Doug / smarc-fsl-linux-kernel

1

/* Connection tracking via netlink socket. Allows for user space

1

/* Connection tracking via netlink socket. Allows for user space

2

* protocol helpers and general trouble making from userspace.

2

* protocol helpers and general trouble making from userspace.

3

*

3

*

4

5

6

7

8

*

8

*

9

* Initial connection tracking via netlink development funded and

9

* Initial connection tracking via netlink development funded and

10

* generally made possible by Network Robots, Inc. (www.networkrobots.com)

10

* generally made possible by Network Robots, Inc. (www.networkrobots.com)

11

*

11

*

12

* Further development of this code funded by Astaro AG (http://www.astaro.com)

12

* Further development of this code funded by Astaro AG (http://www.astaro.com)

13

*

13

*

14

* This software may be used and distributed according to the terms

14

* This software may be used and distributed according to the terms

15

* of the GNU General Public License, incorporated herein by reference.

15

* of the GNU General Public License, incorporated herein by reference.

16

*/

16

*/

17

18

#include <linux/init.h>

18

#include <linux/init.h>

19

#include <linux/module.h>

19

#include <linux/module.h>

20

#include <linux/kernel.h>

20

#include <linux/kernel.h>

21

#include <linux/rculist.h>

21

#include <linux/rculist.h>

22

#include <linux/rculist_nulls.h>

22

#include <linux/rculist_nulls.h>

23

#include <linux/types.h>

23

#include <linux/types.h>

24

#include <linux/timer.h>

24

#include <linux/timer.h>

25

#include <linux/security.h>

25

#include <linux/security.h>

26

#include <linux/skbuff.h>

26

#include <linux/skbuff.h>

27

#include <linux/errno.h>

27

#include <linux/errno.h>

28

#include <linux/netlink.h>

28

#include <linux/netlink.h>

29

#include <linux/spinlock.h>

29

#include <linux/spinlock.h>

30

#include <linux/interrupt.h>

30

#include <linux/interrupt.h>

31

#include <linux/slab.h>

31

#include <linux/slab.h>

32

33

#include <linux/netfilter.h>

33

#include <linux/netfilter.h>

34

#include <net/netlink.h>

34

#include <net/netlink.h>

35

#include <net/sock.h>

35

#include <net/sock.h>

36

#include <net/netfilter/nf_conntrack.h>

36

#include <net/netfilter/nf_conntrack.h>

37

#include <net/netfilter/nf_conntrack_core.h>

37

#include <net/netfilter/nf_conntrack_core.h>

38

#include <net/netfilter/nf_conntrack_expect.h>

38

#include <net/netfilter/nf_conntrack_expect.h>

39

#include <net/netfilter/nf_conntrack_helper.h>

39

#include <net/netfilter/nf_conntrack_helper.h>

40

#include <net/netfilter/nf_conntrack_seqadj.h>

40

#include <net/netfilter/nf_conntrack_seqadj.h>

41

#include <net/netfilter/nf_conntrack_l3proto.h>

41

#include <net/netfilter/nf_conntrack_l3proto.h>

42

#include <net/netfilter/nf_conntrack_l4proto.h>

42

#include <net/netfilter/nf_conntrack_l4proto.h>

43

#include <net/netfilter/nf_conntrack_tuple.h>

43

#include <net/netfilter/nf_conntrack_tuple.h>

44

#include <net/netfilter/nf_conntrack_acct.h>

44

#include <net/netfilter/nf_conntrack_acct.h>

45

#include <net/netfilter/nf_conntrack_zones.h>

45

#include <net/netfilter/nf_conntrack_zones.h>

46

#include <net/netfilter/nf_conntrack_timestamp.h>

46

#include <net/netfilter/nf_conntrack_timestamp.h>

47

#include <net/netfilter/nf_conntrack_labels.h>

47

#include <net/netfilter/nf_conntrack_labels.h>

48

#ifdef CONFIG_NF_NAT_NEEDED

48

#ifdef CONFIG_NF_NAT_NEEDED

49

#include <net/netfilter/nf_nat_core.h>

49

#include <net/netfilter/nf_nat_core.h>

50

#include <net/netfilter/nf_nat_l4proto.h>

50

#include <net/netfilter/nf_nat_l4proto.h>

51

#include <net/netfilter/nf_nat_helper.h>

51

#include <net/netfilter/nf_nat_helper.h>

52

#endif

52

#endif

53

54

#include <linux/netfilter/nfnetlink.h>

54

#include <linux/netfilter/nfnetlink.h>

55

#include <linux/netfilter/nfnetlink_conntrack.h>

55

#include <linux/netfilter/nfnetlink_conntrack.h>

56

57

MODULE_LICENSE("GPL");

57

MODULE_LICENSE("GPL");

58

59

static char __initdata version[] = "0.93";

59

static char __initdata version[] = "0.93";

60

61

static inline int

61

static inline int

62

ctnetlink_dump_tuples_proto(struct sk_buff *skb,

62

ctnetlink_dump_tuples_proto(struct sk_buff *skb,

63

const struct nf_conntrack_tuple *tuple,

63

const struct nf_conntrack_tuple *tuple,

64

struct nf_conntrack_l4proto *l4proto)

64

struct nf_conntrack_l4proto *l4proto)

65

{

65

{

66

int ret = 0;

66

int ret = 0;

67

struct nlattr *nest_parms;

67

struct nlattr *nest_parms;

68

69

nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);

69

nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);

70

if (!nest_parms)

70

if (!nest_parms)

71

goto nla_put_failure;

71

goto nla_put_failure;

72

if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum))

72

if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum))

73

goto nla_put_failure;

73

goto nla_put_failure;

74

75

if (likely(l4proto->tuple_to_nlattr))

75

if (likely(l4proto->tuple_to_nlattr))

76

ret = l4proto->tuple_to_nlattr(skb, tuple);

76

ret = l4proto->tuple_to_nlattr(skb, tuple);

77

78

nla_nest_end(skb, nest_parms);

78

nla_nest_end(skb, nest_parms);

79

80

return ret;

80

return ret;

81

82

nla_put_failure:

82

nla_put_failure:

83

return -1;

83

return -1;

84

}

84

}

85

86

static inline int

86

static inline int

87

ctnetlink_dump_tuples_ip(struct sk_buff *skb,

87

ctnetlink_dump_tuples_ip(struct sk_buff *skb,

88

const struct nf_conntrack_tuple *tuple,

88

const struct nf_conntrack_tuple *tuple,

89

struct nf_conntrack_l3proto *l3proto)

89

struct nf_conntrack_l3proto *l3proto)

90

{

90

{

91

int ret = 0;

91

int ret = 0;

92

struct nlattr *nest_parms;

92

struct nlattr *nest_parms;

93

94

nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);

94

nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);

95

if (!nest_parms)

95

if (!nest_parms)

96

goto nla_put_failure;

96

goto nla_put_failure;

97

98

if (likely(l3proto->tuple_to_nlattr))

98

if (likely(l3proto->tuple_to_nlattr))

99

ret = l3proto->tuple_to_nlattr(skb, tuple);

99

ret = l3proto->tuple_to_nlattr(skb, tuple);

100

101

nla_nest_end(skb, nest_parms);

101

nla_nest_end(skb, nest_parms);

102

103

return ret;

103

return ret;

104

105

nla_put_failure:

105

nla_put_failure:

106

return -1;

106

return -1;

107

}

107

}

108

109

static int

109

static int

110

ctnetlink_dump_tuples(struct sk_buff *skb,

110

ctnetlink_dump_tuples(struct sk_buff *skb,

111

const struct nf_conntrack_tuple *tuple)

111

const struct nf_conntrack_tuple *tuple)

112

{

112

{

113

int ret;

113

int ret;

114

struct nf_conntrack_l3proto *l3proto;

114

struct nf_conntrack_l3proto *l3proto;

115

struct nf_conntrack_l4proto *l4proto;

115

struct nf_conntrack_l4proto *l4proto;

116

117

rcu_read_lock();

117

rcu_read_lock();

118

l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

118

l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

119

ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);

119

ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);

120

121

if (ret >= 0) {

121

if (ret >= 0) {

122

l4proto = __nf_ct_l4proto_find(tuple->src.l3num,

122

l4proto = __nf_ct_l4proto_find(tuple->src.l3num,

123

tuple->dst.protonum);

123

tuple->dst.protonum);

124

ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);

124

ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);

125

}

125

}

126

rcu_read_unlock();

126

rcu_read_unlock();

127

return ret;

127

return ret;

128

}

128

}

129

130

static inline int

130

static inline int

131

ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)

131

ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)

132

{

132

{

133

if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status)))

133

if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status)))

134

goto nla_put_failure;

134

goto nla_put_failure;

135

return 0;

135

return 0;

136

137

nla_put_failure:

137

nla_put_failure:

138

return -1;

138

return -1;

139

}

139

}

140

141

static inline int

141

static inline int

142

ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)

142

ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)

143

{

143

{

144

long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;

144

long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;

145

146

if (timeout < 0)

146

if (timeout < 0)

147

timeout = 0;

147

timeout = 0;

148

149

if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout)))

149

if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout)))

150

goto nla_put_failure;

150

goto nla_put_failure;

151

return 0;

151

return 0;

152

153

nla_put_failure:

153

nla_put_failure:

154

return -1;

154

return -1;

155

}

155

}

156

157

static inline int

157

static inline int

158

ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct)

158

ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct)

159

{

159

{

160

struct nf_conntrack_l4proto *l4proto;

160

struct nf_conntrack_l4proto *l4proto;

161

struct nlattr *nest_proto;

161

struct nlattr *nest_proto;

162

int ret;

162

int ret;

163

164

l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));

164

l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));

165

if (!l4proto->to_nlattr)

165

if (!l4proto->to_nlattr)

166

return 0;

166

return 0;

167

168

nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);

168

nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);

169

if (!nest_proto)

169

if (!nest_proto)

170

goto nla_put_failure;

170

goto nla_put_failure;

171

172

ret = l4proto->to_nlattr(skb, nest_proto, ct);

172

ret = l4proto->to_nlattr(skb, nest_proto, ct);

173

174

nla_nest_end(skb, nest_proto);

174

nla_nest_end(skb, nest_proto);

175

176

return ret;

176

return ret;

177

178

nla_put_failure:

178

nla_put_failure:

179

return -1;

179

return -1;

180

}

180

}

181

182

static inline int

182

static inline int

183

ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)

183

ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)

184

{

184

{

185

struct nlattr *nest_helper;

185

struct nlattr *nest_helper;

186

const struct nf_conn_help *help = nfct_help(ct);

186

const struct nf_conn_help *help = nfct_help(ct);

187

struct nf_conntrack_helper *helper;

187

struct nf_conntrack_helper *helper;

188

189

if (!help)

189

if (!help)

190

return 0;

190

return 0;

191

192

helper = rcu_dereference(help->helper);

192

helper = rcu_dereference(help->helper);

193

if (!helper)

193

if (!helper)

194

goto out;

194

goto out;

195

196

nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);

196

nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);

197

if (!nest_helper)

197

if (!nest_helper)

198

goto nla_put_failure;

198

goto nla_put_failure;

199

if (nla_put_string(skb, CTA_HELP_NAME, helper->name))

199

if (nla_put_string(skb, CTA_HELP_NAME, helper->name))

200

goto nla_put_failure;

200

goto nla_put_failure;

201

202

if (helper->to_nlattr)

202

if (helper->to_nlattr)

203

helper->to_nlattr(skb, ct);

203

helper->to_nlattr(skb, ct);

204

205

nla_nest_end(skb, nest_helper);

205

nla_nest_end(skb, nest_helper);

206

out:

206

out:

207

return 0;

207

return 0;

208

209

nla_put_failure:

209

nla_put_failure:

210

return -1;

210

return -1;

211

}

211

}

212

213

static int

213

static int

214

dump_counters(struct sk_buff *skb, struct nf_conn_acct *acct,

214

dump_counters(struct sk_buff *skb, struct nf_conn_acct *acct,

215

enum ip_conntrack_dir dir, int type)

215

enum ip_conntrack_dir dir, int type)

216

{

216

{

217

enum ctattr_type attr = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;

217

enum ctattr_type attr = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;

218

struct nf_conn_counter *counter = acct->counter;

218

struct nf_conn_counter *counter = acct->counter;

219

struct nlattr *nest_count;

219

struct nlattr *nest_count;

220

u64 pkts, bytes;

220

u64 pkts, bytes;

221

222

if (type == IPCTNL_MSG_CT_GET_CTRZERO) {

222

if (type == IPCTNL_MSG_CT_GET_CTRZERO) {

223

pkts = atomic64_xchg(&counter[dir].packets, 0);

223

pkts = atomic64_xchg(&counter[dir].packets, 0);

224

bytes = atomic64_xchg(&counter[dir].bytes, 0);

224

bytes = atomic64_xchg(&counter[dir].bytes, 0);

225

} else {

225

} else {

226

pkts = atomic64_read(&counter[dir].packets);

226

pkts = atomic64_read(&counter[dir].packets);

227

bytes = atomic64_read(&counter[dir].bytes);

227

bytes = atomic64_read(&counter[dir].bytes);

228

}

228

}

229

230

nest_count = nla_nest_start(skb, attr | NLA_F_NESTED);

230

nest_count = nla_nest_start(skb, attr | NLA_F_NESTED);

231

if (!nest_count)

231

if (!nest_count)

232

goto nla_put_failure;

232

goto nla_put_failure;

233

234

if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts)) ||

234

if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts)) ||

235

nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes)))

235

nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes)))

236

goto nla_put_failure;

236

goto nla_put_failure;

237

238

nla_nest_end(skb, nest_count);

238

nla_nest_end(skb, nest_count);

239

240

return 0;

240

return 0;

241

242

nla_put_failure:

242

nla_put_failure:

243

return -1;

243

return -1;

244

}

244

}

245

246

static int

246

static int

247

ctnetlink_dump_acct(struct sk_buff *skb, const struct nf_conn *ct, int type)

247

ctnetlink_dump_acct(struct sk_buff *skb, const struct nf_conn *ct, int type)

248

{

248

{

249

struct nf_conn_acct *acct = nf_conn_acct_find(ct);

249

struct nf_conn_acct *acct = nf_conn_acct_find(ct);

250

251

if (!acct)

251

if (!acct)

252

return 0;

252

return 0;

253

254

if (dump_counters(skb, acct, IP_CT_DIR_ORIGINAL, type) < 0)

254

if (dump_counters(skb, acct, IP_CT_DIR_ORIGINAL, type) < 0)

255

return -1;

255

return -1;

256

if (dump_counters(skb, acct, IP_CT_DIR_REPLY, type) < 0)

256

if (dump_counters(skb, acct, IP_CT_DIR_REPLY, type) < 0)

257

return -1;

257

return -1;

258

259

return 0;

259

return 0;

260

}

260

}

261

262

static int

262

static int

263

ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)

263

ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)

264

{

264

{

265

struct nlattr *nest_count;

265

struct nlattr *nest_count;

266

const struct nf_conn_tstamp *tstamp;

266

const struct nf_conn_tstamp *tstamp;

267

268

tstamp = nf_conn_tstamp_find(ct);

268

tstamp = nf_conn_tstamp_find(ct);

269

if (!tstamp)

269

if (!tstamp)

270

return 0;

270

return 0;

271

272

nest_count = nla_nest_start(skb, CTA_TIMESTAMP | NLA_F_NESTED);

272

nest_count = nla_nest_start(skb, CTA_TIMESTAMP | NLA_F_NESTED);

273

if (!nest_count)

273

if (!nest_count)

274

goto nla_put_failure;

274

goto nla_put_failure;

275

276

if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start)) ||

276

if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start)) ||

277

(tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP,

277

(tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP,

278

cpu_to_be64(tstamp->stop))))

278

cpu_to_be64(tstamp->stop))))

279

goto nla_put_failure;

279

goto nla_put_failure;

280

nla_nest_end(skb, nest_count);

280

nla_nest_end(skb, nest_count);

281

282

return 0;

282

return 0;

283

284

nla_put_failure:

284

nla_put_failure:

285

return -1;

285

return -1;

286

}

286

}

287

288

#ifdef CONFIG_NF_CONNTRACK_MARK

288

#ifdef CONFIG_NF_CONNTRACK_MARK

289

static inline int

289

static inline int

290

ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)

290

ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)

291

{

291

{

292

if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark)))

292

if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark)))

293

goto nla_put_failure;

293

goto nla_put_failure;

294

return 0;

294

return 0;

295

296

nla_put_failure:

296

nla_put_failure:

297

return -1;

297

return -1;

298

}

298

}

299

#else

299

#else

300

#define ctnetlink_dump_mark(a, b) (0)

300

#define ctnetlink_dump_mark(a, b) (0)

301

#endif

301

#endif

302

303

#ifdef CONFIG_NF_CONNTRACK_SECMARK

303

#ifdef CONFIG_NF_CONNTRACK_SECMARK

304

static inline int

304

static inline int

305

ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)

305

ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)

306

{

306

{

307

struct nlattr *nest_secctx;

307

struct nlattr *nest_secctx;

308

int len, ret;

308

int len, ret;

309

char *secctx;

309

char *secctx;

310

311

ret = security_secid_to_secctx(ct->secmark, &secctx, &len);

311

ret = security_secid_to_secctx(ct->secmark, &secctx, &len);

312

if (ret)

312

if (ret)

313

return 0;

313

return 0;

314

315

ret = -1;

315

ret = -1;

316

nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);

316

nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);

317

if (!nest_secctx)

317

if (!nest_secctx)

318

goto nla_put_failure;

318

goto nla_put_failure;

319

320

if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))

320

if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))

321

goto nla_put_failure;

321

goto nla_put_failure;

322

nla_nest_end(skb, nest_secctx);

322

nla_nest_end(skb, nest_secctx);

323

324

ret = 0;

324

ret = 0;

325

nla_put_failure:

325

nla_put_failure:

326

security_release_secctx(secctx, len);

326

security_release_secctx(secctx, len);

327

return ret;

327

return ret;

328

}

328

}

329

#else

329

#else

330

#define ctnetlink_dump_secctx(a, b) (0)

330

#define ctnetlink_dump_secctx(a, b) (0)

331

#endif

331

#endif

332

333

#ifdef CONFIG_NF_CONNTRACK_LABELS

333

#ifdef CONFIG_NF_CONNTRACK_LABELS

334

static int ctnetlink_label_size(const struct nf_conn *ct)

334

static int ctnetlink_label_size(const struct nf_conn *ct)

335

{

335

{

336

struct nf_conn_labels *labels = nf_ct_labels_find(ct);

336

struct nf_conn_labels *labels = nf_ct_labels_find(ct);

337

338

if (!labels)

338

if (!labels)

339

return 0;

339

return 0;

340

return nla_total_size(labels->words * sizeof(long));

340

return nla_total_size(labels->words * sizeof(long));

341

}

341

}

342

343

static int

343

static int

344

ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)

344

ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)

345

{

345

{

346

struct nf_conn_labels *labels = nf_ct_labels_find(ct);

346

struct nf_conn_labels *labels = nf_ct_labels_find(ct);

347

unsigned int len, i;

347

unsigned int len, i;

348

349

if (!labels)

349

if (!labels)

350

return 0;

350

return 0;

351

352

len = labels->words * sizeof(long);

352

len = labels->words * sizeof(long);

353

i = 0;

353

i = 0;

354

do {

354

do {

355

if (labels->bits[i] != 0)

355

if (labels->bits[i] != 0)

356

return nla_put(skb, CTA_LABELS, len, labels->bits);

356

return nla_put(skb, CTA_LABELS, len, labels->bits);

357

i++;

357

i++;

358

} while (i < labels->words);

358

} while (i < labels->words);

359

360

return 0;

360

return 0;

361

}

361

}

362

#else

362

#else

363

#define ctnetlink_dump_labels(a, b) (0)

363

#define ctnetlink_dump_labels(a, b) (0)

364

#define ctnetlink_label_size(a) (0)

364

#define ctnetlink_label_size(a) (0)

365

#endif

365

#endif

366

367

#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)

367

#define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)

368

369

static inline int

369

static inline int

370

ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)

370

ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)

371

{

371

{

372

struct nlattr *nest_parms;

372

struct nlattr *nest_parms;

373

374

if (!(ct->status & IPS_EXPECTED))

374

if (!(ct->status & IPS_EXPECTED))

375

return 0;

375

return 0;

376

377

nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);

377

nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);

378

if (!nest_parms)

378

if (!nest_parms)

379

goto nla_put_failure;

379

goto nla_put_failure;

380

if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)

380

if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)

381

goto nla_put_failure;

381

goto nla_put_failure;

382

nla_nest_end(skb, nest_parms);

382

nla_nest_end(skb, nest_parms);

383

384

return 0;

384

return 0;

385

386

nla_put_failure:

386

nla_put_failure:

387

return -1;

387

return -1;

388

}

388

}

389

390

static int

390

static int

391

dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type)

391

dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type)

392

{

392

{

393

struct nlattr *nest_parms;

393

struct nlattr *nest_parms;

394

395

nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);

395

nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);

396

if (!nest_parms)

396

if (!nest_parms)

397

goto nla_put_failure;

397

goto nla_put_failure;

398

399

if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS,

399

if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS,

400

htonl(seq->correction_pos)) ||

400

htonl(seq->correction_pos)) ||

401

nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE,

401

nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE,

402

htonl(seq->offset_before)) ||

402

htonl(seq->offset_before)) ||

403

nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER,

403

nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER,

404

htonl(seq->offset_after)))

404

htonl(seq->offset_after)))

405

goto nla_put_failure;

405

goto nla_put_failure;

406

407

nla_nest_end(skb, nest_parms);

407

nla_nest_end(skb, nest_parms);

408

409

return 0;

409

return 0;

410

411

nla_put_failure:

411

nla_put_failure:

412

return -1;

412

return -1;

413

}

413

}

414

415

static inline int

415

static inline int

416

ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)

416

ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)

417

{

417

{

418

struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);

418

struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);

419

struct nf_ct_seqadj *seq;

419

struct nf_ct_seqadj *seq;

420

421

if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj)

421

if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj)

422

return 0;

422

return 0;

423

424

seq = &seqadj->seq[IP_CT_DIR_ORIGINAL];

424

seq = &seqadj->seq[IP_CT_DIR_ORIGINAL];

425

if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1)

425

if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1)

426

return -1;

426

return -1;

427

428

seq = &seqadj->seq[IP_CT_DIR_REPLY];

428

seq = &seqadj->seq[IP_CT_DIR_REPLY];

429

if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1)

429

if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1)

430

return -1;

430

return -1;

431

432

return 0;

432

return 0;

433

}

433

}

434

435

static inline int

435

static inline int

436

ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)

436

ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)

437

{

437

{

438

if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))

438

if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))

439

goto nla_put_failure;

439

goto nla_put_failure;

440

return 0;

440

return 0;

441

442

nla_put_failure:

442

nla_put_failure:

443

return -1;

443

return -1;

444

}

444

}

445

446

static inline int

446

static inline int

447

ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)

447

ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)

448

{

448

{

449

if (nla_put_be32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use))))

449

if (nla_put_be32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use))))

450

goto nla_put_failure;

450

goto nla_put_failure;

451

return 0;

451

return 0;

452

453

nla_put_failure:

453

nla_put_failure:

454

return -1;

454

return -1;

455

}

455

}

456

457

static int

457

static int

458

ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,

458

ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,

459

struct nf_conn *ct)

459

struct nf_conn *ct)

460

{

460

{

461

struct nlmsghdr *nlh;

461

struct nlmsghdr *nlh;

462

struct nfgenmsg *nfmsg;

462

struct nfgenmsg *nfmsg;

463

struct nlattr *nest_parms;

463

struct nlattr *nest_parms;

464

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

464

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

465

466

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_NEW);

466

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_NEW);

467

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

467

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

468

if (nlh == NULL)

468

if (nlh == NULL)

469

goto nlmsg_failure;

469

goto nlmsg_failure;

470

471

nfmsg = nlmsg_data(nlh);

471

nfmsg = nlmsg_data(nlh);

472

nfmsg->nfgen_family = nf_ct_l3num(ct);

472

nfmsg->nfgen_family = nf_ct_l3num(ct);

473

nfmsg->version = NFNETLINK_V0;

473

nfmsg->version = NFNETLINK_V0;

474

nfmsg->res_id = 0;

474

nfmsg->res_id = 0;

475

476

nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);

476

nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);

477

if (!nest_parms)

477

if (!nest_parms)

478

goto nla_put_failure;

478

goto nla_put_failure;

479

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

479

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

480

goto nla_put_failure;

480

goto nla_put_failure;

481

nla_nest_end(skb, nest_parms);

481

nla_nest_end(skb, nest_parms);

482

483

nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);

483

nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);

484

if (!nest_parms)

484

if (!nest_parms)

485

goto nla_put_failure;

485

goto nla_put_failure;

486

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

486

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

487

goto nla_put_failure;

487

goto nla_put_failure;

488

nla_nest_end(skb, nest_parms);

488

nla_nest_end(skb, nest_parms);

489

490

if (nf_ct_zone(ct) &&

490

if (nf_ct_zone(ct) &&

491

nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))

491

nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))

492

goto nla_put_failure;

492

goto nla_put_failure;

493

494

if (ctnetlink_dump_status(skb, ct) < 0 ||

494

if (ctnetlink_dump_status(skb, ct) < 0 ||

495

ctnetlink_dump_timeout(skb, ct) < 0 ||

495

ctnetlink_dump_timeout(skb, ct) < 0 ||

496

ctnetlink_dump_acct(skb, ct, type) < 0 ||

496

ctnetlink_dump_acct(skb, ct, type) < 0 ||

497

ctnetlink_dump_timestamp(skb, ct) < 0 ||

497

ctnetlink_dump_timestamp(skb, ct) < 0 ||

498

ctnetlink_dump_protoinfo(skb, ct) < 0 ||

498

ctnetlink_dump_protoinfo(skb, ct) < 0 ||

499

ctnetlink_dump_helpinfo(skb, ct) < 0 ||

499

ctnetlink_dump_helpinfo(skb, ct) < 0 ||

500

ctnetlink_dump_mark(skb, ct) < 0 ||

500

ctnetlink_dump_mark(skb, ct) < 0 ||

501

ctnetlink_dump_secctx(skb, ct) < 0 ||

501

ctnetlink_dump_secctx(skb, ct) < 0 ||

502

ctnetlink_dump_labels(skb, ct) < 0 ||

502

ctnetlink_dump_labels(skb, ct) < 0 ||

503

ctnetlink_dump_id(skb, ct) < 0 ||

503

ctnetlink_dump_id(skb, ct) < 0 ||

504

ctnetlink_dump_use(skb, ct) < 0 ||

504

ctnetlink_dump_use(skb, ct) < 0 ||

505

ctnetlink_dump_master(skb, ct) < 0 ||

505

ctnetlink_dump_master(skb, ct) < 0 ||

506

ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

506

ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

507

goto nla_put_failure;

507

goto nla_put_failure;

508

509

nlmsg_end(skb, nlh);

509

nlmsg_end(skb, nlh);

510

return skb->len;

510

return skb->len;

511

512

nlmsg_failure:

512

nlmsg_failure:

513

nla_put_failure:

513

nla_put_failure:

514

nlmsg_cancel(skb, nlh);

514

nlmsg_cancel(skb, nlh);

515

return -1;

515

return -1;

516

}

516

}

517

518

static inline size_t

518

static inline size_t

519

ctnetlink_proto_size(const struct nf_conn *ct)

519

ctnetlink_proto_size(const struct nf_conn *ct)

520

{

520

{

521

struct nf_conntrack_l3proto *l3proto;

521

struct nf_conntrack_l3proto *l3proto;

522

struct nf_conntrack_l4proto *l4proto;

522

struct nf_conntrack_l4proto *l4proto;

523

size_t len = 0;

523

size_t len = 0;

524

525

rcu_read_lock();

525

rcu_read_lock();

526

l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));

526

l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));

527

len += l3proto->nla_size;

527

len += l3proto->nla_size;

528

529

l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));

529

l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));

530

len += l4proto->nla_size;

530

len += l4proto->nla_size;

531

rcu_read_unlock();

531

rcu_read_unlock();

532

533

return len;

533

return len;

534

}

534

}

535

536

static inline size_t

536

static inline size_t

537

ctnetlink_acct_size(const struct nf_conn *ct)

537

ctnetlink_acct_size(const struct nf_conn *ct)

538

{

538

{

539

if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT))

539

if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT))

540

return 0;

540

return 0;

541

return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */

541

return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */

542

+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */

542

+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */

543

+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */

543

+ 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */

544

;

544

;

545

}

545

}

546

547

static inline int

547

static inline int

548

ctnetlink_secctx_size(const struct nf_conn *ct)

548

ctnetlink_secctx_size(const struct nf_conn *ct)

549

{

549

{

550

#ifdef CONFIG_NF_CONNTRACK_SECMARK

550

#ifdef CONFIG_NF_CONNTRACK_SECMARK

551

int len, ret;

551

int len, ret;

552

553

ret = security_secid_to_secctx(ct->secmark, NULL, &len);

553

ret = security_secid_to_secctx(ct->secmark, NULL, &len);

554

if (ret)

554

if (ret)

555

return 0;

555

return 0;

556

557

return nla_total_size(0) /* CTA_SECCTX */

557

return nla_total_size(0) /* CTA_SECCTX */

558

+ nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */

558

+ nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */

559

#else

559

#else

560

return 0;

560

return 0;

561

#endif

561

#endif

562

}

562

}

563

564

static inline size_t

564

static inline size_t

565

ctnetlink_timestamp_size(const struct nf_conn *ct)

565

ctnetlink_timestamp_size(const struct nf_conn *ct)

566

{

566

{

567

#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP

567

#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP

568

if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP))

568

if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP))

569

return 0;

569

return 0;

570

return nla_total_size(0) + 2 * nla_total_size(sizeof(uint64_t));

570

return nla_total_size(0) + 2 * nla_total_size(sizeof(uint64_t));

571

#else

571

#else

572

return 0;

572

return 0;

573

#endif

573

#endif

574

}

574

}

575

576

static inline size_t

576

static inline size_t

577

ctnetlink_nlmsg_size(const struct nf_conn *ct)

577

ctnetlink_nlmsg_size(const struct nf_conn *ct)

578

{

578

{

579

return NLMSG_ALIGN(sizeof(struct nfgenmsg))

579

return NLMSG_ALIGN(sizeof(struct nfgenmsg))

580

+ 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */

580

+ 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */

581

+ 3 * nla_total_size(0) /* CTA_TUPLE_IP */

581

+ 3 * nla_total_size(0) /* CTA_TUPLE_IP */

582

+ 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */

582

+ 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */

583

+ 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */

583

+ 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */

584

+ nla_total_size(sizeof(u_int32_t)) /* CTA_ID */

584

+ nla_total_size(sizeof(u_int32_t)) /* CTA_ID */

585

+ nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */

585

+ nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */

586

+ ctnetlink_acct_size(ct)

586

+ ctnetlink_acct_size(ct)

587

+ ctnetlink_timestamp_size(ct)

587

+ ctnetlink_timestamp_size(ct)

588

+ nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */

588

+ nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */

589

+ nla_total_size(0) /* CTA_PROTOINFO */

589

+ nla_total_size(0) /* CTA_PROTOINFO */

590

+ nla_total_size(0) /* CTA_HELP */

590

+ nla_total_size(0) /* CTA_HELP */

591

+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */

591

+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */

592

+ ctnetlink_secctx_size(ct)

592

+ ctnetlink_secctx_size(ct)

593

#ifdef CONFIG_NF_NAT_NEEDED

593

#ifdef CONFIG_NF_NAT_NEEDED

594

+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */

594

+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */

595

+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */

595

+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */

596

#endif

596

#endif

597

#ifdef CONFIG_NF_CONNTRACK_MARK

597

#ifdef CONFIG_NF_CONNTRACK_MARK

598

+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */

598

+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */

599

#endif

599

#endif

600

+ ctnetlink_proto_size(ct)

600

+ ctnetlink_proto_size(ct)

601

+ ctnetlink_label_size(ct)

601

+ ctnetlink_label_size(ct)

602

;

602

;

603

}

603

}

604

605

#ifdef CONFIG_NF_CONNTRACK_EVENTS

605

#ifdef CONFIG_NF_CONNTRACK_EVENTS

606

static int

606

static int

607

ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)

607

ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)

608

{

608

{

609

struct net *net;

609

struct net *net;

610

struct nlmsghdr *nlh;

610

struct nlmsghdr *nlh;

611

struct nfgenmsg *nfmsg;

611

struct nfgenmsg *nfmsg;

612

struct nlattr *nest_parms;

612

struct nlattr *nest_parms;

613

struct nf_conn *ct = item->ct;

613

struct nf_conn *ct = item->ct;

614

struct sk_buff *skb;

614

struct sk_buff *skb;

615

unsigned int type;

615

unsigned int type;

616

unsigned int flags = 0, group;

616

unsigned int flags = 0, group;

617

int err;

617

int err;

618

619

/* ignore our fake conntrack entry */

619

/* ignore our fake conntrack entry */

620

if (nf_ct_is_untracked(ct))

620

if (nf_ct_is_untracked(ct))

621

return 0;

621

return 0;

622

623

if (events & (1 << IPCT_DESTROY)) {

623

if (events & (1 << IPCT_DESTROY)) {

624

type = IPCTNL_MSG_CT_DELETE;

624

type = IPCTNL_MSG_CT_DELETE;

625

group = NFNLGRP_CONNTRACK_DESTROY;

625

group = NFNLGRP_CONNTRACK_DESTROY;

626

} else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) {

626

} else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) {

627

type = IPCTNL_MSG_CT_NEW;

627

type = IPCTNL_MSG_CT_NEW;

628

flags = NLM_F_CREATE|NLM_F_EXCL;

628

flags = NLM_F_CREATE|NLM_F_EXCL;

629

group = NFNLGRP_CONNTRACK_NEW;

629

group = NFNLGRP_CONNTRACK_NEW;

630

} else if (events) {

630

} else if (events) {

631

type = IPCTNL_MSG_CT_NEW;

