1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org> |
4 | * |
5 | * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com> |
6 | */ |
7 | #include <linux/init.h> |
8 | #include <linux/module.h> |
9 | #include <linux/kernel.h> |
10 | #include <linux/skbuff.h> |
11 | #include <linux/netlink.h> |
12 | #include <linux/rculist.h> |
13 | #include <linux/slab.h> |
14 | #include <linux/types.h> |
15 | #include <linux/list.h> |
16 | #include <linux/errno.h> |
17 | #include <linux/capability.h> |
18 | #include <net/netlink.h> |
19 | #include <net/sock.h> |
20 | |
21 | #include <net/netfilter/nf_conntrack_helper.h> |
22 | #include <net/netfilter/nf_conntrack_expect.h> |
23 | #include <net/netfilter/nf_conntrack_ecache.h> |
24 | |
25 | #include <linux/netfilter/nfnetlink.h> |
26 | #include <linux/netfilter/nfnetlink_conntrack.h> |
27 | #include <linux/netfilter/nfnetlink_cthelper.h> |
28 | |
29 | MODULE_LICENSE("GPL" ); |
30 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>" ); |
31 | MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers" ); |
32 | |
33 | struct nfnl_cthelper { |
34 | struct list_head list; |
35 | struct nf_conntrack_helper helper; |
36 | }; |
37 | |
38 | static LIST_HEAD(nfnl_cthelper_list); |
39 | |
40 | static int |
41 | nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff, |
42 | struct nf_conn *ct, enum ip_conntrack_info ctinfo) |
43 | { |
44 | const struct nf_conn_help *help; |
45 | struct nf_conntrack_helper *helper; |
46 | |
47 | help = nfct_help(ct); |
48 | if (help == NULL) |
49 | return NF_DROP; |
50 | |
51 | /* rcu_read_lock()ed by nf_hook_thresh */ |
52 | helper = rcu_dereference(help->helper); |
53 | if (helper == NULL) |
54 | return NF_DROP; |
55 | |
56 | /* This is a user-space helper not yet configured, skip. */ |
57 | if ((helper->flags & |
58 | (NF_CT_HELPER_F_USERSPACE | NF_CT_HELPER_F_CONFIGURED)) == |
59 | NF_CT_HELPER_F_USERSPACE) |
60 | return NF_ACCEPT; |
61 | |
62 | /* If the user-space helper is not available, don't block traffic. */ |
63 | return NF_QUEUE_NR(helper->queue_num) | NF_VERDICT_FLAG_QUEUE_BYPASS; |
64 | } |
65 | |
66 | static const struct nla_policy nfnl_cthelper_tuple_pol[NFCTH_TUPLE_MAX+1] = { |
67 | [NFCTH_TUPLE_L3PROTONUM] = { .type = NLA_U16, }, |
68 | [NFCTH_TUPLE_L4PROTONUM] = { .type = NLA_U8, }, |
69 | }; |
70 | |
71 | static int |
72 | nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple, |
73 | const struct nlattr *attr) |
74 | { |
75 | int err; |
76 | struct nlattr *tb[NFCTH_TUPLE_MAX+1]; |
77 | |
78 | err = nla_parse_nested_deprecated(tb, NFCTH_TUPLE_MAX, nla: attr, |
79 | policy: nfnl_cthelper_tuple_pol, NULL); |
80 | if (err < 0) |
81 | return err; |
82 | |
83 | if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM]) |
84 | return -EINVAL; |
85 | |
86 | /* Not all fields are initialized so first zero the tuple */ |
87 | memset(tuple, 0, sizeof(struct nf_conntrack_tuple)); |
88 | |
89 | tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM])); |
90 | tuple->dst.protonum = nla_get_u8(nla: tb[NFCTH_TUPLE_L4PROTONUM]); |
91 | |
92 | return 0; |
93 | } |
94 | |
95 | static int |
96 | nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct) |
