nfnetlink_cthelper.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
  4. *
  5. * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com>
  6. */
  7. #include <linux/init.h>
  8. #include <linux/module.h>
  9. #include <linux/kernel.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/netlink.h>
  12. #include <linux/rculist.h>
  13. #include <linux/slab.h>
  14. #include <linux/types.h>
  15. #include <linux/list.h>
  16. #include <linux/errno.h>
  17. #include <linux/capability.h>
  18. #include <net/netlink.h>
  19. #include <net/sock.h>
  20. #include <net/netfilter/nf_conntrack_helper.h>
  21. #include <net/netfilter/nf_conntrack_expect.h>
  22. #include <net/netfilter/nf_conntrack_ecache.h>
  23. #include <linux/netfilter/nfnetlink.h>
  24. #include <linux/netfilter/nfnetlink_conntrack.h>
  25. #include <linux/netfilter/nfnetlink_cthelper.h>
  26. MODULE_LICENSE("GPL");
  27. MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
  28. MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers");
  29. struct nfnl_cthelper {
  30. struct list_head list;
  31. struct nf_conntrack_helper helper;
  32. };
  33. static LIST_HEAD(nfnl_cthelper_list);
  34. static int
  35. nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff,
  36. struct nf_conn *ct, enum ip_conntrack_info ctinfo)
  37. {
  38. const struct nf_conn_help *help;
  39. struct nf_conntrack_helper *helper;
  40. help = nfct_help(ct);
  41. if (help == NULL)
  42. return NF_DROP;
  43. /* rcu_read_lock()ed by nf_hook_thresh */
  44. helper = rcu_dereference(help->helper);
  45. if (helper == NULL)
  46. return NF_DROP;
  47. /* This is a user-space helper not yet configured, skip. */
  48. if ((helper->flags &
  49. (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) ==
  50. NF_CT_HELPER_F_USERSPACE)
  51. return NF_ACCEPT;
  52. /* If the user-space helper is not available, don't block traffic. */
  53. return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS;
  54. }
  55. static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = {
  56. [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, },
  57. [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, },
  58. };
  59. static int
  60. nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
  61. const struct nlattr *attr)
  62. {
  63. int err;
  64. struct nlattr *tb[NFCTH_TUPLE_MAX+1];
  65. err = nla_parse_nested_deprecated(tb, NFCTH_TUPLE_MAX, attr,
  66. nfnl_cthelper_tuple_pol, NULL);
  67. if (err < 0)
  68. return err;
  69. if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
  70. return -EINVAL;
  71. /* Not all fields are initialized so first zero the tuple */
  72. memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
  73. tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
  74. tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
  75. return 0;
  76. }
  77. static int
  78. nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
  79. {
  80. struct nf_conn_help *help = nfct_help(ct);
  81. if (attr == NULL)
  82. return -EINVAL;
  83. if (help->helper->data_len == 0)
  84. return -EINVAL;
  85. nla_memcpy(help->data, attr, sizeof(help->data));
  86. return 0;
  87. }
  88. static int
  89. nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct)
  90. {
  91. const struct nf_conn_help *help = nfct_help(ct);
  92. if (help->helper->data_len &&
  93. nla_put(skb, CTA_HELP_INFO, help->helper->data_len, &help->data))
  94. goto nla_put_failure;
  95. return 0;
  96. nla_put_failure:
  97. return -ENOSPC;
  98. }
  99. static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = {
  100. [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING,
  101. .len = NF_CT_HELPER_NAME_LEN-1 },
  102. [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, },
  103. [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, },
  104. };
  105. static int
  106. nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
  107. const struct nlattr *attr)
  108. {
  109. int err;
  110. struct nlattr *tb[NFCTH_POLICY_MAX+1];
  111. err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr,
  112. nfnl_cthelper_expect_pol, NULL);
  113. if (err < 0)
  114. return err;
  115. if (!tb[NFCTH_POLICY_NAME] ||
  116. !tb[NFCTH_POLICY_EXPECT_MAX] ||
  117. !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
  118. return -EINVAL;
  119. nla_strlcpy(expect_policy->name,
  120. tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN);
  121. expect_policy->max_expected =
  122. ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
  123. if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
  124. return -EINVAL;
  125. expect_policy->timeout =
  126. ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
  127. return 0;
  128. }
  129. static const struct nla_policy
  130. nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = {
  131. [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, },
  132. };
  133. static int
  134. nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
  135. const struct nlattr *attr)
  136. {
  137. int i, ret;
  138. struct nf_conntrack_expect_policy *expect_policy;
  139. struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
  140. unsigned int class_max;
  141. ret = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr,
  142. nfnl_cthelper_expect_policy_set,
  143. NULL);
  144. if (ret < 0)
  145. return ret;
  146. if (!tb[NFCTH_POLICY_SET_NUM])
  147. return -EINVAL;
  148. class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
  149. if (class_max == 0)
  150. return -EINVAL;
  151. if (class_max > NF_CT_MAX_EXPECT_CLASSES)
  152. return -EOVERFLOW;
  153. expect_policy = kcalloc(class_max,
  154. sizeof(struct nf_conntrack_expect_policy),
  155. GFP_KERNEL);
  156. if (expect_policy == NULL)
  157. return -ENOMEM;
  158. for (i = 0; i < class_max; i++) {
  159. if (!tb[NFCTH_POLICY_SET+i])
  160. goto err;
  161. ret = nfnl_cthelper_expect_policy(&expect_policy[i],
  162. tb[NFCTH_POLICY_SET+i]);
  163. if (ret < 0)
  164. goto err;
  165. }
  166. helper->expect_class_max = class_max - 1;
  167. helper->expect_policy = expect_policy;
  168. return 0;
  169. err:
  170. kfree(expect_policy);
  171. return -EINVAL;
  172. }
  173. static int
  174. nfnl_cthelper_create(const struct nlattr * const tb[],
  175. struct nf_conntrack_tuple *tuple)
  176. {
  177. struct nf_conntrack_helper *helper;
  178. struct nfnl_cthelper *nfcth;
  179. unsigned int size;
  180. int ret;
  181. if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN])
  182. return -EINVAL;
  183. nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL);
  184. if (nfcth == NULL)
  185. return -ENOMEM;
  186. helper = &nfcth->helper;
  187. ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]);
  188. if (ret < 0)
  189. goto err1;
  190. nla_strlcpy(helper->name,
  191. tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN);
  192. size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
  193. if (size > sizeof_field(struct nf_conn_help, data)) {
  194. ret = -ENOMEM;
  195. goto err2;
  196. }
  197. helper->data_len = size;
  198. helper->flags |= NF_CT_HELPER_F_USERSPACE;
  199. memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));
  200. helper->me = THIS_MODULE;
  201. helper->help = nfnl_userspace_cthelper;
  202. helper->from_nlattr = nfnl_cthelper_from_nlattr;
  203. helper->to_nlattr = nfnl_cthelper_to_nlattr;
  204. /* Default to queue number zero, this can be updated at any time. */
  205. if (tb[NFCTH_QUEUE_NUM])
  206. helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
  207. if (tb[NFCTH_STATUS]) {
  208. int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
  209. switch(status) {
  210. case NFCT_HELPER_STATUS_ENABLED:
  211. helper->flags |= NF_CT_HELPER_F_CONFIGURED;
  212. break;
  213. case NFCT_HELPER_STATUS_DISABLED:
  214. helper->flags &= ~NF_CT_HELPER_F_CONFIGURED;
  215. break;
  216. }
  217. }
  218. ret = nf_conntrack_helper_register(helper);
  219. if (ret < 0)
  220. goto err2;
  221. list_add_tail(&nfcth->list, &nfnl_cthelper_list);
  222. return 0;
  223. err2:
  224. kfree(helper->expect_policy);
  225. err1:
  226. kfree(nfcth);
  227. return ret;
  228. }
  229. static int
  230. nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy,
  231. struct nf_conntrack_expect_policy *new_policy,
  232. const struct nlattr *attr)
  233. {
  234. struct nlattr *tb[NFCTH_POLICY_MAX + 1];
  235. int err;
  236. err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, attr,
  237. nfnl_cthelper_expect_pol, NULL);
  238. if (err < 0)
  239. return err;
  240. if (!tb[NFCTH_POLICY_NAME] ||
  241. !tb[NFCTH_POLICY_EXPECT_MAX] ||
  242. !tb[NFCTH_POLICY_EXPECT_TIMEOUT])
  243. return -EINVAL;
  244. if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name))
  245. return -EBUSY;
  246. new_policy->max_expected =
  247. ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
  248. if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
  249. return -EINVAL;
  250. new_policy->timeout =
  251. ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT]));
  252. return 0;
  253. }
  254. static int nfnl_cthelper_update_policy_all(struct nlattr *tb[],
  255. struct nf_conntrack_helper *helper)
  256. {
  257. struct nf_conntrack_expect_policy *new_policy;
  258. struct nf_conntrack_expect_policy *policy;
  259. int i, ret = 0;
  260. new_policy = kmalloc_array(helper->expect_class_max + 1,
  261. sizeof(*new_policy), GFP_KERNEL);
  262. if (!new_policy)
  263. return -ENOMEM;
  264. /* Check first that all policy attributes are well-formed, so we don't
  265. * leave things in inconsistent state on errors.
