)cb->args[1];
2933 restart:
2934         hlist_for_each_entry_rcu(exp, &help->expectations, lnode) {
2935                 if (l3proto && exp->tuple.src.l3num != l3proto)
2936                         continue;
2937                 if (cb->args[1]) {
2938                         if (exp != last)
2939                                 continue;
2940                         cb->args[1] = 0;
2941                 }
2942                 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).portid,
2943                                             cb->nlh->nlmsg_seq,
2944                                             IPCTNL_MSG_EXP_NEW,
2945                                             exp) < 0) {
2946                         if (!refcount_inc_not_zero(&exp->use))
2947                                 continue;
2948                         cb->args[1] = (unsigned long)exp;
2949                         goto out;
2950                 }
2951         }
2952         if (cb->args[1]) {
2953                 cb->args[1] = 0;
2954                 goto restart;
2955         }
2956         cb->args[0] = 1;
2957 out:
2958         rcu_read_unlock();
2959         if (last)
2960                 nf_ct_expect_put(last);
2961
2962         return skb->len;
2963 }
2964
2965 static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
2966                                  struct sk_buff *skb,
2967                                  const struct nlmsghdr *nlh,
2968                                  const struct nlattr * const cda[],
2969                                  struct netlink_ext_ack *extack)
2970 {
2971         int err;
2972         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
2973         u_int8_t u3 = nfmsg->nfgen_family;
2974         struct nf_conntrack_tuple tuple;
2975         struct nf_conntrack_tuple_hash *h;
2976         struct nf_conn *ct;
2977         struct nf_conntrack_zone zone;
2978         struct netlink_dump_control c = {
2979                 .dump = ctnetlink_exp_ct_dump_table,
2980                 .done = ctnetlink_exp_done,
2981         };
2982
2983         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
2984                                     u3, NULL);
2985         if (err < 0)
2986                 return err;
2987
2988         err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
2989         if (err < 0)
2990                 return err;
2991
2992         h = nf_conntrack_find_get(net, &zone, &tuple);
2993         if (!h)
2994                 return -ENOENT;
2995
2996         ct = nf_ct_tuplehash_to_ctrack(h);
2997         /* No expectation linked to this connection tracking. */
2998         if (!nfct_help(ct)) {
2999                 nf_ct_put(ct);
3000                 return 0;
3001         }
3002
3003         c.data = ct;
3004
3005         err = netlink_dump_start(ctnl, skb, nlh, &c);
3006         nf_ct_put(ct);
3007
3008         return err;
3009 }
3010
3011 static int ctnetlink_get_expect(struct net *net, struct sock *ctnl,
3012                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
3013                                 const struct nlattr * const cda[],
3014                                 struct netlink_ext_ack *extack)
3015 {
3016         struct nf_conntrack_tuple tuple;
3017         struct nf_conntrack_expect *exp;
3018         struct sk_buff *skb2;
3019         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3020         u_int8_t u3 = nfmsg->nfgen_family;
3021         struct nf_conntrack_zone zone;
3022         int err;
3023
3024         if (nlh->nlmsg_flags & NLM_F_DUMP) {
3025                 if (cda[CTA_EXPECT_MASTER])
3026                         return ctnetlink_dump_exp_ct(net, ctnl, skb, nlh, cda,
3027                                                      extack);
3028                 else {
3029                         struct netlink_dump_control c = {
3030                                 .dump = ctnetlink_exp_dump_table,
3031                                 .done = ctnetlink_exp_done,
3032                         };
3033                         return netlink_dump_start(ctnl, skb, nlh, &c);
3034                 }
3035         }
3036
3037         err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
3038         if (err < 0)
3039                 return err;
3040
3041         if (cda[CTA_EXPECT_TUPLE])
3042                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3043                                             u3, NULL);
3044         else if (cda[CTA_EXPECT_MASTER])
3045                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
3046                                             u3, NULL);
3047         else
3048                 return -EINVAL;
3049
3050         if (err < 0)