97 | { |
98 | struct nf_conn_help *help = nfct_help(ct); |
99 | const struct nf_conntrack_helper *helper; |
100 | |
101 | if (attr == NULL) |
102 | return -EINVAL; |
103 | |
104 | helper = rcu_dereference(help->helper); |
105 | if (!helper || helper->data_len == 0) |
106 | return -EINVAL; |
107 | |
108 | nla_memcpy(dest: help->data, src: attr, count: sizeof(help->data)); |
109 | return 0; |
110 | } |
111 | |
112 | static int |
113 | nfnl_cthelper_to_nlattr(struct sk_buff *skb, const struct nf_conn *ct) |
114 | { |
115 | const struct nf_conn_help *help = nfct_help(ct); |
116 | const struct nf_conntrack_helper *helper; |
117 | |
118 | helper = rcu_dereference(help->helper); |
119 | if (helper && helper->data_len && |
120 | nla_put(skb, attrtype: CTA_HELP_INFO, attrlen: helper->data_len, data: &help->data)) |
121 | goto nla_put_failure; |
122 | |
123 | return 0; |
124 | |
125 | nla_put_failure: |
126 | return -ENOSPC; |
127 | } |
128 | |
129 | static const struct nla_policy nfnl_cthelper_expect_pol[NFCTH_POLICY_MAX+1] = { |
130 | [NFCTH_POLICY_NAME] = { .type = NLA_NUL_STRING, |
131 | .len = NF_CT_HELPER_NAME_LEN-1 }, |
132 | [NFCTH_POLICY_EXPECT_MAX] = { .type = NLA_U32, }, |
133 | [NFCTH_POLICY_EXPECT_TIMEOUT] = { .type = NLA_U32, }, |
134 | }; |
135 | |
136 | static int |
137 | nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy, |
138 | const struct nlattr *attr) |
139 | { |
140 | int err; |
141 | struct nlattr *tb[NFCTH_POLICY_MAX+1]; |
142 | |
143 | err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, nla: attr, |
144 | policy: nfnl_cthelper_expect_pol, NULL); |
145 | if (err < 0) |
146 | return err; |
147 | |
148 | if (!tb[NFCTH_POLICY_NAME] || |
149 | !tb[NFCTH_POLICY_EXPECT_MAX] || |
150 | !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) |
151 | return -EINVAL; |
152 | |
153 | nla_strscpy(dst: expect_policy->name, |
154 | nla: tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN); |
155 | expect_policy->max_expected = |
156 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); |
157 | if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) |
158 | return -EINVAL; |
159 | |
160 | expect_policy->timeout = |
161 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); |
162 | |
163 | return 0; |
164 | } |
165 | |
166 | static const struct nla_policy |
167 | nfnl_cthelper_expect_policy_set[NFCTH_POLICY_SET_MAX+1] = { |
168 | [NFCTH_POLICY_SET_NUM] = { .type = NLA_U32, }, |
169 | }; |
170 | |
171 | static int |
172 | nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, |
173 | const struct nlattr *attr) |
174 | { |
175 | int i, ret; |
176 | struct nf_conntrack_expect_policy *expect_policy; |
177 | struct nlattr *tb[NFCTH_POLICY_SET_MAX+1]; |
178 | unsigned int class_max; |
179 | |
180 | ret = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, nla: attr, |
181 | policy: nfnl_cthelper_expect_policy_set, |
182 | NULL); |
183 | if (ret < 0) |
184 | return ret; |
185 | |
186 | if (!tb[NFCTH_POLICY_SET_NUM]) |
187 | return -EINVAL; |
188 | |
189 | class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); |
190 | if (class_max == 0) |
191 | return -EINVAL; |