  266. */
  267. for (i = 0; i < helper->expect_class_max + 1; i++) {
  268. if (!tb[NFCTH_POLICY_SET + i]) {
  269. ret = -EINVAL;
  270. goto err;
  271. }
  272. ret = nfnl_cthelper_update_policy_one(&helper->expect_policy[i],
  273. &new_policy[i],
  274. tb[NFCTH_POLICY_SET + i]);
  275. if (ret < 0)
  276. goto err;
  277. }
  278. /* Now we can safely update them. */
  279. for (i = 0; i < helper->expect_class_max + 1; i++) {
  280. policy = (struct nf_conntrack_expect_policy *)
  281. &helper->expect_policy[i];
  282. policy->max_expected = new_policy->max_expected;
  283. policy->timeout = new_policy->timeout;
  284. }
  285. err:
  286. kfree(new_policy);
  287. return ret;
  288. }
  289. static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper,
  290. const struct nlattr *attr)
  291. {
  292. struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1];
  293. unsigned int class_max;
  294. int err;
  295. err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, attr,
  296. nfnl_cthelper_expect_policy_set,
  297. NULL);
  298. if (err < 0)
  299. return err;
  300. if (!tb[NFCTH_POLICY_SET_NUM])
  301. return -EINVAL;
  302. class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
  303. if (helper->expect_class_max + 1 != class_max)
  304. return -EBUSY;
  305. return nfnl_cthelper_update_policy_all(tb, helper);
  306. }
  307. static int
  308. nfnl_cthelper_update(const struct nlattr * const tb[],
  309. struct nf_conntrack_helper *helper)
  310. {
  311. u32 size;
  312. int ret;
  313. if (tb[NFCTH_PRIV_DATA_LEN]) {
  314. size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
  315. if (size != helper->data_len)
  316. return -EBUSY;
  317. }
  318. if (tb[NFCTH_POLICY]) {
  319. ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]);
  320. if (ret < 0)
  321. return ret;
  322. }
  323. if (tb[NFCTH_QUEUE_NUM])
  324. helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM]));
  325. if (tb[NFCTH_STATUS]) {
  326. int status = ntohl(nla_get_be32(tb[NFCTH_STATUS]));
  327. switch(status) {
  328. case NFCT_HELPER_STATUS_ENABLED:
  329. helper->flags |= NF_CT_HELPER_F_CONFIGURED;
  330. break;
  331. case NFCT_HELPER_STATUS_DISABLED:
  332. helper->flags &= ~NF_CT_HELPER_F_CONFIGURED;
  333. break;
  334. }
  335. }
  336. return 0;
  337. }
  338. static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
  339. struct sk_buff *skb, const struct nlmsghdr *nlh,
  340. const struct nlattr * const tb[],
  341. struct netlink_ext_ack *extack)
  342. {
  343. const char *helper_name;
  344. struct nf_conntrack_helper *cur, *helper = NULL;
  345. struct nf_conntrack_tuple tuple;
  346. struct nfnl_cthelper *nlcth;
  347. int ret = 0;
  348. if (!capable(CAP_NET_ADMIN))
  349. return -EPERM;
  350. if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
  351. return -EINVAL;
  352. helper_name = nla_data(tb[NFCTH_NAME]);
  353. ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
  354. if (ret < 0)
  355. return ret;
  356. list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
  357. cur = &nlcth->helper;
  358. if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
  359. continue;
  360. if ((tuple.src.l3num != cur->tuple.src.l3num ||
  361. tuple.dst.protonum != cur->tuple.dst.protonum))
  362. continue;