631

type = IPCTNL_MSG_CT_NEW;

632

group = NFNLGRP_CONNTRACK_UPDATE;

632

group = NFNLGRP_CONNTRACK_UPDATE;

633

} else

633

} else

634

return 0;

634

return 0;

635

636

net = nf_ct_net(ct);

636

net = nf_ct_net(ct);

637

if (!item->report && !nfnetlink_has_listeners(net, group))

637

if (!item->report && !nfnetlink_has_listeners(net, group))

638

return 0;

638

return 0;

639

640

skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);

640

skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);

641

if (skb == NULL)

641

if (skb == NULL)

642

goto errout;

642

goto errout;

643

644

type |= NFNL_SUBSYS_CTNETLINK << 8;

644

type |= NFNL_SUBSYS_CTNETLINK << 8;

645

nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);

645

nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);

646

if (nlh == NULL)

646

if (nlh == NULL)

647

goto nlmsg_failure;

647

goto nlmsg_failure;

648

649

nfmsg = nlmsg_data(nlh);

649

nfmsg = nlmsg_data(nlh);

650

nfmsg->nfgen_family = nf_ct_l3num(ct);

650

nfmsg->nfgen_family = nf_ct_l3num(ct);

651

nfmsg->version = NFNETLINK_V0;

651

nfmsg->version = NFNETLINK_V0;

652

nfmsg->res_id = 0;

652

nfmsg->res_id = 0;

653

654

rcu_read_lock();

654

rcu_read_lock();

655

nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);

655

nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);

656

if (!nest_parms)

656

if (!nest_parms)

657

goto nla_put_failure;

657

goto nla_put_failure;

658

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

658

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

659

goto nla_put_failure;

659

goto nla_put_failure;

660

nla_nest_end(skb, nest_parms);

660

nla_nest_end(skb, nest_parms);

661

662

nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);

662

nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);

663

if (!nest_parms)

663

if (!nest_parms)

664

goto nla_put_failure;

664

goto nla_put_failure;

665

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

665

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

666

goto nla_put_failure;

666

goto nla_put_failure;

667

nla_nest_end(skb, nest_parms);

667

nla_nest_end(skb, nest_parms);

668

669

if (nf_ct_zone(ct) &&

669

if (nf_ct_zone(ct) &&

670

nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))

670

nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))

671

goto nla_put_failure;

671

goto nla_put_failure;

672

673

if (ctnetlink_dump_id(skb, ct) < 0)

673

if (ctnetlink_dump_id(skb, ct) < 0)

674

goto nla_put_failure;

674

goto nla_put_failure;

675

676

if (ctnetlink_dump_status(skb, ct) < 0)

676

if (ctnetlink_dump_status(skb, ct) < 0)

677

goto nla_put_failure;

677

goto nla_put_failure;

678

679

if (events & (1 << IPCT_DESTROY)) {

679

if (events & (1 << IPCT_DESTROY)) {

680

if (ctnetlink_dump_acct(skb, ct, type) < 0 ||

680

if (ctnetlink_dump_acct(skb, ct, type) < 0 ||

681

ctnetlink_dump_timestamp(skb, ct) < 0)

681

ctnetlink_dump_timestamp(skb, ct) < 0)

682

goto nla_put_failure;

682

goto nla_put_failure;

683

} else {

683

} else {

684

if (ctnetlink_dump_timeout(skb, ct) < 0)

684

if (ctnetlink_dump_timeout(skb, ct) < 0)

685

goto nla_put_failure;

685

goto nla_put_failure;

686

687

if (events & (1 << IPCT_PROTOINFO)

687

if (events & (1 << IPCT_PROTOINFO)

688

&& ctnetlink_dump_protoinfo(skb, ct) < 0)

688

&& ctnetlink_dump_protoinfo(skb, ct) < 0)

689

goto nla_put_failure;

689

goto nla_put_failure;

690

691

if ((events & (1 << IPCT_HELPER) || nfct_help(ct))

691

if ((events & (1 << IPCT_HELPER) || nfct_help(ct))

692

&& ctnetlink_dump_helpinfo(skb, ct) < 0)

692

&& ctnetlink_dump_helpinfo(skb, ct) < 0)

693

goto nla_put_failure;

693

goto nla_put_failure;

694

695

#ifdef CONFIG_NF_CONNTRACK_SECMARK

695

#ifdef CONFIG_NF_CONNTRACK_SECMARK

696

if ((events & (1 << IPCT_SECMARK) || ct->secmark)

696

if ((events & (1 << IPCT_SECMARK) || ct->secmark)

697

&& ctnetlink_dump_secctx(skb, ct) < 0)

697

&& ctnetlink_dump_secctx(skb, ct) < 0)

698

goto nla_put_failure;

698

goto nla_put_failure;

699

#endif

699

#endif

700

if (events & (1 << IPCT_LABEL) &&

700

if (events & (1 << IPCT_LABEL) &&

701

ctnetlink_dump_labels(skb, ct) < 0)

701

ctnetlink_dump_labels(skb, ct) < 0)

702

goto nla_put_failure;

702

goto nla_put_failure;

703

704

if (events & (1 << IPCT_RELATED) &&

704

if (events & (1 << IPCT_RELATED) &&

705

ctnetlink_dump_master(skb, ct) < 0)

705

ctnetlink_dump_master(skb, ct) < 0)

706

goto nla_put_failure;

706

goto nla_put_failure;

707

708

if (events & (1 << IPCT_SEQADJ) &&

708

if (events & (1 << IPCT_SEQADJ) &&

709

ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

709

ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

710

goto nla_put_failure;

710

goto nla_put_failure;

711

}

711

}

712

713

#ifdef CONFIG_NF_CONNTRACK_MARK

713

#ifdef CONFIG_NF_CONNTRACK_MARK

714

if ((events & (1 << IPCT_MARK) || ct->mark)

714

if ((events & (1 << IPCT_MARK) || ct->mark)

715

&& ctnetlink_dump_mark(skb, ct) < 0)

715

&& ctnetlink_dump_mark(skb, ct) < 0)

716

goto nla_put_failure;

716

goto nla_put_failure;

717

#endif

717

#endif

718

rcu_read_unlock();

718

rcu_read_unlock();

719

720

nlmsg_end(skb, nlh);

720

nlmsg_end(skb, nlh);

721

err = nfnetlink_send(skb, net, item->portid, group, item->report,

721

err = nfnetlink_send(skb, net, item->portid, group, item->report,

722

GFP_ATOMIC);

722

GFP_ATOMIC);

723

if (err == -ENOBUFS || err == -EAGAIN)

723

if (err == -ENOBUFS || err == -EAGAIN)

724

return -ENOBUFS;

724

return -ENOBUFS;

725

726

return 0;

726

return 0;

727

728

nla_put_failure:

728

nla_put_failure:

729

rcu_read_unlock();

729

rcu_read_unlock();

730

nlmsg_cancel(skb, nlh);

730

nlmsg_cancel(skb, nlh);

731

nlmsg_failure:

731

nlmsg_failure:

732

kfree_skb(skb);

732

kfree_skb(skb);

733

errout:

733

errout:

734

if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)

734

if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)

735

return -ENOBUFS;

735

return -ENOBUFS;

736

737

return 0;

737

return 0;

738

}

738

}

739

#endif /* CONFIG_NF_CONNTRACK_EVENTS */

739

#endif /* CONFIG_NF_CONNTRACK_EVENTS */

740

741

static int ctnetlink_done(struct netlink_callback *cb)

741

static int ctnetlink_done(struct netlink_callback *cb)

742

{

742

{

743

if (cb->args[1])

743

if (cb->args[1])

744

nf_ct_put((struct nf_conn *)cb->args[1]);

744

nf_ct_put((struct nf_conn *)cb->args[1]);

745

if (cb->data)

745

if (cb->data)

746

kfree(cb->data);

746

kfree(cb->data);

747

return 0;

747

return 0;

748

}

748

}

749

750

struct ctnetlink_dump_filter {

750

struct ctnetlink_dump_filter {

751

struct {

751

struct {

752

u_int32_t val;

752

u_int32_t val;

753

u_int32_t mask;

753

u_int32_t mask;

754

} mark;

754

} mark;

755

};

755

};

756

757

static int

757

static int

758

ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)

758

ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)

759

{

759

{

760

struct net *net = sock_net(skb->sk);

760

struct net *net = sock_net(skb->sk);

761

struct nf_conn *ct, *last;

761

struct nf_conn *ct, *last;

762

struct nf_conntrack_tuple_hash *h;

762

struct nf_conntrack_tuple_hash *h;

763

struct hlist_nulls_node *n;

763

struct hlist_nulls_node *n;

764

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

764

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

765

u_int8_t l3proto = nfmsg->nfgen_family;

765

u_int8_t l3proto = nfmsg->nfgen_family;

766

int res;

766

int res;

767

#ifdef CONFIG_NF_CONNTRACK_MARK

767

#ifdef CONFIG_NF_CONNTRACK_MARK

768

const struct ctnetlink_dump_filter *filter = cb->data;

768

const struct ctnetlink_dump_filter *filter = cb->data;

769

#endif

769

#endif

770

771

spin_lock_bh(&nf_conntrack_lock);

771

spin_lock_bh(&nf_conntrack_lock);

772

last = (struct nf_conn *)cb->args[1];

772

last = (struct nf_conn *)cb->args[1];

773

for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {

773

for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {

774

restart:

774

restart:

775

hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],

775

hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],

776

hnnode) {

776

hnnode) {

777

if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)

777

if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)

778

continue;

778

continue;

779

ct = nf_ct_tuplehash_to_ctrack(h);

779

ct = nf_ct_tuplehash_to_ctrack(h);

780

/* Dump entries of a given L3 protocol number.

780

/* Dump entries of a given L3 protocol number.

781

* If it is not specified, ie. l3proto == 0,

781

* If it is not specified, ie. l3proto == 0,

782

* then dump everything. */

782

* then dump everything. */

783

if (l3proto && nf_ct_l3num(ct) != l3proto)

783

if (l3proto && nf_ct_l3num(ct) != l3proto)

784

continue;

784

continue;

785

if (cb->args[1]) {

785

if (cb->args[1]) {

786

if (ct != last)

786

if (ct != last)

787

continue;

787

continue;

788

cb->args[1] = 0;

788

cb->args[1] = 0;

789

}

789

}

790

#ifdef CONFIG_NF_CONNTRACK_MARK

790

#ifdef CONFIG_NF_CONNTRACK_MARK

791

if (filter && !((ct->mark & filter->mark.mask) ==

791

if (filter && !((ct->mark & filter->mark.mask) ==

792

filter->mark.val)) {

792

filter->mark.val)) {

793

continue;

793

continue;

794

}

794

}

795

#endif

795

#endif

796

rcu_read_lock();

796

rcu_read_lock();

797

res =

797

res =

798

ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,

798

ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,

799

cb->nlh->nlmsg_seq,

799

cb->nlh->nlmsg_seq,

800

NFNL_MSG_TYPE(cb->nlh->nlmsg_type),

800

NFNL_MSG_TYPE(cb->nlh->nlmsg_type),

801

ct);

801

ct);

802

rcu_read_unlock();

802

rcu_read_unlock();

803

if (res < 0) {

803

if (res < 0) {

804

nf_conntrack_get(&ct->ct_general);

804

nf_conntrack_get(&ct->ct_general);

805

cb->args[1] = (unsigned long)ct;

805

cb->args[1] = (unsigned long)ct;

806

goto out;

806

goto out;

807

}

807

}

808

}

808

}

809

if (cb->args[1]) {

809

if (cb->args[1]) {

810

cb->args[1] = 0;

810

cb->args[1] = 0;

811

goto restart;

811

goto restart;

812

}

812

}

813

}

813

}

814

out:

814

out:

815

spin_unlock_bh(&nf_conntrack_lock);

815

spin_unlock_bh(&nf_conntrack_lock);

816

if (last)

816

if (last)

817

nf_ct_put(last);

817

nf_ct_put(last);

818

819

return skb->len;

819

return skb->len;

820

}

820

}

821

822

static inline int

822

static inline int

823

ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)

823

ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)

824

{

824

{

825

struct nlattr *tb[CTA_IP_MAX+1];

825

struct nlattr *tb[CTA_IP_MAX+1];

826

struct nf_conntrack_l3proto *l3proto;

826

struct nf_conntrack_l3proto *l3proto;

827

int ret = 0;

827

int ret = 0;

828

829

ret = nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);

829

ret = nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);

830

if (ret < 0)

830

if (ret < 0)

831

return ret;

831

return ret;

832

833

rcu_read_lock();

833

rcu_read_lock();

834

l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

834

l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

835

836

if (likely(l3proto->nlattr_to_tuple)) {

836

if (likely(l3proto->nlattr_to_tuple)) {

837

ret = nla_validate_nested(attr, CTA_IP_MAX,

837

ret = nla_validate_nested(attr, CTA_IP_MAX,

838

l3proto->nla_policy);

838

l3proto->nla_policy);

839

if (ret == 0)

839

if (ret == 0)

840

ret = l3proto->nlattr_to_tuple(tb, tuple);

840

ret = l3proto->nlattr_to_tuple(tb, tuple);

841

}

841

}

842

843

rcu_read_unlock();

843

rcu_read_unlock();

844

845

return ret;

845

return ret;

846

}

846

}

847

848

static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {

848

static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {

849

[CTA_PROTO_NUM] = { .type = NLA_U8 },

849

[CTA_PROTO_NUM] = { .type = NLA_U8 },

850

};

850

};

851

852

static inline int

852

static inline int

853

ctnetlink_parse_tuple_proto(struct nlattr *attr,

853

ctnetlink_parse_tuple_proto(struct nlattr *attr,

854

struct nf_conntrack_tuple *tuple)

854

struct nf_conntrack_tuple *tuple)

855

{

855

{

856

struct nlattr *tb[CTA_PROTO_MAX+1];

856

struct nlattr *tb[CTA_PROTO_MAX+1];

857

struct nf_conntrack_l4proto *l4proto;

857

struct nf_conntrack_l4proto *l4proto;

858

int ret = 0;

858

int ret = 0;

859

860

ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);

860

ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);

861

if (ret < 0)

861

if (ret < 0)

862

return ret;

862

return ret;

863

864

if (!tb[CTA_PROTO_NUM])

864

if (!tb[CTA_PROTO_NUM])

865

return -EINVAL;

865

return -EINVAL;

866

tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);

866

tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);

867

868

rcu_read_lock();

868

rcu_read_lock();

869

l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);

869

l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);

870

871

if (likely(l4proto->nlattr_to_tuple)) {

871

if (likely(l4proto->nlattr_to_tuple)) {

872

ret = nla_validate_nested(attr, CTA_PROTO_MAX,

872

ret = nla_validate_nested(attr, CTA_PROTO_MAX,

873

l4proto->nla_policy);

873

l4proto->nla_policy);

874

if (ret == 0)

874

if (ret == 0)

875

ret = l4proto->nlattr_to_tuple(tb, tuple);

875

ret = l4proto->nlattr_to_tuple(tb, tuple);

876

}

876

}

877

878

rcu_read_unlock();

878

rcu_read_unlock();

879

880

return ret;

880

return ret;

881

}

881

}

882

883

static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {

883

static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {

884

[CTA_TUPLE_IP] = { .type = NLA_NESTED },

884

[CTA_TUPLE_IP] = { .type = NLA_NESTED },

885

[CTA_TUPLE_PROTO] = { .type = NLA_NESTED },

885

[CTA_TUPLE_PROTO] = { .type = NLA_NESTED },

886

};

886

};

887

888

static int

888

static int

889

ctnetlink_parse_tuple(const struct nlattr * const cda[],

889

ctnetlink_parse_tuple(const struct nlattr * const cda[],

890

struct nf_conntrack_tuple *tuple,

890

struct nf_conntrack_tuple *tuple,

891

enum ctattr_type type, u_int8_t l3num)

891

enum ctattr_type type, u_int8_t l3num)

892

{

892

{

893

struct nlattr *tb[CTA_TUPLE_MAX+1];

893

struct nlattr *tb[CTA_TUPLE_MAX+1];

894

int err;

894

int err;

895

896

memset(tuple, 0, sizeof(*tuple));

896

memset(tuple, 0, sizeof(*tuple));

897

898

err = nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);

898

err = nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);

899

if (err < 0)

899

if (err < 0)

900

return err;

900

return err;

901

902

if (!tb[CTA_TUPLE_IP])

902

if (!tb[CTA_TUPLE_IP])

903

return -EINVAL;

903

return -EINVAL;

904

905

tuple->src.l3num = l3num;

905

tuple->src.l3num = l3num;

906

907

err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);

907

err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);

908

if (err < 0)

908

if (err < 0)

909

return err;

909

return err;

910

911

if (!tb[CTA_TUPLE_PROTO])

911

if (!tb[CTA_TUPLE_PROTO])

912

return -EINVAL;

912

return -EINVAL;

913

914

err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);

914

err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);

915

if (err < 0)

915

if (err < 0)

916

return err;

916

return err;

917

918

/* orig and expect tuples get DIR_ORIGINAL */

918

/* orig and expect tuples get DIR_ORIGINAL */

919

if (type == CTA_TUPLE_REPLY)

919

if (type == CTA_TUPLE_REPLY)

920

tuple->dst.dir = IP_CT_DIR_REPLY;

920

tuple->dst.dir = IP_CT_DIR_REPLY;

921

else

921

else

922

tuple->dst.dir = IP_CT_DIR_ORIGINAL;

922

tuple->dst.dir = IP_CT_DIR_ORIGINAL;

923

924

return 0;

924

return 0;

925

}

925

}

926

927

static int

927

static int

928

ctnetlink_parse_zone(const struct nlattr *attr, u16 *zone)

928

ctnetlink_parse_zone(const struct nlattr *attr, u16 *zone)

929

{

929

{

930

if (attr)

930

if (attr)

931

#ifdef CONFIG_NF_CONNTRACK_ZONES

931

#ifdef CONFIG_NF_CONNTRACK_ZONES

932

*zone = ntohs(nla_get_be16(attr));

932

*zone = ntohs(nla_get_be16(attr));

933

#else

933

#else

934

return -EOPNOTSUPP;

934

return -EOPNOTSUPP;

935

#endif

935

#endif

936

else

936

else

937

*zone = 0;

937

*zone = 0;

938

939

return 0;

939

return 0;

940

}

940

}

941

942

static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = {

942

static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = {

943

[CTA_HELP_NAME] = { .type = NLA_NUL_STRING,

943

[CTA_HELP_NAME] = { .type = NLA_NUL_STRING,

944

.len = NF_CT_HELPER_NAME_LEN - 1 },

944

.len = NF_CT_HELPER_NAME_LEN - 1 },

945

};

945

};

946

947

static inline int

947

static inline int

948

ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,

948

ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,

949

struct nlattr **helpinfo)

949

struct nlattr **helpinfo)

950

{

950

{

951

int err;

951

int err;

952

struct nlattr *tb[CTA_HELP_MAX+1];

952

struct nlattr *tb[CTA_HELP_MAX+1];

953

954

err = nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy);

954

err = nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy);

955

if (err < 0)

955

if (err < 0)

956

return err;

956

return err;

957

958

if (!tb[CTA_HELP_NAME])

958

if (!tb[CTA_HELP_NAME])

959

return -EINVAL;

959

return -EINVAL;

960

961

*helper_name = nla_data(tb[CTA_HELP_NAME]);

961

*helper_name = nla_data(tb[CTA_HELP_NAME]);

962

963

if (tb[CTA_HELP_INFO])

963

if (tb[CTA_HELP_INFO])

964

*helpinfo = tb[CTA_HELP_INFO];

964

*helpinfo = tb[CTA_HELP_INFO];

965

966

return 0;

966

return 0;

967

}

967

}

968

969

#define __CTA_LABELS_MAX_LENGTH ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)

969

#define __CTA_LABELS_MAX_LENGTH ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)

970

static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {

970

static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {

971

[CTA_TUPLE_ORIG] = { .type = NLA_NESTED },

971

[CTA_TUPLE_ORIG] = { .type = NLA_NESTED },

972

[CTA_TUPLE_REPLY] = { .type = NLA_NESTED },

972

[CTA_TUPLE_REPLY] = { .type = NLA_NESTED },

973

[CTA_STATUS] = { .type = NLA_U32 },

973

[CTA_STATUS] = { .type = NLA_U32 },

974

[CTA_PROTOINFO] = { .type = NLA_NESTED },

974

[CTA_PROTOINFO] = { .type = NLA_NESTED },

975

[CTA_HELP] = { .type = NLA_NESTED },

975

[CTA_HELP] = { .type = NLA_NESTED },

976

[CTA_NAT_SRC] = { .type = NLA_NESTED },

976

[CTA_NAT_SRC] = { .type = NLA_NESTED },

977

[CTA_TIMEOUT] = { .type = NLA_U32 },

977

[CTA_TIMEOUT] = { .type = NLA_U32 },

978

[CTA_MARK] = { .type = NLA_U32 },

978

[CTA_MARK] = { .type = NLA_U32 },

979

[CTA_ID] = { .type = NLA_U32 },

979

[CTA_ID] = { .type = NLA_U32 },

980

[CTA_NAT_DST] = { .type = NLA_NESTED },

980

[CTA_NAT_DST] = { .type = NLA_NESTED },

981

[CTA_TUPLE_MASTER] = { .type = NLA_NESTED },

981

[CTA_TUPLE_MASTER] = { .type = NLA_NESTED },

982

[CTA_NAT_SEQ_ADJ_ORIG] = { .type = NLA_NESTED },

982

[CTA_NAT_SEQ_ADJ_ORIG] = { .type = NLA_NESTED },

983

[CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED },

983

[CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED },

984

[CTA_ZONE] = { .type = NLA_U16 },

984

[CTA_ZONE] = { .type = NLA_U16 },

985

[CTA_MARK_MASK] = { .type = NLA_U32 },

985

[CTA_MARK_MASK] = { .type = NLA_U32 },

986

[CTA_LABELS] = { .type = NLA_BINARY,

986

[CTA_LABELS] = { .type = NLA_BINARY,

987

.len = __CTA_LABELS_MAX_LENGTH },

987

.len = __CTA_LABELS_MAX_LENGTH },

988

[CTA_LABELS_MASK] = { .type = NLA_BINARY,

988

[CTA_LABELS_MASK] = { .type = NLA_BINARY,

989

.len = __CTA_LABELS_MAX_LENGTH },

989

.len = __CTA_LABELS_MAX_LENGTH },

990

};

990

};

991

992

static int

992

static int

993

ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,

993

ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,

994

const struct nlmsghdr *nlh,

994

const struct nlmsghdr *nlh,

995

const struct nlattr * const cda[])

995

const struct nlattr * const cda[])

996

{

996

{

997

struct net *net = sock_net(ctnl);

997

struct net *net = sock_net(ctnl);

998

struct nf_conntrack_tuple_hash *h;

998

struct nf_conntrack_tuple_hash *h;

999

struct nf_conntrack_tuple tuple;

999

struct nf_conntrack_tuple tuple;

1000

struct nf_conn *ct;

1000

struct nf_conn *ct;

1001

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

1001

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

1002

u_int8_t u3 = nfmsg->nfgen_family;

1002

u_int8_t u3 = nfmsg->nfgen_family;

1003

u16 zone;

1003

u16 zone;

1004

int err;

1004

int err;

1005

1006

err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);

1006

err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);

1007

if (err < 0)

1007

if (err < 0)

1008

return err;

1008

return err;

1009

1010

if (cda[CTA_TUPLE_ORIG])

1010

if (cda[CTA_TUPLE_ORIG])

1011

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);

1011

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);

1012

else if (cda[CTA_TUPLE_REPLY])

1012

else if (cda[CTA_TUPLE_REPLY])

1013

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);

1013

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);

1014

else {

1014

else {

1015

/* Flush the whole table */

1015

/* Flush the whole table */

1016

nf_conntrack_flush_report(net,

1016

nf_conntrack_flush_report(net,

1017

NETLINK_CB(skb).portid,

1017

NETLINK_CB(skb).portid,

1018

nlmsg_report(nlh));

1018

nlmsg_report(nlh));

1019

return 0;

1019

return 0;

1020

}

1020

}

1021

1022

if (err < 0)

1022

if (err < 0)

1023

return err;

1023

return err;

1024

1025

h = nf_conntrack_find_get(net, zone, &tuple);

1025

h = nf_conntrack_find_get(net, zone, &tuple);

1026

if (!h)

1026

if (!h)

1027

return -ENOENT;

1027

return -ENOENT;

1028

1029

ct = nf_ct_tuplehash_to_ctrack(h);

1029

ct = nf_ct_tuplehash_to_ctrack(h);

1030

1031

if (cda[CTA_ID]) {

1031

if (cda[CTA_ID]) {

1032

u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));

1032

u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));

1033

if (id != (u32)(unsigned long)ct) {

1033

if (id != (u32)(unsigned long)ct) {

1034

nf_ct_put(ct);

1034

nf_ct_put(ct);

1035

return -ENOENT;

1035

return -ENOENT;

1036

}

1036

}

1037

}

1037

}

1038

1039

if (del_timer(&ct->timeout))

1039

if (del_timer(&ct->timeout))

1040

nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(nlh));

1040

nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(nlh));

1041

1042

nf_ct_put(ct);

1042

nf_ct_put(ct);

1043

1044

return 0;

1044

return 0;

1045

}

1045

}

1046

1047

static int

1047

static int

1048

ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,

1048

ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,

1049

const struct nlmsghdr *nlh,

1049

const struct nlmsghdr *nlh,

1050

const struct nlattr * const cda[])

1050

const struct nlattr * const cda[])

1051

{

1051

{

1052

struct net *net = sock_net(ctnl);

1052

struct net *net = sock_net(ctnl);

1053

struct nf_conntrack_tuple_hash *h;

1053

struct nf_conntrack_tuple_hash *h;

1054

struct nf_conntrack_tuple tuple;

1054

struct nf_conntrack_tuple tuple;

1055

struct nf_conn *ct;

1055

struct nf_conn *ct;

1056

struct sk_buff *skb2 = NULL;

1056

struct sk_buff *skb2 = NULL;

1057

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

1057

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

1058

u_int8_t u3 = nfmsg->nfgen_family;

1058

u_int8_t u3 = nfmsg->nfgen_family;

1059

u16 zone;

1059

u16 zone;

1060

int err;

1060

int err;

1061

1062

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1062

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1063

struct netlink_dump_control c = {

1063

struct netlink_dump_control c = {

1064

.dump = ctnetlink_dump_table,

1064

.dump = ctnetlink_dump_table,

1065

.done = ctnetlink_done,

1065

.done = ctnetlink_done,

1066

};

1066

};

1067

#ifdef CONFIG_NF_CONNTRACK_MARK

1067

#ifdef CONFIG_NF_CONNTRACK_MARK

1068

if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {

1068

if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {

1069

struct ctnetlink_dump_filter *filter;

1069

struct ctnetlink_dump_filter *filter;

1070

1071

filter = kzalloc(sizeof(struct ctnetlink_dump_filter),

1071

filter = kzalloc(sizeof(struct ctnetlink_dump_filter),

1072

GFP_ATOMIC);

1072

GFP_ATOMIC);

1073

if (filter == NULL)

1073

if (filter == NULL)

1074

return -ENOMEM;

1074

return -ENOMEM;

1075

1076

filter->mark.val = ntohl(nla_get_be32(cda[CTA_MARK]));

1076

filter->mark.val = ntohl(nla_get_be32(cda[CTA_MARK]));

1077

filter->mark.mask =

1077

filter->mark.mask =

1078

ntohl(nla_get_be32(cda[CTA_MARK_MASK]));

1078

ntohl(nla_get_be32(cda[CTA_MARK_MASK]));

1079

c.data = filter;

1079

c.data = filter;

1080

}

1080

}

1081

#endif

1081

#endif

1082

return netlink_dump_start(ctnl, skb, nlh, &c);

1082

return netlink_dump_start(ctnl, skb, nlh, &c);

1083

}

1083

}

1084

1085

err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);

1085

err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);

1086

if (err < 0)

1086

if (err < 0)

1087

return err;

1087

return err;

1088

1089

if (cda[CTA_TUPLE_ORIG])

1089

if (cda[CTA_TUPLE_ORIG])

1090

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);

1090

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);

1091

else if (cda[CTA_TUPLE_REPLY])

1091

else if (cda[CTA_TUPLE_REPLY])

1092

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);

1092

err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);

1093

else

1093

else

1094

return -EINVAL;

1094

return -EINVAL;

1095

1096

if (err < 0)

1096

if (err < 0)

1097

return err;

1097

return err;

1098

1099

h = nf_conntrack_find_get(net, zone, &tuple);

1099

h = nf_conntrack_find_get(net, zone, &tuple);

1100

if (!h)

1100

if (!h)

1101

return -ENOENT;

1101

return -ENOENT;

1102

1103

ct = nf_ct_tuplehash_to_ctrack(h);

1103

ct = nf_ct_tuplehash_to_ctrack(h);

1104

1105

err = -ENOMEM;

1105

err = -ENOMEM;

1106

skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

1106

skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

1107

if (skb2 == NULL) {

1107

if (skb2 == NULL) {

1108

nf_ct_put(ct);

1108

nf_ct_put(ct);

1109

return -ENOMEM;

1109

return -ENOMEM;

1110

}

1110

}

1111

1112

rcu_read_lock();

1112

rcu_read_lock();

1113

err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq,

1113

err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq,

1114

NFNL_MSG_TYPE(nlh->nlmsg_type), ct);

1114

NFNL_MSG_TYPE(nlh->nlmsg_type), ct);

1115

rcu_read_unlock();

1115

rcu_read_unlock();

1116

nf_ct_put(ct);

1116

nf_ct_put(ct);

1117

if (err <= 0)

1117

if (err <= 0)

1118

goto free;

1118

goto free;

1119

1120

err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);

1120

err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);

1121

if (err < 0)

1121

if (err < 0)

1122

goto out;

1122

goto out;

1123

1124

return 0;

1124

return 0;

1125

1126

free:

1126

free:

1127

kfree_skb(skb2);

1127

kfree_skb(skb2);

1128

out:

1128

out:

1129

/* this avoids a loop in nfnetlink. */

1129

/* this avoids a loop in nfnetlink. */

1130

return err == -EAGAIN ? -ENOBUFS : err;

1130

return err == -EAGAIN ? -ENOBUFS : err;

1131

}

1131

}

1132

1133

static int ctnetlink_done_list(struct netlink_callback *cb)

1133

static int ctnetlink_done_list(struct netlink_callback *cb)

1134

{

1134

{

1135

if (cb->args[1])

1135

if (cb->args[1])

1136

nf_ct_put((struct nf_conn *)cb->args[1]);

1136

nf_ct_put((struct nf_conn *)cb->args[1]);

1137

return 0;

1137

return 0;

1138

}

1138

}

1139

1140

static int

1140

static int

1141

ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb,

1141

ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb,

1142

struct hlist_nulls_head *list)

1142

struct hlist_nulls_head *list)

1143

{

1143

{

1144

struct nf_conn *ct, *last;

1144

struct nf_conn *ct, *last;

1145

struct nf_conntrack_tuple_hash *h;

1145

struct nf_conntrack_tuple_hash *h;

1146

struct hlist_nulls_node *n;

1146

struct hlist_nulls_node *n;

1147

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

1147

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

1148

u_int8_t l3proto = nfmsg->nfgen_family;

1148

u_int8_t l3proto = nfmsg->nfgen_family;

1149

int res;

1149

int res;

1150

1151

if (cb->args[2])

1151

if (cb->args[2])

1152

return 0;

1152

return 0;

1153

1154

spin_lock_bh(&nf_conntrack_lock);

1154

spin_lock_bh(&nf_conntrack_lock);

1155

last = (struct nf_conn *)cb->args[1];

1155

last = (struct nf_conn *)cb->args[1];

1156

restart:

1156

restart:

1157

hlist_nulls_for_each_entry(h, n, list, hnnode) {

1157

hlist_nulls_for_each_entry(h, n, list, hnnode) {

1158

ct = nf_ct_tuplehash_to_ctrack(h);

1158

ct = nf_ct_tuplehash_to_ctrack(h);

1159

if (l3proto && nf_ct_l3num(ct) != l3proto)

1159

if (l3proto && nf_ct_l3num(ct) != l3proto)

1160

continue;

1160

continue;

1161

if (cb->args[1]) {

1161

if (cb->args[1]) {

1162

if (ct != last)

1162

if (ct != last)

1163

continue;

1163

continue;

1164

cb->args[1] = 0;

1164

cb->args[1] = 0;

1165

}

1165

}

1166

rcu_read_lock();

1166

rcu_read_lock();

1167

res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,

1167

res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,

1168

cb->nlh->nlmsg_seq,

1168

cb->nlh->nlmsg_seq,

1169

NFNL_MSG_TYPE(cb->nlh->nlmsg_type),

1169

NFNL_MSG_TYPE(cb->nlh->nlmsg_type),

1170

ct);

1170

ct);

1171

rcu_read_unlock();

1171

rcu_read_unlock();

1172

if (res < 0) {

1172

if (res < 0) {

1173

nf_conntrack_get(&ct->ct_general);

1173

nf_conntrack_get(&ct->ct_general);

1174

cb->args[1] = (unsigned long)ct;

1174

cb->args[1] = (unsigned long)ct;

1175

goto out;

1175

goto out;

1176

}

1176

}

1177

}

1177

}

1178

if (cb->args[1]) {

1178

if (cb->args[1]) {

1179

cb->args[1] = 0;

1179

cb->args[1] = 0;

1180

goto restart;

1180

goto restart;

1181

} else

1181

} else

1182

cb->args[2] = 1;

1182

cb->args[2] = 1;

1183

out:

1183

out:

1184

spin_unlock_bh(&nf_conntrack_lock);

1184

spin_unlock_bh(&nf_conntrack_lock);

1185

if (last)

1185

if (last)

1186

nf_ct_put(last);

1186

nf_ct_put(last);

1187

1188

return skb->len;

1188

return skb->len;

1189

}

1189

}

1190

1191

static int

1191

static int

1192

ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb)