192 | if (class_max > NF_CT_MAX_EXPECT_CLASSES) |
193 | return -EOVERFLOW; |
194 | |
195 | expect_policy = kcalloc(n: class_max, |
196 | size: sizeof(struct nf_conntrack_expect_policy), |
197 | GFP_KERNEL); |
198 | if (expect_policy == NULL) |
199 | return -ENOMEM; |
200 | |
201 | for (i = 0; i < class_max; i++) { |
202 | if (!tb[NFCTH_POLICY_SET+i]) |
203 | goto err; |
204 | |
205 | ret = nfnl_cthelper_expect_policy(expect_policy: &expect_policy[i], |
206 | attr: tb[NFCTH_POLICY_SET+i]); |
207 | if (ret < 0) |
208 | goto err; |
209 | } |
210 | |
211 | helper->expect_class_max = class_max - 1; |
212 | helper->expect_policy = expect_policy; |
213 | return 0; |
214 | err: |
215 | kfree(objp: expect_policy); |
216 | return -EINVAL; |
217 | } |
218 | |
219 | static int |
220 | nfnl_cthelper_create(const struct nlattr * const tb[], |
221 | struct nf_conntrack_tuple *tuple) |
222 | { |
223 | struct nf_conntrack_helper *helper; |
224 | struct nfnl_cthelper *nfcth; |
225 | unsigned int size; |
226 | int ret; |
227 | |
228 | if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN]) |
229 | return -EINVAL; |
230 | |
231 | nfcth = kzalloc(size: sizeof(*nfcth), GFP_KERNEL); |
232 | if (nfcth == NULL) |
233 | return -ENOMEM; |
234 | helper = &nfcth->helper; |
235 | |
236 | ret = nfnl_cthelper_parse_expect_policy(helper, attr: tb[NFCTH_POLICY]); |
237 | if (ret < 0) |
238 | goto err1; |
239 | |
240 | nla_strscpy(dst: helper->name, |
241 | nla: tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN); |
242 | size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); |
243 | if (size > sizeof_field(struct nf_conn_help, data)) { |
244 | ret = -ENOMEM; |
245 | goto err2; |
246 | } |
247 | helper->data_len = size; |
248 | |
249 | helper->flags |= NF_CT_HELPER_F_USERSPACE; |
250 | memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple)); |
251 | |
252 | helper->me = THIS_MODULE; |
253 | helper->help = nfnl_userspace_cthelper; |
254 | helper->from_nlattr = nfnl_cthelper_from_nlattr; |
255 | helper->to_nlattr = nfnl_cthelper_to_nlattr; |
256 | |
257 | /* Default to queue number zero, this can be updated at any time. */ |
258 | if (tb[NFCTH_QUEUE_NUM]) |
259 | helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); |
260 | |
261 | if (tb[NFCTH_STATUS]) { |
262 | int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); |
263 | |
264 | switch(status) { |
265 | case NFCT_HELPER_STATUS_ENABLED: |
266 | helper->flags |= NF_CT_HELPER_F_CONFIGURED; |
267 | break; |
268 | case NFCT_HELPER_STATUS_DISABLED: |
269 | helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; |
270 | break; |
271 | } |
272 | } |
273 | |
274 | ret = nf_conntrack_helper_register(helper); |
275 | if (ret < 0) |
276 | goto err2; |
277 | |
278 | list_add_tail(new: &nfcth->list, head: &nfnl_cthelper_list); |
279 | return 0; |
280 | err2: |
281 | kfree(objp: helper->expect_policy); |
282 | err1: |
283 | kfree(objp: nfcth); |
284 | return ret; |
285 | } |
286 | |
287 | static int |
288 | nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy, |
289 | struct nf_conntrack_expect_policy *new_policy, |
290 | const struct nlattr *attr) |
291 | { |