  363. if (nlh->nlmsg_flags & NLM_F_EXCL)
  364. return -EEXIST;
  365. helper = cur;
  366. break;
  367. }
  368. if (helper == NULL)
  369. ret = nfnl_cthelper_create(tb, &tuple);
  370. else
  371. ret = nfnl_cthelper_update(tb, helper);
  372. return ret;
  373. }
  374. static int
  375. nfnl_cthelper_dump_tuple(struct sk_buff *skb,
  376. struct nf_conntrack_helper *helper)
  377. {
  378. struct nlattr *nest_parms;
  379. nest_parms = nla_nest_start(skb, NFCTH_TUPLE);
  380. if (nest_parms == NULL)
  381. goto nla_put_failure;
  382. if (nla_put_be16(skb, NFCTH_TUPLE_L3PROTONUM,
  383. htons(helper->tuple.src.l3num)))
  384. goto nla_put_failure;
  385. if (nla_put_u8(skb, NFCTH_TUPLE_L4PROTONUM, helper->tuple.dst.protonum))
  386. goto nla_put_failure;
  387. nla_nest_end(skb, nest_parms);
  388. return 0;
  389. nla_put_failure:
  390. return -1;
  391. }
  392. static int
  393. nfnl_cthelper_dump_policy(struct sk_buff *skb,
  394. struct nf_conntrack_helper *helper)
  395. {
  396. int i;
  397. struct nlattr *nest_parms1, *nest_parms2;
  398. nest_parms1 = nla_nest_start(skb, NFCTH_POLICY);
  399. if (nest_parms1 == NULL)
  400. goto nla_put_failure;
  401. if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
  402. htonl(helper->expect_class_max + 1)))
  403. goto nla_put_failure;
  404. for (i = 0; i < helper->expect_class_max + 1; i++) {
  405. nest_parms2 = nla_nest_start(skb, (NFCTH_POLICY_SET + i));
  406. if (nest_parms2 == NULL)
  407. goto nla_put_failure;
  408. if (nla_put_string(skb, NFCTH_POLICY_NAME,
  409. helper->expect_policy[i].name))
  410. goto nla_put_failure;
  411. if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_MAX,
  412. htonl(helper->expect_policy[i].max_expected)))
  413. goto nla_put_failure;
  414. if (nla_put_be32(skb, NFCTH_POLICY_EXPECT_TIMEOUT,
  415. htonl(helper->expect_policy[i].timeout)))
  416. goto nla_put_failure;
  417. nla_nest_end(skb, nest_parms2);
  418. }
  419. nla_nest_end(skb, nest_parms1);
  420. return 0;
  421. nla_put_failure:
  422. return -1;
  423. }
  424. static int
  425. nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
  426. int event, struct nf_conntrack_helper *helper)
  427. {
  428. struct nlmsghdr *nlh;
  429. struct nfgenmsg *nfmsg;
  430. unsigned int flags = portid ? NLM_F_MULTI : 0;
  431. int status;
  432. event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event);
  433. nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
  434. if (nlh == NULL)
  435. goto nlmsg_failure;
  436. nfmsg = nlmsg_data(nlh);
  437. nfmsg->nfgen_family = AF_UNSPEC;
  438. nfmsg->version = NFNETLINK_V0;
  439. nfmsg->res_id = 0;
  440. if (nla_put_string(skb, NFCTH_NAME, helper->name))
  441. goto nla_put_failure;
  442. if (nla_put_be32(skb, NFCTH_QUEUE_NUM, htonl(helper->queue_num)))
  443. goto nla_put_failure;
  444. if (nfnl_cthelper_dump_tuple(skb, helper) < 0)
  445. goto nla_put_failure;
  446. if (nfnl_cthelper_dump_policy(skb, helper) < 0)
  447. goto nla_put_failure;
  448. if (nla_put_be32(skb, NFCTH_PRIV_DATA_LEN, htonl(helper->data_len)))
  449. goto nla_put_failure;
  450. if (helper->flags & NF_CT_HELPER_F_CONFIGURED)
  451. status = NFCT_HELPER_STATUS_ENABLED;
  452. else
  453. status = NFCT_HELPER_STATUS_DISABLED;