1192

ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb)

1193

{

1193

{

1194

struct net *net = sock_net(skb->sk);

1194

struct net *net = sock_net(skb->sk);

1195

1196

return ctnetlink_dump_list(skb, cb, &net->ct.dying);

1196

return ctnetlink_dump_list(skb, cb, &net->ct.dying);

1197

}

1197

}

1198

1199

static int

1199

static int

1200

ctnetlink_get_ct_dying(struct sock *ctnl, struct sk_buff *skb,

1200

ctnetlink_get_ct_dying(struct sock *ctnl, struct sk_buff *skb,

1201

const struct nlmsghdr *nlh,

1201

const struct nlmsghdr *nlh,

1202

const struct nlattr * const cda[])

1202

const struct nlattr * const cda[])

1203

{

1203

{

1204

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1204

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1205

struct netlink_dump_control c = {

1205

struct netlink_dump_control c = {

1206

.dump = ctnetlink_dump_dying,

1206

.dump = ctnetlink_dump_dying,

1207

.done = ctnetlink_done_list,

1207

.done = ctnetlink_done_list,

1208

};

1208

};

1209

return netlink_dump_start(ctnl, skb, nlh, &c);

1209

return netlink_dump_start(ctnl, skb, nlh, &c);

1210

}

1210

}

1211

1212

return -EOPNOTSUPP;

1212

return -EOPNOTSUPP;

1213

}

1213

}

1214

1215

static int

1215

static int

1216

ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb)

1216

ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb)

1217

{

1217

{

1218

struct net *net = sock_net(skb->sk);

1218

struct net *net = sock_net(skb->sk);

1219

1220

return ctnetlink_dump_list(skb, cb, &net->ct.unconfirmed);

1220

return ctnetlink_dump_list(skb, cb, &net->ct.unconfirmed);

1221

}

1221

}

1222

1223

static int

1223

static int

1224

ctnetlink_get_ct_unconfirmed(struct sock *ctnl, struct sk_buff *skb,

1224

ctnetlink_get_ct_unconfirmed(struct sock *ctnl, struct sk_buff *skb,

1225

const struct nlmsghdr *nlh,

1225

const struct nlmsghdr *nlh,

1226

const struct nlattr * const cda[])

1226

const struct nlattr * const cda[])

1227

{

1227

{

1228

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1228

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1229

struct netlink_dump_control c = {

1229

struct netlink_dump_control c = {

1230

.dump = ctnetlink_dump_unconfirmed,

1230

.dump = ctnetlink_dump_unconfirmed,

1231

.done = ctnetlink_done_list,

1231

.done = ctnetlink_done_list,

1232

};

1232

};

1233

return netlink_dump_start(ctnl, skb, nlh, &c);

1233

return netlink_dump_start(ctnl, skb, nlh, &c);

1234

}

1234

}

1235

1236

return -EOPNOTSUPP;

1236

return -EOPNOTSUPP;

1237

}

1237

}

1238

1239

#ifdef CONFIG_NF_NAT_NEEDED

1239

#ifdef CONFIG_NF_NAT_NEEDED

1240

static int

1240

static int

1241

ctnetlink_parse_nat_setup(struct nf_conn *ct,

1241

ctnetlink_parse_nat_setup(struct nf_conn *ct,

1242

enum nf_nat_manip_type manip,

1242

enum nf_nat_manip_type manip,

1243

const struct nlattr *attr)

1243

const struct nlattr *attr)

1244

{

1244

{

1245

typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;

1245

typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;

1246

int err;

1246

int err;

1247

1248

parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);

1248

parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);

1249

if (!parse_nat_setup) {

1249

if (!parse_nat_setup) {

1250

#ifdef CONFIG_MODULES

1250

#ifdef CONFIG_MODULES

1251

rcu_read_unlock();

1251

rcu_read_unlock();

1252

nfnl_unlock(NFNL_SUBSYS_CTNETLINK);

1252

nfnl_unlock(NFNL_SUBSYS_CTNETLINK);

1253

if (request_module("nf-nat") < 0) {

1253

if (request_module("nf-nat") < 0) {

1254

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1254

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1255

rcu_read_lock();

1255

rcu_read_lock();

1256

return -EOPNOTSUPP;

1256

return -EOPNOTSUPP;

1257

}

1257

}

1258

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1258

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1259

rcu_read_lock();

1259

rcu_read_lock();

1260

if (nfnetlink_parse_nat_setup_hook)

1260

if (nfnetlink_parse_nat_setup_hook)

1261

return -EAGAIN;

1261

return -EAGAIN;

1262

#endif

1262

#endif

1263

return -EOPNOTSUPP;

1263

return -EOPNOTSUPP;

1264

}

1264

}

1265

1266

err = parse_nat_setup(ct, manip, attr);

1266

err = parse_nat_setup(ct, manip, attr);

1267

if (err == -EAGAIN) {

1267

if (err == -EAGAIN) {

1268

#ifdef CONFIG_MODULES

1268

#ifdef CONFIG_MODULES

1269

rcu_read_unlock();

1269

rcu_read_unlock();

1270

nfnl_unlock(NFNL_SUBSYS_CTNETLINK);

1270

nfnl_unlock(NFNL_SUBSYS_CTNETLINK);

1271

if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {

1271

if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {

1272

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1272

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1273

rcu_read_lock();

1273

rcu_read_lock();

1274

return -EOPNOTSUPP;

1274

return -EOPNOTSUPP;

1275

}

1275

}

1276

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1276

nfnl_lock(NFNL_SUBSYS_CTNETLINK);

1277

rcu_read_lock();

1277

rcu_read_lock();

1278

#else

1278

#else

1279

err = -EOPNOTSUPP;

1279

err = -EOPNOTSUPP;

1280

#endif

1280

#endif

1281

}

1281

}

1282

return err;

1282

return err;

1283

}

1283

}

1284

#endif

1284

#endif

1285

1286

static int

1286

static int

1287

ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])

1287

ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])

1288

{

1288

{

1289

unsigned long d;

1289

unsigned long d;

1290

unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));

1290

unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));

1291

d = ct->status ^ status;

1291

d = ct->status ^ status;

1292

1293

if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))

1293

if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))

1294

/* unchangeable */

1294

/* unchangeable */

1295

return -EBUSY;

1295

return -EBUSY;

1296

1297

if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))

1297

if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))

1298

/* SEEN_REPLY bit can only be set */

1298

/* SEEN_REPLY bit can only be set */

1299

return -EBUSY;

1299

return -EBUSY;

1300

1301

if (d & IPS_ASSURED && !(status & IPS_ASSURED))

1301

if (d & IPS_ASSURED && !(status & IPS_ASSURED))

1302

/* ASSURED bit can only be set */

1302

/* ASSURED bit can only be set */

1303

return -EBUSY;

1303

return -EBUSY;

1304

1305

/* Be careful here, modifying NAT bits can screw up things,

1305

/* Be careful here, modifying NAT bits can screw up things,

1306

* so don't let users modify them directly if they don't pass

1306

* so don't let users modify them directly if they don't pass

1307

* nf_nat_range. */

1307

* nf_nat_range. */

1308

ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);

1308

ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);

1309

return 0;

1309

return 0;

1310

}

1310

}

1311

1312

static int

1312

static int

1313

ctnetlink_change_nat(struct nf_conn *ct, const struct nlattr * const cda[])

1313

ctnetlink_change_nat(struct nf_conn *ct, const struct nlattr * const cda[])

1314

{

1314

{

1315

#ifdef CONFIG_NF_NAT_NEEDED

1315

#ifdef CONFIG_NF_NAT_NEEDED

1316

int ret;

1316

int ret;

1317

1318

if (cda[CTA_NAT_DST]) {

1318

if (cda[CTA_NAT_DST]) {

1319

ret = ctnetlink_parse_nat_setup(ct,

1319

ret = ctnetlink_parse_nat_setup(ct,

1320

NF_NAT_MANIP_DST,

1320

NF_NAT_MANIP_DST,

1321

cda[CTA_NAT_DST]);

1321

cda[CTA_NAT_DST]);

1322

if (ret < 0)

1322

if (ret < 0)

1323

return ret;

1323

return ret;

1324

}

1324

}

1325

if (cda[CTA_NAT_SRC]) {

1325

if (cda[CTA_NAT_SRC]) {

1326

ret = ctnetlink_parse_nat_setup(ct,

1326

ret = ctnetlink_parse_nat_setup(ct,

1327

NF_NAT_MANIP_SRC,

1327

NF_NAT_MANIP_SRC,

1328

cda[CTA_NAT_SRC]);

1328

cda[CTA_NAT_SRC]);

1329

if (ret < 0)

1329

if (ret < 0)

1330

return ret;

1330

return ret;

1331

}

1331

}

1332

return 0;

1332

return 0;

1333

#else

1333

#else

1334

return -EOPNOTSUPP;

1334

return -EOPNOTSUPP;

1335

#endif

1335

#endif

1336

}

1336

}

1337

1338

static inline int

1338

static inline int

1339

ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])

1339

ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])

1340

{

1340

{

1341

struct nf_conntrack_helper *helper;

1341

struct nf_conntrack_helper *helper;

1342

struct nf_conn_help *help = nfct_help(ct);

1342

struct nf_conn_help *help = nfct_help(ct);

1343

char *helpname = NULL;

1343

char *helpname = NULL;

1344

struct nlattr *helpinfo = NULL;

1344

struct nlattr *helpinfo = NULL;

1345

int err;

1345

int err;

1346

1347

/* don't change helper of sibling connections */

1347

/* don't change helper of sibling connections */

1348

if (ct->master)

1348

if (ct->master)

1349

return -EBUSY;

1349

return -EBUSY;

1350

1351

err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);

1351

err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);

1352

if (err < 0)

1352

if (err < 0)

1353

return err;

1353

return err;

1354

1355

if (!strcmp(helpname, "")) {

1355

if (!strcmp(helpname, "")) {

1356

if (help && help->helper) {

1356

if (help && help->helper) {

1357

/* we had a helper before ... */

1357

/* we had a helper before ... */

1358

nf_ct_remove_expectations(ct);

1358

nf_ct_remove_expectations(ct);

1359

RCU_INIT_POINTER(help->helper, NULL);

1359

RCU_INIT_POINTER(help->helper, NULL);

1360

}

1360

}

1361

1362

return 0;

1362

return 0;

1363

}

1363

}

1364

1365

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

1365

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

1366

nf_ct_protonum(ct));

1366

nf_ct_protonum(ct));

1367

if (helper == NULL) {

1367

if (helper == NULL) {

1368

#ifdef CONFIG_MODULES

1368

#ifdef CONFIG_MODULES

1369

spin_unlock_bh(&nf_conntrack_lock);

1369

spin_unlock_bh(&nf_conntrack_lock);

1370

1371

if (request_module("nfct-helper-%s", helpname) < 0) {

1371

if (request_module("nfct-helper-%s", helpname) < 0) {

1372

spin_lock_bh(&nf_conntrack_lock);

1372

spin_lock_bh(&nf_conntrack_lock);

1373

return -EOPNOTSUPP;

1373

return -EOPNOTSUPP;

1374

}

1374

}

1375

1376

spin_lock_bh(&nf_conntrack_lock);

1376

spin_lock_bh(&nf_conntrack_lock);

1377

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

1377

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

1378

nf_ct_protonum(ct));

1378

nf_ct_protonum(ct));

1379

if (helper)

1379

if (helper)

1380

return -EAGAIN;

1380

return -EAGAIN;

1381

#endif

1381

#endif

1382

return -EOPNOTSUPP;

1382

return -EOPNOTSUPP;

1383

}

1383

}

1384

1385

if (help) {

1385

if (help) {

1386

if (help->helper == helper) {

1386

if (help->helper == helper) {

1387

/* update private helper data if allowed. */

1387

/* update private helper data if allowed. */

1388

if (helper->from_nlattr)

1388

if (helper->from_nlattr)

1389

helper->from_nlattr(helpinfo, ct);

1389

helper->from_nlattr(helpinfo, ct);

1390

return 0;

1390

return 0;

1391

} else

1391

} else

1392

return -EBUSY;

1392

return -EBUSY;

1393

}

1393

}

1394

1395

/* we cannot set a helper for an existing conntrack */

1395

/* we cannot set a helper for an existing conntrack */

1396

return -EOPNOTSUPP;

1396

return -EOPNOTSUPP;

1397

}

1397

}

1398

1399

static inline int

1399

static inline int

1400

ctnetlink_change_timeout(struct nf_conn *ct, const struct nlattr * const cda[])

1400

ctnetlink_change_timeout(struct nf_conn *ct, const struct nlattr * const cda[])

1401

{

1401

{

1402

u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));

1402

u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));

1403

1404

if (!del_timer(&ct->timeout))

1404

if (!del_timer(&ct->timeout))

1405

return -ETIME;

1405

return -ETIME;

1406

1407

ct->timeout.expires = jiffies + timeout * HZ;

1407

ct->timeout.expires = jiffies + timeout * HZ;

1408

add_timer(&ct->timeout);

1408

add_timer(&ct->timeout);

1409

1410

return 0;

1410

return 0;

1411

}

1411

}

1412

1413

static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = {

1413

static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = {

1414

[CTA_PROTOINFO_TCP] = { .type = NLA_NESTED },

1414

[CTA_PROTOINFO_TCP] = { .type = NLA_NESTED },

1415

[CTA_PROTOINFO_DCCP] = { .type = NLA_NESTED },

1415

[CTA_PROTOINFO_DCCP] = { .type = NLA_NESTED },

1416

[CTA_PROTOINFO_SCTP] = { .type = NLA_NESTED },

1416

[CTA_PROTOINFO_SCTP] = { .type = NLA_NESTED },

1417

};

1417

};

1418

1419

static inline int

1419

static inline int

1420

ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[])

1420

ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[])

1421

{

1421

{

1422

const struct nlattr *attr = cda[CTA_PROTOINFO];

1422

const struct nlattr *attr = cda[CTA_PROTOINFO];

1423

struct nlattr *tb[CTA_PROTOINFO_MAX+1];

1423

struct nlattr *tb[CTA_PROTOINFO_MAX+1];

1424

struct nf_conntrack_l4proto *l4proto;

1424

struct nf_conntrack_l4proto *l4proto;

1425

int err = 0;

1425

int err = 0;

1426

1427

err = nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy);

1427

err = nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy);

1428

if (err < 0)

1428

if (err < 0)

1429

return err;

1429

return err;

1430

1431

rcu_read_lock();

1431

rcu_read_lock();

1432

l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));

1432

l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));

1433

if (l4proto->from_nlattr)

1433

if (l4proto->from_nlattr)

1434

err = l4proto->from_nlattr(tb, ct);

1434

err = l4proto->from_nlattr(tb, ct);

1435

rcu_read_unlock();

1435

rcu_read_unlock();

1436

1437

return err;

1437

return err;

1438

}

1438

}

1439

1440

static const struct nla_policy seqadj_policy[CTA_SEQADJ_MAX+1] = {

1440

static const struct nla_policy seqadj_policy[CTA_SEQADJ_MAX+1] = {

1441

[CTA_SEQADJ_CORRECTION_POS] = { .type = NLA_U32 },

1441

[CTA_SEQADJ_CORRECTION_POS] = { .type = NLA_U32 },

1442

[CTA_SEQADJ_OFFSET_BEFORE] = { .type = NLA_U32 },

1442

[CTA_SEQADJ_OFFSET_BEFORE] = { .type = NLA_U32 },

1443

[CTA_SEQADJ_OFFSET_AFTER] = { .type = NLA_U32 },

1443

[CTA_SEQADJ_OFFSET_AFTER] = { .type = NLA_U32 },

1444

};

1444

};

1445

1446

static inline int

1446

static inline int

1447

change_seq_adj(struct nf_ct_seqadj *seq, const struct nlattr * const attr)

1447

change_seq_adj(struct nf_ct_seqadj *seq, const struct nlattr * const attr)

1448

{

1448

{

1449

int err;

1449

int err;

1450

struct nlattr *cda[CTA_SEQADJ_MAX+1];

1450

struct nlattr *cda[CTA_SEQADJ_MAX+1];

1451

1452

err = nla_parse_nested(cda, CTA_SEQADJ_MAX, attr, seqadj_policy);

1452

err = nla_parse_nested(cda, CTA_SEQADJ_MAX, attr, seqadj_policy);

1453

if (err < 0)

1453

if (err < 0)

1454

return err;

1454

return err;

1455

1456

if (!cda[CTA_SEQADJ_CORRECTION_POS])

1456

if (!cda[CTA_SEQADJ_CORRECTION_POS])

1457

return -EINVAL;

1457

return -EINVAL;

1458

1459

seq->correction_pos =

1459

seq->correction_pos =

1460

ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS]));

1460

ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS]));

1461

1462

if (!cda[CTA_SEQADJ_OFFSET_BEFORE])

1462

if (!cda[CTA_SEQADJ_OFFSET_BEFORE])

1463

return -EINVAL;

1463

return -EINVAL;

1464

1465

seq->offset_before =

1465

seq->offset_before =

1466

ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE]));

1466

ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE]));

1467

1468

if (!cda[CTA_SEQADJ_OFFSET_AFTER])

1468

if (!cda[CTA_SEQADJ_OFFSET_AFTER])

1469

return -EINVAL;

1469

return -EINVAL;

1470

1471

seq->offset_after =

1471

seq->offset_after =

1472

ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER]));

1472

ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER]));

1473

1474

return 0;

1474

return 0;

1475

}

1475

}

1476

1477

static int

1477

static int

1478

ctnetlink_change_seq_adj(struct nf_conn *ct,

1478

ctnetlink_change_seq_adj(struct nf_conn *ct,

1479

const struct nlattr * const cda[])

1479

const struct nlattr * const cda[])

1480

{

1480

{

1481

struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);

1481

struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);

1482

int ret = 0;

1482

int ret = 0;

1483

1484

if (!seqadj)

1484

if (!seqadj)

1485

return 0;

1485

return 0;

1486

1487

if (cda[CTA_SEQ_ADJ_ORIG]) {

1487

if (cda[CTA_SEQ_ADJ_ORIG]) {

1488

ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL],

1488

ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL],

1489

cda[CTA_SEQ_ADJ_ORIG]);

1489

cda[CTA_SEQ_ADJ_ORIG]);

1490

if (ret < 0)

1490

if (ret < 0)

1491

return ret;

1491

return ret;

1492

1493

ct->status |= IPS_SEQ_ADJUST;

1493

ct->status |= IPS_SEQ_ADJUST;

1494

}

1494

}

1495

1496

if (cda[CTA_SEQ_ADJ_REPLY]) {

1496

if (cda[CTA_SEQ_ADJ_REPLY]) {

1497

ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY],

1497

ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY],

1498

cda[CTA_SEQ_ADJ_REPLY]);

1498

cda[CTA_SEQ_ADJ_REPLY]);

1499

if (ret < 0)

1499

if (ret < 0)

1500

return ret;

1500

return ret;

1501

1502

ct->status |= IPS_SEQ_ADJUST;

1502

ct->status |= IPS_SEQ_ADJUST;

1503

}

1503

}

1504

1505

return 0;

1505

return 0;

1506

}

1506

}

1507

1508

static int

1508

static int

1509

ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[])

1509

ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[])

1510

{

1510

{

1511

#ifdef CONFIG_NF_CONNTRACK_LABELS

1511

#ifdef CONFIG_NF_CONNTRACK_LABELS

1512

size_t len = nla_len(cda[CTA_LABELS]);

1512

size_t len = nla_len(cda[CTA_LABELS]);

1513

const void *mask = cda[CTA_LABELS_MASK];

1513

const void *mask = cda[CTA_LABELS_MASK];

1514

1515

if (len & (sizeof(u32)-1)) /* must be multiple of u32 */

1515

if (len & (sizeof(u32)-1)) /* must be multiple of u32 */

1516

return -EINVAL;

1516

return -EINVAL;

1517

1518

if (mask) {

1518

if (mask) {

1519

if (nla_len(cda[CTA_LABELS_MASK]) == 0 ||

1519

if (nla_len(cda[CTA_LABELS_MASK]) == 0 ||

1520

nla_len(cda[CTA_LABELS_MASK]) != len)

1520

nla_len(cda[CTA_LABELS_MASK]) != len)

1521

return -EINVAL;

1521

return -EINVAL;

1522

mask = nla_data(cda[CTA_LABELS_MASK]);

1522

mask = nla_data(cda[CTA_LABELS_MASK]);

1523

}

1523

}

1524

1525

len /= sizeof(u32);

1525

len /= sizeof(u32);

1526

1527

return nf_connlabels_replace(ct, nla_data(cda[CTA_LABELS]), mask, len);

1527

return nf_connlabels_replace(ct, nla_data(cda[CTA_LABELS]), mask, len);

1528

#else

1528

#else

1529

return -EOPNOTSUPP;

1529

return -EOPNOTSUPP;

1530

#endif

1530

#endif

1531

}

1531

}

1532

1533

static int

1533

static int

1534

ctnetlink_change_conntrack(struct nf_conn *ct,

1534

ctnetlink_change_conntrack(struct nf_conn *ct,

1535

const struct nlattr * const cda[])

1535

const struct nlattr * const cda[])

1536

{

1536

{

1537

int err;

1537

int err;

1538

1539

/* only allow NAT changes and master assignation for new conntracks */

1539

/* only allow NAT changes and master assignation for new conntracks */

1540

if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])

1540

if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])

1541

return -EOPNOTSUPP;

1541

return -EOPNOTSUPP;

1542

1543

if (cda[CTA_HELP]) {

1543

if (cda[CTA_HELP]) {

1544

err = ctnetlink_change_helper(ct, cda);

1544

err = ctnetlink_change_helper(ct, cda);

1545

if (err < 0)

1545

if (err < 0)

1546

return err;

1546

return err;

1547

}

1547

}

1548

1549

if (cda[CTA_TIMEOUT]) {

1549

if (cda[CTA_TIMEOUT]) {

1550

err = ctnetlink_change_timeout(ct, cda);

1550

err = ctnetlink_change_timeout(ct, cda);

1551

if (err < 0)

1551

if (err < 0)

1552

return err;

1552

return err;

1553

}

1553

}

1554

1555

if (cda[CTA_STATUS]) {

1555

if (cda[CTA_STATUS]) {

1556

err = ctnetlink_change_status(ct, cda);

1556

err = ctnetlink_change_status(ct, cda);

1557

if (err < 0)

1557

if (err < 0)

1558

return err;

1558

return err;

1559

}

1559

}

1560

1561

if (cda[CTA_PROTOINFO]) {

1561

if (cda[CTA_PROTOINFO]) {

1562

err = ctnetlink_change_protoinfo(ct, cda);

1562

err = ctnetlink_change_protoinfo(ct, cda);

1563

if (err < 0)

1563

if (err < 0)

1564

return err;

1564

return err;

1565

}

1565

}

1566

1567

#if defined(CONFIG_NF_CONNTRACK_MARK)

1567

#if defined(CONFIG_NF_CONNTRACK_MARK)

1568

if (cda[CTA_MARK])

1568

if (cda[CTA_MARK])

1569

ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));

1569

ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));

1570

#endif

1570

#endif

1571

1572

if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {

1572

if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {

1573

err = ctnetlink_change_seq_adj(ct, cda);

1573

err = ctnetlink_change_seq_adj(ct, cda);

1574

if (err < 0)

1574

if (err < 0)

1575

return err;

1575

return err;

1576

}

1576

}

1577

1578

if (cda[CTA_LABELS]) {

1578

if (cda[CTA_LABELS]) {

1579

err = ctnetlink_attach_labels(ct, cda);

1579

err = ctnetlink_attach_labels(ct, cda);

1580

if (err < 0)

1580

if (err < 0)

1581

return err;

1581

return err;

1582

}

1582

}

1583

1584

return 0;

1584

return 0;

1585

}

1585

}

1586

1587

static struct nf_conn *

1587

static struct nf_conn *

1588

ctnetlink_create_conntrack(struct net *net, u16 zone,

1588

ctnetlink_create_conntrack(struct net *net, u16 zone,

1589

const struct nlattr * const cda[],

1589

const struct nlattr * const cda[],

1590

struct nf_conntrack_tuple *otuple,

1590

struct nf_conntrack_tuple *otuple,

1591

struct nf_conntrack_tuple *rtuple,

1591

struct nf_conntrack_tuple *rtuple,

1592

u8 u3)

1592

u8 u3)

1593

{

1593

{

1594

struct nf_conn *ct;

1594

struct nf_conn *ct;

1595

int err = -EINVAL;

1595

int err = -EINVAL;

1596

struct nf_conntrack_helper *helper;

1596

struct nf_conntrack_helper *helper;

1597

struct nf_conn_tstamp *tstamp;

1597

struct nf_conn_tstamp *tstamp;

1598

1599

ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);

1599

ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);

1600

if (IS_ERR(ct))

1600

if (IS_ERR(ct))

1601

return ERR_PTR(-ENOMEM);

1601

return ERR_PTR(-ENOMEM);

1602

1603

if (!cda[CTA_TIMEOUT])

1603

if (!cda[CTA_TIMEOUT])

1604

goto err1;

1604

goto err1;

1605

ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));

1605

ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));

1606

1607

ct->timeout.expires = jiffies + ct->timeout.expires * HZ;

1607

ct->timeout.expires = jiffies + ct->timeout.expires * HZ;

1608

1609

rcu_read_lock();

1609

rcu_read_lock();

1610

if (cda[CTA_HELP]) {

1610

if (cda[CTA_HELP]) {

1611

char *helpname = NULL;

1611

char *helpname = NULL;

1612

struct nlattr *helpinfo = NULL;

1612

struct nlattr *helpinfo = NULL;

1613

1614

err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);

1614

err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);

1615

if (err < 0)

1615

if (err < 0)

1616

goto err2;

1616

goto err2;

1617

1618

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

1618

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

1619

nf_ct_protonum(ct));

1619

nf_ct_protonum(ct));

1620

if (helper == NULL) {

1620

if (helper == NULL) {

1621

rcu_read_unlock();

1621

rcu_read_unlock();

1622

#ifdef CONFIG_MODULES

1622

#ifdef CONFIG_MODULES

1623

if (request_module("nfct-helper-%s", helpname) < 0) {

1623

if (request_module("nfct-helper-%s", helpname) < 0) {

1624

err = -EOPNOTSUPP;

1624

err = -EOPNOTSUPP;

1625

goto err1;

1625

goto err1;

1626

}

1626

}

1627

1628

rcu_read_lock();

1628

rcu_read_lock();

1629

helper = __nf_conntrack_helper_find(helpname,

1629

helper = __nf_conntrack_helper_find(helpname,

1630

nf_ct_l3num(ct),

1630

nf_ct_l3num(ct),

1631

nf_ct_protonum(ct));

1631

nf_ct_protonum(ct));

1632

if (helper) {

1632

if (helper) {

1633

err = -EAGAIN;

1633

err = -EAGAIN;

1634

goto err2;

1634

goto err2;

1635

}

1635

}

1636

rcu_read_unlock();

1636

rcu_read_unlock();

1637

#endif

1637

#endif

1638

err = -EOPNOTSUPP;

1638

err = -EOPNOTSUPP;

1639

goto err1;

1639

goto err1;

1640

} else {

1640

} else {

1641

struct nf_conn_help *help;

1641

struct nf_conn_help *help;

1642

1643

help = nf_ct_helper_ext_add(ct, helper, GFP_ATOMIC);

1643

help = nf_ct_helper_ext_add(ct, helper, GFP_ATOMIC);

1644

if (help == NULL) {

1644

if (help == NULL) {

1645

err = -ENOMEM;

1645

err = -ENOMEM;

1646

goto err2;

1646

goto err2;

1647

}

1647

}

1648

/* set private helper data if allowed. */

1648

/* set private helper data if allowed. */

1649

if (helper->from_nlattr)

1649

if (helper->from_nlattr)

1650

helper->from_nlattr(helpinfo, ct);

1650

helper->from_nlattr(helpinfo, ct);

1651

1652

/* not in hash table yet so not strictly necessary */

1652

/* not in hash table yet so not strictly necessary */

1653

RCU_INIT_POINTER(help->helper, helper);

1653

RCU_INIT_POINTER(help->helper, helper);

1654

}

1654

}

1655

} else {

1655

} else {

1656

/* try an implicit helper assignation */

1656

/* try an implicit helper assignation */

1657

err = __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);

1657

err = __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);

1658

if (err < 0)

1658

if (err < 0)

1659

goto err2;

1659

goto err2;

1660

}

1660

}

1661

1662

if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {

1662

if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {

1663

err = ctnetlink_change_nat(ct, cda);

1663

err = ctnetlink_change_nat(ct, cda);

1664

if (err < 0)

1664

if (err < 0)

1665

goto err2;

1665

goto err2;

1666

}

1666

}

1667

1668

nf_ct_acct_ext_add(ct, GFP_ATOMIC);

1668

nf_ct_acct_ext_add(ct, GFP_ATOMIC);

1669

nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);

1669

nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);

1670

nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);

1670

nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);

1671

nf_ct_labels_ext_add(ct);

1671

nf_ct_labels_ext_add(ct);

1672

1673

/* we must add conntrack extensions before confirmation. */

1673

/* we must add conntrack extensions before confirmation. */

1674

ct->status |= IPS_CONFIRMED;

1674

ct->status |= IPS_CONFIRMED;

1675

1676

if (cda[CTA_STATUS]) {

1676

if (cda[CTA_STATUS]) {

1677

err = ctnetlink_change_status(ct, cda);

1677

err = ctnetlink_change_status(ct, cda);

1678

if (err < 0)

1678

if (err < 0)

1679

goto err2;

1679

goto err2;

1680

}

1680

}

1681

1682

if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {

1682

if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {

1683

err = ctnetlink_change_seq_adj(ct, cda);

1683

err = ctnetlink_change_seq_adj(ct, cda);

1684

if (err < 0)

1684

if (err < 0)

1685

goto err2;

1685

goto err2;

1686

}

1686

}

1687

1688

memset(&ct->proto, 0, sizeof(ct->proto));

1688

memset(&ct->proto, 0, sizeof(ct->proto));

1689

if (cda[CTA_PROTOINFO]) {

1689

if (cda[CTA_PROTOINFO]) {

1690

err = ctnetlink_change_protoinfo(ct, cda);

1690

err = ctnetlink_change_protoinfo(ct, cda);

1691

if (err < 0)

1691

if (err < 0)

1692

goto err2;

1692

goto err2;

1693

}

1693

}

1694

1695

#if defined(CONFIG_NF_CONNTRACK_MARK)

1695

#if defined(CONFIG_NF_CONNTRACK_MARK)

1696

if (cda[CTA_MARK])

1696

if (cda[CTA_MARK])

1697

ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));

1697

ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));

1698

#endif

1698

#endif

1699

1700

/* setup master conntrack: this is a confirmed expectation */

1700

/* setup master conntrack: this is a confirmed expectation */

1701

if (cda[CTA_TUPLE_MASTER]) {

1701

if (cda[CTA_TUPLE_MASTER]) {

1702

struct nf_conntrack_tuple master;

1702

struct nf_conntrack_tuple master;

1703

struct nf_conntrack_tuple_hash *master_h;

1703

struct nf_conntrack_tuple_hash *master_h;

1704

struct nf_conn *master_ct;

1704

struct nf_conn *master_ct;

1705

1706

err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);

1706

err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);

1707

if (err < 0)

1707

if (err < 0)

1708

goto err2;

1708

goto err2;

1709

1710

master_h = nf_conntrack_find_get(net, zone, &master);

1710

master_h = nf_conntrack_find_get(net, zone, &master);

1711

if (master_h == NULL) {

1711

if (master_h == NULL) {

1712

err = -ENOENT;

1712

err = -ENOENT;

1713

goto err2;

1713

goto err2;

1714

}

1714

}

1715

master_ct = nf_ct_tuplehash_to_ctrack(master_h);

1715

master_ct = nf_ct_tuplehash_to_ctrack(master_h);

1716

__set_bit(IPS_EXPECTED_BIT, &ct->status);

1716

__set_bit(IPS_EXPECTED_BIT, &ct->status);

1717

ct->master = master_ct;

1717

ct->master = master_ct;

1718

}

1718

}

1719

tstamp = nf_conn_tstamp_find(ct);

1719

tstamp = nf_conn_tstamp_find(ct);

1720

if (tstamp)

1720

if (tstamp)

1721

tstamp->start = ktime_to_ns(ktime_get_real());

1721

tstamp->start = ktime_to_ns(ktime_get_real());

1722

1723

err = nf_conntrack_hash_check_insert(ct);

1723

err = nf_conntrack_hash_check_insert(ct);

1724

if (err < 0)

1724

if (err < 0)

1725

goto err2;

1725

goto err2;

1726

1727

rcu_read_unlock();

1727

rcu_read_unlock();

1728

1729

return ct;

1729

return ct;

1730

1731

err2:

1731

err2:

1732

rcu_read_unlock();

1732

rcu_read_unlock();

1733

err1:

1733

err1:

1734

nf_conntrack_free(ct);

1734

nf_conntrack_free(ct);

1735

return ERR_PTR(err);

1735

return ERR_PTR(err);

1736

}

1736

}

1737

1738

static int

1738

static int

1739

ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,

1739

ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,

1740

const struct nlmsghdr *nlh,

1740

const struct nlmsghdr *nlh,

1741

const struct nlattr * const cda[])

1741

const struct nlattr * const cda[])

1742

{

1742

{

1743

struct net *net = sock_net(ctnl);

1743

struct net *net = sock_net(ctnl);

1744

struct nf_conntrack_tuple otuple, rtuple;

1744

struct nf_conntrack_tuple otuple, rtuple;

1745

struct nf_conntrack_tuple_hash *h = NULL;

1745

struct nf_conntrack_tuple_hash *h = NULL;

1746

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

1746

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

1747

struct nf_conn *ct;

1747

struct nf_conn *ct;

1748

u_int8_t u3 = nfmsg->nfgen_family;

1748

u_int8_t u3 = nfmsg->nfgen_family;

1749

u16 zone;

1749

u16 zone;

1750

int err;

1750

int err;

1751

1752

err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);