3051                 return err;
3052
3053         exp = nf_ct_expect_find_get(net, &zone, &tuple);
3054         if (!exp)
3055                 return -ENOENT;
3056
3057         if (cda[CTA_EXPECT_ID]) {
3058                 __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
3059
3060                 if (id != nf_expect_get_id(exp)) {
3061                         nf_ct_expect_put(exp);
3062                         return -ENOENT;
3063                 }
3064         }
3065
3066         err = -ENOMEM;
3067         skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3068         if (skb2 == NULL) {
3069                 nf_ct_expect_put(exp);
3070                 goto out;
3071         }
3072
3073         rcu_read_lock();
3074         err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,
3075                                       nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);
3076         rcu_read_unlock();
3077         nf_ct_expect_put(exp);
3078         if (err <= 0)
3079                 goto free;
3080
3081         err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
3082         if (err < 0)
3083                 goto out;
3084
3085         return 0;
3086
3087 free:
3088         kfree_skb(skb2);
3089 out:
3090         /* this avoids a loop in nfnetlink. */
3091         return err == -EAGAIN ? -ENOBUFS : err;
3092 }
3093
3094 static bool expect_iter_name(struct nf_conntrack_expect *exp, void *data)
3095 {
3096         const struct nf_conn_help *m_help;
3097         const char *name = data;
3098
3099         m_help = nfct_help(exp->master);
3100
3101         return strcmp(m_help->helper->name, name) == 0;
3102 }
3103
3104 static bool expect_iter_all(struct nf_conntrack_expect *exp, void *data)
3105 {
3106         return true;
3107 }
3108
3109 static int ctnetlink_del_expect(struct net *net, struct sock *ctnl,
3110                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
3111                                 const struct nlattr * const cda[],
3112                                 struct netlink_ext_ack *extack)
3113 {
3114         struct nf_conntrack_expect *exp;
3115         struct nf_conntrack_tuple tuple;
3116         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3117         u_int8_t u3 = nfmsg->nfgen_family;
3118         struct nf_conntrack_zone zone;
3119         int err;
3120
3121         if (cda[CTA_EXPECT_TUPLE]) {
3122                 /* delete a single expect by tuple */
3123                 err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
3124                 if (err < 0)
3125                         return err;
3126
3127                 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3128                                             u3, NULL);
3129                 if (err < 0)
3130                         return err;
3131
3132                 /* bump usage count to 2 */
3133                 exp = nf_ct_expect_find_get(net, &zone, &tuple);
3134                 if (!exp)
3135                         return -ENOENT;
3136
3137                 if (cda[CTA_EXPECT_ID]) {
3138                         __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
3139                         if (ntohl(id) != (u32)(unsigned long)exp) {
3140                                 nf_ct_expect_put(exp);
3141                                 return -ENOENT;
3142                         }
3143                 }
3144
3145                 /* after list removal, usage count == 1 */
3146                 spin_lock_bh(&nf_conntrack_expect_lock);
3147                 if (del_timer(&exp->timeout)) {
3148                         nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
3149                                                    nlmsg_report(nlh));
3150                         nf_ct_expect_put(exp);
3151                 }
3152                 spin_unlock_bh(&nf_conntrack_expect_lock);
3153                 /* have to put what we 'get' above.
3154                  * after this line usage count == 0 */
3155                 nf_ct_expect_put(exp);
3156         } else if (cda[CTA_EXPECT_HELP_NAME]) {
3157                 char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
3158
3159                 nf_ct_expect_iterate_net(net, expect_iter_name, name,
3160                                          NETLINK_CB(skb).portid,
3161                                          nlmsg_report(nlh));
3162         } else {
3163                 /* This basically means we have to flush everything*/
3164                 nf_ct_expect_iterate_net(net, expect_iter_all, NULL,
3165                                          NETLINK_CB(skb).portid,
3166                                          nlmsg_report(nlh));
3167         }
3168