  454. if (nla_put_be32(skb, NFCTH_STATUS, htonl(status)))
  455. goto nla_put_failure;
  456. nlmsg_end(skb, nlh);
  457. return skb->len;
  458. nlmsg_failure:
  459. nla_put_failure:
  460. nlmsg_cancel(skb, nlh);
  461. return -1;
  462. }
  463. static int
  464. nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
  465. {
  466. struct nf_conntrack_helper *cur, *last;
  467. rcu_read_lock();
  468. last = (struct nf_conntrack_helper *)cb->args[1];
  469. for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) {
  470. restart:
  471. hlist_for_each_entry_rcu(cur,
  472. &nf_ct_helper_hash[cb->args[0]], hnode) {
  473. /* skip non-userspace conntrack helpers. */
  474. if (!(cur->flags & NF_CT_HELPER_F_USERSPACE))
  475. continue;
  476. if (cb->args[1]) {
  477. if (cur != last)
  478. continue;
  479. cb->args[1] = 0;
  480. }
  481. if (nfnl_cthelper_fill_info(skb,
  482. NETLINK_CB(cb->skb).portid,
  483. cb->nlh->nlmsg_seq,
  484. NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
  485. NFNL_MSG_CTHELPER_NEW, cur) < 0) {
  486. cb->args[1] = (unsigned long)cur;
  487. goto out;
  488. }
  489. }
  490. }
  491. if (cb->args[1]) {
  492. cb->args[1] = 0;
  493. goto restart;
  494. }
  495. out:
  496. rcu_read_unlock();
  497. return skb->len;
  498. }
  499. static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
  500. struct sk_buff *skb, const struct nlmsghdr *nlh,
  501. const struct nlattr * const tb[],
  502. struct netlink_ext_ack *extack)
  503. {
  504. int ret = -ENOENT;
  505. struct nf_conntrack_helper *cur;
  506. struct sk_buff *skb2;
  507. char *helper_name = NULL;
  508. struct nf_conntrack_tuple tuple;
  509. struct nfnl_cthelper *nlcth;
  510. bool tuple_set = false;
  511. if (!capable(CAP_NET_ADMIN))
  512. return -EPERM;
  513. if (nlh->nlmsg_flags & NLM_F_DUMP) {
  514. struct netlink_dump_control c = {
  515. .dump = nfnl_cthelper_dump_table,
  516. };
  517. return netlink_dump_start(nfnl, skb, nlh, &c);
  518. }
  519. if (tb[NFCTH_NAME])
  520. helper_name = nla_data(tb[NFCTH_NAME]);
  521. if (tb[NFCTH_TUPLE]) {
  522. ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
  523. if (ret < 0)
  524. return ret;
  525. tuple_set = true;
  526. }
  527. list_for_each_entry(nlcth, &nfnl_cthelper_list, list) {
  528. cur = &nlcth->helper;
  529. if (helper_name &&
  530. strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
  531. continue;
  532. if (tuple_set &&
  533. (tuple.src.l3num != cur->tuple.src.l3num ||
  534. tuple.dst.protonum != cur->tuple.dst.protonum))
  535. continue;
  536. skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  537. if (skb2 == NULL) {
  538. ret = -ENOMEM;
  539. break;
  540. }
  541. ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid,
  542. nlh->nlmsg_seq,
  543. NFNL_MSG_TYPE(nlh->nlmsg_type),
  544. NFNL_MSG_CTHELPER_NEW, cur);
  545. if (ret <= 0) {
  546. kfree_skb(skb2);
  547. break;
  548. }
  549. ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid,
  550. MSG_DONTWAIT);
  551. if (ret > 0)
  552. ret = 0;
  553. /* this avoids a loop in nfnetlink. */
  554. return ret == -EAGAIN ? -ENOBUFS : ret;
  555. }
  556. return ret;
  557. }
  558. static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
  559. struct sk_buff *skb, const struct nlmsghdr *nlh,