1752

err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);

1753

if (err < 0)

1753

if (err < 0)

1754

return err;

1754

return err;

1755

1756

if (cda[CTA_TUPLE_ORIG]) {

1756

if (cda[CTA_TUPLE_ORIG]) {

1757

err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);

1757

err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);

1758

if (err < 0)

1758

if (err < 0)

1759

return err;

1759

return err;

1760

}

1760

}

1761

1762

if (cda[CTA_TUPLE_REPLY]) {

1762

if (cda[CTA_TUPLE_REPLY]) {

1763

err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);

1763

err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);

1764

if (err < 0)

1764

if (err < 0)

1765

return err;

1765

return err;

1766

}

1766

}

1767

1768

if (cda[CTA_TUPLE_ORIG])

1768

if (cda[CTA_TUPLE_ORIG])

1769

h = nf_conntrack_find_get(net, zone, &otuple);

1769

h = nf_conntrack_find_get(net, zone, &otuple);

1770

else if (cda[CTA_TUPLE_REPLY])

1770

else if (cda[CTA_TUPLE_REPLY])

1771

h = nf_conntrack_find_get(net, zone, &rtuple);

1771

h = nf_conntrack_find_get(net, zone, &rtuple);

1772

1773

if (h == NULL) {

1773

if (h == NULL) {

1774

err = -ENOENT;

1774

err = -ENOENT;

1775

if (nlh->nlmsg_flags & NLM_F_CREATE) {

1775

if (nlh->nlmsg_flags & NLM_F_CREATE) {

1776

enum ip_conntrack_events events;

1776

enum ip_conntrack_events events;

1777

1778

if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])

1778

if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])

1779

return -EINVAL;

1779

return -EINVAL;

1780

1781

ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,

1781

ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,

1782

&rtuple, u3);

1782

&rtuple, u3);

1783

if (IS_ERR(ct))

1783

if (IS_ERR(ct))

1784

return PTR_ERR(ct);

1784

return PTR_ERR(ct);

1785

1786

err = 0;

1786

err = 0;

1787

if (test_bit(IPS_EXPECTED_BIT, &ct->status))

1787

if (test_bit(IPS_EXPECTED_BIT, &ct->status))

1788

events = IPCT_RELATED;

1788

events = IPCT_RELATED;

1789

else

1789

else

1790

events = IPCT_NEW;

1790

events = IPCT_NEW;

1791

1792

if (cda[CTA_LABELS] &&

1792

if (cda[CTA_LABELS] &&

1793

ctnetlink_attach_labels(ct, cda) == 0)

1793

ctnetlink_attach_labels(ct, cda) == 0)

1794

events |= (1 << IPCT_LABEL);

1794

events |= (1 << IPCT_LABEL);

1795

1796

nf_conntrack_eventmask_report((1 << IPCT_REPLY) |

1796

nf_conntrack_eventmask_report((1 << IPCT_REPLY) |

1797

(1 << IPCT_ASSURED) |

1797

(1 << IPCT_ASSURED) |

1798

(1 << IPCT_HELPER) |

1798

(1 << IPCT_HELPER) |

1799

(1 << IPCT_PROTOINFO) |

1799

(1 << IPCT_PROTOINFO) |

1800

(1 << IPCT_SEQADJ) |

1800

(1 << IPCT_SEQADJ) |

1801

(1 << IPCT_MARK) | events,

1801

(1 << IPCT_MARK) | events,

1802

ct, NETLINK_CB(skb).portid,

1802

ct, NETLINK_CB(skb).portid,

1803

nlmsg_report(nlh));

1803

nlmsg_report(nlh));

1804

nf_ct_put(ct);

1804

nf_ct_put(ct);

1805

}

1805

}

1806

1807

return err;

1807

return err;

1808

}

1808

}

1809

/* implicit 'else' */

1809

/* implicit 'else' */

1810

1811

err = -EEXIST;

1811

err = -EEXIST;

1812

ct = nf_ct_tuplehash_to_ctrack(h);

1812

ct = nf_ct_tuplehash_to_ctrack(h);

1813

if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {

1813

if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {

1814

spin_lock_bh(&nf_conntrack_lock);

1814

spin_lock_bh(&nf_conntrack_lock);

1815

err = ctnetlink_change_conntrack(ct, cda);

1815

err = ctnetlink_change_conntrack(ct, cda);

1816

spin_unlock_bh(&nf_conntrack_lock);

1816

spin_unlock_bh(&nf_conntrack_lock);

1817

if (err == 0) {

1817

if (err == 0) {

1818

nf_conntrack_eventmask_report((1 << IPCT_REPLY) |

1818

nf_conntrack_eventmask_report((1 << IPCT_REPLY) |

1819

(1 << IPCT_ASSURED) |

1819

(1 << IPCT_ASSURED) |

1820

(1 << IPCT_HELPER) |

1820

(1 << IPCT_HELPER) |

1821

(1 << IPCT_LABEL) |

1821

(1 << IPCT_LABEL) |

1822

(1 << IPCT_PROTOINFO) |

1822

(1 << IPCT_PROTOINFO) |

1823

(1 << IPCT_SEQADJ) |

1823

(1 << IPCT_SEQADJ) |

1824

(1 << IPCT_MARK),

1824

(1 << IPCT_MARK),

1825

ct, NETLINK_CB(skb).portid,

1825

ct, NETLINK_CB(skb).portid,

1826

nlmsg_report(nlh));

1826

nlmsg_report(nlh));

1827

}

1827

}

1828

}

1828

}

1829

1830

nf_ct_put(ct);

1830

nf_ct_put(ct);

1831

return err;

1831

return err;

1832

}

1832

}

1833

1834

static int

1834

static int

1835

ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,

1835

ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,

1836

__u16 cpu, const struct ip_conntrack_stat *st)

1836

__u16 cpu, const struct ip_conntrack_stat *st)

1837

{

1837

{

1838

struct nlmsghdr *nlh;

1838

struct nlmsghdr *nlh;

1839

struct nfgenmsg *nfmsg;

1839

struct nfgenmsg *nfmsg;

1840

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

1840

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

1841

1842

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS_CPU);

1842

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS_CPU);

1843

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

1843

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

1844

if (nlh == NULL)

1844

if (nlh == NULL)

1845

goto nlmsg_failure;

1845

goto nlmsg_failure;

1846

1847

nfmsg = nlmsg_data(nlh);

1847

nfmsg = nlmsg_data(nlh);

1848

nfmsg->nfgen_family = AF_UNSPEC;

1848

nfmsg->nfgen_family = AF_UNSPEC;

1849

nfmsg->version = NFNETLINK_V0;

1849

nfmsg->version = NFNETLINK_V0;

1850

nfmsg->res_id = htons(cpu);

1850

nfmsg->res_id = htons(cpu);

1851

1852

if (nla_put_be32(skb, CTA_STATS_SEARCHED, htonl(st->searched)) ||

1852

if (nla_put_be32(skb, CTA_STATS_SEARCHED, htonl(st->searched)) ||

1853

nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||

1853

nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||

1854

nla_put_be32(skb, CTA_STATS_NEW, htonl(st->new)) ||

1854

nla_put_be32(skb, CTA_STATS_NEW, htonl(st->new)) ||

1855

nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||

1855

nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||

1856

nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||

1856

nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||

1857

nla_put_be32(skb, CTA_STATS_DELETE, htonl(st->delete)) ||

1857

nla_put_be32(skb, CTA_STATS_DELETE, htonl(st->delete)) ||

1858

nla_put_be32(skb, CTA_STATS_DELETE_LIST, htonl(st->delete_list)) ||

1858

nla_put_be32(skb, CTA_STATS_DELETE_LIST, htonl(st->delete_list)) ||

1859

nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||

1859

nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||

1860

nla_put_be32(skb, CTA_STATS_INSERT_FAILED,

1860

nla_put_be32(skb, CTA_STATS_INSERT_FAILED,

1861

htonl(st->insert_failed)) ||

1861

htonl(st->insert_failed)) ||

1862

nla_put_be32(skb, CTA_STATS_DROP, htonl(st->drop)) ||

1862

nla_put_be32(skb, CTA_STATS_DROP, htonl(st->drop)) ||

1863

nla_put_be32(skb, CTA_STATS_EARLY_DROP, htonl(st->early_drop)) ||

1863

nla_put_be32(skb, CTA_STATS_EARLY_DROP, htonl(st->early_drop)) ||

1864

nla_put_be32(skb, CTA_STATS_ERROR, htonl(st->error)) ||

1864

nla_put_be32(skb, CTA_STATS_ERROR, htonl(st->error)) ||

1865

nla_put_be32(skb, CTA_STATS_SEARCH_RESTART,

1865

nla_put_be32(skb, CTA_STATS_SEARCH_RESTART,

1866

htonl(st->search_restart)))

1866

htonl(st->search_restart)))

1867

goto nla_put_failure;

1867

goto nla_put_failure;

1868

1869

nlmsg_end(skb, nlh);

1869

nlmsg_end(skb, nlh);

1870

return skb->len;

1870

return skb->len;

1871

1872

nla_put_failure:

1872

nla_put_failure:

1873

nlmsg_failure:

1873

nlmsg_failure:

1874

nlmsg_cancel(skb, nlh);

1874

nlmsg_cancel(skb, nlh);

1875

return -1;

1875

return -1;

1876

}

1876

}

1877

1878

static int

1878

static int

1879

ctnetlink_ct_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)

1879

ctnetlink_ct_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)

1880

{

1880

{

1881

int cpu;

1881

int cpu;

1882

struct net *net = sock_net(skb->sk);

1882

struct net *net = sock_net(skb->sk);

1883

1884

if (cb->args[0] == nr_cpu_ids)

1884

if (cb->args[0] == nr_cpu_ids)

1885

return 0;

1885

return 0;

1886

1887

for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {

1887

for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {

1888

const struct ip_conntrack_stat *st;

1888

const struct ip_conntrack_stat *st;

1889

1890

if (!cpu_possible(cpu))

1890

if (!cpu_possible(cpu))

1891

continue;

1891

continue;

1892

1893

st = per_cpu_ptr(net->ct.stat, cpu);

1893

st = per_cpu_ptr(net->ct.stat, cpu);

1894

if (ctnetlink_ct_stat_cpu_fill_info(skb,

1894

if (ctnetlink_ct_stat_cpu_fill_info(skb,

1895

NETLINK_CB(cb->skb).portid,

1895

NETLINK_CB(cb->skb).portid,

1896

cb->nlh->nlmsg_seq,

1896

cb->nlh->nlmsg_seq,

1897

cpu, st) < 0)

1897

cpu, st) < 0)

1898

break;

1898

break;

1899

}

1899

}

1900

cb->args[0] = cpu;

1900

cb->args[0] = cpu;

1901

1902

return skb->len;

1902

return skb->len;

1903

}

1903

}

1904

1905

static int

1905

static int

1906

ctnetlink_stat_ct_cpu(struct sock *ctnl, struct sk_buff *skb,

1906

ctnetlink_stat_ct_cpu(struct sock *ctnl, struct sk_buff *skb,

1907

const struct nlmsghdr *nlh,

1907

const struct nlmsghdr *nlh,

1908

const struct nlattr * const cda[])

1908

const struct nlattr * const cda[])

1909

{

1909

{

1910

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1910

if (nlh->nlmsg_flags & NLM_F_DUMP) {

1911

struct netlink_dump_control c = {

1911

struct netlink_dump_control c = {

1912

.dump = ctnetlink_ct_stat_cpu_dump,

1912

.dump = ctnetlink_ct_stat_cpu_dump,

1913

};

1913

};

1914

return netlink_dump_start(ctnl, skb, nlh, &c);

1914

return netlink_dump_start(ctnl, skb, nlh, &c);

1915

}

1915

}

1916

1917

return 0;

1917

return 0;

1918

}

1918

}

1919

1920

static int

1920

static int

1921

ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,

1921

ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,

1922

struct net *net)

1922

struct net *net)

1923

{

1923

{

1924

struct nlmsghdr *nlh;

1924

struct nlmsghdr *nlh;

1925

struct nfgenmsg *nfmsg;

1925

struct nfgenmsg *nfmsg;

1926

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

1926

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

1927

unsigned int nr_conntracks = atomic_read(&net->ct.count);

1927

unsigned int nr_conntracks = atomic_read(&net->ct.count);

1928

1929

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS);

1929

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS);

1930

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

1930

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

1931

if (nlh == NULL)

1931

if (nlh == NULL)

1932

goto nlmsg_failure;

1932

goto nlmsg_failure;

1933

1934

nfmsg = nlmsg_data(nlh);

1934

nfmsg = nlmsg_data(nlh);

1935

nfmsg->nfgen_family = AF_UNSPEC;

1935

nfmsg->nfgen_family = AF_UNSPEC;

1936

nfmsg->version = NFNETLINK_V0;

1936

nfmsg->version = NFNETLINK_V0;

1937

nfmsg->res_id = 0;

1937

nfmsg->res_id = 0;

1938

1939

if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))

1939

if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))

1940

goto nla_put_failure;

1940

goto nla_put_failure;

1941

1942

nlmsg_end(skb, nlh);

1942

nlmsg_end(skb, nlh);

1943

return skb->len;

1943

return skb->len;

1944

1945

nla_put_failure:

1945

nla_put_failure:

1946

nlmsg_failure:

1946

nlmsg_failure:

1947

nlmsg_cancel(skb, nlh);

1947

nlmsg_cancel(skb, nlh);

1948

return -1;

1948

return -1;

1949

}

1949

}

1950

1951

static int

1951

static int

1952

ctnetlink_stat_ct(struct sock *ctnl, struct sk_buff *skb,

1952

ctnetlink_stat_ct(struct sock *ctnl, struct sk_buff *skb,

1953

const struct nlmsghdr *nlh,

1953

const struct nlmsghdr *nlh,

1954

const struct nlattr * const cda[])

1954

const struct nlattr * const cda[])

1955

{

1955

{

1956

struct sk_buff *skb2;

1956

struct sk_buff *skb2;

1957

int err;

1957

int err;

1958

1959

skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

1959

skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

1960

if (skb2 == NULL)

1960

if (skb2 == NULL)

1961

return -ENOMEM;

1961

return -ENOMEM;

1962

1963

err = ctnetlink_stat_ct_fill_info(skb2, NETLINK_CB(skb).portid,

1963

err = ctnetlink_stat_ct_fill_info(skb2, NETLINK_CB(skb).portid,

1964

nlh->nlmsg_seq,

1964

nlh->nlmsg_seq,

1965

NFNL_MSG_TYPE(nlh->nlmsg_type),

1965

NFNL_MSG_TYPE(nlh->nlmsg_type),

1966

sock_net(skb->sk));

1966

sock_net(skb->sk));

1967

if (err <= 0)

1967

if (err <= 0)

1968

goto free;

1968

goto free;

1969

1970

err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);

1970

err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);

1971

if (err < 0)

1971

if (err < 0)

1972

goto out;

1972

goto out;

1973

1974

return 0;

1974

return 0;

1975

1976

free:

1976

free:

1977

kfree_skb(skb2);

1977

kfree_skb(skb2);

1978

out:

1978

out:

1979

/* this avoids a loop in nfnetlink. */

1979

/* this avoids a loop in nfnetlink. */

1980

return err == -EAGAIN ? -ENOBUFS : err;

1980

return err == -EAGAIN ? -ENOBUFS : err;

1981

}

1981

}

1982

1983

static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {

1983

static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {

1984

[CTA_EXPECT_MASTER] = { .type = NLA_NESTED },

1984

[CTA_EXPECT_MASTER] = { .type = NLA_NESTED },

1985

[CTA_EXPECT_TUPLE] = { .type = NLA_NESTED },

1985

[CTA_EXPECT_TUPLE] = { .type = NLA_NESTED },

1986

[CTA_EXPECT_MASK] = { .type = NLA_NESTED },

1986

[CTA_EXPECT_MASK] = { .type = NLA_NESTED },

1987

[CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },

1987

[CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },

1988

[CTA_EXPECT_ID] = { .type = NLA_U32 },

1988

[CTA_EXPECT_ID] = { .type = NLA_U32 },

1989

[CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING,

1989

[CTA_EXPECT_HELP_NAME] = { .type = NLA_NUL_STRING,

1990

.len = NF_CT_HELPER_NAME_LEN - 1 },

1990

.len = NF_CT_HELPER_NAME_LEN - 1 },

1991

[CTA_EXPECT_ZONE] = { .type = NLA_U16 },

1991

[CTA_EXPECT_ZONE] = { .type = NLA_U16 },

1992

[CTA_EXPECT_FLAGS] = { .type = NLA_U32 },

1992

[CTA_EXPECT_FLAGS] = { .type = NLA_U32 },

1993

[CTA_EXPECT_CLASS] = { .type = NLA_U32 },

1993

[CTA_EXPECT_CLASS] = { .type = NLA_U32 },

1994

[CTA_EXPECT_NAT] = { .type = NLA_NESTED },

1994

[CTA_EXPECT_NAT] = { .type = NLA_NESTED },

1995

[CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },

1995

[CTA_EXPECT_FN] = { .type = NLA_NUL_STRING },

1996

};

1996

};

1997

1998

static struct nf_conntrack_expect *

1998

static struct nf_conntrack_expect *

1999

ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,

1999

ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,

2000

struct nf_conntrack_helper *helper,

2000

struct nf_conntrack_helper *helper,

2001

struct nf_conntrack_tuple *tuple,

2001

struct nf_conntrack_tuple *tuple,

2002

struct nf_conntrack_tuple *mask);

2002

struct nf_conntrack_tuple *mask);

2003

2004

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

2004

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

2005

static size_t

2005

static size_t

2006

ctnetlink_nfqueue_build_size(const struct nf_conn *ct)

2006

ctnetlink_nfqueue_build_size(const struct nf_conn *ct)

2007

{

2007

{

2008

return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */

2008

return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */

2009

+ 3 * nla_total_size(0) /* CTA_TUPLE_IP */

2009

+ 3 * nla_total_size(0) /* CTA_TUPLE_IP */

2010

+ 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */

2010

+ 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */

2011

+ 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */

2011

+ 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */

2012

+ nla_total_size(sizeof(u_int32_t)) /* CTA_ID */

2012

+ nla_total_size(sizeof(u_int32_t)) /* CTA_ID */

2013

+ nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */

2013

+ nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */

2014

+ nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */

2014

+ nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */

2015

+ nla_total_size(0) /* CTA_PROTOINFO */

2015

+ nla_total_size(0) /* CTA_PROTOINFO */

2016

+ nla_total_size(0) /* CTA_HELP */

2016

+ nla_total_size(0) /* CTA_HELP */

2017

+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */

2017

+ nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */

2018

+ ctnetlink_secctx_size(ct)

2018

+ ctnetlink_secctx_size(ct)

2019

#ifdef CONFIG_NF_NAT_NEEDED

2019

#ifdef CONFIG_NF_NAT_NEEDED

2020

+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */

2020

+ 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */

2021

+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */

2021

+ 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */

2022

#endif

2022

#endif

2023

#ifdef CONFIG_NF_CONNTRACK_MARK

2023

#ifdef CONFIG_NF_CONNTRACK_MARK

2024

+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */

2024

+ nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */

2025

#endif

2025

#endif

2026

+ ctnetlink_proto_size(ct)

2026

+ ctnetlink_proto_size(ct)

2027

;

2027

;

2028

}

2028

}

2029

2030

static int

2030

static int

2031

ctnetlink_nfqueue_build(struct sk_buff *skb, struct nf_conn *ct)

2031

ctnetlink_nfqueue_build(struct sk_buff *skb, struct nf_conn *ct)

2032

{

2032

{

2033

struct nlattr *nest_parms;

2033

struct nlattr *nest_parms;

2034

2035

rcu_read_lock();

2035

rcu_read_lock();

2036

nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);

2036

nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);

2037

if (!nest_parms)

2037

if (!nest_parms)

2038

goto nla_put_failure;

2038

goto nla_put_failure;

2039

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

2039

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)

2040

goto nla_put_failure;

2040

goto nla_put_failure;

2041

nla_nest_end(skb, nest_parms);

2041

nla_nest_end(skb, nest_parms);

2042

2043

nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);

2043

nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);

2044

if (!nest_parms)

2044

if (!nest_parms)

2045

goto nla_put_failure;

2045

goto nla_put_failure;

2046

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

2046

if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)

2047

goto nla_put_failure;

2047

goto nla_put_failure;

2048

nla_nest_end(skb, nest_parms);

2048

nla_nest_end(skb, nest_parms);

2049

2050

if (nf_ct_zone(ct)) {

2050

if (nf_ct_zone(ct)) {

2051

if (nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))

2051

if (nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))

2052

goto nla_put_failure;

2052

goto nla_put_failure;

2053

}

2053

}

2054

2055

if (ctnetlink_dump_id(skb, ct) < 0)

2055

if (ctnetlink_dump_id(skb, ct) < 0)

2056

goto nla_put_failure;

2056

goto nla_put_failure;

2057

2058

if (ctnetlink_dump_status(skb, ct) < 0)

2058

if (ctnetlink_dump_status(skb, ct) < 0)

2059

goto nla_put_failure;

2059

goto nla_put_failure;

2060

2061

if (ctnetlink_dump_timeout(skb, ct) < 0)

2061

if (ctnetlink_dump_timeout(skb, ct) < 0)

2062

goto nla_put_failure;

2062

goto nla_put_failure;

2063

2064

if (ctnetlink_dump_protoinfo(skb, ct) < 0)

2064

if (ctnetlink_dump_protoinfo(skb, ct) < 0)

2065

goto nla_put_failure;

2065

goto nla_put_failure;

2066

2067

if (ctnetlink_dump_helpinfo(skb, ct) < 0)

2067

if (ctnetlink_dump_helpinfo(skb, ct) < 0)

2068

goto nla_put_failure;

2068

goto nla_put_failure;

2069

2070

#ifdef CONFIG_NF_CONNTRACK_SECMARK

2070

#ifdef CONFIG_NF_CONNTRACK_SECMARK

2071

if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0)

2071

if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0)

2072

goto nla_put_failure;

2072

goto nla_put_failure;

2073

#endif

2073

#endif

2074

if (ct->master && ctnetlink_dump_master(skb, ct) < 0)

2074

if (ct->master && ctnetlink_dump_master(skb, ct) < 0)

2075

goto nla_put_failure;

2075

goto nla_put_failure;

2076

2077

if ((ct->status & IPS_SEQ_ADJUST) &&

2077

if ((ct->status & IPS_SEQ_ADJUST) &&

2078

ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

2078

ctnetlink_dump_ct_seq_adj(skb, ct) < 0)

2079

goto nla_put_failure;

2079

goto nla_put_failure;

2080

2081

#ifdef CONFIG_NF_CONNTRACK_MARK

2081

#ifdef CONFIG_NF_CONNTRACK_MARK

2082

if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)

2082

if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)

2083

goto nla_put_failure;

2083

goto nla_put_failure;

2084

#endif

2084

#endif

2085

if (ctnetlink_dump_labels(skb, ct) < 0)

2085

if (ctnetlink_dump_labels(skb, ct) < 0)

2086

goto nla_put_failure;

2086

goto nla_put_failure;

2087

rcu_read_unlock();

2087

rcu_read_unlock();

2088

return 0;

2088

return 0;

2089

2090

nla_put_failure:

2090

nla_put_failure:

2091

rcu_read_unlock();

2091

rcu_read_unlock();

2092

return -ENOSPC;

2092

return -ENOSPC;

2093

}

2093

}

2094

2095

static int

2095

static int

2096

ctnetlink_nfqueue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)

2096

ctnetlink_nfqueue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)

2097

{

2097

{

2098

int err;

2098

int err;

2099

2100

if (cda[CTA_TIMEOUT]) {

2100

if (cda[CTA_TIMEOUT]) {

2101

err = ctnetlink_change_timeout(ct, cda);

2101

err = ctnetlink_change_timeout(ct, cda);

2102

if (err < 0)

2102

if (err < 0)

2103

return err;

2103

return err;

2104

}

2104

}

2105

if (cda[CTA_STATUS]) {

2105

if (cda[CTA_STATUS]) {

2106

err = ctnetlink_change_status(ct, cda);

2106

err = ctnetlink_change_status(ct, cda);

2107

if (err < 0)

2107

if (err < 0)

2108

return err;

2108

return err;

2109

}

2109

}

2110

if (cda[CTA_HELP]) {

2110

if (cda[CTA_HELP]) {

2111

err = ctnetlink_change_helper(ct, cda);

2111

err = ctnetlink_change_helper(ct, cda);

2112

if (err < 0)

2112

if (err < 0)

2113

return err;

2113

return err;

2114

}

2114

}

2115

if (cda[CTA_LABELS]) {

2115

if (cda[CTA_LABELS]) {

2116

err = ctnetlink_attach_labels(ct, cda);

2116

err = ctnetlink_attach_labels(ct, cda);

2117

if (err < 0)

2117

if (err < 0)

2118

return err;

2118

return err;

2119

}

2119

}

2120

#if defined(CONFIG_NF_CONNTRACK_MARK)

2120

#if defined(CONFIG_NF_CONNTRACK_MARK)

2121

if (cda[CTA_MARK])

2121

if (cda[CTA_MARK]) {

2122

ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));

2122

u32 mask = 0, mark, newmark;

2123

if (cda[CTA_MARK_MASK])

2124

mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK]));

2125

2126

mark = ntohl(nla_get_be32(cda[CTA_MARK]));

2127

newmark = (ct->mark & mask) ^ mark;

2128

if (newmark != ct->mark)

2129

ct->mark = newmark;

2130

}

2123

#endif

2131

#endif

2124

return 0;

2132

return 0;

2125

}

2133

}

2126

2134

2127

static int

2135

static int

2128

ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)

2136

ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)

2129

{

2137

{

2130

struct nlattr *cda[CTA_MAX+1];

2138

struct nlattr *cda[CTA_MAX+1];

2131

int ret;

2139

int ret;

2132

2140

2133

ret = nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);

2141

ret = nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);

2134

if (ret < 0)

2142

if (ret < 0)

2135

return ret;

2143

return ret;

2136

2144

2137

spin_lock_bh(&nf_conntrack_lock);

2145

spin_lock_bh(&nf_conntrack_lock);

2138

ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);

2146

ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);

2139

spin_unlock_bh(&nf_conntrack_lock);

2147

spin_unlock_bh(&nf_conntrack_lock);

2140

2148

2141

return ret;

2149

return ret;

2142

}

2150

}

2143

2151

2144

static int ctnetlink_nfqueue_exp_parse(const struct nlattr * const *cda,

2152

static int ctnetlink_nfqueue_exp_parse(const struct nlattr * const *cda,

2145

const struct nf_conn *ct,

2153

const struct nf_conn *ct,

2146

struct nf_conntrack_tuple *tuple,

2154

struct nf_conntrack_tuple *tuple,

2147

struct nf_conntrack_tuple *mask)

2155

struct nf_conntrack_tuple *mask)

2148

{

2156

{

2149

int err;

2157

int err;

2150

2158

2151

err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE,

2159

err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE,

2152

nf_ct_l3num(ct));

2160

nf_ct_l3num(ct));

2153

if (err < 0)

2161

if (err < 0)

2154

return err;

2162

return err;

2155

2163

2156

return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK,

2164

return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK,

2157

nf_ct_l3num(ct));

2165

nf_ct_l3num(ct));

2158

}

2166

}

2159

2167

2160

static int

2168

static int

2161

ctnetlink_nfqueue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,

2169

ctnetlink_nfqueue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,

2162

u32 portid, u32 report)

2170

u32 portid, u32 report)

2163

{

2171

{

2164

struct nlattr *cda[CTA_EXPECT_MAX+1];

2172

struct nlattr *cda[CTA_EXPECT_MAX+1];

2165

struct nf_conntrack_tuple tuple, mask;

2173

struct nf_conntrack_tuple tuple, mask;

2166

struct nf_conntrack_helper *helper = NULL;

2174

struct nf_conntrack_helper *helper = NULL;

2167

struct nf_conntrack_expect *exp;

2175

struct nf_conntrack_expect *exp;

2168

int err;

2176

int err;

2169

2177

2170

err = nla_parse_nested(cda, CTA_EXPECT_MAX, attr, exp_nla_policy);

2178

err = nla_parse_nested(cda, CTA_EXPECT_MAX, attr, exp_nla_policy);

2171

if (err < 0)

2179

if (err < 0)

2172

return err;

2180

return err;

2173

2181

2174

err = ctnetlink_nfqueue_exp_parse((const struct nlattr * const *)cda,

2182

err = ctnetlink_nfqueue_exp_parse((const struct nlattr * const *)cda,

2175

ct, &tuple, &mask);

2183

ct, &tuple, &mask);

2176

if (err < 0)

2184

if (err < 0)

2177

return err;

2185

return err;

2178

2186

2179

if (cda[CTA_EXPECT_HELP_NAME]) {

2187

if (cda[CTA_EXPECT_HELP_NAME]) {

2180

const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);

2188

const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);

2181

2189

2182

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

2190

helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),

2183

nf_ct_protonum(ct));

2191

nf_ct_protonum(ct));

2184

if (helper == NULL)

2192

if (helper == NULL)

2185

return -EOPNOTSUPP;

2193

return -EOPNOTSUPP;

2186

}

2194

}

2187

2195

2188

exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,

2196

exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,

2189

helper, &tuple, &mask);

2197

helper, &tuple, &mask);

2190

if (IS_ERR(exp))

2198

if (IS_ERR(exp))

2191

return PTR_ERR(exp);

2199

return PTR_ERR(exp);

2192

2200

2193

err = nf_ct_expect_related_report(exp, portid, report);

2201

err = nf_ct_expect_related_report(exp, portid, report);

2194

if (err < 0) {

2202

if (err < 0) {

2195

nf_ct_expect_put(exp);

2203

nf_ct_expect_put(exp);

2196

return err;

2204

return err;

2197

}

2205

}

2198

2206

2199

return 0;

2207

return 0;

2200

}

2208

}

2201

2209

2202

static struct nfq_ct_hook ctnetlink_nfqueue_hook = {

2210

static struct nfq_ct_hook ctnetlink_nfqueue_hook = {

2203

.build_size = ctnetlink_nfqueue_build_size,

2211

.build_size = ctnetlink_nfqueue_build_size,

2204

.build = ctnetlink_nfqueue_build,

2212

.build = ctnetlink_nfqueue_build,

2205

.parse = ctnetlink_nfqueue_parse,

2213

.parse = ctnetlink_nfqueue_parse,

2206

.attach_expect = ctnetlink_nfqueue_attach_expect,

2214

.attach_expect = ctnetlink_nfqueue_attach_expect,

2207

.seq_adjust = nf_ct_tcp_seqadj_set,

2215

.seq_adjust = nf_ct_tcp_seqadj_set,

2208

};

2216

};

2209

#endif /* CONFIG_NETFILTER_NETLINK_QUEUE_CT */

2217

#endif /* CONFIG_NETFILTER_NETLINK_QUEUE_CT */

2210

2218

2211

/***********************************************************************

2219

/***********************************************************************

2212

* EXPECT

2220

* EXPECT

2213

***********************************************************************/

2221

***********************************************************************/

2214

2222

2215

static inline int

2223

static inline int

2216

ctnetlink_exp_dump_tuple(struct sk_buff *skb,

2224

ctnetlink_exp_dump_tuple(struct sk_buff *skb,

2217

const struct nf_conntrack_tuple *tuple,

2225

const struct nf_conntrack_tuple *tuple,

2218

enum ctattr_expect type)

2226

enum ctattr_expect type)

2219

{

2227

{

2220

struct nlattr *nest_parms;

2228

struct nlattr *nest_parms;

2221

2229

2222

nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);

2230

nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);

2223

if (!nest_parms)

2231

if (!nest_parms)

2224

goto nla_put_failure;

2232

goto nla_put_failure;

2225

if (ctnetlink_dump_tuples(skb, tuple) < 0)

2233

if (ctnetlink_dump_tuples(skb, tuple) < 0)

2226

goto nla_put_failure;

2234

goto nla_put_failure;

2227

nla_nest_end(skb, nest_parms);

2235

nla_nest_end(skb, nest_parms);

2228

2236

2229

return 0;

2237

return 0;

2230

2238

2231

nla_put_failure:

2239

nla_put_failure:

2232

return -1;

2240

return -1;

2233

}

2241

}

2234

2242

2235

static inline int

2243

static inline int

2236

ctnetlink_exp_dump_mask(struct sk_buff *skb,

2244

ctnetlink_exp_dump_mask(struct sk_buff *skb,

2237

const struct nf_conntrack_tuple *tuple,

2245

const struct nf_conntrack_tuple *tuple,

2238

const struct nf_conntrack_tuple_mask *mask)

2246

const struct nf_conntrack_tuple_mask *mask)

2239

{

2247

{

2240

int ret;

2248

int ret;

2241

struct nf_conntrack_l3proto *l3proto;

2249

struct nf_conntrack_l3proto *l3proto;

2242

struct nf_conntrack_l4proto *l4proto;

2250

struct nf_conntrack_l4proto *l4proto;

2243

struct nf_conntrack_tuple m;

2251

struct nf_conntrack_tuple m;

2244

struct nlattr *nest_parms;

2252

struct nlattr *nest_parms;

2245

2253

2246

memset(&m, 0xFF, sizeof(m));

2254

memset(&m, 0xFF, sizeof(m));

2247

memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));

2255

memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));

2248

m.src.u.all = mask->src.u.all;

2256

m.src.u.all = mask->src.u.all;

2249

m.dst.protonum = tuple->dst.protonum;

2257

m.dst.protonum = tuple->dst.protonum;

2250

2258

2251

nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);

2259

nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);

2252

if (!nest_parms)

2260

if (!nest_parms)

2253

goto nla_put_failure;

2261

goto nla_put_failure;

2254

2262

2255

rcu_read_lock();

2263

rcu_read_lock();

2256

l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

2264

l3proto = __nf_ct_l3proto_find(tuple->src.l3num);

2257

ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);

2265

ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);

