1 /* Connection tracking via netlink socket. Allows for user space
2 * protocol helpers and general trouble making from userspace.
4 * (C) 2001 by Jay Schulist <jschlst@samba.org>
5 * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
6 * (C) 2003 by Patrick Mchardy <kaber@trash.net>
7 * (C) 2005-2006 by Pablo Neira Ayuso <pablo@eurodev.net>
9 * I've reworked this stuff to use attributes instead of conntrack
10 * structures. 5.44 am. I need more tea. --pablo 05/07/11.
12 * Initial connection tracking via netlink development funded and
13 * generally made possible by Network Robots, Inc. (www.networkrobots.com)
15 * Further development of this code funded by Astaro AG (http://www.astaro.com)
17 * This software may be used and distributed according to the terms
18 * of the GNU General Public License, incorporated herein by reference.
20 * Derived from ip_conntrack_netlink.c: Port by Pablo Neira Ayuso (05/11/14)
23 #include <linux/init.h>
24 #include <linux/module.h>
25 #include <linux/kernel.h>
26 #include <linux/types.h>
27 #include <linux/timer.h>
28 #include <linux/skbuff.h>
29 #include <linux/errno.h>
30 #include <linux/netlink.h>
31 #include <linux/spinlock.h>
32 #include <linux/interrupt.h>
33 #include <linux/notifier.h>
35 #include <linux/netfilter.h>
36 #include <net/netfilter/nf_conntrack.h>
37 #include <net/netfilter/nf_conntrack_core.h>
38 #include <net/netfilter/nf_conntrack_expect.h>
39 #include <net/netfilter/nf_conntrack_helper.h>
40 #include <net/netfilter/nf_conntrack_l3proto.h>
41 #include <net/netfilter/nf_conntrack_l4proto.h>
42 #include <linux/netfilter_ipv4/ip_nat_protocol.h>
44 #include <linux/netfilter/nfnetlink.h>
45 #include <linux/netfilter/nfnetlink_conntrack.h>
47 MODULE_LICENSE("GPL");
49 static char __initdata version[] = "0.93";
52 ctnetlink_dump_tuples_proto(struct sk_buff *skb,
53 const struct nf_conntrack_tuple *tuple,
54 struct nf_conntrack_l4proto *l4proto)
57 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_PROTO);
59 NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum);
61 if (likely(l4proto->tuple_to_nfattr))
62 ret = l4proto->tuple_to_nfattr(skb, tuple);
64 NFA_NEST_END(skb, nest_parms);
73 ctnetlink_dump_tuples_ip(struct sk_buff *skb,
74 const struct nf_conntrack_tuple *tuple,
75 struct nf_conntrack_l3proto *l3proto)
78 struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
80 if (likely(l3proto->tuple_to_nfattr))
81 ret = l3proto->tuple_to_nfattr(skb, tuple);
83 NFA_NEST_END(skb, nest_parms);
92 ctnetlink_dump_tuples(struct sk_buff *skb,
93 const struct nf_conntrack_tuple *tuple)
96 struct nf_conntrack_l3proto *l3proto;
97 struct nf_conntrack_l4proto *l4proto;
99 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
100 ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
101 nf_ct_l3proto_put(l3proto);
103 if (unlikely(ret < 0))
106 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
107 ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
108 nf_ct_l4proto_put(l4proto);
114 ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
116 __be32 status = htonl((u_int32_t) ct->status);
117 NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
125 ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
127 long timeout_l = ct->timeout.expires - jiffies;
133 timeout = htonl(timeout_l / HZ);
135 NFA_PUT(skb, CTA_TIMEOUT, sizeof(timeout), &timeout);
143 ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
145 struct nf_conntrack_l4proto *l4proto = nf_ct_l4proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num, ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
146 struct nfattr *nest_proto;
149 if (!l4proto->to_nfattr) {
150 nf_ct_l4proto_put(l4proto);
154 nest_proto = NFA_NEST(skb, CTA_PROTOINFO);
156 ret = l4proto->to_nfattr(skb, nest_proto, ct);
158 nf_ct_l4proto_put(l4proto);
160 NFA_NEST_END(skb, nest_proto);
165 nf_ct_l4proto_put(l4proto);
170 ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
172 struct nfattr *nest_helper;
173 const struct nf_conn_help *help = nfct_help(ct);
175 if (!help || !help->helper)
178 nest_helper = NFA_NEST(skb, CTA_HELP);
179 NFA_PUT(skb, CTA_HELP_NAME, strlen(help->helper->name), help->helper->name);
181 if (help->helper->to_nfattr)