  560. const struct nlattr * const tb[],
  561. struct netlink_ext_ack *extack)
  562. {
  563. char *helper_name = NULL;
  564. struct nf_conntrack_helper *cur;
  565. struct nf_conntrack_tuple tuple;
  566. bool tuple_set = false, found = false;
  567. struct nfnl_cthelper *nlcth, *n;
  568. int j = 0, ret;
  569. if (!capable(CAP_NET_ADMIN))
  570. return -EPERM;
  571. if (tb[NFCTH_NAME])
  572. helper_name = nla_data(tb[NFCTH_NAME]);
  573. if (tb[NFCTH_TUPLE]) {
  574. ret = nfnl_cthelper_parse_tuple(&tuple, tb[NFCTH_TUPLE]);
  575. if (ret < 0)
  576. return ret;
  577. tuple_set = true;
  578. }
  579. ret = -ENOENT;
  580. list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
  581. cur = &nlcth->helper;
  582. j++;
  583. if (helper_name &&
  584. strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))
  585. continue;
  586. if (tuple_set &&
  587. (tuple.src.l3num != cur->tuple.src.l3num ||
  588. tuple.dst.protonum != cur->tuple.dst.protonum))
  589. continue;
  590. if (refcount_dec_if_one(&cur->refcnt)) {
  591. found = true;
  592. nf_conntrack_helper_unregister(cur);
  593. kfree(cur->expect_policy);
  594. list_del(&nlcth->list);
  595. kfree(nlcth);
  596. } else {
  597. ret = -EBUSY;
  598. }
  599. }
  600. /* Make sure we return success if we flush and there is no helpers */
  601. return (found || j == 0) ? 0 : ret;
  602. }
  603. static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
  604. [NFCTH_NAME] = { .type = NLA_NUL_STRING,
  605. .len = NF_CT_HELPER_NAME_LEN-1 },
  606. [NFCTH_QUEUE_NUM] = { .type = NLA_U32, },
  607. [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, },
  608. [NFCTH_STATUS] = { .type = NLA_U32, },
  609. };
  610. static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = {
  611. [NFNL_MSG_CTHELPER_NEW] = { .call = nfnl_cthelper_new,
  612. .attr_count = NFCTH_MAX,
  613. .policy = nfnl_cthelper_policy },
  614. [NFNL_MSG_CTHELPER_GET] = { .call = nfnl_cthelper_get,
  615. .attr_count = NFCTH_MAX,
  616. .policy = nfnl_cthelper_policy },
  617. [NFNL_MSG_CTHELPER_DEL] = { .call = nfnl_cthelper_del,
  618. .attr_count = NFCTH_MAX,
  619. .policy = nfnl_cthelper_policy },
  620. };
  621. static const struct nfnetlink_subsystem nfnl_cthelper_subsys = {
  622. .name = "cthelper",
  623. .subsys_id = NFNL_SUBSYS_CTHELPER,
  624. .cb_count = NFNL_MSG_CTHELPER_MAX,
  625. .cb = nfnl_cthelper_cb,
  626. };
  627. MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER);
  628. static int __init nfnl_cthelper_init(void)
  629. {
  630. int ret;
  631. ret = nfnetlink_subsys_register(&nfnl_cthelper_subsys);
  632. if (ret < 0) {
  633. pr_err("nfnl_cthelper: cannot register with nfnetlink.\n");
  634. goto err_out;
  635. }
  636. return 0;
  637. err_out:
  638. return ret;
  639. }
  640. static void __exit nfnl_cthelper_exit(void)
  641. {
  642. struct nf_conntrack_helper *cur;
  643. struct nfnl_cthelper *nlcth, *n;
  644. nfnetlink_subsys_unregister(&nfnl_cthelper_subsys);
  645. list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
  646. cur = &nlcth->helper;
  647. nf_conntrack_helper_unregister(cur);
  648. kfree(cur->expect_policy);
  649. kfree(nlcth);
  650. }
  651. }
  652. module_init(nfnl_cthelper_init);
  653. module_exit(nfnl_cthelper_exit);