3169         return 0;
3170 }
3171 static int
3172 ctnetlink_change_expect(struct nf_conntrack_expect *x,
3173                         const struct nlattr * const cda[])
3174 {
3175         if (cda[CTA_EXPECT_TIMEOUT]) {
3176                 if (!del_timer(&x->timeout))
3177                         return -ETIME;
3178
3179                 x->timeout.expires = jiffies +
3180                         ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
3181                 add_timer(&x->timeout);
3182         }
3183         return 0;
3184 }
3185
3186 #if IS_ENABLED(CONFIG_NF_NAT)
3187 static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
3188         [CTA_EXPECT_NAT_DIR]    = { .type = NLA_U32 },
3189         [CTA_EXPECT_NAT_TUPLE]  = { .type = NLA_NESTED },
3190 };
3191 #endif
3192
3193 static int
3194 ctnetlink_parse_expect_nat(const struct nlattr *attr,
3195                            struct nf_conntrack_expect *exp,
3196                            u_int8_t u3)
3197 {
3198 #ifdef CONFIG_NF_NAT_NEEDED
3199         struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];
3200         struct nf_conntrack_tuple nat_tuple = {};
3201         int err;
3202
3203         err = nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr,
3204                                exp_nat_nla_policy, NULL);
3205         if (err < 0)
3206                 return err;
3207
3208         if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE])
3209                 return -EINVAL;
3210
3211         err = ctnetlink_parse_tuple((const struct nlattr * const *)tb,
3212                                     &nat_tuple, CTA_EXPECT_NAT_TUPLE,
3213                                     u3, NULL);
3214         if (err < 0)
3215                 return err;
3216
3217         exp->saved_addr = nat_tuple.src.u3;
3218         exp->saved_proto = nat_tuple.src.u;
3219         exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));
3220
3221         return 0;
3222 #else
3223         return -EOPNOTSUPP;
3224 #endif
3225 }
3226
3227 static struct nf_conntrack_expect *
3228 ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
3229                        struct nf_conntrack_helper *helper,
3230                        struct nf_conntrack_tuple *tuple,
3231                        struct nf_conntrack_tuple *mask)
3232 {
3233         u_int32_t class = 0;
3234         struct nf_conntrack_expect *exp;
3235         struct nf_conn_help *help;
3236         int err;
3237
3238         help = nfct_help(ct);
3239         if (!help)
3240                 return ERR_PTR(-EOPNOTSUPP);
3241
3242         if (cda[CTA_EXPECT_CLASS] && helper) {
3243                 class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
3244                 if (class > helper->expect_class_max)
3245                         return ERR_PTR(-EINVAL);
3246         }
3247         exp = nf_ct_expect_alloc(ct);
3248         if (!exp)
3249                 return ERR_PTR(-ENOMEM);
3250
3251         if (cda[CTA_EXPECT_FLAGS]) {
3252                 exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
3253                 exp->flags &= ~NF_CT_EXPECT_USERSPACE;
3254         } else {
3255                 exp->flags = 0;
3256         }
3257         if (cda[CTA_EXPECT_FN]) {
3258                 const char *name = nla_data(cda[CTA_EXPECT_FN]);
3259                 struct nf_ct_helper_expectfn *expfn;
3260
3261                 expfn = nf_ct_helper_expectfn_find_by_name(name);
3262                 if (expfn == NULL) {
3263                         err = -EINVAL;
3264                         goto err_out;
3265                 }
3266                 exp->expectfn = expfn->expectfn;
3267         } else
3268                 exp->expectfn = NULL;
3269
3270         exp->class = class;
3271         exp->master = ct;
3272         exp->helper = helper;
3273         exp->tuple = *tuple;
3274         exp->mask.src.u3 = mask->src.u3;
3275         exp->mask.src.u.all = mask->src.u.all;
3276
3277         if (cda[CTA_EXPECT_NAT]) {
3278                 err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],
3279                                                  exp, nf_ct_l3num(ct));
3280                 if (err < 0)
3281                         goto err_out;
3282         }
3283         return exp;
3284 err_out:
3285         nf_ct_expect_put(exp);
3286         return ERR_PTR(err);
3287 }
3288
3289 static int
3290 ctnetlink_create_expect(struct net *net,
3291                         const struct nf_conntrack_zone *zone,
3292                         const struct nlattr * const cda[],
3293                         u_int8_t u3, u32 portid, int report)
3294 {
3295         struct nf_conntrack_tuple tuple, mask, master_tuple;