182 help->helper->to_nfattr(skb, ct);
184 NFA_NEST_END(skb, nest_helper);
192 #ifdef CONFIG_NF_CT_ACCT
194 ctnetlink_dump_counters(struct sk_buff *skb, const struct nf_conn *ct,
195 enum ip_conntrack_dir dir)
197 enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
198 struct nfattr *nest_count = NFA_NEST(skb, type);
201 tmp = htonl(ct->counters[dir].packets);
202 NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(u_int32_t), &tmp);
204 tmp = htonl(ct->counters[dir].bytes);
205 NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(u_int32_t), &tmp);
207 NFA_NEST_END(skb, nest_count);
215 #define ctnetlink_dump_counters(a, b, c) (0)
218 #ifdef CONFIG_NF_CONNTRACK_MARK
220 ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
222 __be32 mark = htonl(ct->mark);
224 NFA_PUT(skb, CTA_MARK, sizeof(u_int32_t), &mark);
231 #define ctnetlink_dump_mark(a, b) (0)
235 ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
237 __be32 id = htonl(ct->id);
238 NFA_PUT(skb, CTA_ID, sizeof(u_int32_t), &id);
246 ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
248 __be32 use = htonl(atomic_read(&ct->ct_general.use));
250 NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
257 #define tuple(ct, dir) (&(ct)->tuplehash[dir].tuple)
260 ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
261 int event, int nowait,
262 const struct nf_conn *ct)
264 struct nlmsghdr *nlh;
265 struct nfgenmsg *nfmsg;
266 struct nfattr *nest_parms;
271 event |= NFNL_SUBSYS_CTNETLINK << 8;
272 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
273 nfmsg = NLMSG_DATA(nlh);
275 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
276 nfmsg->nfgen_family =
277 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
278 nfmsg->version = NFNETLINK_V0;
281 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
282 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
284 NFA_NEST_END(skb, nest_parms);
286 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
287 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
289 NFA_NEST_END(skb, nest_parms);
291 if (ctnetlink_dump_status(skb, ct) < 0 ||
292 ctnetlink_dump_timeout(skb, ct) < 0 ||
293 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
294 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0 ||
295 ctnetlink_dump_protoinfo(skb, ct) < 0 ||
296 ctnetlink_dump_helpinfo(skb, ct) < 0 ||
297 ctnetlink_dump_mark(skb, ct) < 0 ||
298 ctnetlink_dump_id(skb, ct) < 0 ||
299 ctnetlink_dump_use(skb, ct) < 0)
302 nlh->nlmsg_len = skb->tail - b;
307 skb_trim(skb, b - skb->data);
311 #ifdef CONFIG_NF_CONNTRACK_EVENTS
312 static int ctnetlink_conntrack_event(struct notifier_block *this,
313 unsigned long events, void *ptr)
315 struct nlmsghdr *nlh;
316 struct nfgenmsg *nfmsg;
317 struct nfattr *nest_parms;
318 struct nf_conn *ct = (struct nf_conn *)ptr;
322 unsigned int flags = 0, group;
324 /* ignore our fake conntrack entry */
325 if (ct == &nf_conntrack_untracked)
328 if (events & IPCT_DESTROY) {
329 type = IPCTNL_MSG_CT_DELETE;
330 group = NFNLGRP_CONNTRACK_DESTROY;
331 } else if (events & (IPCT_NEW | IPCT_RELATED)) {
332 type = IPCTNL_MSG_CT_NEW;
333 flags = NLM_F_CREATE|NLM_F_EXCL;
334 group = NFNLGRP_CONNTRACK_NEW;
335 } else if (events & (IPCT_STATUS | IPCT_PROTOINFO)) {
336 type = IPCTNL_MSG_CT_NEW;
337 group = NFNLGRP_CONNTRACK_UPDATE;
341 if (!nfnetlink_has_listeners(group))
344 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
350 type |= NFNL_SUBSYS_CTNETLINK << 8;
351 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
352 nfmsg = NLMSG_DATA(nlh);
354 nlh->nlmsg_flags = flags;
355 nfmsg->nfgen_family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
356 nfmsg->version = NFNETLINK_V0;
359 nest_parms = NFA_NEST(skb, CTA_TUPLE_ORIG);
360 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
362 NFA_NEST_END(skb, nest_parms);
364 nest_parms = NFA_NEST(skb, CTA_TUPLE_REPLY);
365 if (ctnetlink_dump_tuples(skb, tuple(ct, IP_CT_DIR_REPLY)) < 0)
367 NFA_NEST_END(skb, nest_parms);
369 if (events & IPCT_DESTROY) {
370 if (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
371 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0)
374 if (ctnetlink_dump_status(skb, ct) < 0)
377 if (ctnetlink_dump_timeout(skb, ct) < 0)