292 | struct nlattr *tb[NFCTH_POLICY_MAX + 1]; |
293 | int err; |
294 | |
295 | err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_MAX, nla: attr, |
296 | policy: nfnl_cthelper_expect_pol, NULL); |
297 | if (err < 0) |
298 | return err; |
299 | |
300 | if (!tb[NFCTH_POLICY_NAME] || |
301 | !tb[NFCTH_POLICY_EXPECT_MAX] || |
302 | !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) |
303 | return -EINVAL; |
304 | |
305 | if (nla_strcmp(nla: tb[NFCTH_POLICY_NAME], str: policy->name)) |
306 | return -EBUSY; |
307 | |
308 | new_policy->max_expected = |
309 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); |
310 | if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT) |
311 | return -EINVAL; |
312 | |
313 | new_policy->timeout = |
314 | ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); |
315 | |
316 | return 0; |
317 | } |
318 | |
319 | static int nfnl_cthelper_update_policy_all(struct nlattr *tb[], |
320 | struct nf_conntrack_helper *helper) |
321 | { |
322 | struct nf_conntrack_expect_policy *new_policy; |
323 | struct nf_conntrack_expect_policy *policy; |
324 | int i, ret = 0; |
325 | |
326 | new_policy = kmalloc_array(n: helper->expect_class_max + 1, |
327 | size: sizeof(*new_policy), GFP_KERNEL); |
328 | if (!new_policy) |
329 | return -ENOMEM; |
330 | |
331 | /* Check first that all policy attributes are well-formed, so we don't |
332 | * leave things in inconsistent state on errors. |
333 | */ |
334 | for (i = 0; i < helper->expect_class_max + 1; i++) { |
335 | |
336 | if (!tb[NFCTH_POLICY_SET + i]) { |
337 | ret = -EINVAL; |
338 | goto err; |
339 | } |
340 | |
341 | ret = nfnl_cthelper_update_policy_one(policy: &helper->expect_policy[i], |
342 | new_policy: &new_policy[i], |
343 | attr: tb[NFCTH_POLICY_SET + i]); |
344 | if (ret < 0) |
345 | goto err; |
346 | } |
347 | /* Now we can safely update them. */ |
348 | for (i = 0; i < helper->expect_class_max + 1; i++) { |
349 | policy = (struct nf_conntrack_expect_policy *) |
350 | &helper->expect_policy[i]; |
351 | policy->max_expected = new_policy->max_expected; |
352 | policy->timeout = new_policy->timeout; |
353 | } |
354 | |
355 | err: |
356 | kfree(objp: new_policy); |
357 | return ret; |
358 | } |
359 | |
360 | static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper, |
361 | const struct nlattr *attr) |
362 | { |
363 | struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1]; |
364 | unsigned int class_max; |
365 | int err; |
366 | |
367 | err = nla_parse_nested_deprecated(tb, NFCTH_POLICY_SET_MAX, nla: attr, |
368 | policy: nfnl_cthelper_expect_policy_set, |
369 | NULL); |
370 | if (err < 0) |
371 | return err; |
372 | |
373 | if (!tb[NFCTH_POLICY_SET_NUM]) |
374 | return -EINVAL; |
375 | |
376 | class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); |
377 | if (helper->expect_class_max + 1 != class_max) |
378 | return -EBUSY; |
379 | |
380 | return nfnl_cthelper_update_policy_all(tb, helper); |
381 | } |
382 | |
383 | static int |
384 | nfnl_cthelper_update(const struct nlattr * const tb[], |
385 | struct nf_conntrack_helper *helper) |
386 | { |
387 | u32 size; |
388 | int ret; |
389 | |
390 | if (tb[NFCTH_PRIV_DATA_LEN]) { |