3296         struct nf_conntrack_tuple_hash *h = NULL;
3297         struct nf_conntrack_helper *helper = NULL;
3298         struct nf_conntrack_expect *exp;
3299         struct nf_conn *ct;
3300         int err;
3301
3302         /* caller guarantees that those three CTA_EXPECT_* exist */
3303         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3304                                     u3, NULL);
3305         if (err < 0)
3306                 return err;
3307         err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK,
3308                                     u3, NULL);
3309         if (err < 0)
3310                 return err;
3311         err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER,
3312                                     u3, NULL);
3313         if (err < 0)
3314                 return err;
3315
3316         /* Look for master conntrack of this expectation */
3317         h = nf_conntrack_find_get(net, zone, &master_tuple);
3318         if (!h)
3319                 return -ENOENT;
3320         ct = nf_ct_tuplehash_to_ctrack(h);
3321
3322         rcu_read_lock();
3323         if (cda[CTA_EXPECT_HELP_NAME]) {
3324                 const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
3325
3326                 helper = __nf_conntrack_helper_find(helpname, u3,
3327                                                     nf_ct_protonum(ct));
3328                 if (helper == NULL) {
3329                         rcu_read_unlock();
3330 #ifdef CONFIG_MODULES
3331                         if (request_module("nfct-helper-%s", helpname) < 0) {
3332                                 err = -EOPNOTSUPP;
3333                                 goto err_ct;
3334                         }
3335                         rcu_read_lock();
3336                         helper = __nf_conntrack_helper_find(helpname, u3,
3337                                                             nf_ct_protonum(ct));
3338                         if (helper) {
3339                                 err = -EAGAIN;
3340                                 goto err_rcu;
3341                         }
3342                         rcu_read_unlock();
3343 #endif
3344                         err = -EOPNOTSUPP;
3345                         goto err_ct;
3346                 }
3347         }
3348
3349         exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);
3350         if (IS_ERR(exp)) {
3351                 err = PTR_ERR(exp);
3352                 goto err_rcu;
3353         }
3354
3355         err = nf_ct_expect_related_report(exp, portid, report);
3356         nf_ct_expect_put(exp);
3357 err_rcu:
3358         rcu_read_unlock();
3359 err_ct:
3360         nf_ct_put(ct);
3361         return err;
3362 }
3363
3364 static int ctnetlink_new_expect(struct net *net, struct sock *ctnl,
3365                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
3366                                 const struct nlattr * const cda[],
3367                                 struct netlink_ext_ack *extack)
3368 {
3369         struct nf_conntrack_tuple tuple;
3370         struct nf_conntrack_expect *exp;
3371         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
3372         u_int8_t u3 = nfmsg->nfgen_family;
3373         struct nf_conntrack_zone zone;
3374         int err;
3375
3376         if (!cda[CTA_EXPECT_TUPLE]
3377             || !cda[CTA_EXPECT_MASK]
3378             || !cda[CTA_EXPECT_MASTER])
3379                 return -EINVAL;
3380
3381         err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
3382         if (err < 0)
3383                 return err;
3384
3385         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE,
3386                                     u3, NULL);
3387         if (err < 0)
3388                 return err;
3389
3390         spin_lock_bh(&nf_conntrack_expect_lock);
3391         exp = __nf_ct_expect_find(net, &zone, &tuple);
3392         if (!exp) {
3393                 spin_unlock_bh(&nf_conntrack_expect_lock);
3394                 err = -ENOENT;
3395                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
3396                         err = ctnetlink_create_expect(net, &zone, cda, u3,
3397                                                       NETLINK_CB(skb).portid,
3398                                                       nlmsg_report(nlh));
3399                 }
3400                 return err;
3401         }
3402
3403         err = -EEXIST;
3404         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
3405                 err = ctnetlink_change_expect(exp, cda);
3406         spin_unlock_bh(&nf_conntrack_expect_lock);
3407
3408         return err;
3409 }
3410
3411 static int
3412 ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu,