380 if (events & IPCT_PROTOINFO
381 && ctnetlink_dump_protoinfo(skb, ct) < 0)
384 if ((events & IPCT_HELPER || nfct_help(ct))
385 && ctnetlink_dump_helpinfo(skb, ct) < 0)
388 if ((events & IPCT_MARK || ct->mark)
389 && ctnetlink_dump_mark(skb, ct) < 0)
392 if (events & IPCT_COUNTER_FILLING &&
393 (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
394 ctnetlink_dump_counters(skb, ct, IP_CT_DIR_REPLY) < 0))
398 nlh->nlmsg_len = skb->tail - b;
399 nfnetlink_send(skb, 0, group, 0);
407 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
409 static int ctnetlink_done(struct netlink_callback *cb)
412 nf_ct_put((struct nf_conn *)cb->args[1]);
416 #define L3PROTO(ct) ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num
419 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
421 struct nf_conn *ct, *last;
422 struct nf_conntrack_tuple_hash *h;
424 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
425 u_int8_t l3proto = nfmsg->nfgen_family;
427 read_lock_bh(&nf_conntrack_lock);
428 last = (struct nf_conn *)cb->args[1];
429 for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
431 list_for_each_prev(i, &nf_conntrack_hash[cb->args[0]]) {
432 h = (struct nf_conntrack_tuple_hash *) i;
433 if (DIRECTION(h) != IP_CT_DIR_ORIGINAL)
435 ct = nf_ct_tuplehash_to_ctrack(h);
436 /* Dump entries of a given L3 protocol number.
437 * If it is not specified, ie. l3proto == 0,
438 * then dump everything. */
439 if (l3proto && L3PROTO(ct) != l3proto)
446 if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
450 nf_conntrack_get(&ct->ct_general);
451 cb->args[1] = (unsigned long)ct;
454 #ifdef CONFIG_NF_CT_ACCT
455 if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) ==
456 IPCTNL_MSG_CT_GET_CTRZERO)
457 memset(&ct->counters, 0, sizeof(ct->counters));
466 read_unlock_bh(&nf_conntrack_lock);
474 ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
476 struct nfattr *tb[CTA_IP_MAX];
477 struct nf_conntrack_l3proto *l3proto;
480 nfattr_parse_nested(tb, CTA_IP_MAX, attr);
482 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
484 if (likely(l3proto->nfattr_to_tuple))
485 ret = l3proto->nfattr_to_tuple(tb, tuple);
487 nf_ct_l3proto_put(l3proto);
492 static const size_t cta_min_proto[CTA_PROTO_MAX] = {
493 [CTA_PROTO_NUM-1] = sizeof(u_int8_t),
497 ctnetlink_parse_tuple_proto(struct nfattr *attr,
498 struct nf_conntrack_tuple *tuple)
500 struct nfattr *tb[CTA_PROTO_MAX];
501 struct nf_conntrack_l4proto *l4proto;
504 nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
506 if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
509 if (!tb[CTA_PROTO_NUM-1])
511 tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]);
513 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
515 if (likely(l4proto->nfattr_to_tuple))
516 ret = l4proto->nfattr_to_tuple(tb, tuple);
518 nf_ct_l4proto_put(l4proto);
524 ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
525 enum ctattr_tuple type, u_int8_t l3num)
527 struct nfattr *tb[CTA_TUPLE_MAX];
530 memset(tuple, 0, sizeof(*tuple));
532 nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
534 if (!tb[CTA_TUPLE_IP-1])
537 tuple->src.l3num = l3num;
539 err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP-1], tuple);
543 if (!tb[CTA_TUPLE_PROTO-1])
546 err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO-1], tuple);
550 /* orig and expect tuples get DIR_ORIGINAL */
551 if (type == CTA_TUPLE_REPLY)
552 tuple->dst.dir = IP_CT_DIR_REPLY;
554 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
559 #ifdef CONFIG_IP_NF_NAT_NEEDED
560 static const size_t cta_min_protonat[CTA_PROTONAT_MAX] = {
561 [CTA_PROTONAT_PORT_MIN-1] = sizeof(u_int16_t),
562 [CTA_PROTONAT_PORT_MAX-1] = sizeof(u_int16_t),
565 static int ctnetlink_parse_nat_proto(struct nfattr *attr,
566 const struct nf_conn *ct,
567 struct ip_nat_range *range)
569 struct nfattr *tb[CTA_PROTONAT_MAX];
570 struct ip_nat_protocol *npt;
572 nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
574 if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
577 npt = ip_nat_proto_find_get(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum);
579 if (!npt->nfattr_to_range) {
580 ip_nat_proto_put(npt);
584 /* nfattr_to_range returns 1 if it parsed, 0 if not, neg. on error */