391 | size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); |
392 | if (size != helper->data_len) |
393 | return -EBUSY; |
394 | } |
395 | |
396 | if (tb[NFCTH_POLICY]) { |
397 | ret = nfnl_cthelper_update_policy(helper, attr: tb[NFCTH_POLICY]); |
398 | if (ret < 0) |
399 | return ret; |
400 | } |
401 | if (tb[NFCTH_QUEUE_NUM]) |
402 | helper->queue_num = ntohl(nla_get_be32(tb[NFCTH_QUEUE_NUM])); |
403 | |
404 | if (tb[NFCTH_STATUS]) { |
405 | int status = ntohl(nla_get_be32(tb[NFCTH_STATUS])); |
406 | |
407 | switch(status) { |
408 | case NFCT_HELPER_STATUS_ENABLED: |
409 | helper->flags |= NF_CT_HELPER_F_CONFIGURED; |
410 | break; |
411 | case NFCT_HELPER_STATUS_DISABLED: |
412 | helper->flags &= ~NF_CT_HELPER_F_CONFIGURED; |
413 | break; |
414 | } |
415 | } |
416 | return 0; |
417 | } |
418 | |
419 | static int nfnl_cthelper_new(struct sk_buff *skb, const struct nfnl_info *info, |
420 | const struct nlattr * const tb[]) |
421 | { |
422 | const char *helper_name; |
423 | struct nf_conntrack_helper *cur, *helper = NULL; |
424 | struct nf_conntrack_tuple tuple; |
425 | struct nfnl_cthelper *nlcth; |
426 | int ret = 0; |
427 | |
428 | if (!capable(CAP_NET_ADMIN)) |
429 | return -EPERM; |
430 | |
431 | if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE]) |
432 | return -EINVAL; |
433 | |
434 | helper_name = nla_data(nla: tb[NFCTH_NAME]); |
435 | |
436 | ret = nfnl_cthelper_parse_tuple(tuple: &tuple, attr: tb[NFCTH_TUPLE]); |
437 | if (ret < 0) |
438 | return ret; |
439 | |
440 | list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { |
441 | cur = &nlcth->helper; |
442 | |
443 | if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) |
444 | continue; |
445 | |
446 | if ((tuple.src.l3num != cur->tuple.src.l3num || |
447 | tuple.dst.protonum != cur->tuple.dst.protonum)) |
448 | continue; |
449 | |
450 | if (info->nlh->nlmsg_flags & NLM_F_EXCL) |
451 | return -EEXIST; |
452 | |
453 | helper = cur; |
454 | break; |
455 | } |
456 | |
457 | if (helper == NULL) |
458 | ret = nfnl_cthelper_create(tb, tuple: &tuple); |
459 | else |
460 | ret = nfnl_cthelper_update(tb, helper); |
461 | |
462 | return ret; |
463 | } |
464 | |
465 | static int |
466 | nfnl_cthelper_dump_tuple(struct sk_buff *skb, |
467 | struct nf_conntrack_helper *helper) |
468 | { |
469 | struct nlattr *nest_parms; |
470 | |
471 | nest_parms = nla_nest_start(skb, attrtype: NFCTH_TUPLE); |
472 | if (nest_parms == NULL) |
473 | goto nla_put_failure; |
474 | |
475 | if (nla_put_be16(skb, attrtype: NFCTH_TUPLE_L3PROTONUM, |
476 | htons(helper->tuple.src.l3num))) |
477 | goto nla_put_failure; |
478 | |
479 | if (nla_put_u8(skb, attrtype: NFCTH_TUPLE_L4PROTONUM, value: helper->tuple.dst.protonum)) |
480 | goto nla_put_failure; |
481 | |
482 | nla_nest_end(skb, start: nest_parms); |
483 | return 0; |
484 | |
485 | nla_put_failure: |
486 | return -1; |
487 | } |
488 | |
489 | static int |
490 | nfnl_cthelper_dump_policy(struct sk_buff *skb, |
491 | struct nf_conntrack_helper *helper) |
492 | { |
493 | int i; |
494 | struct nlattr *nest_parms1, *nest_parms2; |
495 | |
496 | nest_parms1 = nla_nest_start(skb, attrtype: NFCTH_POLICY); |