3413                              const struct ip_conntrack_stat *st)
3414 {
3415         struct nlmsghdr *nlh;
3416         struct nfgenmsg *nfmsg;
3417         unsigned int flags = portid ? NLM_F_MULTI : 0, event;
3418
3419         event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK,
3420                               IPCTNL_MSG_EXP_GET_STATS_CPU);
3421         nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
3422         if (nlh == NULL)
3423                 goto nlmsg_failure;
3424
3425         nfmsg = nlmsg_data(nlh);
3426         nfmsg->nfgen_family = AF_UNSPEC;
3427         nfmsg->version      = NFNETLINK_V0;
3428         nfmsg->res_id       = htons(cpu);
3429
3430         if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) ||
3431             nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) ||
3432             nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete)))
3433                 goto nla_put_failure;
3434
3435         nlmsg_end(skb, nlh);
3436         return skb->len;
3437
3438 nla_put_failure:
3439 nlmsg_failure:
3440         nlmsg_cancel(skb, nlh);
3441         return -1;
3442 }
3443
3444 static int
3445 ctnetlink_exp_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)
3446 {
3447         int cpu;
3448         struct net *net = sock_net(skb->sk);
3449
3450         if (cb->args[0] == nr_cpu_ids)
3451                 return 0;
3452
3453         for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
3454                 const struct ip_conntrack_stat *st;
3455
3456                 if (!cpu_possible(cpu))
3457                         continue;
3458
3459                 st = per_cpu_ptr(net->ct.stat, cpu);
3460                 if (ctnetlink_exp_stat_fill_info(skb, NETLINK_CB(cb->skb).portid,
3461                                                  cb->nlh->nlmsg_seq,
3462                                                  cpu, st) < 0)
3463                         break;
3464         }
3465         cb->args[0] = cpu;
3466
3467         return skb->len;
3468 }
3469
3470 static int ctnetlink_stat_exp_cpu(struct net *net, struct sock *ctnl,
3471                                   struct sk_buff *skb,
3472                                   const struct nlmsghdr *nlh,
3473                                   const struct nlattr * const cda[],
3474                                   struct netlink_ext_ack *extack)
3475 {
3476         if (nlh->nlmsg_flags & NLM_F_DUMP) {
3477                 struct netlink_dump_control c = {
3478                         .dump = ctnetlink_exp_stat_cpu_dump,
3479                 };
3480                 return netlink_dump_start(ctnl, skb, nlh, &c);
3481         }
3482
3483         return 0;
3484 }
3485
3486 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3487 static struct nf_ct_event_notifier ctnl_notifier = {
3488         .fcn = ctnetlink_conntrack_event,
3489 };
3490
3491 static struct nf_exp_event_notifier ctnl_notifier_exp = {
3492         .fcn = ctnetlink_expect_event,
3493 };
3494 #endif
3495
3496 static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
3497         [IPCTNL_MSG_CT_NEW]             = { .call = ctnetlink_new_conntrack,
3498                                             .attr_count = CTA_MAX,
3499                                             .policy = ct_nla_policy },
3500         [IPCTNL_MSG_CT_GET]             = { .call = ctnetlink_get_conntrack,
3501                                             .attr_count = CTA_MAX,
3502                                             .policy = ct_nla_policy },
3503         [IPCTNL_MSG_CT_DELETE]          = { .call = ctnetlink_del_conntrack,
3504                                             .attr_count = CTA_MAX,
3505                                             .policy = ct_nla_policy },
3506         [IPCTNL_MSG_CT_GET_CTRZERO]     = { .call = ctnetlink_get_conntrack,
3507                                             .attr_count = CTA_MAX,
3508                                             .policy = ct_nla_policy },
3509         [IPCTNL_MSG_CT_GET_STATS_CPU]   = { .call = ctnetlink_stat_ct_cpu },
3510         [IPCTNL_MSG_CT_GET_STATS]       = { .call = ctnetlink_stat_ct },
3511         [IPCTNL_MSG_CT_GET_DYING]       = { .call = ctnetlink_get_ct_dying },
3512         [IPCTNL_MSG_CT_GET_UNCONFIRMED] = { .call = ctnetlink_get_ct_unconfirmed },
3513 };
3514
3515 static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
3516         [IPCTNL_MSG_EXP_GET]            = { .call = ctnetlink_get_expect,
3517                                             .attr_count = CTA_EXPECT_MAX,
3518                                             .policy = exp_nla_policy },
3519         [IPCTNL_MSG_EXP_NEW]            = { .call = ctnetlink_new_expect,