585 if (npt->nfattr_to_range(tb, range) > 0)
586 range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
588 ip_nat_proto_put(npt);
593 static const size_t cta_min_nat[CTA_NAT_MAX] = {
594 [CTA_NAT_MINIP-1] = sizeof(u_int32_t),
595 [CTA_NAT_MAXIP-1] = sizeof(u_int32_t),
599 ctnetlink_parse_nat(struct nfattr *nat,
600 const struct nf_conn *ct, struct ip_nat_range *range)
602 struct nfattr *tb[CTA_NAT_MAX];
605 memset(range, 0, sizeof(*range));
607 nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
609 if (nfattr_bad_size(tb, CTA_NAT_MAX, cta_min_nat))
612 if (tb[CTA_NAT_MINIP-1])
613 range->min_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
615 if (!tb[CTA_NAT_MAXIP-1])
616 range->max_ip = range->min_ip;
618 range->max_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
621 range->flags |= IP_NAT_RANGE_MAP_IPS;
623 if (!tb[CTA_NAT_PROTO-1])
626 err = ctnetlink_parse_nat_proto(tb[CTA_NAT_PROTO-1], ct, range);
635 ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
637 struct nfattr *tb[CTA_HELP_MAX];
639 nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
641 if (!tb[CTA_HELP_NAME-1])
644 *helper_name = NFA_DATA(tb[CTA_HELP_NAME-1]);
649 static const size_t cta_min[CTA_MAX] = {
650 [CTA_STATUS-1] = sizeof(u_int32_t),
651 [CTA_TIMEOUT-1] = sizeof(u_int32_t),
652 [CTA_MARK-1] = sizeof(u_int32_t),
653 [CTA_USE-1] = sizeof(u_int32_t),
654 [CTA_ID-1] = sizeof(u_int32_t)
658 ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
659 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
661 struct nf_conntrack_tuple_hash *h;
662 struct nf_conntrack_tuple tuple;
664 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
665 u_int8_t u3 = nfmsg->nfgen_family;
668 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
671 if (cda[CTA_TUPLE_ORIG-1])
672 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
673 else if (cda[CTA_TUPLE_REPLY-1])
674 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
676 /* Flush the whole table */
677 nf_conntrack_flush();
684 h = nf_conntrack_find_get(&tuple, NULL);
688 ct = nf_ct_tuplehash_to_ctrack(h);
691 u_int32_t id = ntohl(*(__be32 *)NFA_DATA(cda[CTA_ID-1]));
697 if (del_timer(&ct->timeout))
698 ct->timeout.function((unsigned long)ct);
706 ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
707 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
709 struct nf_conntrack_tuple_hash *h;
710 struct nf_conntrack_tuple tuple;
712 struct sk_buff *skb2 = NULL;
713 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
714 u_int8_t u3 = nfmsg->nfgen_family;
717 if (nlh->nlmsg_flags & NLM_F_DUMP) {
720 #ifndef CONFIG_NF_CT_ACCT
721 if (NFNL_MSG_TYPE(nlh->nlmsg_type) == IPCTNL_MSG_CT_GET_CTRZERO)
724 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
725 ctnetlink_dump_table,
726 ctnetlink_done)) != 0)
729 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
736 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
739 if (cda[CTA_TUPLE_ORIG-1])
740 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
741 else if (cda[CTA_TUPLE_REPLY-1])
742 err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
749 h = nf_conntrack_find_get(&tuple, NULL);
753 ct = nf_ct_tuplehash_to_ctrack(h);
756 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
762 err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).pid, nlh->nlmsg_seq,
763 IPCTNL_MSG_CT_NEW, 1, ct);
768 err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
781 ctnetlink_change_status(struct nf_conn *ct, struct nfattr *cda[])
784 unsigned int status = ntohl(*(__be32 *)NFA_DATA(cda[CTA_STATUS-1]));
785 d = ct->status ^ status;
787 if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
791 if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
792 /* SEEN_REPLY bit can only be set */
796 if (d & IPS_ASSURED && !(status & IPS_ASSURED))
797 /* ASSURED bit can only be set */
800 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
801 #ifndef CONFIG_IP_NF_NAT_NEEDED
804 struct ip_nat_range range;
806 if (cda[CTA_NAT_DST-1]) {
807 if (ctnetlink_parse_nat(cda[CTA_NAT_DST-1], ct,
810 if (ip_nat_initialized(ct,
811 HOOK2MANIP(NF_IP_PRE_ROUTING)))
813 ip_nat_setup_info(ct, &range, hooknum);
815 if (cda[CTA_NAT_SRC-1]) {