2258

if (ret >= 0) {

2266

if (ret >= 0) {

2259

l4proto = __nf_ct_l4proto_find(tuple->src.l3num,

2267

l4proto = __nf_ct_l4proto_find(tuple->src.l3num,

2260

tuple->dst.protonum);

2268

tuple->dst.protonum);

2261

ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);

2269

ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);

2262

}

2270

}

2263

rcu_read_unlock();

2271

rcu_read_unlock();

2264

2272

2265

if (unlikely(ret < 0))

2273

if (unlikely(ret < 0))

2266

goto nla_put_failure;

2274

goto nla_put_failure;

2267

2275

2268

nla_nest_end(skb, nest_parms);

2276

nla_nest_end(skb, nest_parms);

2269

2277

2270

return 0;

2278

return 0;

2271

2279

2272

nla_put_failure:

2280

nla_put_failure:

2273

return -1;

2281

return -1;

2274

}

2282

}

2275

2283

2276

static const union nf_inet_addr any_addr;

2284

static const union nf_inet_addr any_addr;

2277

2285

2278

static int

2286

static int

2279

ctnetlink_exp_dump_expect(struct sk_buff *skb,

2287

ctnetlink_exp_dump_expect(struct sk_buff *skb,

2280

const struct nf_conntrack_expect *exp)

2288

const struct nf_conntrack_expect *exp)

2281

{

2289

{

2282

struct nf_conn *master = exp->master;

2290

struct nf_conn *master = exp->master;

2283

long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;

2291

long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;

2284

struct nf_conn_help *help;

2292

struct nf_conn_help *help;

2285

#ifdef CONFIG_NF_NAT_NEEDED

2293

#ifdef CONFIG_NF_NAT_NEEDED

2286

struct nlattr *nest_parms;

2294

struct nlattr *nest_parms;

2287

struct nf_conntrack_tuple nat_tuple = {};

2295

struct nf_conntrack_tuple nat_tuple = {};

2288

#endif

2296

#endif

2289

struct nf_ct_helper_expectfn *expfn;

2297

struct nf_ct_helper_expectfn *expfn;

2290

2298

2291

if (timeout < 0)

2299

if (timeout < 0)

2292

timeout = 0;

2300

timeout = 0;

2293

2301

2294

if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)

2302

if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)

2295

goto nla_put_failure;

2303

goto nla_put_failure;

2296

if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)

2304

if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)

2297

goto nla_put_failure;

2305

goto nla_put_failure;

2298

if (ctnetlink_exp_dump_tuple(skb,

2306

if (ctnetlink_exp_dump_tuple(skb,

2299

&master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,

2307

&master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,

2300

CTA_EXPECT_MASTER) < 0)

2308

CTA_EXPECT_MASTER) < 0)

2301

goto nla_put_failure;

2309

goto nla_put_failure;

2302

2310

2303

#ifdef CONFIG_NF_NAT_NEEDED

2311

#ifdef CONFIG_NF_NAT_NEEDED

2304

if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) ||

2312

if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) ||

2305

exp->saved_proto.all) {

2313

exp->saved_proto.all) {

2306

nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);

2314

nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);

2307

if (!nest_parms)

2315

if (!nest_parms)

2308

goto nla_put_failure;

2316

goto nla_put_failure;

2309

2317

2310

if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))

2318

if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))

2311

goto nla_put_failure;

2319

goto nla_put_failure;

2312

2320

2313

nat_tuple.src.l3num = nf_ct_l3num(master);

2321

nat_tuple.src.l3num = nf_ct_l3num(master);

2314

nat_tuple.src.u3 = exp->saved_addr;

2322

nat_tuple.src.u3 = exp->saved_addr;

2315

nat_tuple.dst.protonum = nf_ct_protonum(master);

2323

nat_tuple.dst.protonum = nf_ct_protonum(master);

2316

nat_tuple.src.u = exp->saved_proto;

2324

nat_tuple.src.u = exp->saved_proto;

2317

2325

2318

if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,

2326

if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,

2319

CTA_EXPECT_NAT_TUPLE) < 0)

2327

CTA_EXPECT_NAT_TUPLE) < 0)

2320

goto nla_put_failure;

2328

goto nla_put_failure;

2321

nla_nest_end(skb, nest_parms);

2329

nla_nest_end(skb, nest_parms);

2322

}

2330

}

2323

#endif

2331

#endif

2324

if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||

2332

if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||

2325

nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) ||

2333

nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) ||

2326

nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||

2334

nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||

2327

nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))

2335

nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))

2328

goto nla_put_failure;

2336

goto nla_put_failure;

2329

help = nfct_help(master);

2337

help = nfct_help(master);

2330

if (help) {

2338

if (help) {

2331

struct nf_conntrack_helper *helper;

2339

struct nf_conntrack_helper *helper;

2332

2340

2333

helper = rcu_dereference(help->helper);

2341

helper = rcu_dereference(help->helper);

2334

if (helper &&

2342

if (helper &&

2335

nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))

2343

nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))

2336

goto nla_put_failure;

2344

goto nla_put_failure;

2337

}

2345

}

2338

expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);

2346

expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);

2339

if (expfn != NULL &&

2347

if (expfn != NULL &&

2340

nla_put_string(skb, CTA_EXPECT_FN, expfn->name))

2348

nla_put_string(skb, CTA_EXPECT_FN, expfn->name))

2341

goto nla_put_failure;

2349

goto nla_put_failure;

2342

2350

2343

return 0;

2351

return 0;

2344

2352

2345

nla_put_failure:

2353

nla_put_failure:

2346

return -1;

2354

return -1;

2347

}

2355

}

2348

2356

2349

static int

2357

static int

2350

ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq,

2358

ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq,

2351

int event, const struct nf_conntrack_expect *exp)

2359

int event, const struct nf_conntrack_expect *exp)

2352

{

2360

{

2353

struct nlmsghdr *nlh;

2361

struct nlmsghdr *nlh;

2354

struct nfgenmsg *nfmsg;

2362

struct nfgenmsg *nfmsg;

2355

unsigned int flags = portid ? NLM_F_MULTI : 0;

2363

unsigned int flags = portid ? NLM_F_MULTI : 0;

2356

2364

2357

event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;

2365

event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;

2358

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

2366

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

2359

if (nlh == NULL)

2367

if (nlh == NULL)

2360

goto nlmsg_failure;

2368

goto nlmsg_failure;

2361

2369

2362

nfmsg = nlmsg_data(nlh);

2370

nfmsg = nlmsg_data(nlh);

2363

nfmsg->nfgen_family = exp->tuple.src.l3num;

2371

nfmsg->nfgen_family = exp->tuple.src.l3num;

2364

nfmsg->version = NFNETLINK_V0;

2372

nfmsg->version = NFNETLINK_V0;

2365

nfmsg->res_id = 0;

2373

nfmsg->res_id = 0;

2366

2374

2367

if (ctnetlink_exp_dump_expect(skb, exp) < 0)

2375

if (ctnetlink_exp_dump_expect(skb, exp) < 0)

2368

goto nla_put_failure;

2376

goto nla_put_failure;

2369

2377

2370

nlmsg_end(skb, nlh);

2378

nlmsg_end(skb, nlh);

2371

return skb->len;

2379

return skb->len;

2372

2380

2373

nlmsg_failure:

2381

nlmsg_failure:

2374

nla_put_failure:

2382

nla_put_failure:

2375

nlmsg_cancel(skb, nlh);

2383

nlmsg_cancel(skb, nlh);

2376

return -1;

2384

return -1;

2377

}

2385

}

2378

2386

2379

#ifdef CONFIG_NF_CONNTRACK_EVENTS

2387

#ifdef CONFIG_NF_CONNTRACK_EVENTS

2380

static int

2388

static int

2381

ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)

2389

ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)

2382

{

2390

{

2383

struct nf_conntrack_expect *exp = item->exp;

2391

struct nf_conntrack_expect *exp = item->exp;

2384

struct net *net = nf_ct_exp_net(exp);

2392

struct net *net = nf_ct_exp_net(exp);

2385

struct nlmsghdr *nlh;

2393

struct nlmsghdr *nlh;

2386

struct nfgenmsg *nfmsg;

2394

struct nfgenmsg *nfmsg;

2387

struct sk_buff *skb;

2395

struct sk_buff *skb;

2388

unsigned int type, group;

2396

unsigned int type, group;

2389

int flags = 0;

2397

int flags = 0;

2390

2398

2391

if (events & (1 << IPEXP_DESTROY)) {

2399

if (events & (1 << IPEXP_DESTROY)) {

2392

type = IPCTNL_MSG_EXP_DELETE;

2400

type = IPCTNL_MSG_EXP_DELETE;

2393

group = NFNLGRP_CONNTRACK_EXP_DESTROY;

2401

group = NFNLGRP_CONNTRACK_EXP_DESTROY;

2394

} else if (events & (1 << IPEXP_NEW)) {

2402

} else if (events & (1 << IPEXP_NEW)) {

2395

type = IPCTNL_MSG_EXP_NEW;

2403

type = IPCTNL_MSG_EXP_NEW;

2396

flags = NLM_F_CREATE|NLM_F_EXCL;

2404

flags = NLM_F_CREATE|NLM_F_EXCL;

2397

group = NFNLGRP_CONNTRACK_EXP_NEW;

2405

group = NFNLGRP_CONNTRACK_EXP_NEW;

2398

} else

2406

} else

2399

return 0;

2407

return 0;

2400

2408

2401

if (!item->report && !nfnetlink_has_listeners(net, group))

2409

if (!item->report && !nfnetlink_has_listeners(net, group))

2402

return 0;

2410

return 0;

2403

2411

2404

skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);

2412

skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);

2405

if (skb == NULL)

2413

if (skb == NULL)

2406

goto errout;

2414

goto errout;

2407

2415

2408

type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;

2416

type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;

2409

nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);

2417

nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);

2410

if (nlh == NULL)

2418

if (nlh == NULL)

2411

goto nlmsg_failure;

2419

goto nlmsg_failure;

2412

2420

2413

nfmsg = nlmsg_data(nlh);

2421

nfmsg = nlmsg_data(nlh);

2414

nfmsg->nfgen_family = exp->tuple.src.l3num;

2422

nfmsg->nfgen_family = exp->tuple.src.l3num;

2415

nfmsg->version = NFNETLINK_V0;

2423

nfmsg->version = NFNETLINK_V0;

2416

nfmsg->res_id = 0;

2424

nfmsg->res_id = 0;

2417

2425

2418

rcu_read_lock();

2426

rcu_read_lock();

2419

if (ctnetlink_exp_dump_expect(skb, exp) < 0)

2427

if (ctnetlink_exp_dump_expect(skb, exp) < 0)

2420

goto nla_put_failure;

2428

goto nla_put_failure;

2421

rcu_read_unlock();

2429

rcu_read_unlock();

2422

2430

2423

nlmsg_end(skb, nlh);

2431

nlmsg_end(skb, nlh);

2424

nfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC);

2432

nfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC);

2425

return 0;

2433

return 0;

2426

2434

2427

nla_put_failure:

2435

nla_put_failure:

2428

rcu_read_unlock();

2436

rcu_read_unlock();

2429

nlmsg_cancel(skb, nlh);

2437

nlmsg_cancel(skb, nlh);

2430

nlmsg_failure:

2438

nlmsg_failure:

2431

kfree_skb(skb);

2439

kfree_skb(skb);

2432

errout:

2440

errout:

2433

nfnetlink_set_err(net, 0, 0, -ENOBUFS);

2441

nfnetlink_set_err(net, 0, 0, -ENOBUFS);

2434

return 0;

2442

return 0;

2435

}

2443

}

2436

#endif

2444

#endif

2437

static int ctnetlink_exp_done(struct netlink_callback *cb)

2445

static int ctnetlink_exp_done(struct netlink_callback *cb)

2438

{

2446

{

2439

if (cb->args[1])

2447

if (cb->args[1])

2440

nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);

2448

nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);

2441

return 0;

2449

return 0;

2442

}

2450

}

2443

2451

2444

static int

2452

static int

2445

ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)

2453

ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)

2446

{

2454

{

2447

struct net *net = sock_net(skb->sk);

2455

struct net *net = sock_net(skb->sk);

2448

struct nf_conntrack_expect *exp, *last;

2456

struct nf_conntrack_expect *exp, *last;

2449

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

2457

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

2450

u_int8_t l3proto = nfmsg->nfgen_family;

2458

u_int8_t l3proto = nfmsg->nfgen_family;

2451

2459

2452

rcu_read_lock();

2460

rcu_read_lock();

2453

last = (struct nf_conntrack_expect *)cb->args[1];

2461

last = (struct nf_conntrack_expect *)cb->args[1];

2454

for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {

2462

for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {

2455

restart:

2463

restart:

2456

hlist_for_each_entry(exp, &net->ct.expect_hash[cb->args[0]],

2464

hlist_for_each_entry(exp, &net->ct.expect_hash[cb->args[0]],

2457

hnode) {

2465

hnode) {

2458

if (l3proto && exp->tuple.src.l3num != l3proto)

2466

if (l3proto && exp->tuple.src.l3num != l3proto)

2459

continue;

2467

continue;

2460

if (cb->args[1]) {

2468

if (cb->args[1]) {

2461

if (exp != last)

2469

if (exp != last)

2462

continue;

2470

continue;

2463

cb->args[1] = 0;

2471

cb->args[1] = 0;

2464

}

2472

}

2465

if (ctnetlink_exp_fill_info(skb,

2473

if (ctnetlink_exp_fill_info(skb,

2466

NETLINK_CB(cb->skb).portid,

2474

NETLINK_CB(cb->skb).portid,

2467

cb->nlh->nlmsg_seq,

2475

cb->nlh->nlmsg_seq,

2468

IPCTNL_MSG_EXP_NEW,

2476

IPCTNL_MSG_EXP_NEW,

2469

exp) < 0) {

2477

exp) < 0) {

2470

if (!atomic_inc_not_zero(&exp->use))

2478

if (!atomic_inc_not_zero(&exp->use))

2471

continue;

2479

continue;

2472

cb->args[1] = (unsigned long)exp;

2480

cb->args[1] = (unsigned long)exp;

2473

goto out;

2481

goto out;

2474

}

2482

}

2475

}

2483

}

2476

if (cb->args[1]) {

2484

if (cb->args[1]) {

2477

cb->args[1] = 0;

2485

cb->args[1] = 0;

2478

goto restart;

2486

goto restart;

2479

}

2487

}

2480

}

2488

}

2481

out:

2489

out:

2482

rcu_read_unlock();

2490

rcu_read_unlock();

2483

if (last)

2491

if (last)

2484

nf_ct_expect_put(last);

2492

nf_ct_expect_put(last);

2485

2493

2486

return skb->len;

2494

return skb->len;

2487

}

2495

}

2488

2496

2489

static int

2497

static int

2490

ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)

2498

ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)

2491

{

2499

{

2492

struct nf_conntrack_expect *exp, *last;

2500

struct nf_conntrack_expect *exp, *last;

2493

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

2501

struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);

2494

struct nf_conn *ct = cb->data;

2502

struct nf_conn *ct = cb->data;

2495

struct nf_conn_help *help = nfct_help(ct);

2503

struct nf_conn_help *help = nfct_help(ct);

2496

u_int8_t l3proto = nfmsg->nfgen_family;

2504

u_int8_t l3proto = nfmsg->nfgen_family;

2497

2505

2498

if (cb->args[0])

2506

if (cb->args[0])

2499

return 0;

2507

return 0;

2500

2508

2501

rcu_read_lock();

2509

rcu_read_lock();

2502

last = (struct nf_conntrack_expect *)cb->args[1];

2510

last = (struct nf_conntrack_expect *)cb->args[1];

2503

restart:

2511

restart:

2504

hlist_for_each_entry(exp, &help->expectations, lnode) {

2512

hlist_for_each_entry(exp, &help->expectations, lnode) {

2505

if (l3proto && exp->tuple.src.l3num != l3proto)

2513

if (l3proto && exp->tuple.src.l3num != l3proto)

2506

continue;

2514

continue;

2507

if (cb->args[1]) {

2515

if (cb->args[1]) {

2508

if (exp != last)

2516

if (exp != last)

2509

continue;

2517

continue;

2510

cb->args[1] = 0;

2518

cb->args[1] = 0;

2511

}

2519

}

2512

if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).portid,

2520

if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).portid,

2513

cb->nlh->nlmsg_seq,

2521

cb->nlh->nlmsg_seq,

2514

IPCTNL_MSG_EXP_NEW,

2522

IPCTNL_MSG_EXP_NEW,

2515

exp) < 0) {

2523

exp) < 0) {

2516

if (!atomic_inc_not_zero(&exp->use))

2524

if (!atomic_inc_not_zero(&exp->use))

2517

continue;

2525

continue;

2518

cb->args[1] = (unsigned long)exp;

2526

cb->args[1] = (unsigned long)exp;

2519

goto out;

2527

goto out;

2520

}

2528

}

2521

}

2529

}

2522

if (cb->args[1]) {

2530

if (cb->args[1]) {

2523

cb->args[1] = 0;

2531

cb->args[1] = 0;

2524

goto restart;

2532

goto restart;

2525

}

2533

}

2526

cb->args[0] = 1;

2534

cb->args[0] = 1;

2527

out:

2535

out:

2528

rcu_read_unlock();

2536

rcu_read_unlock();

2529

if (last)

2537

if (last)

2530

nf_ct_expect_put(last);

2538

nf_ct_expect_put(last);

2531

2539

2532

return skb->len;

2540

return skb->len;

2533

}

2541

}

2534

2542

2535

static int ctnetlink_dump_exp_ct(struct sock *ctnl, struct sk_buff *skb,

2543

static int ctnetlink_dump_exp_ct(struct sock *ctnl, struct sk_buff *skb,

2536

const struct nlmsghdr *nlh,

2544

const struct nlmsghdr *nlh,

2537

const struct nlattr * const cda[])

2545

const struct nlattr * const cda[])

2538

{

2546

{

2539

int err;

2547

int err;

2540

struct net *net = sock_net(ctnl);

2548

struct net *net = sock_net(ctnl);

2541

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2549

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2542

u_int8_t u3 = nfmsg->nfgen_family;

2550

u_int8_t u3 = nfmsg->nfgen_family;

2543

struct nf_conntrack_tuple tuple;

2551

struct nf_conntrack_tuple tuple;

2544

struct nf_conntrack_tuple_hash *h;

2552

struct nf_conntrack_tuple_hash *h;

2545

struct nf_conn *ct;

2553

struct nf_conn *ct;

2546

u16 zone = 0;

2554

u16 zone = 0;

2547

struct netlink_dump_control c = {

2555

struct netlink_dump_control c = {

2548

.dump = ctnetlink_exp_ct_dump_table,

2556

.dump = ctnetlink_exp_ct_dump_table,

2549

.done = ctnetlink_exp_done,

2557

.done = ctnetlink_exp_done,

2550

};

2558

};

2551

2559

2552

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);

2560

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);

2553

if (err < 0)

2561

if (err < 0)

2554

return err;

2562

return err;

2555

2563

2556

if (cda[CTA_EXPECT_ZONE]) {

2564

if (cda[CTA_EXPECT_ZONE]) {

2557

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2565

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2558

if (err < 0)

2566

if (err < 0)

2559

return err;

2567

return err;

2560

}

2568

}

2561

2569

2562

h = nf_conntrack_find_get(net, zone, &tuple);

2570

h = nf_conntrack_find_get(net, zone, &tuple);

2563

if (!h)

2571

if (!h)

2564

return -ENOENT;

2572

return -ENOENT;

2565

2573

2566

ct = nf_ct_tuplehash_to_ctrack(h);

2574

ct = nf_ct_tuplehash_to_ctrack(h);

2567

c.data = ct;

2575

c.data = ct;

2568

2576

2569

err = netlink_dump_start(ctnl, skb, nlh, &c);

2577

err = netlink_dump_start(ctnl, skb, nlh, &c);

2570

nf_ct_put(ct);

2578

nf_ct_put(ct);

2571

2579

2572

return err;

2580

return err;

2573

}

2581

}

2574

2582

2575

static int

2583

static int

2576

ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,

2584

ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,

2577

const struct nlmsghdr *nlh,

2585

const struct nlmsghdr *nlh,

2578

const struct nlattr * const cda[])

2586

const struct nlattr * const cda[])

2579

{

2587

{

2580

struct net *net = sock_net(ctnl);

2588

struct net *net = sock_net(ctnl);

2581

struct nf_conntrack_tuple tuple;

2589

struct nf_conntrack_tuple tuple;

2582

struct nf_conntrack_expect *exp;

2590

struct nf_conntrack_expect *exp;

2583

struct sk_buff *skb2;

2591

struct sk_buff *skb2;

2584

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2592

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2585

u_int8_t u3 = nfmsg->nfgen_family;

2593

u_int8_t u3 = nfmsg->nfgen_family;

2586

u16 zone;

2594

u16 zone;

2587

int err;

2595

int err;

2588

2596

2589

if (nlh->nlmsg_flags & NLM_F_DUMP) {

2597

if (nlh->nlmsg_flags & NLM_F_DUMP) {

2590

if (cda[CTA_EXPECT_MASTER])

2598

if (cda[CTA_EXPECT_MASTER])

2591

return ctnetlink_dump_exp_ct(ctnl, skb, nlh, cda);

2599

return ctnetlink_dump_exp_ct(ctnl, skb, nlh, cda);

2592

else {

2600

else {

2593

struct netlink_dump_control c = {

2601

struct netlink_dump_control c = {

2594

.dump = ctnetlink_exp_dump_table,

2602

.dump = ctnetlink_exp_dump_table,

2595

.done = ctnetlink_exp_done,

2603

.done = ctnetlink_exp_done,

2596

};

2604

};

2597

return netlink_dump_start(ctnl, skb, nlh, &c);

2605

return netlink_dump_start(ctnl, skb, nlh, &c);

2598

}

2606

}

2599

}

2607

}

2600

2608

2601

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2609

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2602

if (err < 0)

2610

if (err < 0)

2603

return err;

2611

return err;

2604

2612

2605

if (cda[CTA_EXPECT_TUPLE])

2613

if (cda[CTA_EXPECT_TUPLE])

2606

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2614

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2607

else if (cda[CTA_EXPECT_MASTER])

2615

else if (cda[CTA_EXPECT_MASTER])

2608

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);

2616

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);

2609

else

2617

else

2610

return -EINVAL;

2618

return -EINVAL;

2611

2619

2612

if (err < 0)

2620

if (err < 0)

2613

return err;

2621

return err;

2614

2622

2615

exp = nf_ct_expect_find_get(net, zone, &tuple);

2623

exp = nf_ct_expect_find_get(net, zone, &tuple);

2616

if (!exp)

2624

if (!exp)

2617

return -ENOENT;

2625

return -ENOENT;

2618

2626

2619

if (cda[CTA_EXPECT_ID]) {

2627

if (cda[CTA_EXPECT_ID]) {

2620

__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);

2628

__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);

2621

if (ntohl(id) != (u32)(unsigned long)exp) {

2629

if (ntohl(id) != (u32)(unsigned long)exp) {

2622

nf_ct_expect_put(exp);

2630

nf_ct_expect_put(exp);

2623

return -ENOENT;

2631

return -ENOENT;

2624

}

2632

}

2625

}

2633

}

2626

2634

2627

err = -ENOMEM;

2635

err = -ENOMEM;

2628

skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

2636

skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

2629

if (skb2 == NULL) {

2637

if (skb2 == NULL) {

2630

nf_ct_expect_put(exp);

2638

nf_ct_expect_put(exp);

2631

goto out;

2639

goto out;

2632

}

2640

}

2633

2641

2634

rcu_read_lock();

2642

rcu_read_lock();

2635

err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,

2643

err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,

2636

nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);

2644

nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);

2637

rcu_read_unlock();

2645

rcu_read_unlock();

2638

nf_ct_expect_put(exp);

2646

nf_ct_expect_put(exp);

2639

if (err <= 0)

2647

if (err <= 0)

2640

goto free;

2648

goto free;

2641

2649

2642

err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);

2650

err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);

2643

if (err < 0)

2651

if (err < 0)

2644

goto out;

2652

goto out;

2645

2653

2646

return 0;

2654

return 0;

2647

2655

2648

free:

2656

free:

2649

kfree_skb(skb2);

2657

kfree_skb(skb2);

2650

out:

2658

out:

2651

/* this avoids a loop in nfnetlink. */

2659

/* this avoids a loop in nfnetlink. */

2652

return err == -EAGAIN ? -ENOBUFS : err;

2660

return err == -EAGAIN ? -ENOBUFS : err;

2653

}

2661

}

2654

2662

2655

static int

2663

static int

2656

ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,

2664

ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,

2657

const struct nlmsghdr *nlh,

2665

const struct nlmsghdr *nlh,

2658

const struct nlattr * const cda[])

2666

const struct nlattr * const cda[])

2659

{

2667

{

2660

struct net *net = sock_net(ctnl);

2668

struct net *net = sock_net(ctnl);

2661

struct nf_conntrack_expect *exp;

2669

struct nf_conntrack_expect *exp;

2662

struct nf_conntrack_tuple tuple;

2670

struct nf_conntrack_tuple tuple;

2663

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2671

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2664

struct hlist_node *next;

2672

struct hlist_node *next;

2665

u_int8_t u3 = nfmsg->nfgen_family;

2673

u_int8_t u3 = nfmsg->nfgen_family;

2666

unsigned int i;

2674

unsigned int i;

2667

u16 zone;

2675

u16 zone;

2668

int err;

2676

int err;

2669

2677

2670

if (cda[CTA_EXPECT_TUPLE]) {

2678

if (cda[CTA_EXPECT_TUPLE]) {

2671

/* delete a single expect by tuple */

2679

/* delete a single expect by tuple */

2672

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2680

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2673

if (err < 0)

2681

if (err < 0)

2674

return err;

2682

return err;

2675

2683

2676

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2684

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2677

if (err < 0)

2685

if (err < 0)

2678

return err;

2686

return err;

2679

2687

2680

/* bump usage count to 2 */

2688

/* bump usage count to 2 */

2681

exp = nf_ct_expect_find_get(net, zone, &tuple);

2689

exp = nf_ct_expect_find_get(net, zone, &tuple);

2682

if (!exp)

2690

if (!exp)

2683

return -ENOENT;

2691

return -ENOENT;

2684

2692

2685

if (cda[CTA_EXPECT_ID]) {

2693

if (cda[CTA_EXPECT_ID]) {

2686

__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);

2694

__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);

2687

if (ntohl(id) != (u32)(unsigned long)exp) {

2695

if (ntohl(id) != (u32)(unsigned long)exp) {

2688

nf_ct_expect_put(exp);

2696

nf_ct_expect_put(exp);

2689

return -ENOENT;

2697

return -ENOENT;

2690

}

2698

}

2691

}

2699

}

2692

2700

2693

/* after list removal, usage count == 1 */

2701

/* after list removal, usage count == 1 */

2694

spin_lock_bh(&nf_conntrack_lock);

2702

spin_lock_bh(&nf_conntrack_lock);

2695

if (del_timer(&exp->timeout)) {

2703

if (del_timer(&exp->timeout)) {

2696

nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,

2704

nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,

2697

nlmsg_report(nlh));

2705

nlmsg_report(nlh));

2698

nf_ct_expect_put(exp);

2706

nf_ct_expect_put(exp);

2699

}

2707

}

2700

spin_unlock_bh(&nf_conntrack_lock);

2708

spin_unlock_bh(&nf_conntrack_lock);

2701

/* have to put what we 'get' above.

2709

/* have to put what we 'get' above.

2702

* after this line usage count == 0 */

2710

* after this line usage count == 0 */

2703

nf_ct_expect_put(exp);

2711

nf_ct_expect_put(exp);

2704

} else if (cda[CTA_EXPECT_HELP_NAME]) {

2712

} else if (cda[CTA_EXPECT_HELP_NAME]) {

2705

char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);

2713

char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);

2706

struct nf_conn_help *m_help;

2714

struct nf_conn_help *m_help;

2707

2715

2708

/* delete all expectations for this helper */

2716

/* delete all expectations for this helper */

2709

spin_lock_bh(&nf_conntrack_lock);

2717

spin_lock_bh(&nf_conntrack_lock);

2710

for (i = 0; i < nf_ct_expect_hsize; i++) {

2718

for (i = 0; i < nf_ct_expect_hsize; i++) {

2711

hlist_for_each_entry_safe(exp, next,

2719

hlist_for_each_entry_safe(exp, next,

2712

&net->ct.expect_hash[i],

2720

&net->ct.expect_hash[i],

2713

hnode) {

2721

hnode) {

2714

m_help = nfct_help(exp->master);

2722

m_help = nfct_help(exp->master);

2715

if (!strcmp(m_help->helper->name, name) &&

2723

if (!strcmp(m_help->helper->name, name) &&

2716

del_timer(&exp->timeout)) {

2724

del_timer(&exp->timeout)) {

2717

nf_ct_unlink_expect_report(exp,

2725

nf_ct_unlink_expect_report(exp,

2718

NETLINK_CB(skb).portid,

2726

NETLINK_CB(skb).portid,

2719

nlmsg_report(nlh));

2727

nlmsg_report(nlh));

2720

nf_ct_expect_put(exp);

2728

nf_ct_expect_put(exp);

2721

}

2729

}

2722

}

2730

}

2723

}

2731

}

2724

spin_unlock_bh(&nf_conntrack_lock);

2732

spin_unlock_bh(&nf_conntrack_lock);

2725

} else {

2733

} else {

2726

/* This basically means we have to flush everything*/

2734

/* This basically means we have to flush everything*/

2727

spin_lock_bh(&nf_conntrack_lock);

2735

spin_lock_bh(&nf_conntrack_lock);

2728

for (i = 0; i < nf_ct_expect_hsize; i++) {

2736

for (i = 0; i < nf_ct_expect_hsize; i++) {

2729

hlist_for_each_entry_safe(exp, next,

2737

hlist_for_each_entry_safe(exp, next,

2730

&net->ct.expect_hash[i],

2738

&net->ct.expect_hash[i],

2731

hnode) {

2739

hnode) {

2732

if (del_timer(&exp->timeout)) {

2740

if (del_timer(&exp->timeout)) {

2733

nf_ct_unlink_expect_report(exp,

2741

nf_ct_unlink_expect_report(exp,

2734

NETLINK_CB(skb).portid,

2742

NETLINK_CB(skb).portid,

2735

nlmsg_report(nlh));

2743

nlmsg_report(nlh));

2736

nf_ct_expect_put(exp);

2744

nf_ct_expect_put(exp);

2737

}

2745

}

2738

}

2746

}

2739

}

2747

}

2740

spin_unlock_bh(&nf_conntrack_lock);

2748

spin_unlock_bh(&nf_conntrack_lock);

2741

}

2749

}

2742

2750

2743

return 0;

2751

return 0;

2744

}

2752

}

2745

static int

2753

static int

2746

ctnetlink_change_expect(struct nf_conntrack_expect *x,

2754

ctnetlink_change_expect(struct nf_conntrack_expect *x,

2747

const struct nlattr * const cda[])

2755

const struct nlattr * const cda[])

2748

{

2756

{

2749

if (cda[CTA_EXPECT_TIMEOUT]) {

2757

if (cda[CTA_EXPECT_TIMEOUT]) {

2750

if (!del_timer(&x->timeout))

2758

if (!del_timer(&x->timeout))

2751

return -ETIME;

2759

return -ETIME;

2752

2760

2753

x->timeout.expires = jiffies +

2761

x->timeout.expires = jiffies +

2754

ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;

2762

ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;

2755

add_timer(&x->timeout);

2763

add_timer(&x->timeout);

2756

}

2764

}

2757

return 0;

2765

return 0;

2758

}

2766

}

2759

2767

2760

static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {

2768

static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {

2761

[CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 },

2769

[CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 },

2762

[CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED },

2770

[CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED },

2763

};

2771

};

2764

2772

2765

static int

2773

static int

2766

ctnetlink_parse_expect_nat(const struct nlattr *attr,

2774

ctnetlink_parse_expect_nat(const struct nlattr *attr,

2767

struct nf_conntrack_expect *exp,

2775

struct nf_conntrack_expect *exp,

2768

u_int8_t u3)

2776

u_int8_t u3)

2769

{

2777

{

2770

#ifdef CONFIG_NF_NAT_NEEDED

2778

#ifdef CONFIG_NF_NAT_NEEDED

2771

struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];

2779

struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];

2772

struct nf_conntrack_tuple nat_tuple = {};

2780

struct nf_conntrack_tuple nat_tuple = {};

2773

int err;

2781

int err;

2774

2782

2775

err = nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_nla_policy);

2783

err = nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_nla_policy);

2776

if (err < 0)

2784

if (err < 0)

2777

return err;

2785

return err;

2778

2786

2779

if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE])

2787

if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE])

2780

return -EINVAL;

2788

return -EINVAL;

2781

2789

2782

err = ctnetlink_parse_tuple((const struct nlattr * const *)tb,

2790

err = ctnetlink_parse_tuple((const struct nlattr * const *)tb,

2783

&nat_tuple, CTA_EXPECT_NAT_TUPLE, u3);

2791

&nat_tuple, CTA_EXPECT_NAT_TUPLE, u3);

2784

if (err < 0)

2792

if (err < 0)

2785

return err;

2793

return err;

2786

2794

2787

exp->saved_addr = nat_tuple.src.u3;

2795

exp->saved_addr = nat_tuple.src.u3;

2788

exp->saved_proto = nat_tuple.src.u;

2796

exp->saved_proto = nat_tuple.src.u;

2789

exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));

2797

exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));

2790

2798

2791

return 0;

2799

return 0;

2792

#else

2800

#else

2793

return -EOPNOTSUPP;

2801

return -EOPNOTSUPP;

2794

#endif

2802

#endif

2795

}

2803

}

2796

2804

2797

static struct nf_conntrack_expect *

2805

static struct nf_conntrack_expect *

2798

ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,

2806

ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,

2799

struct nf_conntrack_helper *helper,

2807

struct nf_conntrack_helper *helper,

2800

struct nf_conntrack_tuple *tuple,

2808

struct nf_conntrack_tuple *tuple,

2801

struct nf_conntrack_tuple *mask)