497 | if (nest_parms1 == NULL) |
498 | goto nla_put_failure; |
499 | |
500 | if (nla_put_be32(skb, attrtype: NFCTH_POLICY_SET_NUM, |
501 | htonl(helper->expect_class_max + 1))) |
502 | goto nla_put_failure; |
503 | |
504 | for (i = 0; i < helper->expect_class_max + 1; i++) { |
505 | nest_parms2 = nla_nest_start(skb, attrtype: (NFCTH_POLICY_SET + i)); |
506 | if (nest_parms2 == NULL) |
507 | goto nla_put_failure; |
508 | |
509 | if (nla_put_string(skb, attrtype: NFCTH_POLICY_NAME, |
510 | str: helper->expect_policy[i].name)) |
511 | goto nla_put_failure; |
512 | |
513 | if (nla_put_be32(skb, attrtype: NFCTH_POLICY_EXPECT_MAX, |
514 | htonl(helper->expect_policy[i].max_expected))) |
515 | goto nla_put_failure; |
516 | |
517 | if (nla_put_be32(skb, attrtype: NFCTH_POLICY_EXPECT_TIMEOUT, |
518 | htonl(helper->expect_policy[i].timeout))) |
519 | goto nla_put_failure; |
520 | |
521 | nla_nest_end(skb, start: nest_parms2); |
522 | } |
523 | nla_nest_end(skb, start: nest_parms1); |
524 | return 0; |
525 | |
526 | nla_put_failure: |
527 | return -1; |
528 | } |
529 | |
530 | static int |
531 | nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, |
532 | int event, struct nf_conntrack_helper *helper) |
533 | { |
534 | struct nlmsghdr *nlh; |
535 | unsigned int flags = portid ? NLM_F_MULTI : 0; |
536 | int status; |
537 | |
538 | event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, msg_type: event); |
539 | nlh = nfnl_msg_put(skb, portid, seq, type: event, flags, AF_UNSPEC, |
540 | NFNETLINK_V0, res_id: 0); |
541 | if (!nlh) |
542 | goto nlmsg_failure; |
543 | |
544 | if (nla_put_string(skb, attrtype: NFCTH_NAME, str: helper->name)) |
545 | goto nla_put_failure; |
546 | |
547 | if (nla_put_be32(skb, attrtype: NFCTH_QUEUE_NUM, htonl(helper->queue_num))) |
548 | goto nla_put_failure; |
549 | |
550 | if (nfnl_cthelper_dump_tuple(skb, helper) < 0) |
551 | goto nla_put_failure; |
552 | |
553 | if (nfnl_cthelper_dump_policy(skb, helper) < 0) |
554 | goto nla_put_failure; |
555 | |
556 | if (nla_put_be32(skb, attrtype: NFCTH_PRIV_DATA_LEN, htonl(helper->data_len))) |
557 | goto nla_put_failure; |
558 | |
559 | if (helper->flags & NF_CT_HELPER_F_CONFIGURED) |
560 | status = NFCT_HELPER_STATUS_ENABLED; |
561 | else |
562 | status = NFCT_HELPER_STATUS_DISABLED; |
563 | |
564 | if (nla_put_be32(skb, attrtype: NFCTH_STATUS, htonl(status))) |
565 | goto nla_put_failure; |
566 | |
567 | nlmsg_end(skb, nlh); |
568 | return skb->len; |
569 | |
570 | nlmsg_failure: |
571 | nla_put_failure: |
572 | nlmsg_cancel(skb, nlh); |
573 | return -1; |
574 | } |
575 | |
576 | static int |
577 | nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) |
578 | { |
579 | struct nf_conntrack_helper *cur, *last; |
580 | |
581 | rcu_read_lock(); |
582 | last = (struct nf_conntrack_helper *)cb->args[1]; |
583 | for (; cb->args[0] < nf_ct_helper_hsize; cb->args[0]++) { |
584 | restart: |
585 | hlist_for_each_entry_rcu(cur, |
586 | &nf_ct_helper_hash[cb->args[0]], hnode) { |
587 | |
588 | /* skip non-userspace conntrack helpers. */ |
589 | if (!(cur->flags & NF_CT_HELPER_F_USERSPACE)) |
590 | continue; |
591 | |
592 | if (cb->args[1]) { |