816 if (ctnetlink_parse_nat(cda[CTA_NAT_SRC-1], ct,
819 if (ip_nat_initialized(ct,
820 HOOK2MANIP(NF_IP_POST_ROUTING)))
822 ip_nat_setup_info(ct, &range, hooknum);
827 /* Be careful here, modifying NAT bits can screw up things,
828 * so don't let users modify them directly if they don't pass
830 ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
836 ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
838 struct nf_conntrack_helper *helper;
839 struct nf_conn_help *help = nfct_help(ct);
844 /* FIXME: we need to reallocate and rehash */
848 /* don't change helper of sibling connections */
852 err = ctnetlink_parse_help(cda[CTA_HELP-1], &helpname);
856 helper = __nf_conntrack_helper_find_byname(helpname);
858 if (!strcmp(helpname, ""))
866 /* we had a helper before ... */
867 nf_ct_remove_expectations(ct);
870 /* need to zero data of old helper */
871 memset(&help->help, 0, sizeof(help->help));
875 help->helper = helper;
881 ctnetlink_change_timeout(struct nf_conn *ct, struct nfattr *cda[])
883 u_int32_t timeout = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
885 if (!del_timer(&ct->timeout))
888 ct->timeout.expires = jiffies + timeout * HZ;
889 add_timer(&ct->timeout);
895 ctnetlink_change_protoinfo(struct nf_conn *ct, struct nfattr *cda[])
897 struct nfattr *tb[CTA_PROTOINFO_MAX], *attr = cda[CTA_PROTOINFO-1];
898 struct nf_conntrack_l4proto *l4proto;
899 u_int16_t npt = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum;
900 u_int16_t l3num = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
903 nfattr_parse_nested(tb, CTA_PROTOINFO_MAX, attr);
905 l4proto = nf_ct_l4proto_find_get(l3num, npt);
907 if (l4proto->from_nfattr)
908 err = l4proto->from_nfattr(tb, ct);
909 nf_ct_l4proto_put(l4proto);
915 ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
919 if (cda[CTA_HELP-1]) {
920 err = ctnetlink_change_helper(ct, cda);
925 if (cda[CTA_TIMEOUT-1]) {
926 err = ctnetlink_change_timeout(ct, cda);
931 if (cda[CTA_STATUS-1]) {
932 err = ctnetlink_change_status(ct, cda);
937 if (cda[CTA_PROTOINFO-1]) {
938 err = ctnetlink_change_protoinfo(ct, cda);
943 #if defined(CONFIG_NF_CONNTRACK_MARK)
945 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
952 ctnetlink_create_conntrack(struct nfattr *cda[],
953 struct nf_conntrack_tuple *otuple,
954 struct nf_conntrack_tuple *rtuple)
958 struct nf_conn_help *help;
960 ct = nf_conntrack_alloc(otuple, rtuple);
961 if (ct == NULL || IS_ERR(ct))
964 if (!cda[CTA_TIMEOUT-1])
966 ct->timeout.expires = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
968 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
969 ct->status |= IPS_CONFIRMED;
971 if (cda[CTA_STATUS-1]) {
972 err = ctnetlink_change_status(ct, cda);
977 if (cda[CTA_PROTOINFO-1]) {
978 err = ctnetlink_change_protoinfo(ct, cda);
983 #if defined(CONFIG_NF_CONNTRACK_MARK)
985 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
988 help = nfct_help(ct);
990 help->helper = nf_ct_helper_find_get(rtuple);
992 add_timer(&ct->timeout);
993 nf_conntrack_hash_insert(ct);
995 if (help && help->helper)
996 nf_ct_helper_put(help->helper);
1001 nf_conntrack_free(ct);
1006 ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
1007 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1009 struct nf_conntrack_tuple otuple, rtuple;
1010 struct nf_conntrack_tuple_hash *h = NULL;
1011 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1012 u_int8_t u3 = nfmsg->nfgen_family;
1015 if (nfattr_bad_size(cda, CTA_MAX, cta_min))
1018 if (cda[CTA_TUPLE_ORIG-1]) {
1019 err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
1024 if (cda[CTA_TUPLE_REPLY-1]) {
1025 err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
1030 write_lock_bh(&nf_conntrack_lock);
1031 if (cda[CTA_TUPLE_ORIG-1])
1032 h = __nf_conntrack_find(&otuple, NULL);
1033 else if (cda[CTA_TUPLE_REPLY-1])
1034 h = __nf_conntrack_find(&rtuple, NULL);
1037 write_unlock_bh(&nf_conntrack_lock);
1039 if (nlh->nlmsg_flags & NLM_F_CREATE)
1040 err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
1043 /* implicit 'else' */
1045 /* we only allow nat config for new conntracks */
1046 if (cda[CTA_NAT_SRC-1] || cda[CTA_NAT_DST-1]) {
1051 /* We manipulate the conntrack inside the global conntrack table lock,