2809

struct nf_conntrack_tuple *mask)

2802

{

2810

{

2803

u_int32_t class = 0;

2811

u_int32_t class = 0;

2804

struct nf_conntrack_expect *exp;

2812

struct nf_conntrack_expect *exp;

2805

struct nf_conn_help *help;

2813

struct nf_conn_help *help;

2806

int err;

2814

int err;

2807

2815

2808

if (cda[CTA_EXPECT_CLASS] && helper) {

2816

if (cda[CTA_EXPECT_CLASS] && helper) {

2809

class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));

2817

class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));

2810

if (class > helper->expect_class_max)

2818

if (class > helper->expect_class_max)

2811

return ERR_PTR(-EINVAL);

2819

return ERR_PTR(-EINVAL);

2812

}

2820

}

2813

exp = nf_ct_expect_alloc(ct);

2821

exp = nf_ct_expect_alloc(ct);

2814

if (!exp)

2822

if (!exp)

2815

return ERR_PTR(-ENOMEM);

2823

return ERR_PTR(-ENOMEM);

2816

2824

2817

help = nfct_help(ct);

2825

help = nfct_help(ct);

2818

if (!help) {

2826

if (!help) {

2819

if (!cda[CTA_EXPECT_TIMEOUT]) {

2827

if (!cda[CTA_EXPECT_TIMEOUT]) {

2820

err = -EINVAL;

2828

err = -EINVAL;

2821

goto err_out;

2829

goto err_out;

2822

}

2830

}

2823

exp->timeout.expires =

2831

exp->timeout.expires =

2824

jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;

2832

jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;

2825

2833

2826

exp->flags = NF_CT_EXPECT_USERSPACE;

2834

exp->flags = NF_CT_EXPECT_USERSPACE;

2827

if (cda[CTA_EXPECT_FLAGS]) {

2835

if (cda[CTA_EXPECT_FLAGS]) {

2828

exp->flags |=

2836

exp->flags |=

2829

ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));

2837

ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));

2830

}

2838

}

2831

} else {

2839

} else {

2832

if (cda[CTA_EXPECT_FLAGS]) {

2840

if (cda[CTA_EXPECT_FLAGS]) {

2833

exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));

2841

exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));

2834

exp->flags &= ~NF_CT_EXPECT_USERSPACE;

2842

exp->flags &= ~NF_CT_EXPECT_USERSPACE;

2835

} else

2843

} else

2836

exp->flags = 0;

2844

exp->flags = 0;

2837

}

2845

}

2838

if (cda[CTA_EXPECT_FN]) {

2846

if (cda[CTA_EXPECT_FN]) {

2839

const char *name = nla_data(cda[CTA_EXPECT_FN]);

2847

const char *name = nla_data(cda[CTA_EXPECT_FN]);

2840

struct nf_ct_helper_expectfn *expfn;

2848

struct nf_ct_helper_expectfn *expfn;

2841

2849

2842

expfn = nf_ct_helper_expectfn_find_by_name(name);

2850

expfn = nf_ct_helper_expectfn_find_by_name(name);

2843

if (expfn == NULL) {

2851

if (expfn == NULL) {

2844

err = -EINVAL;

2852

err = -EINVAL;

2845

goto err_out;

2853

goto err_out;

2846

}

2854

}

2847

exp->expectfn = expfn->expectfn;

2855

exp->expectfn = expfn->expectfn;

2848

} else

2856

} else

2849

exp->expectfn = NULL;

2857

exp->expectfn = NULL;

2850

2858

2851

exp->class = class;

2859

exp->class = class;

2852

exp->master = ct;

2860

exp->master = ct;

2853

exp->helper = helper;

2861

exp->helper = helper;

2854

exp->tuple = *tuple;

2862

exp->tuple = *tuple;

2855

exp->mask.src.u3 = mask->src.u3;

2863

exp->mask.src.u3 = mask->src.u3;

2856

exp->mask.src.u.all = mask->src.u.all;

2864

exp->mask.src.u.all = mask->src.u.all;

2857

2865

2858

if (cda[CTA_EXPECT_NAT]) {

2866

if (cda[CTA_EXPECT_NAT]) {

2859

err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],

2867

err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],

2860

exp, nf_ct_l3num(ct));

2868

exp, nf_ct_l3num(ct));

2861

if (err < 0)

2869

if (err < 0)

2862

goto err_out;

2870

goto err_out;

2863

}

2871

}

2864

return exp;

2872

return exp;

2865

err_out:

2873

err_out:

2866

nf_ct_expect_put(exp);

2874

nf_ct_expect_put(exp);

2867

return ERR_PTR(err);

2875

return ERR_PTR(err);

2868

}

2876

}

2869

2877

2870

static int

2878

static int

2871

ctnetlink_create_expect(struct net *net, u16 zone,

2879

ctnetlink_create_expect(struct net *net, u16 zone,

2872

const struct nlattr * const cda[],

2880

const struct nlattr * const cda[],

2873

u_int8_t u3, u32 portid, int report)

2881

u_int8_t u3, u32 portid, int report)

2874

{

2882

{

2875

struct nf_conntrack_tuple tuple, mask, master_tuple;

2883

struct nf_conntrack_tuple tuple, mask, master_tuple;

2876

struct nf_conntrack_tuple_hash *h = NULL;

2884

struct nf_conntrack_tuple_hash *h = NULL;

2877

struct nf_conntrack_helper *helper = NULL;

2885

struct nf_conntrack_helper *helper = NULL;

2878

struct nf_conntrack_expect *exp;

2886

struct nf_conntrack_expect *exp;

2879

struct nf_conn *ct;

2887

struct nf_conn *ct;

2880

int err;

2888

int err;

2881

2889

2882

/* caller guarantees that those three CTA_EXPECT_* exist */

2890

/* caller guarantees that those three CTA_EXPECT_* exist */

2883

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2891

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2884

if (err < 0)

2892

if (err < 0)

2885

return err;

2893

return err;

2886

err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);

2894

err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);

2887

if (err < 0)

2895

if (err < 0)

2888

return err;

2896

return err;

2889

err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);

2897

err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);

2890

if (err < 0)

2898

if (err < 0)

2891

return err;

2899

return err;

2892

2900

2893

/* Look for master conntrack of this expectation */

2901

/* Look for master conntrack of this expectation */

2894

h = nf_conntrack_find_get(net, zone, &master_tuple);

2902

h = nf_conntrack_find_get(net, zone, &master_tuple);

2895

if (!h)

2903

if (!h)

2896

return -ENOENT;

2904

return -ENOENT;

2897

ct = nf_ct_tuplehash_to_ctrack(h);

2905

ct = nf_ct_tuplehash_to_ctrack(h);

2898

2906

2899

if (cda[CTA_EXPECT_HELP_NAME]) {

2907

if (cda[CTA_EXPECT_HELP_NAME]) {

2900

const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);

2908

const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);

2901

2909

2902

helper = __nf_conntrack_helper_find(helpname, u3,

2910

helper = __nf_conntrack_helper_find(helpname, u3,

2903

nf_ct_protonum(ct));

2911

nf_ct_protonum(ct));

2904

if (helper == NULL) {

2912

if (helper == NULL) {

2905

#ifdef CONFIG_MODULES

2913

#ifdef CONFIG_MODULES

2906

if (request_module("nfct-helper-%s", helpname) < 0) {

2914

if (request_module("nfct-helper-%s", helpname) < 0) {

2907

err = -EOPNOTSUPP;

2915

err = -EOPNOTSUPP;

2908

goto err_ct;

2916

goto err_ct;

2909

}

2917

}

2910

helper = __nf_conntrack_helper_find(helpname, u3,

2918

helper = __nf_conntrack_helper_find(helpname, u3,

2911

nf_ct_protonum(ct));

2919

nf_ct_protonum(ct));

2912

if (helper) {

2920

if (helper) {

2913

err = -EAGAIN;

2921

err = -EAGAIN;

2914

goto err_ct;

2922

goto err_ct;

2915

}

2923

}

2916

#endif

2924

#endif

2917

err = -EOPNOTSUPP;

2925

err = -EOPNOTSUPP;

2918

goto err_ct;

2926

goto err_ct;

2919

}

2927

}

2920

}

2928

}

2921

2929

2922

exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);

2930

exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);

2923

if (IS_ERR(exp)) {

2931

if (IS_ERR(exp)) {

2924

err = PTR_ERR(exp);

2932

err = PTR_ERR(exp);

2925

goto err_ct;

2933

goto err_ct;

2926

}

2934

}

2927

2935

2928

err = nf_ct_expect_related_report(exp, portid, report);

2936

err = nf_ct_expect_related_report(exp, portid, report);

2929

if (err < 0)

2937

if (err < 0)

2930

goto err_exp;

2938

goto err_exp;

2931

2939

2932

return 0;

2940

return 0;

2933

err_exp:

2941

err_exp:

2934

nf_ct_expect_put(exp);

2942

nf_ct_expect_put(exp);

2935

err_ct:

2943

err_ct:

2936

nf_ct_put(ct);

2944

nf_ct_put(ct);

2937

return err;

2945

return err;

2938

}

2946

}

2939

2947

2940

static int

2948

static int

2941

ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,

2949

ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,

2942

const struct nlmsghdr *nlh,

2950

const struct nlmsghdr *nlh,

2943

const struct nlattr * const cda[])

2951

const struct nlattr * const cda[])

2944

{

2952

{

2945

struct net *net = sock_net(ctnl);

2953

struct net *net = sock_net(ctnl);

2946

struct nf_conntrack_tuple tuple;

2954

struct nf_conntrack_tuple tuple;

2947

struct nf_conntrack_expect *exp;

2955

struct nf_conntrack_expect *exp;

2948

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2956

struct nfgenmsg *nfmsg = nlmsg_data(nlh);

2949

u_int8_t u3 = nfmsg->nfgen_family;

2957

u_int8_t u3 = nfmsg->nfgen_family;

2950

u16 zone;

2958

u16 zone;

2951

int err;

2959

int err;

2952

2960

2953

if (!cda[CTA_EXPECT_TUPLE]

2961

if (!cda[CTA_EXPECT_TUPLE]

2954

|| !cda[CTA_EXPECT_MASK]

2962

|| !cda[CTA_EXPECT_MASK]

2955

|| !cda[CTA_EXPECT_MASTER])

2963

|| !cda[CTA_EXPECT_MASTER])

2956

return -EINVAL;

2964

return -EINVAL;

2957

2965

2958

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2966

err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);

2959

if (err < 0)

2967

if (err < 0)

2960

return err;

2968

return err;

2961

2969

2962

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2970

err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);

2963

if (err < 0)

2971

if (err < 0)

2964

return err;

2972

return err;

2965

2973

2966

spin_lock_bh(&nf_conntrack_lock);

2974

spin_lock_bh(&nf_conntrack_lock);

2967

exp = __nf_ct_expect_find(net, zone, &tuple);

2975

exp = __nf_ct_expect_find(net, zone, &tuple);

2968

2976

2969

if (!exp) {

2977

if (!exp) {

2970

spin_unlock_bh(&nf_conntrack_lock);

2978

spin_unlock_bh(&nf_conntrack_lock);

2971

err = -ENOENT;

2979

err = -ENOENT;

2972

if (nlh->nlmsg_flags & NLM_F_CREATE) {

2980

if (nlh->nlmsg_flags & NLM_F_CREATE) {

2973

err = ctnetlink_create_expect(net, zone, cda,

2981

err = ctnetlink_create_expect(net, zone, cda,

2974

u3,

2982

u3,

2975

NETLINK_CB(skb).portid,

2983

NETLINK_CB(skb).portid,

2976

nlmsg_report(nlh));

2984

nlmsg_report(nlh));

2977

}

2985

}

2978

return err;

2986

return err;

2979

}

2987

}

2980

2988

2981

err = -EEXIST;

2989

err = -EEXIST;

2982

if (!(nlh->nlmsg_flags & NLM_F_EXCL))

2990

if (!(nlh->nlmsg_flags & NLM_F_EXCL))

2983

err = ctnetlink_change_expect(exp, cda);

2991

err = ctnetlink_change_expect(exp, cda);

2984

spin_unlock_bh(&nf_conntrack_lock);

2992

spin_unlock_bh(&nf_conntrack_lock);

2985

2993

2986

return err;

2994

return err;

2987

}

2995

}

2988

2996

2989

static int

2997

static int

2990

ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu,

2998

ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu,

2991

const struct ip_conntrack_stat *st)

2999

const struct ip_conntrack_stat *st)

2992

{

3000

{

2993

struct nlmsghdr *nlh;

3001

struct nlmsghdr *nlh;

2994

struct nfgenmsg *nfmsg;

3002

struct nfgenmsg *nfmsg;

2995

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

3003

unsigned int flags = portid ? NLM_F_MULTI : 0, event;

2996

3004

2997

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_EXP_GET_STATS_CPU);

3005

event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_EXP_GET_STATS_CPU);

2998

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

3006

nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);

2999

if (nlh == NULL)

3007

if (nlh == NULL)

3000

goto nlmsg_failure;

3008

goto nlmsg_failure;

3001

3009

3002

nfmsg = nlmsg_data(nlh);

3010

nfmsg = nlmsg_data(nlh);

3003

nfmsg->nfgen_family = AF_UNSPEC;

3011

nfmsg->nfgen_family = AF_UNSPEC;

3004

nfmsg->version = NFNETLINK_V0;

3012

nfmsg->version = NFNETLINK_V0;

3005

nfmsg->res_id = htons(cpu);

3013

nfmsg->res_id = htons(cpu);

3006

3014

3007

if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) ||

3015

if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) ||

3008

nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) ||

3016

nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) ||

3009

nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete)))

3017

nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete)))

3010

goto nla_put_failure;

3018

goto nla_put_failure;

3011

3019

3012

nlmsg_end(skb, nlh);

3020

nlmsg_end(skb, nlh);

3013

return skb->len;

3021

return skb->len;

3014

3022

3015

nla_put_failure:

3023

nla_put_failure:

3016

nlmsg_failure:

3024

nlmsg_failure:

3017

nlmsg_cancel(skb, nlh);

3025

nlmsg_cancel(skb, nlh);

3018

return -1;

3026

return -1;

3019

}

3027

}

3020

3028

3021

static int

3029

static int

3022

ctnetlink_exp_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)

3030

ctnetlink_exp_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)

3023

{

3031

{

3024

int cpu;

3032

int cpu;

3025

struct net *net = sock_net(skb->sk);

3033

struct net *net = sock_net(skb->sk);

3026

3034

3027

if (cb->args[0] == nr_cpu_ids)

3035

if (cb->args[0] == nr_cpu_ids)

3028

return 0;

3036

return 0;

3029

3037

3030

for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {

3038

for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {

3031

const struct ip_conntrack_stat *st;

3039

const struct ip_conntrack_stat *st;

3032

3040

3033

if (!cpu_possible(cpu))

3041

if (!cpu_possible(cpu))

3034

continue;

3042

continue;

3035

3043

3036

st = per_cpu_ptr(net->ct.stat, cpu);

3044

st = per_cpu_ptr(net->ct.stat, cpu);

3037

if (ctnetlink_exp_stat_fill_info(skb, NETLINK_CB(cb->skb).portid,

3045

if (ctnetlink_exp_stat_fill_info(skb, NETLINK_CB(cb->skb).portid,

3038

cb->nlh->nlmsg_seq,

3046

cb->nlh->nlmsg_seq,

3039

cpu, st) < 0)

3047

cpu, st) < 0)

3040

break;

3048

break;

3041

}

3049

}

3042

cb->args[0] = cpu;

3050

cb->args[0] = cpu;

3043

3051

3044

return skb->len;

3052

return skb->len;

3045

}

3053

}

3046

3054

3047

static int

3055

static int

3048

ctnetlink_stat_exp_cpu(struct sock *ctnl, struct sk_buff *skb,

3056

ctnetlink_stat_exp_cpu(struct sock *ctnl, struct sk_buff *skb,

3049

const struct nlmsghdr *nlh,

3057

const struct nlmsghdr *nlh,

3050

const struct nlattr * const cda[])

3058

const struct nlattr * const cda[])

3051

{

3059

{

3052

if (nlh->nlmsg_flags & NLM_F_DUMP) {

3060

if (nlh->nlmsg_flags & NLM_F_DUMP) {

3053

struct netlink_dump_control c = {

3061

struct netlink_dump_control c = {

3054

.dump = ctnetlink_exp_stat_cpu_dump,

3062

.dump = ctnetlink_exp_stat_cpu_dump,

3055

};

3063

};

3056

return netlink_dump_start(ctnl, skb, nlh, &c);

3064

return netlink_dump_start(ctnl, skb, nlh, &c);

3057

}

3065

}

3058

3066

3059

return 0;

3067

return 0;

3060

}

3068

}

3061

3069

3062

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3070

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3063

static struct nf_ct_event_notifier ctnl_notifier = {

3071

static struct nf_ct_event_notifier ctnl_notifier = {

3064

.fcn = ctnetlink_conntrack_event,

3072

.fcn = ctnetlink_conntrack_event,

3065

};

3073

};

3066

3074

3067

static struct nf_exp_event_notifier ctnl_notifier_exp = {

3075

static struct nf_exp_event_notifier ctnl_notifier_exp = {

3068

.fcn = ctnetlink_expect_event,

3076

.fcn = ctnetlink_expect_event,

3069

};

3077

};

3070

#endif

3078

#endif

3071

3079

3072

static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {

3080

static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {

3073

[IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,

3081

[IPCTNL_MSG_CT_NEW] = { .call = ctnetlink_new_conntrack,

3074

.attr_count = CTA_MAX,

3082

.attr_count = CTA_MAX,

3075

.policy = ct_nla_policy },

3083

.policy = ct_nla_policy },

3076

[IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,

3084

[IPCTNL_MSG_CT_GET] = { .call = ctnetlink_get_conntrack,

3077

.attr_count = CTA_MAX,

3085

.attr_count = CTA_MAX,

3078

.policy = ct_nla_policy },

3086

.policy = ct_nla_policy },

3079

[IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,

3087

[IPCTNL_MSG_CT_DELETE] = { .call = ctnetlink_del_conntrack,

3080

.attr_count = CTA_MAX,

3088

.attr_count = CTA_MAX,

3081

.policy = ct_nla_policy },

3089

.policy = ct_nla_policy },

3082

[IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,

3090

[IPCTNL_MSG_CT_GET_CTRZERO] = { .call = ctnetlink_get_conntrack,

3083

.attr_count = CTA_MAX,

3091

.attr_count = CTA_MAX,

3084

.policy = ct_nla_policy },

3092

.policy = ct_nla_policy },

3085

[IPCTNL_MSG_CT_GET_STATS_CPU] = { .call = ctnetlink_stat_ct_cpu },

3093

[IPCTNL_MSG_CT_GET_STATS_CPU] = { .call = ctnetlink_stat_ct_cpu },

3086

[IPCTNL_MSG_CT_GET_STATS] = { .call = ctnetlink_stat_ct },

3094

[IPCTNL_MSG_CT_GET_STATS] = { .call = ctnetlink_stat_ct },

3087

[IPCTNL_MSG_CT_GET_DYING] = { .call = ctnetlink_get_ct_dying },

3095

[IPCTNL_MSG_CT_GET_DYING] = { .call = ctnetlink_get_ct_dying },

3088

[IPCTNL_MSG_CT_GET_UNCONFIRMED] = { .call = ctnetlink_get_ct_unconfirmed },

3096

[IPCTNL_MSG_CT_GET_UNCONFIRMED] = { .call = ctnetlink_get_ct_unconfirmed },

3089

};

3097

};

3090

3098

3091

static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {

3099

static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {

3092

[IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,

3100

[IPCTNL_MSG_EXP_GET] = { .call = ctnetlink_get_expect,

3093

.attr_count = CTA_EXPECT_MAX,

3101

.attr_count = CTA_EXPECT_MAX,

3094

.policy = exp_nla_policy },

3102

.policy = exp_nla_policy },

3095

[IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,

3103

[IPCTNL_MSG_EXP_NEW] = { .call = ctnetlink_new_expect,

3096

.attr_count = CTA_EXPECT_MAX,

3104

.attr_count = CTA_EXPECT_MAX,

3097

.policy = exp_nla_policy },

3105

.policy = exp_nla_policy },

3098

[IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,

3106

[IPCTNL_MSG_EXP_DELETE] = { .call = ctnetlink_del_expect,

3099

.attr_count = CTA_EXPECT_MAX,

3107

.attr_count = CTA_EXPECT_MAX,

3100

.policy = exp_nla_policy },

3108

.policy = exp_nla_policy },

3101

[IPCTNL_MSG_EXP_GET_STATS_CPU] = { .call = ctnetlink_stat_exp_cpu },

3109

[IPCTNL_MSG_EXP_GET_STATS_CPU] = { .call = ctnetlink_stat_exp_cpu },

3102

};

3110

};

3103

3111

3104

static const struct nfnetlink_subsystem ctnl_subsys = {

3112

static const struct nfnetlink_subsystem ctnl_subsys = {

3105

.name = "conntrack",

3113

.name = "conntrack",

3106

.subsys_id = NFNL_SUBSYS_CTNETLINK,

3114

.subsys_id = NFNL_SUBSYS_CTNETLINK,

3107

.cb_count = IPCTNL_MSG_MAX,

3115

.cb_count = IPCTNL_MSG_MAX,

3108

.cb = ctnl_cb,

3116

.cb = ctnl_cb,

3109

};

3117

};

3110

3118

3111

static const struct nfnetlink_subsystem ctnl_exp_subsys = {

3119

static const struct nfnetlink_subsystem ctnl_exp_subsys = {

3112

.name = "conntrack_expect",

3120

.name = "conntrack_expect",

3113

.subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,

3121

.subsys_id = NFNL_SUBSYS_CTNETLINK_EXP,

3114

.cb_count = IPCTNL_MSG_EXP_MAX,

3122

.cb_count = IPCTNL_MSG_EXP_MAX,

3115

.cb = ctnl_exp_cb,

3123

.cb = ctnl_exp_cb,

3116

};

3124

};

3117

3125

3118

MODULE_ALIAS("ip_conntrack_netlink");

3126

MODULE_ALIAS("ip_conntrack_netlink");

3119

MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);

3127

MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);

3120

MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);

3128

MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);

3121

3129

3122

static int __net_init ctnetlink_net_init(struct net *net)

3130

static int __net_init ctnetlink_net_init(struct net *net)

3123

{

3131

{

3124

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3132

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3125

int ret;

3133

int ret;

3126

3134

3127

ret = nf_conntrack_register_notifier(net, &ctnl_notifier);

3135

ret = nf_conntrack_register_notifier(net, &ctnl_notifier);

3128

if (ret < 0) {

3136

if (ret < 0) {

3129

pr_err("ctnetlink_init: cannot register notifier.\n");

3137

pr_err("ctnetlink_init: cannot register notifier.\n");

3130

goto err_out;

3138

goto err_out;

3131

}

3139

}

3132

3140

3133

ret = nf_ct_expect_register_notifier(net, &ctnl_notifier_exp);

3141

ret = nf_ct_expect_register_notifier(net, &ctnl_notifier_exp);

3134

if (ret < 0) {

3142

if (ret < 0) {

3135

pr_err("ctnetlink_init: cannot expect register notifier.\n");

3143

pr_err("ctnetlink_init: cannot expect register notifier.\n");

3136

goto err_unreg_notifier;

3144

goto err_unreg_notifier;

3137

}

3145

}

3138

#endif

3146

#endif

3139

return 0;

3147

return 0;

3140

3148

3141

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3149

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3142

err_unreg_notifier:

3150

err_unreg_notifier:

3143

nf_conntrack_unregister_notifier(net, &ctnl_notifier);

3151

nf_conntrack_unregister_notifier(net, &ctnl_notifier);

3144

err_out:

3152

err_out:

3145

return ret;

3153

return ret;

3146

#endif

3154

#endif

3147

}

3155

}

3148

3156

3149

static void ctnetlink_net_exit(struct net *net)

3157

static void ctnetlink_net_exit(struct net *net)

3150

{

3158

{

3151

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3159

#ifdef CONFIG_NF_CONNTRACK_EVENTS

3152

nf_ct_expect_unregister_notifier(net, &ctnl_notifier_exp);

3160

nf_ct_expect_unregister_notifier(net, &ctnl_notifier_exp);

3153

nf_conntrack_unregister_notifier(net, &ctnl_notifier);

3161

nf_conntrack_unregister_notifier(net, &ctnl_notifier);

3154

#endif

3162

#endif

3155

}

3163

}

3156

3164

3157

static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)

3165

static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)

3158

{

3166

{

3159

struct net *net;

3167

struct net *net;

3160

3168

3161

list_for_each_entry(net, net_exit_list, exit_list)

3169

list_for_each_entry(net, net_exit_list, exit_list)

3162

ctnetlink_net_exit(net);

3170

ctnetlink_net_exit(net);

3163

}

3171

}

3164

3172

3165

static struct pernet_operations ctnetlink_net_ops = {

3173

static struct pernet_operations ctnetlink_net_ops = {

3166

.init = ctnetlink_net_init,

3174

.init = ctnetlink_net_init,

3167

.exit_batch = ctnetlink_net_exit_batch,

3175

.exit_batch = ctnetlink_net_exit_batch,

3168

};

3176

};

3169

3177

3170

static int __init ctnetlink_init(void)

3178

static int __init ctnetlink_init(void)

3171

{

3179

{

3172

int ret;

3180

int ret;

3173

3181

3174

pr_info("ctnetlink v%s: registering with nfnetlink.\n", version);

3182

pr_info("ctnetlink v%s: registering with nfnetlink.\n", version);

3175

ret = nfnetlink_subsys_register(&ctnl_subsys);

3183

ret = nfnetlink_subsys_register(&ctnl_subsys);

3176

if (ret < 0) {

3184

if (ret < 0) {

3177

pr_err("ctnetlink_init: cannot register with nfnetlink.\n");

3185

pr_err("ctnetlink_init: cannot register with nfnetlink.\n");

3178

goto err_out;

3186

goto err_out;

3179

}

3187

}

3180

3188

3181

ret = nfnetlink_subsys_register(&ctnl_exp_subsys);

3189

ret = nfnetlink_subsys_register(&ctnl_exp_subsys);

3182

if (ret < 0) {

3190

if (ret < 0) {

3183

pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n");

3191

pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n");

3184

goto err_unreg_subsys;

3192

goto err_unreg_subsys;

3185

}

3193

}

3186

3194

3187

ret = register_pernet_subsys(&ctnetlink_net_ops);

3195

ret = register_pernet_subsys(&ctnetlink_net_ops);

3188

if (ret < 0) {

3196

if (ret < 0) {

3189

pr_err("ctnetlink_init: cannot register pernet operations\n");

3197

pr_err("ctnetlink_init: cannot register pernet operations\n");

3190

goto err_unreg_exp_subsys;

3198

goto err_unreg_exp_subsys;

3191

}

3199

}

3192

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

3200

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

3193

/* setup interaction between nf_queue and nf_conntrack_netlink. */

3201

/* setup interaction between nf_queue and nf_conntrack_netlink. */

3194

RCU_INIT_POINTER(nfq_ct_hook, &ctnetlink_nfqueue_hook);

3202

RCU_INIT_POINTER(nfq_ct_hook, &ctnetlink_nfqueue_hook);

3195

#endif

3203

#endif

3196

return 0;

3204

return 0;

3197

3205

3198

err_unreg_exp_subsys:

3206

err_unreg_exp_subsys:

3199

nfnetlink_subsys_unregister(&ctnl_exp_subsys);

3207

nfnetlink_subsys_unregister(&ctnl_exp_subsys);

3200

err_unreg_subsys:

3208

err_unreg_subsys:

3201

nfnetlink_subsys_unregister(&ctnl_subsys);

3209

nfnetlink_subsys_unregister(&ctnl_subsys);

3202

err_out:

3210

err_out:

3203

return ret;

3211

return ret;

3204

}

3212

}

3205

3213

3206

static void __exit ctnetlink_exit(void)

3214

static void __exit ctnetlink_exit(void)

3207

{

3215

{

3208

pr_info("ctnetlink: unregistering from nfnetlink.\n");

3216

pr_info("ctnetlink: unregistering from nfnetlink.\n");

3209

3217

3210

unregister_pernet_subsys(&ctnetlink_net_ops);

3218

unregister_pernet_subsys(&ctnetlink_net_ops);

3211

nfnetlink_subsys_unregister(&ctnl_exp_subsys);

3219

nfnetlink_subsys_unregister(&ctnl_exp_subsys);

3212

nfnetlink_subsys_unregister(&ctnl_subsys);

3220

nfnetlink_subsys_unregister(&ctnl_subsys);

3213

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

3221

#ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT

3214

RCU_INIT_POINTER(nfq_ct_hook, NULL);

3222

RCU_INIT_POINTER(nfq_ct_hook, NULL);

3215

#endif

3223

#endif

3216

}

3224

}

3217

3225

3218

module_init(ctnetlink_init);

3226

module_init(ctnetlink_init);

3219

module_exit(ctnetlink_exit);

3227

module_exit(ctnetlink_exit);