593 | if (cur != last) |
594 | continue; |
595 | cb->args[1] = 0; |
596 | } |
597 | if (nfnl_cthelper_fill_info(skb, |
598 | NETLINK_CB(cb->skb).portid, |
599 | seq: cb->nlh->nlmsg_seq, |
600 | NFNL_MSG_TYPE(cb->nlh->nlmsg_type), |
601 | event: NFNL_MSG_CTHELPER_NEW, helper: cur) < 0) { |
602 | cb->args[1] = (unsigned long)cur; |
603 | goto out; |
604 | } |
605 | } |
606 | } |
607 | if (cb->args[1]) { |
608 | cb->args[1] = 0; |
609 | goto restart; |
610 | } |
611 | out: |
612 | rcu_read_unlock(); |
613 | return skb->len; |
614 | } |
615 | |
616 | static int nfnl_cthelper_get(struct sk_buff *skb, const struct nfnl_info *info, |
617 | const struct nlattr * const tb[]) |
618 | { |
619 | int ret = -ENOENT; |
620 | struct nf_conntrack_helper *cur; |
621 | struct sk_buff *skb2; |
622 | char *helper_name = NULL; |
623 | struct nf_conntrack_tuple tuple; |
624 | struct nfnl_cthelper *nlcth; |
625 | bool tuple_set = false; |
626 | |
627 | if (!capable(CAP_NET_ADMIN)) |
628 | return -EPERM; |
629 | |
630 | if (info->nlh->nlmsg_flags & NLM_F_DUMP) { |
631 | struct netlink_dump_control c = { |
632 | .dump = nfnl_cthelper_dump_table, |
633 | }; |
634 | return netlink_dump_start(ssk: info->sk, skb, nlh: info->nlh, control: &c); |
635 | } |
636 | |
637 | if (tb[NFCTH_NAME]) |
638 | helper_name = nla_data(nla: tb[NFCTH_NAME]); |
639 | |
640 | if (tb[NFCTH_TUPLE]) { |
641 | ret = nfnl_cthelper_parse_tuple(tuple: &tuple, attr: tb[NFCTH_TUPLE]); |
642 | if (ret < 0) |
643 | return ret; |
644 | |
645 | tuple_set = true; |
646 | } |
647 | |
648 | list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { |
649 | cur = &nlcth->helper; |
650 | if (helper_name && |
651 | strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) |
652 | continue; |
653 | |
654 | if (tuple_set && |
655 | (tuple.src.l3num != cur->tuple.src.l3num || |
656 | tuple.dst.protonum != cur->tuple.dst.protonum)) |
657 | continue; |
658 | |
659 | skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
660 | if (skb2 == NULL) { |
661 | ret = -ENOMEM; |
662 | break; |
663 | } |
664 | |
665 | ret = nfnl_cthelper_fill_info(skb: skb2, NETLINK_CB(skb).portid, |
666 | seq: info->nlh->nlmsg_seq, |
667 | NFNL_MSG_TYPE(info->nlh->nlmsg_type), |
668 | event: NFNL_MSG_CTHELPER_NEW, helper: cur); |
669 | if (ret <= 0) { |
670 | kfree_skb(skb: skb2); |
671 | break; |
672 | } |
673 | |
674 | ret = nfnetlink_unicast(skb: skb2, net: info->net, NETLINK_CB(skb).portid); |
675 | break; |
676 | } |
677 | |
678 | return ret; |
679 | } |
680 | |
681 | static int nfnl_cthelper_del(struct sk_buff *skb, const struct nfnl_info *info, |
682 | const struct nlattr * const tb[]) |
683 | { |
684 | char *helper_name = NULL; |
685 | struct nf_conntrack_helper *cur; |
686 | struct nf_conntrack_tuple tuple; |
687 | bool tuple_set = false, found = false; |
688 | struct nfnl_cthelper *nlcth, *n; |
689 | int j = 0, ret; |
690 | |
691 | if (!capable(CAP_NET_ADMIN)) |
692 | return -EPERM; |
693 | |
694 | if (tb[NFCTH_NAME]) |
695 | helper_name = nla_data(nla: tb[NFCTH_NAME]); |
696 | |
697 | if (tb[NFCTH_TUPLE]) { |
698 | ret = nfnl_cthelper_parse_tuple(tuple: &tuple, attr: tb[NFCTH_TUPLE]); |
699 | if (ret < 0) |