1052 * so there's no need to increase the refcount */
1054 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1055 err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
1058 write_unlock_bh(&nf_conntrack_lock);
1062 /***********************************************************************
1064 ***********************************************************************/
1067 ctnetlink_exp_dump_tuple(struct sk_buff *skb,
1068 const struct nf_conntrack_tuple *tuple,
1069 enum ctattr_expect type)
1071 struct nfattr *nest_parms = NFA_NEST(skb, type);
1073 if (ctnetlink_dump_tuples(skb, tuple) < 0)
1074 goto nfattr_failure;
1076 NFA_NEST_END(skb, nest_parms);
1085 ctnetlink_exp_dump_mask(struct sk_buff *skb,
1086 const struct nf_conntrack_tuple *tuple,
1087 const struct nf_conntrack_tuple *mask)
1090 struct nf_conntrack_l3proto *l3proto;
1091 struct nf_conntrack_l4proto *l4proto;
1092 struct nfattr *nest_parms = NFA_NEST(skb, CTA_EXPECT_MASK);
1094 l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
1095 ret = ctnetlink_dump_tuples_ip(skb, mask, l3proto);
1096 nf_ct_l3proto_put(l3proto);
1098 if (unlikely(ret < 0))
1099 goto nfattr_failure;
1101 l4proto = nf_ct_l4proto_find_get(tuple->src.l3num, tuple->dst.protonum);
1102 ret = ctnetlink_dump_tuples_proto(skb, mask, l4proto);
1103 nf_ct_l4proto_put(l4proto);
1104 if (unlikely(ret < 0))
1105 goto nfattr_failure;
1107 NFA_NEST_END(skb, nest_parms);
1116 ctnetlink_exp_dump_expect(struct sk_buff *skb,
1117 const struct nf_conntrack_expect *exp)
1119 struct nf_conn *master = exp->master;
1120 __be32 timeout = htonl((exp->timeout.expires - jiffies) / HZ);
1121 __be32 id = htonl(exp->id);
1123 if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
1124 goto nfattr_failure;
1125 if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
1126 goto nfattr_failure;
1127 if (ctnetlink_exp_dump_tuple(skb,
1128 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
1129 CTA_EXPECT_MASTER) < 0)
1130 goto nfattr_failure;
1132 NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(timeout), &timeout);
1133 NFA_PUT(skb, CTA_EXPECT_ID, sizeof(u_int32_t), &id);
1142 ctnetlink_exp_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1145 const struct nf_conntrack_expect *exp)
1147 struct nlmsghdr *nlh;
1148 struct nfgenmsg *nfmsg;
1153 event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1154 nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(struct nfgenmsg));
1155 nfmsg = NLMSG_DATA(nlh);
1157 nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
1158 nfmsg->nfgen_family = exp->tuple.src.l3num;
1159 nfmsg->version = NFNETLINK_V0;
1162 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1163 goto nfattr_failure;
1165 nlh->nlmsg_len = skb->tail - b;
1170 skb_trim(skb, b - skb->data);
1174 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1175 static int ctnetlink_expect_event(struct notifier_block *this,
1176 unsigned long events, void *ptr)
1178 struct nlmsghdr *nlh;
1179 struct nfgenmsg *nfmsg;
1180 struct nf_conntrack_expect *exp = (struct nf_conntrack_expect *)ptr;
1181 struct sk_buff *skb;
1186 if (events & IPEXP_NEW) {
1187 type = IPCTNL_MSG_EXP_NEW;
1188 flags = NLM_F_CREATE|NLM_F_EXCL;
1192 if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
1195 skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
1201 type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
1202 nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
1203 nfmsg = NLMSG_DATA(nlh);
1205 nlh->nlmsg_flags = flags;
1206 nfmsg->nfgen_family = exp->tuple.src.l3num;
1207 nfmsg->version = NFNETLINK_V0;
1210 if (ctnetlink_exp_dump_expect(skb, exp) < 0)
1211 goto nfattr_failure;
1213 nlh->nlmsg_len = skb->tail - b;
1214 nfnetlink_send(skb, 0, NFNLGRP_CONNTRACK_EXP_NEW, 0);
1225 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
1227 struct nf_conntrack_expect *exp = NULL;
1228 struct list_head *i;
1229 u_int32_t *id = (u_int32_t *) &cb->args[0];
1230 struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
1231 u_int8_t l3proto = nfmsg->nfgen_family;
1233 read_lock_bh(&nf_conntrack_lock);
1234 list_for_each_prev(i, &nf_conntrack_expect_list) {
1235 exp = (struct nf_conntrack_expect *) i;
1236 if (l3proto && exp->tuple.src.l3num != l3proto)