3220

3228

GITLAB

netfilter: ctnetlink: honor CTA_MARK_MASK when setting ctmark

 /* Connection tracking via netlink socket. Allows for user space
  * protocol helpers and general trouble making from userspace.
  *
  * (C) 2001 by Jay Schulist <jschlst@samba.org>
  * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
  * (C) 2003 by Patrick Mchardy <kaber@trash.net>
  * (C) 2005-2012 by Pablo Neira Ayuso <pablo@netfilter.org>
  *
  * Initial connection tracking via netlink development funded and
  * generally made possible by Network Robots, Inc. (www.networkrobots.com)
  *
  * Further development of this code funded by Astaro AG (http://www.astaro.com)
  *
  * This software may be used and distributed according to the terms
  * of the GNU General Public License, incorporated herein by reference.
  */
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/rculist.h>
 #include <linux/rculist_nulls.h>
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/security.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
 #include <linux/netlink.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/slab.h>
 #include <linux/netfilter.h>
 #include <net/netlink.h>
 #include <net/sock.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_expect.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_acct.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
 #include <net/netfilter/nf_nat_helper.h>
 #endif
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 MODULE_LICENSE("GPL");
 static char __initdata version[] = "0.93";
 static inline int
 ctnetlink_dump_tuples_proto(struct sk_buff *skb,
 			    const struct nf_conntrack_tuple *tuple,
 			    struct nf_conntrack_l4proto *l4proto)
 {
 	int ret = 0;
 	struct nlattr *nest_parms;
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_PROTO | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (nla_put_u8(skb, CTA_PROTO_NUM, tuple->dst.protonum))
 		goto nla_put_failure;
 	if (likely(l4proto->tuple_to_nlattr))
 		ret = l4proto->tuple_to_nlattr(skb, tuple);
 	nla_nest_end(skb, nest_parms);
 	return ret;
 nla_put_failure:
 	return -1;
 }
 static inline int
 ctnetlink_dump_tuples_ip(struct sk_buff *skb,
 			 const struct nf_conntrack_tuple *tuple,
 			 struct nf_conntrack_l3proto *l3proto)
 {
 	int ret = 0;
 	struct nlattr *nest_parms;
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_IP | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (likely(l3proto->tuple_to_nlattr))
 		ret = l3proto->tuple_to_nlattr(skb, tuple);
 	nla_nest_end(skb, nest_parms);
 	return ret;
 nla_put_failure:
 	return -1;
 }
 static int
 ctnetlink_dump_tuples(struct sk_buff *skb,
 		      const struct nf_conntrack_tuple *tuple)
 {
 	int ret;
 	struct nf_conntrack_l3proto *l3proto;
 	struct nf_conntrack_l4proto *l4proto;
 	rcu_read_lock();
 	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
 	ret = ctnetlink_dump_tuples_ip(skb, tuple, l3proto);
 	if (ret >= 0) {
 		l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
 					       tuple->dst.protonum);
 		ret = ctnetlink_dump_tuples_proto(skb, tuple, l4proto);
 	}
 	rcu_read_unlock();
 	return ret;
 }
 static inline int
 ctnetlink_dump_status(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	if (nla_put_be32(skb, CTA_STATUS, htonl(ct->status)))
 		goto nla_put_failure;
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static inline int
 ctnetlink_dump_timeout(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	long timeout = ((long)ct->timeout.expires - (long)jiffies) / HZ;
 	if (timeout < 0)
 		timeout = 0;
 	if (nla_put_be32(skb, CTA_TIMEOUT, htonl(timeout)))
 		goto nla_put_failure;
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static inline int
 ctnetlink_dump_protoinfo(struct sk_buff *skb, struct nf_conn *ct)
 {
 	struct nf_conntrack_l4proto *l4proto;
 	struct nlattr *nest_proto;
 	int ret;
 	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 	if (!l4proto->to_nlattr)
 		return 0;
 	nest_proto = nla_nest_start(skb, CTA_PROTOINFO | NLA_F_NESTED);
 	if (!nest_proto)
 		goto nla_put_failure;
 	ret = l4proto->to_nlattr(skb, nest_proto, ct);
 	nla_nest_end(skb, nest_proto);
 	return ret;
 nla_put_failure:
 	return -1;
 }
 static inline int
 ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	struct nlattr *nest_helper;
 	const struct nf_conn_help *help = nfct_help(ct);
 	struct nf_conntrack_helper *helper;
 	if (!help)
 		return 0;
 	helper = rcu_dereference(help->helper);
 	if (!helper)
 		goto out;
 	nest_helper = nla_nest_start(skb, CTA_HELP | NLA_F_NESTED);
 	if (!nest_helper)
 		goto nla_put_failure;
 	if (nla_put_string(skb, CTA_HELP_NAME, helper->name))
 		goto nla_put_failure;
 	if (helper->to_nlattr)
 		helper->to_nlattr(skb, ct);
 	nla_nest_end(skb, nest_helper);
 out:
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static int
 dump_counters(struct sk_buff *skb, struct nf_conn_acct *acct,
 	      enum ip_conntrack_dir dir, int type)
 {
 	enum ctattr_type attr = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
 	struct nf_conn_counter *counter = acct->counter;
 	struct nlattr *nest_count;
 	u64 pkts, bytes;
 	if (type == IPCTNL_MSG_CT_GET_CTRZERO) {
 		pkts = atomic64_xchg(&counter[dir].packets, 0);
 		bytes = atomic64_xchg(&counter[dir].bytes, 0);
 	} else {
 		pkts = atomic64_read(&counter[dir].packets);
 		bytes = atomic64_read(&counter[dir].bytes);
 	}
 	nest_count = nla_nest_start(skb, attr | NLA_F_NESTED);
 	if (!nest_count)
 		goto nla_put_failure;
 	if (nla_put_be64(skb, CTA_COUNTERS_PACKETS, cpu_to_be64(pkts)) ||
 	    nla_put_be64(skb, CTA_COUNTERS_BYTES, cpu_to_be64(bytes)))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_count);
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static int
 ctnetlink_dump_acct(struct sk_buff *skb, const struct nf_conn *ct, int type)
 {
 	struct nf_conn_acct *acct = nf_conn_acct_find(ct);
 	if (!acct)
 		return 0;
 	if (dump_counters(skb, acct, IP_CT_DIR_ORIGINAL, type) < 0)
 		return -1;
 	if (dump_counters(skb, acct, IP_CT_DIR_REPLY, type) < 0)
 		return -1;
 	return 0;
 }
 static int
 ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	struct nlattr *nest_count;
 	const struct nf_conn_tstamp *tstamp;
 	tstamp = nf_conn_tstamp_find(ct);
 	if (!tstamp)
 		return 0;
 	nest_count = nla_nest_start(skb, CTA_TIMESTAMP | NLA_F_NESTED);
 	if (!nest_count)
 		goto nla_put_failure;
 	if (nla_put_be64(skb, CTA_TIMESTAMP_START, cpu_to_be64(tstamp->start)) ||
 	    (tstamp->stop != 0 && nla_put_be64(skb, CTA_TIMESTAMP_STOP,
 					       cpu_to_be64(tstamp->stop))))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_count);
 	return 0;
 nla_put_failure:
 	return -1;
 }
 #ifdef CONFIG_NF_CONNTRACK_MARK
 static inline int
 ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark)))
 		goto nla_put_failure;
 	return 0;
 nla_put_failure:
 	return -1;
 }
 #else
 #define ctnetlink_dump_mark(a, b) (0)
 #endif
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 static inline int
 ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	struct nlattr *nest_secctx;
 	int len, ret;
 	char *secctx;
 	ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
 	if (ret)
 		return 0;
 	ret = -1;
 	nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
 	if (!nest_secctx)
 		goto nla_put_failure;
 	if (nla_put_string(skb, CTA_SECCTX_NAME, secctx))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_secctx);
 	ret = 0;
 nla_put_failure:
 	security_release_secctx(secctx, len);
 	return ret;
 }
 #else
 #define ctnetlink_dump_secctx(a, b) (0)
 #endif
 #ifdef CONFIG_NF_CONNTRACK_LABELS
 static int ctnetlink_label_size(const struct nf_conn *ct)
 {
 	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 	if (!labels)
 		return 0;
 	return nla_total_size(labels->words * sizeof(long));
 }
 static int
 ctnetlink_dump_labels(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	struct nf_conn_labels *labels = nf_ct_labels_find(ct);
 	unsigned int len, i;
 	if (!labels)
 		return 0;
 	len = labels->words * sizeof(long);
 	i = 0;
 	do {
 		if (labels->bits[i] != 0)
 			return nla_put(skb, CTA_LABELS, len, labels->bits);
 		i++;
 	} while (i < labels->words);
 	return 0;
 }
 #else
 #define ctnetlink_dump_labels(a, b) (0)
 #define ctnetlink_label_size(a)	(0)
 #endif
 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
 static inline int
 ctnetlink_dump_master(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	struct nlattr *nest_parms;
 	if (!(ct->status & IPS_EXPECTED))
 		return 0;
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_MASTER | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, master_tuple(ct)) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static int
 dump_ct_seq_adj(struct sk_buff *skb, const struct nf_ct_seqadj *seq, int type)
 {
 	struct nlattr *nest_parms;
 	nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (nla_put_be32(skb, CTA_SEQADJ_CORRECTION_POS,
 			 htonl(seq->correction_pos)) ||
 	    nla_put_be32(skb, CTA_SEQADJ_OFFSET_BEFORE,
 			 htonl(seq->offset_before)) ||
 	    nla_put_be32(skb, CTA_SEQADJ_OFFSET_AFTER,
 			 htonl(seq->offset_after)))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static inline int
 ctnetlink_dump_ct_seq_adj(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
 	struct nf_ct_seqadj *seq;
 	if (!(ct->status & IPS_SEQ_ADJUST) || !seqadj)
 		return 0;
 	seq = &seqadj->seq[IP_CT_DIR_ORIGINAL];
 	if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_ORIG) == -1)
 		return -1;
 	seq = &seqadj->seq[IP_CT_DIR_REPLY];
 	if (dump_ct_seq_adj(skb, seq, CTA_SEQ_ADJ_REPLY) == -1)
 		return -1;
 	return 0;
 }
 static inline int
 ctnetlink_dump_id(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	if (nla_put_be32(skb, CTA_ID, htonl((unsigned long)ct)))
 		goto nla_put_failure;
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static inline int
 ctnetlink_dump_use(struct sk_buff *skb, const struct nf_conn *ct)
 {
 	if (nla_put_be32(skb, CTA_USE, htonl(atomic_read(&ct->ct_general.use))))
 		goto nla_put_failure;
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static int
 ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
 		    struct nf_conn *ct)
 {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfmsg;
 	struct nlattr *nest_parms;
 	unsigned int flags = portid ? NLM_F_MULTI : 0, event;
 	event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_NEW);
 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
 	if (nlh == NULL)
 		goto nlmsg_failure;
 	nfmsg = nlmsg_data(nlh);
 	nfmsg->nfgen_family = nf_ct_l3num(ct);
 	nfmsg->version      = NFNETLINK_V0;
 	nfmsg->res_id	    = 0;
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	if (nf_ct_zone(ct) &&
 	    nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
 		goto nla_put_failure;
 	if (ctnetlink_dump_status(skb, ct) < 0 ||
 	    ctnetlink_dump_timeout(skb, ct) < 0 ||
 	    ctnetlink_dump_acct(skb, ct, type) < 0 ||
 	    ctnetlink_dump_timestamp(skb, ct) < 0 ||
 	    ctnetlink_dump_protoinfo(skb, ct) < 0 ||
 	    ctnetlink_dump_helpinfo(skb, ct) < 0 ||
 	    ctnetlink_dump_mark(skb, ct) < 0 ||
 	    ctnetlink_dump_secctx(skb, ct) < 0 ||
 	    ctnetlink_dump_labels(skb, ct) < 0 ||
 	    ctnetlink_dump_id(skb, ct) < 0 ||
 	    ctnetlink_dump_use(skb, ct) < 0 ||
 	    ctnetlink_dump_master(skb, ct) < 0 ||
 	    ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
 		goto nla_put_failure;
 	nlmsg_end(skb, nlh);
 	return skb->len;
 nlmsg_failure:
 nla_put_failure:
 	nlmsg_cancel(skb, nlh);
 	return -1;
 }
 static inline size_t
 ctnetlink_proto_size(const struct nf_conn *ct)
 {
 	struct nf_conntrack_l3proto *l3proto;
 	struct nf_conntrack_l4proto *l4proto;
 	size_t len = 0;
 	rcu_read_lock();
 	l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
 	len += l3proto->nla_size;
 	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 	len += l4proto->nla_size;
 	rcu_read_unlock();
 	return len;
 }
 static inline size_t
 ctnetlink_acct_size(const struct nf_conn *ct)
 {
 	if (!nf_ct_ext_exist(ct, NF_CT_EXT_ACCT))
 		return 0;
 	return 2 * nla_total_size(0) /* CTA_COUNTERS_ORIG|REPL */
 	       + 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_PACKETS */
 	       + 2 * nla_total_size(sizeof(uint64_t)) /* CTA_COUNTERS_BYTES */
 	       ;
 }
 static inline int
 ctnetlink_secctx_size(const struct nf_conn *ct)
 {
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 	int len, ret;
 	ret = security_secid_to_secctx(ct->secmark, NULL, &len);
 	if (ret)
 		return 0;
 	return nla_total_size(0) /* CTA_SECCTX */
 	       + nla_total_size(sizeof(char) * len); /* CTA_SECCTX_NAME */
 #else
 	return 0;
 #endif
 }
 static inline size_t
 ctnetlink_timestamp_size(const struct nf_conn *ct)
 {
 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
 	if (!nf_ct_ext_exist(ct, NF_CT_EXT_TSTAMP))
 		return 0;
 	return nla_total_size(0) + 2 * nla_total_size(sizeof(uint64_t));
 #else
 	return 0;
 #endif
 }
 static inline size_t
 ctnetlink_nlmsg_size(const struct nf_conn *ct)
 {
 	return NLMSG_ALIGN(sizeof(struct nfgenmsg))
 	       + 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
 	       + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
 	       + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
 	       + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */
 	       + ctnetlink_acct_size(ct)
 	       + ctnetlink_timestamp_size(ct)
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
 	       + nla_total_size(0) /* CTA_PROTOINFO */
 	       + nla_total_size(0) /* CTA_HELP */
 	       + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
 	       + ctnetlink_secctx_size(ct)
 #ifdef CONFIG_NF_NAT_NEEDED
 	       + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
 	       + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
 #endif
 #ifdef CONFIG_NF_CONNTRACK_MARK
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
 #endif
 	       + ctnetlink_proto_size(ct)
 	       + ctnetlink_label_size(ct)
 	       ;
 }
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 static int
 ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
 {
 	struct net *net;
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfmsg;
 	struct nlattr *nest_parms;
 	struct nf_conn *ct = item->ct;
 	struct sk_buff *skb;
 	unsigned int type;
 	unsigned int flags = 0, group;
 	int err;
 	/* ignore our fake conntrack entry */
 	if (nf_ct_is_untracked(ct))
 		return 0;
 	if (events & (1 << IPCT_DESTROY)) {
 		type = IPCTNL_MSG_CT_DELETE;
 		group = NFNLGRP_CONNTRACK_DESTROY;
 	} else  if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) {
 		type = IPCTNL_MSG_CT_NEW;
 		flags = NLM_F_CREATE|NLM_F_EXCL;
 		group = NFNLGRP_CONNTRACK_NEW;
 	} else  if (events) {
 		type = IPCTNL_MSG_CT_NEW;
 		group = NFNLGRP_CONNTRACK_UPDATE;
 	} else
 		return 0;
 	net = nf_ct_net(ct);
 	if (!item->report && !nfnetlink_has_listeners(net, group))
 		return 0;
 	skb = nlmsg_new(ctnetlink_nlmsg_size(ct), GFP_ATOMIC);
 	if (skb == NULL)
 		goto errout;
 	type |= NFNL_SUBSYS_CTNETLINK << 8;
 	nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
 	if (nlh == NULL)
 		goto nlmsg_failure;
 	nfmsg = nlmsg_data(nlh);
 	nfmsg->nfgen_family = nf_ct_l3num(ct);
 	nfmsg->version	= NFNETLINK_V0;
 	nfmsg->res_id	= 0;
 	rcu_read_lock();
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	if (nf_ct_zone(ct) &&
 	    nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
 		goto nla_put_failure;
 	if (ctnetlink_dump_id(skb, ct) < 0)
 		goto nla_put_failure;
 	if (ctnetlink_dump_status(skb, ct) < 0)
 		goto nla_put_failure;
 	if (events & (1 << IPCT_DESTROY)) {
 		if (ctnetlink_dump_acct(skb, ct, type) < 0 ||
 		    ctnetlink_dump_timestamp(skb, ct) < 0)
 			goto nla_put_failure;
 	} else {
 		if (ctnetlink_dump_timeout(skb, ct) < 0)
 			goto nla_put_failure;
 		if (events & (1 << IPCT_PROTOINFO)
 		    && ctnetlink_dump_protoinfo(skb, ct) < 0)
 			goto nla_put_failure;
 		if ((events & (1 << IPCT_HELPER) || nfct_help(ct))
 		    && ctnetlink_dump_helpinfo(skb, ct) < 0)
 			goto nla_put_failure;
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 		if ((events & (1 << IPCT_SECMARK) || ct->secmark)
 		    && ctnetlink_dump_secctx(skb, ct) < 0)
 			goto nla_put_failure;
 #endif
 		if (events & (1 << IPCT_LABEL) &&
 		     ctnetlink_dump_labels(skb, ct) < 0)
 			goto nla_put_failure;
 		if (events & (1 << IPCT_RELATED) &&
 		    ctnetlink_dump_master(skb, ct) < 0)
 			goto nla_put_failure;
 		if (events & (1 << IPCT_SEQADJ) &&
 		    ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
 			goto nla_put_failure;
 	}
 #ifdef CONFIG_NF_CONNTRACK_MARK
 	if ((events & (1 << IPCT_MARK) || ct->mark)
 	    && ctnetlink_dump_mark(skb, ct) < 0)
 		goto nla_put_failure;
 #endif
 	rcu_read_unlock();
 	nlmsg_end(skb, nlh);
 	err = nfnetlink_send(skb, net, item->portid, group, item->report,
 			     GFP_ATOMIC);
 	if (err == -ENOBUFS || err == -EAGAIN)
 		return -ENOBUFS;
 	return 0;
 nla_put_failure:
 	rcu_read_unlock();
 	nlmsg_cancel(skb, nlh);
 nlmsg_failure:
 	kfree_skb(skb);
 errout:
 	if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)
 		return -ENOBUFS;
 	return 0;
 }
 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
 static int ctnetlink_done(struct netlink_callback *cb)
 {
 	if (cb->args[1])
 		nf_ct_put((struct nf_conn *)cb->args[1]);
 	if (cb->data)
 		kfree(cb->data);
 	return 0;
 }
 struct ctnetlink_dump_filter {
 	struct {
 		u_int32_t val;
 		u_int32_t mask;
 	} mark;
 };
 static int
 ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct net *net = sock_net(skb->sk);
 	struct nf_conn *ct, *last;
 	struct nf_conntrack_tuple_hash *h;
 	struct hlist_nulls_node *n;
 	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 	u_int8_t l3proto = nfmsg->nfgen_family;
 	int res;
 #ifdef CONFIG_NF_CONNTRACK_MARK
 	const struct ctnetlink_dump_filter *filter = cb->data;
 #endif
 	spin_lock_bh(&nf_conntrack_lock);
 	last = (struct nf_conn *)cb->args[1];
 	for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
 restart:
 		hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],
 					 hnnode) {
 			if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
 				continue;
 			ct = nf_ct_tuplehash_to_ctrack(h);
 			/* Dump entries of a given L3 protocol number.
 			 * If it is not specified, ie. l3proto == 0,
 			 * then dump everything. */
 			if (l3proto && nf_ct_l3num(ct) != l3proto)
 				continue;
 			if (cb->args[1]) {
 				if (ct != last)
 					continue;
 				cb->args[1] = 0;
 			}
 #ifdef CONFIG_NF_CONNTRACK_MARK
 			if (filter && !((ct->mark & filter->mark.mask) ==
 					filter->mark.val)) {
 				continue;
 			}
 #endif
 			rcu_read_lock();
 			res =
 			ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
 					    cb->nlh->nlmsg_seq,
 					    NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
 					    ct);
 			rcu_read_unlock();
 			if (res < 0) {
 				nf_conntrack_get(&ct->ct_general);
 				cb->args[1] = (unsigned long)ct;
 				goto out;
 			}
 		}
 		if (cb->args[1]) {
 			cb->args[1] = 0;
 			goto restart;
 		}
 	}
 out:
 	spin_unlock_bh(&nf_conntrack_lock);
 	if (last)
 		nf_ct_put(last);
 	return skb->len;
 }
 static inline int
 ctnetlink_parse_tuple_ip(struct nlattr *attr, struct nf_conntrack_tuple *tuple)
 {
 	struct nlattr *tb[CTA_IP_MAX+1];
 	struct nf_conntrack_l3proto *l3proto;
 	int ret = 0;
 	ret = nla_parse_nested(tb, CTA_IP_MAX, attr, NULL);
 	if (ret < 0)
 		return ret;
 	rcu_read_lock();
 	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
 	if (likely(l3proto->nlattr_to_tuple)) {
 		ret = nla_validate_nested(attr, CTA_IP_MAX,
 					  l3proto->nla_policy);
 		if (ret == 0)
 			ret = l3proto->nlattr_to_tuple(tb, tuple);
 	}
 	rcu_read_unlock();
 	return ret;
 }
 static const struct nla_policy proto_nla_policy[CTA_PROTO_MAX+1] = {
 	[CTA_PROTO_NUM]	= { .type = NLA_U8 },
 };
 static inline int
 ctnetlink_parse_tuple_proto(struct nlattr *attr,
 			    struct nf_conntrack_tuple *tuple)
 {
 	struct nlattr *tb[CTA_PROTO_MAX+1];
 	struct nf_conntrack_l4proto *l4proto;
 	int ret = 0;
 	ret = nla_parse_nested(tb, CTA_PROTO_MAX, attr, proto_nla_policy);
 	if (ret < 0)
 		return ret;
 	if (!tb[CTA_PROTO_NUM])
 		return -EINVAL;
 	tuple->dst.protonum = nla_get_u8(tb[CTA_PROTO_NUM]);
 	rcu_read_lock();
 	l4proto = __nf_ct_l4proto_find(tuple->src.l3num, tuple->dst.protonum);
 	if (likely(l4proto->nlattr_to_tuple)) {
 		ret = nla_validate_nested(attr, CTA_PROTO_MAX,
 					  l4proto->nla_policy);
 		if (ret == 0)
 			ret = l4proto->nlattr_to_tuple(tb, tuple);
 	}
 	rcu_read_unlock();
 	return ret;
 }
 static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
 	[CTA_TUPLE_IP]		= { .type = NLA_NESTED },
 	[CTA_TUPLE_PROTO]	= { .type = NLA_NESTED },
 };
 static int
 ctnetlink_parse_tuple(const struct nlattr * const cda[],
 		      struct nf_conntrack_tuple *tuple,
 		      enum ctattr_type type, u_int8_t l3num)
 {
 	struct nlattr *tb[CTA_TUPLE_MAX+1];
 	int err;
 	memset(tuple, 0, sizeof(*tuple));
 	err = nla_parse_nested(tb, CTA_TUPLE_MAX, cda[type], tuple_nla_policy);
 	if (err < 0)
 		return err;
 	if (!tb[CTA_TUPLE_IP])
 		return -EINVAL;
 	tuple->src.l3num = l3num;
 	err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
 	if (err < 0)
 		return err;
 	if (!tb[CTA_TUPLE_PROTO])
 		return -EINVAL;
 	err = ctnetlink_parse_tuple_proto(tb[CTA_TUPLE_PROTO], tuple);
 	if (err < 0)
 		return err;
 	/* orig and expect tuples get DIR_ORIGINAL */
 	if (type == CTA_TUPLE_REPLY)
 		tuple->dst.dir = IP_CT_DIR_REPLY;
 	else
 		tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 	return 0;
 }
 static int
 ctnetlink_parse_zone(const struct nlattr *attr, u16 *zone)
 {
 	if (attr)
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 		*zone = ntohs(nla_get_be16(attr));
 #else
 		return -EOPNOTSUPP;
 #endif
 	else
 		*zone = 0;
 	return 0;
 }
 static const struct nla_policy help_nla_policy[CTA_HELP_MAX+1] = {
 	[CTA_HELP_NAME]		= { .type = NLA_NUL_STRING,
 				    .len = NF_CT_HELPER_NAME_LEN - 1 },
 };
 static inline int
 ctnetlink_parse_help(const struct nlattr *attr, char **helper_name,
 		     struct nlattr **helpinfo)
 {
 	int err;
 	struct nlattr *tb[CTA_HELP_MAX+1];
 	err = nla_parse_nested(tb, CTA_HELP_MAX, attr, help_nla_policy);
 	if (err < 0)
 		return err;
 	if (!tb[CTA_HELP_NAME])
 		return -EINVAL;
 	*helper_name = nla_data(tb[CTA_HELP_NAME]);
 	if (tb[CTA_HELP_INFO])
 		*helpinfo = tb[CTA_HELP_INFO];
 	return 0;
 }
 #define __CTA_LABELS_MAX_LENGTH ((XT_CONNLABEL_MAXBIT + 1) / BITS_PER_BYTE)
 static const struct nla_policy ct_nla_policy[CTA_MAX+1] = {
 	[CTA_TUPLE_ORIG]	= { .type = NLA_NESTED },
 	[CTA_TUPLE_REPLY]	= { .type = NLA_NESTED },
 	[CTA_STATUS] 		= { .type = NLA_U32 },
 	[CTA_PROTOINFO]		= { .type = NLA_NESTED },
 	[CTA_HELP]		= { .type = NLA_NESTED },
 	[CTA_NAT_SRC]		= { .type = NLA_NESTED },
 	[CTA_TIMEOUT] 		= { .type = NLA_U32 },
 	[CTA_MARK]		= { .type = NLA_U32 },
 	[CTA_ID]		= { .type = NLA_U32 },
 	[CTA_NAT_DST]		= { .type = NLA_NESTED },
 	[CTA_TUPLE_MASTER]	= { .type = NLA_NESTED },
 	[CTA_NAT_SEQ_ADJ_ORIG]  = { .type = NLA_NESTED },
 	[CTA_NAT_SEQ_ADJ_REPLY] = { .type = NLA_NESTED },
 	[CTA_ZONE]		= { .type = NLA_U16 },
 	[CTA_MARK_MASK]		= { .type = NLA_U32 },
 	[CTA_LABELS]		= { .type = NLA_BINARY,
 				    .len = __CTA_LABELS_MAX_LENGTH },
 	[CTA_LABELS_MASK]	= { .type = NLA_BINARY,
 				    .len = __CTA_LABELS_MAX_LENGTH },
 };
 static int
 ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
 			const struct nlmsghdr *nlh,
 			const struct nlattr * const cda[])
 {
 	struct net *net = sock_net(ctnl);
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conntrack_tuple tuple;
 	struct nf_conn *ct;
 	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	u_int8_t u3 = nfmsg->nfgen_family;
 	u16 zone;
 	int err;
 	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
 	if (err < 0)
 		return err;
 	if (cda[CTA_TUPLE_ORIG])
 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
 	else if (cda[CTA_TUPLE_REPLY])
 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
 	else {
 		/* Flush the whole table */
 		nf_conntrack_flush_report(net,
 					 NETLINK_CB(skb).portid,
 					 nlmsg_report(nlh));
 		return 0;
 	}
 	if (err < 0)
 		return err;
 	h = nf_conntrack_find_get(net, zone, &tuple);
 	if (!h)
 		return -ENOENT;
 	ct = nf_ct_tuplehash_to_ctrack(h);
 	if (cda[CTA_ID]) {
 		u_int32_t id = ntohl(nla_get_be32(cda[CTA_ID]));
 		if (id != (u32)(unsigned long)ct) {
 			nf_ct_put(ct);
 			return -ENOENT;
 		}
 	}
 	if (del_timer(&ct->timeout))
 		nf_ct_delete(ct, NETLINK_CB(skb).portid, nlmsg_report(nlh));
 	nf_ct_put(ct);
 	return 0;
 }
 static int
 ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
 			const struct nlmsghdr *nlh,
 			const struct nlattr * const cda[])
 {
 	struct net *net = sock_net(ctnl);
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conntrack_tuple tuple;
 	struct nf_conn *ct;
 	struct sk_buff *skb2 = NULL;
 	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	u_int8_t u3 = nfmsg->nfgen_family;
 	u16 zone;
 	int err;
 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {
 			.dump = ctnetlink_dump_table,
 			.done = ctnetlink_done,
 		};
 #ifdef CONFIG_NF_CONNTRACK_MARK
 		if (cda[CTA_MARK] && cda[CTA_MARK_MASK]) {
 			struct ctnetlink_dump_filter *filter;
 			filter = kzalloc(sizeof(struct ctnetlink_dump_filter),
 					 GFP_ATOMIC);
 			if (filter == NULL)
 				return -ENOMEM;
 			filter->mark.val = ntohl(nla_get_be32(cda[CTA_MARK]));
 			filter->mark.mask =
 				ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
 			c.data = filter;
 		}
 #endif
 		return netlink_dump_start(ctnl, skb, nlh, &c);
 	}
 	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
 	if (err < 0)
 		return err;
 	if (cda[CTA_TUPLE_ORIG])
 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_ORIG, u3);
 	else if (cda[CTA_TUPLE_REPLY])
 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_TUPLE_REPLY, u3);
 	else
 		return -EINVAL;
 	if (err < 0)
 		return err;
 	h = nf_conntrack_find_get(net, zone, &tuple);
 	if (!h)
 		return -ENOENT;
 	ct = nf_ct_tuplehash_to_ctrack(h);
 	err = -ENOMEM;
 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 	if (skb2 == NULL) {
 		nf_ct_put(ct);
 		return -ENOMEM;
 	}
 	rcu_read_lock();
 	err = ctnetlink_fill_info(skb2, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
 				  NFNL_MSG_TYPE(nlh->nlmsg_type), ct);
 	rcu_read_unlock();
 	nf_ct_put(ct);
 	if (err <= 0)
 		goto free;
 	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
 	if (err < 0)
 		goto out;
 	return 0;
 free:
 	kfree_skb(skb2);
 out:
 	/* this avoids a loop in nfnetlink. */
 	return err == -EAGAIN ? -ENOBUFS : err;
 }
 static int ctnetlink_done_list(struct netlink_callback *cb)
 {
 	if (cb->args[1])
 		nf_ct_put((struct nf_conn *)cb->args[1]);
 	return 0;
 }
 static int
 ctnetlink_dump_list(struct sk_buff *skb, struct netlink_callback *cb,
 		    struct hlist_nulls_head *list)
 {
 	struct nf_conn *ct, *last;
 	struct nf_conntrack_tuple_hash *h;
 	struct hlist_nulls_node *n;
 	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 	u_int8_t l3proto = nfmsg->nfgen_family;
 	int res;
 	if (cb->args[2])
 		return 0;
 	spin_lock_bh(&nf_conntrack_lock);
 	last = (struct nf_conn *)cb->args[1];
 restart:
 	hlist_nulls_for_each_entry(h, n, list, hnnode) {
 		ct = nf_ct_tuplehash_to_ctrack(h);
 		if (l3proto && nf_ct_l3num(ct) != l3proto)
 			continue;
 		if (cb->args[1]) {
 			if (ct != last)
 				continue;
 			cb->args[1] = 0;
 		}
 		rcu_read_lock();
 		res = ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).portid,
 					  cb->nlh->nlmsg_seq,
 					  NFNL_MSG_TYPE(cb->nlh->nlmsg_type),
 					  ct);
 		rcu_read_unlock();
 		if (res < 0) {
 			nf_conntrack_get(&ct->ct_general);
 			cb->args[1] = (unsigned long)ct;
 			goto out;
 		}
 	}
 	if (cb->args[1]) {
 		cb->args[1] = 0;
 		goto restart;
 	} else
 		cb->args[2] = 1;
 out:
 	spin_unlock_bh(&nf_conntrack_lock);
 	if (last)
 		nf_ct_put(last);
 	return skb->len;
 }
 static int
 ctnetlink_dump_dying(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct net *net = sock_net(skb->sk);
 	return ctnetlink_dump_list(skb, cb, &net->ct.dying);
 }
 static int
 ctnetlink_get_ct_dying(struct sock *ctnl, struct sk_buff *skb,
 		       const struct nlmsghdr *nlh,
 		       const struct nlattr * const cda[])
 {
 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {
 			.dump = ctnetlink_dump_dying,
 			.done = ctnetlink_done_list,
 		};
 		return netlink_dump_start(ctnl, skb, nlh, &c);
 	}
 	return -EOPNOTSUPP;
 }
 static int
 ctnetlink_dump_unconfirmed(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct net *net = sock_net(skb->sk);
 	return ctnetlink_dump_list(skb, cb, &net->ct.unconfirmed);
 }
 static int
 ctnetlink_get_ct_unconfirmed(struct sock *ctnl, struct sk_buff *skb,
 			     const struct nlmsghdr *nlh,
 			     const struct nlattr * const cda[])
 {
 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {
 			.dump = ctnetlink_dump_unconfirmed,
 			.done = ctnetlink_done_list,
 		};
 		return netlink_dump_start(ctnl, skb, nlh, &c);
 	}
 	return -EOPNOTSUPP;
 }
 #ifdef CONFIG_NF_NAT_NEEDED
 static int
 ctnetlink_parse_nat_setup(struct nf_conn *ct,
 			  enum nf_nat_manip_type manip,
 			  const struct nlattr *attr)
 {
 	typeof(nfnetlink_parse_nat_setup_hook) parse_nat_setup;
 	int err;
 	parse_nat_setup = rcu_dereference(nfnetlink_parse_nat_setup_hook);
 	if (!parse_nat_setup) {
 #ifdef CONFIG_MODULES
 		rcu_read_unlock();
 		nfnl_unlock(NFNL_SUBSYS_CTNETLINK);
 		if (request_module("nf-nat") < 0) {
 			nfnl_lock(NFNL_SUBSYS_CTNETLINK);
 			rcu_read_lock();
 			return -EOPNOTSUPP;
 		}
 		nfnl_lock(NFNL_SUBSYS_CTNETLINK);
 		rcu_read_lock();
 		if (nfnetlink_parse_nat_setup_hook)
 			return -EAGAIN;
 #endif
 		return -EOPNOTSUPP;
 	}
 	err = parse_nat_setup(ct, manip, attr);
 	if (err == -EAGAIN) {
 #ifdef CONFIG_MODULES
 		rcu_read_unlock();
 		nfnl_unlock(NFNL_SUBSYS_CTNETLINK);
 		if (request_module("nf-nat-%u", nf_ct_l3num(ct)) < 0) {
 			nfnl_lock(NFNL_SUBSYS_CTNETLINK);
 			rcu_read_lock();
 			return -EOPNOTSUPP;
 		}
 		nfnl_lock(NFNL_SUBSYS_CTNETLINK);
 		rcu_read_lock();
 #else
 		err = -EOPNOTSUPP;
 #endif
 	}
 	return err;
 }
 #endif
 static int
 ctnetlink_change_status(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 	unsigned long d;
 	unsigned int status = ntohl(nla_get_be32(cda[CTA_STATUS]));
 	d = ct->status ^ status;
 	if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
 		/* unchangeable */
 		return -EBUSY;
 	if (d & IPS_SEEN_REPLY && !(status & IPS_SEEN_REPLY))