700 | return ret; |
701 | |
702 | tuple_set = true; |
703 | } |
704 | |
705 | ret = -ENOENT; |
706 | list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { |
707 | cur = &nlcth->helper; |
708 | j++; |
709 | |
710 | if (helper_name && |
711 | strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) |
712 | continue; |
713 | |
714 | if (tuple_set && |
715 | (tuple.src.l3num != cur->tuple.src.l3num || |
716 | tuple.dst.protonum != cur->tuple.dst.protonum)) |
717 | continue; |
718 | |
719 | if (refcount_dec_if_one(r: &cur->refcnt)) { |
720 | found = true; |
721 | nf_conntrack_helper_unregister(cur); |
722 | kfree(objp: cur->expect_policy); |
723 | |
724 | list_del(entry: &nlcth->list); |
725 | kfree(objp: nlcth); |
726 | } else { |
727 | ret = -EBUSY; |
728 | } |
729 | } |
730 | |
731 | /* Make sure we return success if we flush and there is no helpers */ |
732 | return (found || j == 0) ? 0 : ret; |
733 | } |
734 | |
735 | static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = { |
736 | [NFCTH_NAME] = { .type = NLA_NUL_STRING, |
737 | .len = NF_CT_HELPER_NAME_LEN-1 }, |
738 | [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, |
739 | [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, }, |
740 | [NFCTH_STATUS] = { .type = NLA_U32, }, |
741 | }; |
742 | |
743 | static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = { |
744 | [NFNL_MSG_CTHELPER_NEW] = { |
745 | .call = nfnl_cthelper_new, |
746 | .type = NFNL_CB_MUTEX, |
747 | .attr_count = NFCTH_MAX, |
748 | .policy = nfnl_cthelper_policy |
749 | }, |
750 | [NFNL_MSG_CTHELPER_GET] = { |
751 | .call = nfnl_cthelper_get, |
752 | .type = NFNL_CB_MUTEX, |
753 | .attr_count = NFCTH_MAX, |
754 | .policy = nfnl_cthelper_policy |
755 | }, |
756 | [NFNL_MSG_CTHELPER_DEL] = { |
757 | .call = nfnl_cthelper_del, |
758 | .type = NFNL_CB_MUTEX, |
759 | .attr_count = NFCTH_MAX, |
760 | .policy = nfnl_cthelper_policy |
761 | }, |
762 | }; |
763 | |
764 | static const struct nfnetlink_subsystem nfnl_cthelper_subsys = { |
765 | .name = "cthelper" , |
766 | .subsys_id = NFNL_SUBSYS_CTHELPER, |
767 | .cb_count = NFNL_MSG_CTHELPER_MAX, |
768 | .cb = nfnl_cthelper_cb, |
769 | }; |
770 | |
771 | MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER); |
772 | |
773 | static int __init nfnl_cthelper_init(void) |
774 | { |
775 | int ret; |
776 | |
777 | ret = nfnetlink_subsys_register(n: &nfnl_cthelper_subsys); |
778 | if (ret < 0) { |
779 | pr_err("nfnl_cthelper: cannot register with nfnetlink.\n" ); |
780 | goto err_out; |
781 | } |
782 | return 0; |
783 | err_out: |
784 | return ret; |
785 | } |
786 | |
787 | static void __exit nfnl_cthelper_exit(void) |
788 | { |
789 | struct nf_conntrack_helper *cur; |
790 | struct nfnl_cthelper *nlcth, *n; |
791 | |
792 | nfnetlink_subsys_unregister(n: &nfnl_cthelper_subsys); |
793 | |
794 | list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { |
795 | cur = &nlcth->helper; |
796 | |
797 | nf_conntrack_helper_unregister(cur); |
798 | kfree(objp: cur->expect_policy); |
799 | kfree(objp: nlcth); |
800 | } |
801 | } |
802 | |
803 | module_init(nfnl_cthelper_init); |
804 | module_exit(nfnl_cthelper_exit); |
805 | |