1240 if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).pid,
1248 read_unlock_bh(&nf_conntrack_lock);
1253 static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
1254 [CTA_EXPECT_TIMEOUT-1] = sizeof(u_int32_t),
1255 [CTA_EXPECT_ID-1] = sizeof(u_int32_t)
1259 ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
1260 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1262 struct nf_conntrack_tuple tuple;
1263 struct nf_conntrack_expect *exp;
1264 struct sk_buff *skb2;
1265 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1266 u_int8_t u3 = nfmsg->nfgen_family;
1269 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1272 if (nlh->nlmsg_flags & NLM_F_DUMP) {
1275 if ((*errp = netlink_dump_start(ctnl, skb, nlh,
1276 ctnetlink_exp_dump_table,
1277 ctnetlink_done)) != 0)
1279 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
1280 if (rlen > skb->len)
1282 skb_pull(skb, rlen);
1286 if (cda[CTA_EXPECT_MASTER-1])
1287 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
1294 exp = nf_conntrack_expect_find_get(&tuple);
1298 if (cda[CTA_EXPECT_ID-1]) {
1299 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
1300 if (exp->id != ntohl(id)) {
1301 nf_conntrack_expect_put(exp);
1307 skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1311 err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).pid,
1312 nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW,
1317 nf_conntrack_expect_put(exp);
1319 return netlink_unicast(ctnl, skb2, NETLINK_CB(skb).pid, MSG_DONTWAIT);
1324 nf_conntrack_expect_put(exp);
1329 ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
1330 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1332 struct nf_conntrack_expect *exp, *tmp;
1333 struct nf_conntrack_tuple tuple;
1334 struct nf_conntrack_helper *h;
1335 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1336 u_int8_t u3 = nfmsg->nfgen_family;
1339 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1342 if (cda[CTA_EXPECT_TUPLE-1]) {
1343 /* delete a single expect by tuple */
1344 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1348 /* bump usage count to 2 */
1349 exp = nf_conntrack_expect_find_get(&tuple);
1353 if (cda[CTA_EXPECT_ID-1]) {
1354 __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
1355 if (exp->id != ntohl(id)) {
1356 nf_conntrack_expect_put(exp);
1361 /* after list removal, usage count == 1 */
1362 nf_conntrack_unexpect_related(exp);
1363 /* have to put what we 'get' above.
1364 * after this line usage count == 0 */
1365 nf_conntrack_expect_put(exp);
1366 } else if (cda[CTA_EXPECT_HELP_NAME-1]) {
1367 char *name = NFA_DATA(cda[CTA_EXPECT_HELP_NAME-1]);
1369 /* delete all expectations for this helper */
1370 write_lock_bh(&nf_conntrack_lock);
1371 h = __nf_conntrack_helper_find_byname(name);
1373 write_unlock_bh(&nf_conntrack_lock);
1376 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1378 struct nf_conn_help *m_help = nfct_help(exp->master);
1379 if (m_help->helper == h
1380 && del_timer(&exp->timeout)) {
1381 nf_ct_unlink_expect(exp);
1382 nf_conntrack_expect_put(exp);
1385 write_unlock_bh(&nf_conntrack_lock);
1387 /* This basically means we have to flush everything*/
1388 write_lock_bh(&nf_conntrack_lock);
1389 list_for_each_entry_safe(exp, tmp, &nf_conntrack_expect_list,
1391 if (del_timer(&exp->timeout)) {
1392 nf_ct_unlink_expect(exp);
1393 nf_conntrack_expect_put(exp);
1396 write_unlock_bh(&nf_conntrack_lock);
1402 ctnetlink_change_expect(struct nf_conntrack_expect *x, struct nfattr *cda[])
1408 ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
1410 struct nf_conntrack_tuple tuple, mask, master_tuple;
1411 struct nf_conntrack_tuple_hash *h = NULL;
1412 struct nf_conntrack_expect *exp;
1414 struct nf_conn_help *help;
1417 /* caller guarantees that those three CTA_EXPECT_* exist */
1418 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1421 err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
1424 err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
1428 /* Look for master conntrack of this expectation */
1429 h = nf_conntrack_find_get(&master_tuple, NULL);
1432 ct = nf_ct_tuplehash_to_ctrack(h);
1433 help = nfct_help(ct);
1435 if (!help || !help->helper) {