3520                                             .attr_count = CTA_EXPECT_MAX,
3521                                             .policy = exp_nla_policy },
3522         [IPCTNL_MSG_EXP_DELETE]         = { .call = ctnetlink_del_expect,
3523                                             .attr_count = CTA_EXPECT_MAX,
3524                                             .policy = exp_nla_policy },
3525         [IPCTNL_MSG_EXP_GET_STATS_CPU]  = { .call = ctnetlink_stat_exp_cpu },
3526 };
3527
3528 static const struct nfnetlink_subsystem ctnl_subsys = {
3529         .name                           = "conntrack",
3530         .subsys_id                      = NFNL_SUBSYS_CTNETLINK,
3531         .cb_count                       = IPCTNL_MSG_MAX,
3532         .cb                             = ctnl_cb,
3533 };
3534
3535 static const struct nfnetlink_subsystem ctnl_exp_subsys = {
3536         .name                           = "conntrack_expect",
3537         .subsys_id                      = NFNL_SUBSYS_CTNETLINK_EXP,
3538         .cb_count                       = IPCTNL_MSG_EXP_MAX,
3539         .cb                             = ctnl_exp_cb,
3540 };
3541
3542 MODULE_ALIAS("ip_conntrack_netlink");
3543 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
3544 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
3545
3546 static int __net_init ctnetlink_net_init(struct net *net)
3547 {
3548 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3549         int ret;
3550
3551         ret = nf_conntrack_register_notifier(net, &ctnl_notifier);
3552         if (ret < 0) {
3553                 pr_err("ctnetlink_init: cannot register notifier.\n");
3554                 goto err_out;
3555         }
3556
3557         ret = nf_ct_expect_register_notifier(net, &ctnl_notifier_exp);
3558         if (ret < 0) {
3559                 pr_err("ctnetlink_init: cannot expect register notifier.\n");
3560                 goto err_unreg_notifier;
3561         }
3562 #endif
3563         return 0;
3564
3565 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3566 err_unreg_notifier:
3567         nf_conntrack_unregister_notifier(net, &ctnl_notifier);
3568 err_out:
3569         return ret;
3570 #endif
3571 }
3572
3573 static void ctnetlink_net_exit(struct net *net)
3574 {
3575 #ifdef CONFIG_NF_CONNTRACK_EVENTS
3576         nf_ct_expect_unregister_notifier(net, &ctnl_notifier_exp);
3577         nf_conntrack_unregister_notifier(net, &ctnl_notifier);
3578 #endif
3579 }
3580
3581 static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)
3582 {
3583         struct net *net;
3584
3585         list_for_each_entry(net, net_exit_list, exit_list)
3586                 ctnetlink_net_exit(net);
3587
3588         /* wait for other cpus until they are done with ctnl_notifiers */
3589         synchronize_rcu();
3590 }
3591
3592 static struct pernet_operations ctnetlink_net_ops = {
3593         .init           = ctnetlink_net_init,
3594         .exit_batch     = ctnetlink_net_exit_batch,
3595 };
3596
3597 static int __init ctnetlink_init(void)
3598 {
3599         int ret;
3600
3601         ret = nfnetlink_subsys_register(&ctnl_subsys);
3602         if (ret < 0) {
3603                 pr_err("ctnetlink_init: cannot register with nfnetlink.\n");
3604                 goto err_out;
3605         }
3606
3607         ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
3608         if (ret < 0) {
3609                 pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n");
3610                 goto err_unreg_subsys;
3611         }
3612
3613         ret = register_pernet_subsys(&ctnetlink_net_ops);
3614         if (ret < 0) {
3615                 pr_err("ctnetlink_init: cannot register pernet operations\n");
3616                 goto err_unreg_exp_subsys;
3617         }
3618 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
3619         /* setup interaction between nf_queue and nf_conntrack_netlink. */
3620         RCU_INIT_POINTER(nfnl_ct_hook, &ctnetlink_glue_hook);
3621 #endif
3622         return 0;
3623
3624 err_unreg_exp_subsys:
3625         nfnetlink_subsys_unregister(&ctnl_exp_subsys);
3626 err_unreg_subsys:
3627         nfnetlink_subsys_unregister(&ctnl_subsys);
3628 err_out:
3629         return ret;
3630 }
3631
3632 static void __exit ctnetlink_exit(void)
3633 {
3634         unregister_pernet_subsys(&ctnetlink_net_ops);
3635         nfnetlink_subsys_unregister(&ctnl_exp_subsys);
3636         nfnetlink_subsys_unregister(&ctnl_subsys);
3637 #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
3638         RCU_INIT_POINTER(nfnl_ct_hook, NULL);
3639 #endif
3640         synchronize_rcu();
3641 }
3642
3643 module_init(ctnetlink_init);
3644 module_exit(ctnetlink_exit);