1436 /* such conntrack hasn't got any helper, abort */
1441 exp = nf_conntrack_expect_alloc(ct);
1447 exp->expectfn = NULL;
1451 memcpy(&exp->tuple, &tuple, sizeof(struct nf_conntrack_tuple));
1452 memcpy(&exp->mask, &mask, sizeof(struct nf_conntrack_tuple));
1454 err = nf_conntrack_expect_related(exp);
1455 nf_conntrack_expect_put(exp);
1458 nf_ct_put(nf_ct_tuplehash_to_ctrack(h));
1463 ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
1464 struct nlmsghdr *nlh, struct nfattr *cda[], int *errp)
1466 struct nf_conntrack_tuple tuple;
1467 struct nf_conntrack_expect *exp;
1468 struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
1469 u_int8_t u3 = nfmsg->nfgen_family;
1472 if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
1475 if (!cda[CTA_EXPECT_TUPLE-1]
1476 || !cda[CTA_EXPECT_MASK-1]
1477 || !cda[CTA_EXPECT_MASTER-1])
1480 err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
1484 write_lock_bh(&nf_conntrack_lock);
1485 exp = __nf_conntrack_expect_find(&tuple);
1488 write_unlock_bh(&nf_conntrack_lock);
1490 if (nlh->nlmsg_flags & NLM_F_CREATE)
1491 err = ctnetlink_create_expect(cda, u3);
1496 if (!(nlh->nlmsg_flags & NLM_F_EXCL))
1497 err = ctnetlink_change_expect(exp, cda);
1498 write_unlock_bh(&nf_conntrack_lock);
1503 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1504 static struct notifier_block ctnl_notifier = {
1505 .notifier_call = ctnetlink_conntrack_event,
1508 static struct notifier_block ctnl_notifier_exp = {
1509 .notifier_call = ctnetlink_expect_event,
1513 static struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
1514 [IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,
1515 .attr_count = CTA_MAX, },
1516 [IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,
1517 .attr_count = CTA_MAX, },
1518 [IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,
1519 .attr_count = CTA_MAX, },
1520 [IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,
1521 .attr_count = CTA_MAX, },
1524 static struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
1525 [IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,
1526 .attr_count = CTA_EXPECT_MAX, },
1527 [IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,
1528 .attr_count = CTA_EXPECT_MAX, },
1529 [IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,
1530 .attr_count = CTA_EXPECT_MAX, },
1533 static struct nfnetlink_subsystem ctnl_subsys = {
1534 .name = "conntrack",
1535 .subsys_id = NFNL_SUBSYS_CTNETLINK,
1536 .cb_count = IPCTNL_MSG_MAX,
1540 static struct nfnetlink_subsystem ctnl_exp_subsys = {
1541 .name = "conntrack_expect",
1542 .subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,
1543 .cb_count = IPCTNL_MSG_EXP_MAX,
1547 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
1548 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
1550 static int __init ctnetlink_init(void)
1554 printk("ctnetlink v%s: registering with nfnetlink.\n", version);
1555 ret = nfnetlink_subsys_register(&ctnl_subsys);
1557 printk("ctnetlink_init: cannot register with nfnetlink.\n");
1561 ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
1563 printk("ctnetlink_init: cannot register exp with nfnetlink.\n");
1564 goto err_unreg_subsys;
1567 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1568 ret = nf_conntrack_register_notifier(&ctnl_notifier);
1570 printk("ctnetlink_init: cannot register notifier.\n");
1571 goto err_unreg_exp_subsys;
1574 ret = nf_conntrack_expect_register_notifier(&ctnl_notifier_exp);
1576 printk("ctnetlink_init: cannot expect register notifier.\n");
1577 goto err_unreg_notifier;
1583 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1585 nf_conntrack_unregister_notifier(&ctnl_notifier);
1586 err_unreg_exp_subsys:
1587 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1590 nfnetlink_subsys_unregister(&ctnl_subsys);
1595 static void __exit ctnetlink_exit(void)
1597 printk("ctnetlink: unregistering from nfnetlink.\n");
1599 #ifdef CONFIG_NF_CONNTRACK_EVENTS
1600 nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
1601 nf_conntrack_unregister_notifier(&ctnl_notifier);
1604 nfnetlink_subsys_unregister(&ctnl_exp_subsys);
1605 nfnetlink_subsys_unregister(&ctnl_subsys);
1609 module_init(ctnetlink_init);
1610 module_exit(ctnetlink_exit);