 		/* SEEN_REPLY bit can only be set */
 		return -EBUSY;
 	if (d & IPS_ASSURED && !(status & IPS_ASSURED))
 		/* ASSURED bit can only be set */
 		return -EBUSY;
 	/* Be careful here, modifying NAT bits can screw up things,
 	 * so don't let users modify them directly if they don't pass
 	 * nf_nat_range. */
 	ct->status |= status & ~(IPS_NAT_DONE_MASK | IPS_NAT_MASK);
 	return 0;
 }
 static int
 ctnetlink_change_nat(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 #ifdef CONFIG_NF_NAT_NEEDED
 	int ret;
 	if (cda[CTA_NAT_DST]) {
 		ret = ctnetlink_parse_nat_setup(ct,
 						NF_NAT_MANIP_DST,
 						cda[CTA_NAT_DST]);
 		if (ret < 0)
 			return ret;
 	}
 	if (cda[CTA_NAT_SRC]) {
 		ret = ctnetlink_parse_nat_setup(ct,
 						NF_NAT_MANIP_SRC,
 						cda[CTA_NAT_SRC]);
 		if (ret < 0)
 			return ret;
 	}
 	return 0;
 #else
 	return -EOPNOTSUPP;
 #endif
 }
 static inline int
 ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 	struct nf_conntrack_helper *helper;
 	struct nf_conn_help *help = nfct_help(ct);
 	char *helpname = NULL;
 	struct nlattr *helpinfo = NULL;
 	int err;
 	/* don't change helper of sibling connections */
 	if (ct->master)
 		return -EBUSY;
 	err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
 	if (err < 0)
 		return err;
 	if (!strcmp(helpname, "")) {
 		if (help && help->helper) {
 			/* we had a helper before ... */
 			nf_ct_remove_expectations(ct);
 			RCU_INIT_POINTER(help->helper, NULL);
 		}
 		return 0;
 	}
 	helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
 					    nf_ct_protonum(ct));
 	if (helper == NULL) {
 #ifdef CONFIG_MODULES
 		spin_unlock_bh(&nf_conntrack_lock);
 		if (request_module("nfct-helper-%s", helpname) < 0) {
 			spin_lock_bh(&nf_conntrack_lock);
 			return -EOPNOTSUPP;
 		}
 		spin_lock_bh(&nf_conntrack_lock);
 		helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
 						    nf_ct_protonum(ct));
 		if (helper)
 			return -EAGAIN;
 #endif
 		return -EOPNOTSUPP;
 	}
 	if (help) {
 		if (help->helper == helper) {
 			/* update private helper data if allowed. */
 			if (helper->from_nlattr)
 				helper->from_nlattr(helpinfo, ct);
 			return 0;
 		} else
 			return -EBUSY;
 	}
 	/* we cannot set a helper for an existing conntrack */
 	return -EOPNOTSUPP;
 }
 static inline int
 ctnetlink_change_timeout(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 	u_int32_t timeout = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
 	if (!del_timer(&ct->timeout))
 		return -ETIME;
 	ct->timeout.expires = jiffies + timeout * HZ;
 	add_timer(&ct->timeout);
 	return 0;
 }
 static const struct nla_policy protoinfo_policy[CTA_PROTOINFO_MAX+1] = {
 	[CTA_PROTOINFO_TCP]	= { .type = NLA_NESTED },
 	[CTA_PROTOINFO_DCCP]	= { .type = NLA_NESTED },
 	[CTA_PROTOINFO_SCTP]	= { .type = NLA_NESTED },
 };
 static inline int
 ctnetlink_change_protoinfo(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 	const struct nlattr *attr = cda[CTA_PROTOINFO];
 	struct nlattr *tb[CTA_PROTOINFO_MAX+1];
 	struct nf_conntrack_l4proto *l4proto;
 	int err = 0;
 	err = nla_parse_nested(tb, CTA_PROTOINFO_MAX, attr, protoinfo_policy);
 	if (err < 0)
 		return err;
 	rcu_read_lock();
 	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 	if (l4proto->from_nlattr)
 		err = l4proto->from_nlattr(tb, ct);
 	rcu_read_unlock();
 	return err;
 }
 static const struct nla_policy seqadj_policy[CTA_SEQADJ_MAX+1] = {
 	[CTA_SEQADJ_CORRECTION_POS]	= { .type = NLA_U32 },
 	[CTA_SEQADJ_OFFSET_BEFORE]	= { .type = NLA_U32 },
 	[CTA_SEQADJ_OFFSET_AFTER]	= { .type = NLA_U32 },
 };
 static inline int
 change_seq_adj(struct nf_ct_seqadj *seq, const struct nlattr * const attr)
 {
 	int err;
 	struct nlattr *cda[CTA_SEQADJ_MAX+1];
 	err = nla_parse_nested(cda, CTA_SEQADJ_MAX, attr, seqadj_policy);
 	if (err < 0)
 		return err;
 	if (!cda[CTA_SEQADJ_CORRECTION_POS])
 		return -EINVAL;
 	seq->correction_pos =
 		ntohl(nla_get_be32(cda[CTA_SEQADJ_CORRECTION_POS]));
 	if (!cda[CTA_SEQADJ_OFFSET_BEFORE])
 		return -EINVAL;
 	seq->offset_before =
 		ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_BEFORE]));
 	if (!cda[CTA_SEQADJ_OFFSET_AFTER])
 		return -EINVAL;
 	seq->offset_after =
 		ntohl(nla_get_be32(cda[CTA_SEQADJ_OFFSET_AFTER]));
 	return 0;
 }
 static int
 ctnetlink_change_seq_adj(struct nf_conn *ct,
 			 const struct nlattr * const cda[])
 {
 	struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
 	int ret = 0;
 	if (!seqadj)
 		return 0;
 	if (cda[CTA_SEQ_ADJ_ORIG]) {
 		ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_ORIGINAL],
 				     cda[CTA_SEQ_ADJ_ORIG]);
 		if (ret < 0)
 			return ret;
 		ct->status |= IPS_SEQ_ADJUST;
 	}
 	if (cda[CTA_SEQ_ADJ_REPLY]) {
 		ret = change_seq_adj(&seqadj->seq[IP_CT_DIR_REPLY],
 				     cda[CTA_SEQ_ADJ_REPLY]);
 		if (ret < 0)
 			return ret;
 		ct->status |= IPS_SEQ_ADJUST;
 	}
 	return 0;
 }
 static int
 ctnetlink_attach_labels(struct nf_conn *ct, const struct nlattr * const cda[])
 {
 #ifdef CONFIG_NF_CONNTRACK_LABELS
 	size_t len = nla_len(cda[CTA_LABELS]);
 	const void *mask = cda[CTA_LABELS_MASK];
 	if (len & (sizeof(u32)-1)) /* must be multiple of u32 */
 		return -EINVAL;
 	if (mask) {
 		if (nla_len(cda[CTA_LABELS_MASK]) == 0 ||
 		    nla_len(cda[CTA_LABELS_MASK]) != len)
 			return -EINVAL;
 		mask = nla_data(cda[CTA_LABELS_MASK]);
 	}
 	len /= sizeof(u32);
 	return nf_connlabels_replace(ct, nla_data(cda[CTA_LABELS]), mask, len);
 #else
 	return -EOPNOTSUPP;
 #endif
 }
 static int
 ctnetlink_change_conntrack(struct nf_conn *ct,
 			   const struct nlattr * const cda[])
 {
 	int err;
 	/* only allow NAT changes and master assignation for new conntracks */
 	if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST] || cda[CTA_TUPLE_MASTER])
 		return -EOPNOTSUPP;
 	if (cda[CTA_HELP]) {
 		err = ctnetlink_change_helper(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_TIMEOUT]) {
 		err = ctnetlink_change_timeout(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_STATUS]) {
 		err = ctnetlink_change_status(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_PROTOINFO]) {
 		err = ctnetlink_change_protoinfo(ct, cda);
 		if (err < 0)
 			return err;
 	}
 #if defined(CONFIG_NF_CONNTRACK_MARK)
 	if (cda[CTA_MARK])
 		ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
 #endif
 	if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
 		err = ctnetlink_change_seq_adj(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_LABELS]) {
 		err = ctnetlink_attach_labels(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	return 0;
 }
 static struct nf_conn *
 ctnetlink_create_conntrack(struct net *net, u16 zone,
 			   const struct nlattr * const cda[],
 			   struct nf_conntrack_tuple *otuple,
 			   struct nf_conntrack_tuple *rtuple,
 			   u8 u3)
 {
 	struct nf_conn *ct;
 	int err = -EINVAL;
 	struct nf_conntrack_helper *helper;
 	struct nf_conn_tstamp *tstamp;
 	ct = nf_conntrack_alloc(net, zone, otuple, rtuple, GFP_ATOMIC);
 	if (IS_ERR(ct))
 		return ERR_PTR(-ENOMEM);
 	if (!cda[CTA_TIMEOUT])
 		goto err1;
 	ct->timeout.expires = ntohl(nla_get_be32(cda[CTA_TIMEOUT]));
 	ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
 	rcu_read_lock();
  	if (cda[CTA_HELP]) {
 		char *helpname = NULL;
 		struct nlattr *helpinfo = NULL;
 		err = ctnetlink_parse_help(cda[CTA_HELP], &helpname, &helpinfo);
  		if (err < 0)
 			goto err2;
 		helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
 						    nf_ct_protonum(ct));
 		if (helper == NULL) {
 			rcu_read_unlock();
 #ifdef CONFIG_MODULES
 			if (request_module("nfct-helper-%s", helpname) < 0) {
 				err = -EOPNOTSUPP;
 				goto err1;
 			}
 			rcu_read_lock();
 			helper = __nf_conntrack_helper_find(helpname,
 							    nf_ct_l3num(ct),
 							    nf_ct_protonum(ct));
 			if (helper) {
 				err = -EAGAIN;
 				goto err2;
 			}
 			rcu_read_unlock();
 #endif
 			err = -EOPNOTSUPP;
 			goto err1;
 		} else {
 			struct nf_conn_help *help;
 			help = nf_ct_helper_ext_add(ct, helper, GFP_ATOMIC);
 			if (help == NULL) {
 				err = -ENOMEM;
 				goto err2;
 			}
 			/* set private helper data if allowed. */
 			if (helper->from_nlattr)
 				helper->from_nlattr(helpinfo, ct);
 			/* not in hash table yet so not strictly necessary */
 			RCU_INIT_POINTER(help->helper, helper);
 		}
 	} else {
 		/* try an implicit helper assignation */
 		err = __nf_ct_try_assign_helper(ct, NULL, GFP_ATOMIC);
 		if (err < 0)
 			goto err2;
 	}
 	if (cda[CTA_NAT_SRC] || cda[CTA_NAT_DST]) {
 		err = ctnetlink_change_nat(ct, cda);
 		if (err < 0)
 			goto err2;
 	}
 	nf_ct_acct_ext_add(ct, GFP_ATOMIC);
 	nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
 	nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
 	nf_ct_labels_ext_add(ct);
 	/* we must add conntrack extensions before confirmation. */
 	ct->status |= IPS_CONFIRMED;
 	if (cda[CTA_STATUS]) {
 		err = ctnetlink_change_status(ct, cda);
 		if (err < 0)
 			goto err2;
 	}
 	if (cda[CTA_SEQ_ADJ_ORIG] || cda[CTA_SEQ_ADJ_REPLY]) {
 		err = ctnetlink_change_seq_adj(ct, cda);
 		if (err < 0)
 			goto err2;
 	}
 	memset(&ct->proto, 0, sizeof(ct->proto));
 	if (cda[CTA_PROTOINFO]) {
 		err = ctnetlink_change_protoinfo(ct, cda);
 		if (err < 0)
 			goto err2;
 	}
 #if defined(CONFIG_NF_CONNTRACK_MARK)
 	if (cda[CTA_MARK])
 		ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
 #endif
 	/* setup master conntrack: this is a confirmed expectation */
 	if (cda[CTA_TUPLE_MASTER]) {
 		struct nf_conntrack_tuple master;
 		struct nf_conntrack_tuple_hash *master_h;
 		struct nf_conn *master_ct;
 		err = ctnetlink_parse_tuple(cda, &master, CTA_TUPLE_MASTER, u3);
 		if (err < 0)
 			goto err2;
 		master_h = nf_conntrack_find_get(net, zone, &master);
 		if (master_h == NULL) {
 			err = -ENOENT;
 			goto err2;
 		}
 		master_ct = nf_ct_tuplehash_to_ctrack(master_h);
 		__set_bit(IPS_EXPECTED_BIT, &ct->status);
 		ct->master = master_ct;
 	}
 	tstamp = nf_conn_tstamp_find(ct);
 	if (tstamp)
 		tstamp->start = ktime_to_ns(ktime_get_real());
 	err = nf_conntrack_hash_check_insert(ct);
 	if (err < 0)
 		goto err2;
 	rcu_read_unlock();
 	return ct;
 err2:
 	rcu_read_unlock();
 err1:
 	nf_conntrack_free(ct);
 	return ERR_PTR(err);
 }
 static int
 ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 			const struct nlmsghdr *nlh,
 			const struct nlattr * const cda[])
 {
 	struct net *net = sock_net(ctnl);
 	struct nf_conntrack_tuple otuple, rtuple;
 	struct nf_conntrack_tuple_hash *h = NULL;
 	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	struct nf_conn *ct;
 	u_int8_t u3 = nfmsg->nfgen_family;
 	u16 zone;
 	int err;
 	err = ctnetlink_parse_zone(cda[CTA_ZONE], &zone);
 	if (err < 0)
 		return err;
 	if (cda[CTA_TUPLE_ORIG]) {
 		err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG, u3);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_TUPLE_REPLY]) {
 		err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY, u3);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_TUPLE_ORIG])
 		h = nf_conntrack_find_get(net, zone, &otuple);
 	else if (cda[CTA_TUPLE_REPLY])
 		h = nf_conntrack_find_get(net, zone, &rtuple);
 	if (h == NULL) {
 		err = -ENOENT;
 		if (nlh->nlmsg_flags & NLM_F_CREATE) {
 			enum ip_conntrack_events events;
 			if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
 				return -EINVAL;
 			ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
 							&rtuple, u3);
 			if (IS_ERR(ct))
 				return PTR_ERR(ct);
 			err = 0;
 			if (test_bit(IPS_EXPECTED_BIT, &ct->status))
 				events = IPCT_RELATED;
 			else
 				events = IPCT_NEW;
 			if (cda[CTA_LABELS] &&
 			    ctnetlink_attach_labels(ct, cda) == 0)
 				events |= (1 << IPCT_LABEL);
 			nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
 						      (1 << IPCT_ASSURED) |
 						      (1 << IPCT_HELPER) |
 						      (1 << IPCT_PROTOINFO) |
 						      (1 << IPCT_SEQADJ) |
 						      (1 << IPCT_MARK) | events,
 						      ct, NETLINK_CB(skb).portid,
 						      nlmsg_report(nlh));
 			nf_ct_put(ct);
 		}
 		return err;
 	}
 	/* implicit 'else' */
 	err = -EEXIST;
 	ct = nf_ct_tuplehash_to_ctrack(h);
 	if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
 		spin_lock_bh(&nf_conntrack_lock);
 		err = ctnetlink_change_conntrack(ct, cda);
 		spin_unlock_bh(&nf_conntrack_lock);
 		if (err == 0) {
 			nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
 						      (1 << IPCT_ASSURED) |
 						      (1 << IPCT_HELPER) |
 						      (1 << IPCT_LABEL) |
 						      (1 << IPCT_PROTOINFO) |
 						      (1 << IPCT_SEQADJ) |
 						      (1 << IPCT_MARK),
 						      ct, NETLINK_CB(skb).portid,
 						      nlmsg_report(nlh));
 		}
 	}
 	nf_ct_put(ct);
 	return err;
 }
 static int
 ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
 				__u16 cpu, const struct ip_conntrack_stat *st)
 {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfmsg;
 	unsigned int flags = portid ? NLM_F_MULTI : 0, event;
 	event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS_CPU);
 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
 	if (nlh == NULL)
 		goto nlmsg_failure;
 	nfmsg = nlmsg_data(nlh);
 	nfmsg->nfgen_family = AF_UNSPEC;
 	nfmsg->version      = NFNETLINK_V0;
 	nfmsg->res_id	    = htons(cpu);
 	if (nla_put_be32(skb, CTA_STATS_SEARCHED, htonl(st->searched)) ||
 	    nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
 	    nla_put_be32(skb, CTA_STATS_NEW, htonl(st->new)) ||
 	    nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||
 	    nla_put_be32(skb, CTA_STATS_IGNORE, htonl(st->ignore)) ||
 	    nla_put_be32(skb, CTA_STATS_DELETE, htonl(st->delete)) ||
 	    nla_put_be32(skb, CTA_STATS_DELETE_LIST, htonl(st->delete_list)) ||
 	    nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||
 	    nla_put_be32(skb, CTA_STATS_INSERT_FAILED,
 				htonl(st->insert_failed)) ||
 	    nla_put_be32(skb, CTA_STATS_DROP, htonl(st->drop)) ||
 	    nla_put_be32(skb, CTA_STATS_EARLY_DROP, htonl(st->early_drop)) ||
 	    nla_put_be32(skb, CTA_STATS_ERROR, htonl(st->error)) ||
 	    nla_put_be32(skb, CTA_STATS_SEARCH_RESTART,
 				htonl(st->search_restart)))
 		goto nla_put_failure;
 	nlmsg_end(skb, nlh);
 	return skb->len;
 nla_put_failure:
 nlmsg_failure:
 	nlmsg_cancel(skb, nlh);
 	return -1;
 }
 static int
 ctnetlink_ct_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	int cpu;
 	struct net *net = sock_net(skb->sk);
 	if (cb->args[0] == nr_cpu_ids)
 		return 0;
 	for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
 		const struct ip_conntrack_stat *st;
 		if (!cpu_possible(cpu))
 			continue;
 		st = per_cpu_ptr(net->ct.stat, cpu);
 		if (ctnetlink_ct_stat_cpu_fill_info(skb,
 						    NETLINK_CB(cb->skb).portid,
 						    cb->nlh->nlmsg_seq,
 						    cpu, st) < 0)
 				break;
 	}
 	cb->args[0] = cpu;
 	return skb->len;
 }
 static int
 ctnetlink_stat_ct_cpu(struct sock *ctnl, struct sk_buff *skb,
 		      const struct nlmsghdr *nlh,
 		      const struct nlattr * const cda[])
 {
 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {
 			.dump = ctnetlink_ct_stat_cpu_dump,
 		};
 		return netlink_dump_start(ctnl, skb, nlh, &c);
 	}
 	return 0;
 }
 static int
 ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
 			    struct net *net)
 {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfmsg;
 	unsigned int flags = portid ? NLM_F_MULTI : 0, event;
 	unsigned int nr_conntracks = atomic_read(&net->ct.count);
 	event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_CT_GET_STATS);
 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
 	if (nlh == NULL)
 		goto nlmsg_failure;
 	nfmsg = nlmsg_data(nlh);
 	nfmsg->nfgen_family = AF_UNSPEC;
 	nfmsg->version      = NFNETLINK_V0;
 	nfmsg->res_id	    = 0;
 	if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))
 		goto nla_put_failure;
 	nlmsg_end(skb, nlh);
 	return skb->len;
 nla_put_failure:
 nlmsg_failure:
 	nlmsg_cancel(skb, nlh);
 	return -1;
 }
 static int
 ctnetlink_stat_ct(struct sock *ctnl, struct sk_buff *skb,
 		  const struct nlmsghdr *nlh,
 		  const struct nlattr * const cda[])
 {
 	struct sk_buff *skb2;
 	int err;
 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 	if (skb2 == NULL)
 		return -ENOMEM;
 	err = ctnetlink_stat_ct_fill_info(skb2, NETLINK_CB(skb).portid,
 					  nlh->nlmsg_seq,
 					  NFNL_MSG_TYPE(nlh->nlmsg_type),
 					  sock_net(skb->sk));
 	if (err <= 0)
 		goto free;
 	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
 	if (err < 0)
 		goto out;
 	return 0;
 free:
 	kfree_skb(skb2);
 out:
 	/* this avoids a loop in nfnetlink. */
 	return err == -EAGAIN ? -ENOBUFS : err;
 }
 static const struct nla_policy exp_nla_policy[CTA_EXPECT_MAX+1] = {
 	[CTA_EXPECT_MASTER]	= { .type = NLA_NESTED },
 	[CTA_EXPECT_TUPLE]	= { .type = NLA_NESTED },
 	[CTA_EXPECT_MASK]	= { .type = NLA_NESTED },
 	[CTA_EXPECT_TIMEOUT]	= { .type = NLA_U32 },
 	[CTA_EXPECT_ID]		= { .type = NLA_U32 },
 	[CTA_EXPECT_HELP_NAME]	= { .type = NLA_NUL_STRING,
 				    .len = NF_CT_HELPER_NAME_LEN - 1 },
 	[CTA_EXPECT_ZONE]	= { .type = NLA_U16 },
 	[CTA_EXPECT_FLAGS]	= { .type = NLA_U32 },
 	[CTA_EXPECT_CLASS]	= { .type = NLA_U32 },
 	[CTA_EXPECT_NAT]	= { .type = NLA_NESTED },
 	[CTA_EXPECT_FN]		= { .type = NLA_NUL_STRING },
 };
 static struct nf_conntrack_expect *
 ctnetlink_alloc_expect(const struct nlattr *const cda[], struct nf_conn *ct,
 		       struct nf_conntrack_helper *helper,
 		       struct nf_conntrack_tuple *tuple,
 		       struct nf_conntrack_tuple *mask);
 #ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
 static size_t
 ctnetlink_nfqueue_build_size(const struct nf_conn *ct)
 {
 	return 3 * nla_total_size(0) /* CTA_TUPLE_ORIG|REPL|MASTER */
 	       + 3 * nla_total_size(0) /* CTA_TUPLE_IP */
 	       + 3 * nla_total_size(0) /* CTA_TUPLE_PROTO */
 	       + 3 * nla_total_size(sizeof(u_int8_t)) /* CTA_PROTO_NUM */
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_ID */
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_STATUS */
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_TIMEOUT */
 	       + nla_total_size(0) /* CTA_PROTOINFO */
 	       + nla_total_size(0) /* CTA_HELP */
 	       + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
 	       + ctnetlink_secctx_size(ct)
 #ifdef CONFIG_NF_NAT_NEEDED
 	       + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
 	       + 6 * nla_total_size(sizeof(u_int32_t)) /* CTA_NAT_SEQ_OFFSET */
 #endif
 #ifdef CONFIG_NF_CONNTRACK_MARK
 	       + nla_total_size(sizeof(u_int32_t)) /* CTA_MARK */
 #endif
 	       + ctnetlink_proto_size(ct)
 	       ;
 }
 static int
 ctnetlink_nfqueue_build(struct sk_buff *skb, struct nf_conn *ct)
 {
 	struct nlattr *nest_parms;
 	rcu_read_lock();
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_ORIGINAL)) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	nest_parms = nla_nest_start(skb, CTA_TUPLE_REPLY | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, nf_ct_tuple(ct, IP_CT_DIR_REPLY)) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	if (nf_ct_zone(ct)) {
 		if (nla_put_be16(skb, CTA_ZONE, htons(nf_ct_zone(ct))))
 			goto nla_put_failure;
 	}
 	if (ctnetlink_dump_id(skb, ct) < 0)
 		goto nla_put_failure;
 	if (ctnetlink_dump_status(skb, ct) < 0)
 		goto nla_put_failure;
 	if (ctnetlink_dump_timeout(skb, ct) < 0)
 		goto nla_put_failure;
 	if (ctnetlink_dump_protoinfo(skb, ct) < 0)
 		goto nla_put_failure;
 	if (ctnetlink_dump_helpinfo(skb, ct) < 0)
 		goto nla_put_failure;
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 	if (ct->secmark && ctnetlink_dump_secctx(skb, ct) < 0)
 		goto nla_put_failure;
 #endif
 	if (ct->master && ctnetlink_dump_master(skb, ct) < 0)
 		goto nla_put_failure;
 	if ((ct->status & IPS_SEQ_ADJUST) &&
 	    ctnetlink_dump_ct_seq_adj(skb, ct) < 0)
 		goto nla_put_failure;
 #ifdef CONFIG_NF_CONNTRACK_MARK
 	if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0)
 		goto nla_put_failure;
 #endif
 	if (ctnetlink_dump_labels(skb, ct) < 0)
 		goto nla_put_failure;
 	rcu_read_unlock();
 	return 0;
 nla_put_failure:
 	rcu_read_unlock();
 	return -ENOSPC;
 }
 static int
 ctnetlink_nfqueue_parse_ct(const struct nlattr *cda[], struct nf_conn *ct)
 {
 	int err;
 	if (cda[CTA_TIMEOUT]) {
 		err = ctnetlink_change_timeout(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_STATUS]) {
 		err = ctnetlink_change_status(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_HELP]) {
 		err = ctnetlink_change_helper(ct, cda);
 		if (err < 0)
 			return err;
 	}
 	if (cda[CTA_LABELS]) {
 		err = ctnetlink_attach_labels(ct, cda);
 		if (err < 0)
 			return err;
 	}
 #if defined(CONFIG_NF_CONNTRACK_MARK)
-	if (cda[CTA_MARK])
+	if (cda[CTA_MARK]) {
-		ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
+		u32 mask = 0, mark, newmark;
+		if (cda[CTA_MARK_MASK])
+			mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK]));
+		mark = ntohl(nla_get_be32(cda[CTA_MARK]));
+		newmark = (ct->mark & mask) ^ mark;
+		if (newmark != ct->mark)
+			ct->mark = newmark;
+	}
 #endif
 	return 0;
 }
 static int
 ctnetlink_nfqueue_parse(const struct nlattr *attr, struct nf_conn *ct)
 {
 	struct nlattr *cda[CTA_MAX+1];
 	int ret;
 	ret = nla_parse_nested(cda, CTA_MAX, attr, ct_nla_policy);
 	if (ret < 0)
 		return ret;
 	spin_lock_bh(&nf_conntrack_lock);
 	ret = ctnetlink_nfqueue_parse_ct((const struct nlattr **)cda, ct);
 	spin_unlock_bh(&nf_conntrack_lock);
 	return ret;
 }
 static int ctnetlink_nfqueue_exp_parse(const struct nlattr * const *cda,
 				       const struct nf_conn *ct,
 				       struct nf_conntrack_tuple *tuple,
 				       struct nf_conntrack_tuple *mask)
 {
 	int err;
 	err = ctnetlink_parse_tuple(cda, tuple, CTA_EXPECT_TUPLE,
 				    nf_ct_l3num(ct));
 	if (err < 0)
 		return err;
 	return ctnetlink_parse_tuple(cda, mask, CTA_EXPECT_MASK,
 				     nf_ct_l3num(ct));
 }
 static int
 ctnetlink_nfqueue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
 				u32 portid, u32 report)
 {
 	struct nlattr *cda[CTA_EXPECT_MAX+1];
 	struct nf_conntrack_tuple tuple, mask;
 	struct nf_conntrack_helper *helper = NULL;
 	struct nf_conntrack_expect *exp;
 	int err;
 	err = nla_parse_nested(cda, CTA_EXPECT_MAX, attr, exp_nla_policy);
 	if (err < 0)
 		return err;
 	err = ctnetlink_nfqueue_exp_parse((const struct nlattr * const *)cda,
 					  ct, &tuple, &mask);
 	if (err < 0)
 		return err;
 	if (cda[CTA_EXPECT_HELP_NAME]) {
 		const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
 		helper = __nf_conntrack_helper_find(helpname, nf_ct_l3num(ct),
 						    nf_ct_protonum(ct));
 		if (helper == NULL)
 			return -EOPNOTSUPP;
 	}
 	exp = ctnetlink_alloc_expect((const struct nlattr * const *)cda, ct,
 				     helper, &tuple, &mask);
 	if (IS_ERR(exp))
 		return PTR_ERR(exp);
 	err = nf_ct_expect_related_report(exp, portid, report);
 	if (err < 0) {
 		nf_ct_expect_put(exp);
 		return err;
 	}
 	return 0;
 }
 static struct nfq_ct_hook ctnetlink_nfqueue_hook = {
 	.build_size	= ctnetlink_nfqueue_build_size,
 	.build		= ctnetlink_nfqueue_build,
 	.parse		= ctnetlink_nfqueue_parse,
 	.attach_expect	= ctnetlink_nfqueue_attach_expect,
 	.seq_adjust	= nf_ct_tcp_seqadj_set,
 };
 #endif /* CONFIG_NETFILTER_NETLINK_QUEUE_CT */
 /***********************************************************************
  * EXPECT
  ***********************************************************************/
 static inline int
 ctnetlink_exp_dump_tuple(struct sk_buff *skb,
 			 const struct nf_conntrack_tuple *tuple,
 			 enum ctattr_expect type)
 {
 	struct nlattr *nest_parms;
 	nest_parms = nla_nest_start(skb, type | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	if (ctnetlink_dump_tuples(skb, tuple) < 0)
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static inline int
 ctnetlink_exp_dump_mask(struct sk_buff *skb,
 			const struct nf_conntrack_tuple *tuple,
 			const struct nf_conntrack_tuple_mask *mask)
 {
 	int ret;
 	struct nf_conntrack_l3proto *l3proto;
 	struct nf_conntrack_l4proto *l4proto;
 	struct nf_conntrack_tuple m;
 	struct nlattr *nest_parms;
 	memset(&m, 0xFF, sizeof(m));
 	memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
 	m.src.u.all = mask->src.u.all;
 	m.dst.protonum = tuple->dst.protonum;
 	nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
 	if (!nest_parms)
 		goto nla_put_failure;
 	rcu_read_lock();
 	l3proto = __nf_ct_l3proto_find(tuple->src.l3num);
 	ret = ctnetlink_dump_tuples_ip(skb, &m, l3proto);
 	if (ret >= 0) {
 		l4proto = __nf_ct_l4proto_find(tuple->src.l3num,
 					       tuple->dst.protonum);
 	ret = ctnetlink_dump_tuples_proto(skb, &m, l4proto);
 	}
 	rcu_read_unlock();
 	if (unlikely(ret < 0))
 		goto nla_put_failure;
 	nla_nest_end(skb, nest_parms);
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static const union nf_inet_addr any_addr;
 static int
 ctnetlink_exp_dump_expect(struct sk_buff *skb,
 			  const struct nf_conntrack_expect *exp)
 {
 	struct nf_conn *master = exp->master;
 	long timeout = ((long)exp->timeout.expires - (long)jiffies) / HZ;
 	struct nf_conn_help *help;
 #ifdef CONFIG_NF_NAT_NEEDED
 	struct nlattr *nest_parms;
 	struct nf_conntrack_tuple nat_tuple = {};
 #endif
 	struct nf_ct_helper_expectfn *expfn;
 	if (timeout < 0)
 		timeout = 0;
 	if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
 		goto nla_put_failure;
 	if (ctnetlink_exp_dump_mask(skb, &exp->tuple, &exp->mask) < 0)
 		goto nla_put_failure;
 	if (ctnetlink_exp_dump_tuple(skb,
 				 &master->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 				 CTA_EXPECT_MASTER) < 0)
 		goto nla_put_failure;
 #ifdef CONFIG_NF_NAT_NEEDED
 	if (!nf_inet_addr_cmp(&exp->saved_addr, &any_addr) ||
 	    exp->saved_proto.all) {
 		nest_parms = nla_nest_start(skb, CTA_EXPECT_NAT | NLA_F_NESTED);
 		if (!nest_parms)
 			goto nla_put_failure;
 		if (nla_put_be32(skb, CTA_EXPECT_NAT_DIR, htonl(exp->dir)))
 			goto nla_put_failure;
 		nat_tuple.src.l3num = nf_ct_l3num(master);
 		nat_tuple.src.u3 = exp->saved_addr;
 		nat_tuple.dst.protonum = nf_ct_protonum(master);
 		nat_tuple.src.u = exp->saved_proto;
 		if (ctnetlink_exp_dump_tuple(skb, &nat_tuple,
 						CTA_EXPECT_NAT_TUPLE) < 0)
 	                goto nla_put_failure;
 	        nla_nest_end(skb, nest_parms);
 	}
 #endif
 	if (nla_put_be32(skb, CTA_EXPECT_TIMEOUT, htonl(timeout)) ||
 	    nla_put_be32(skb, CTA_EXPECT_ID, htonl((unsigned long)exp)) ||
 	    nla_put_be32(skb, CTA_EXPECT_FLAGS, htonl(exp->flags)) ||
 	    nla_put_be32(skb, CTA_EXPECT_CLASS, htonl(exp->class)))
 		goto nla_put_failure;
 	help = nfct_help(master);
 	if (help) {
 		struct nf_conntrack_helper *helper;
 		helper = rcu_dereference(help->helper);
 		if (helper &&
 		    nla_put_string(skb, CTA_EXPECT_HELP_NAME, helper->name))
 			goto nla_put_failure;
 	}
 	expfn = nf_ct_helper_expectfn_find_by_symbol(exp->expectfn);
 	if (expfn != NULL &&
 	    nla_put_string(skb, CTA_EXPECT_FN, expfn->name))
 		goto nla_put_failure;
 	return 0;
 nla_put_failure:
 	return -1;
 }
 static int
 ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
 			int event, const struct nf_conntrack_expect *exp)
 {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfmsg;
 	unsigned int flags = portid ? NLM_F_MULTI : 0;
 	event |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
 	if (nlh == NULL)
 		goto nlmsg_failure;
 	nfmsg = nlmsg_data(nlh);
 	nfmsg->nfgen_family = exp->tuple.src.l3num;
 	nfmsg->version	    = NFNETLINK_V0;
 	nfmsg->res_id	    = 0;
 	if (ctnetlink_exp_dump_expect(skb, exp) < 0)
 		goto nla_put_failure;
 	nlmsg_end(skb, nlh);
 	return skb->len;
 nlmsg_failure:
 nla_put_failure:
 	nlmsg_cancel(skb, nlh);
 	return -1;
 }
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 static int
 ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
 {
 	struct nf_conntrack_expect *exp = item->exp;
 	struct net *net = nf_ct_exp_net(exp);
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfmsg;
 	struct sk_buff *skb;
 	unsigned int type, group;
 	int flags = 0;
 	if (events & (1 << IPEXP_DESTROY)) {
 		type = IPCTNL_MSG_EXP_DELETE;
 		group = NFNLGRP_CONNTRACK_EXP_DESTROY;
 	} else if (events & (1 << IPEXP_NEW)) {
 		type = IPCTNL_MSG_EXP_NEW;
 		flags = NLM_F_CREATE|NLM_F_EXCL;
 		group = NFNLGRP_CONNTRACK_EXP_NEW;
 	} else
 		return 0;
 	if (!item->report && !nfnetlink_has_listeners(net, group))
 		return 0;
 	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
 	if (skb == NULL)
 		goto errout;
 	type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
 	nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
 	if (nlh == NULL)
 		goto nlmsg_failure;
 	nfmsg = nlmsg_data(nlh);
 	nfmsg->nfgen_family = exp->tuple.src.l3num;
 	nfmsg->version	    = NFNETLINK_V0;
 	nfmsg->res_id	    = 0;
 	rcu_read_lock();
 	if (ctnetlink_exp_dump_expect(skb, exp) < 0)
 		goto nla_put_failure;
 	rcu_read_unlock();
 	nlmsg_end(skb, nlh);
 	nfnetlink_send(skb, net, item->portid, group, item->report, GFP_ATOMIC);
 	return 0;
 nla_put_failure:
 	rcu_read_unlock();
 	nlmsg_cancel(skb, nlh);
 nlmsg_failure:
 	kfree_skb(skb);
 errout:
 	nfnetlink_set_err(net, 0, 0, -ENOBUFS);
 	return 0;
 }
 #endif
 static int ctnetlink_exp_done(struct netlink_callback *cb)
 {
 	if (cb->args[1])
 		nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]);
 	return 0;
 }
 static int
 ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct net *net = sock_net(skb->sk);
 	struct nf_conntrack_expect *exp, *last;
 	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 	u_int8_t l3proto = nfmsg->nfgen_family;
 	rcu_read_lock();
 	last = (struct nf_conntrack_expect *)cb->args[1];
 	for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
 restart:
 		hlist_for_each_entry(exp, &net->ct.expect_hash[cb->args[0]],
 				     hnode) {
 			if (l3proto && exp->tuple.src.l3num != l3proto)
 				continue;
 			if (cb->args[1]) {
 				if (exp != last)
 					continue;
 				cb->args[1] = 0;
 			}
 			if (ctnetlink_exp_fill_info(skb,
 						    NETLINK_CB(cb->skb).portid,
 						    cb->nlh->nlmsg_seq,
 						    IPCTNL_MSG_EXP_NEW,
 						    exp) < 0) {
 				if (!atomic_inc_not_zero(&exp->use))
 					continue;
 				cb->args[1] = (unsigned long)exp;
 				goto out;
 			}
 		}
 		if (cb->args[1]) {
 			cb->args[1] = 0;
 			goto restart;
 		}
 	}
 out:
 	rcu_read_unlock();
 	if (last)
 		nf_ct_expect_put(last);
 	return skb->len;
 }
 static int
 ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct nf_conntrack_expect *exp, *last;
 	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
 	struct nf_conn *ct = cb->data;
 	struct nf_conn_help *help = nfct_help(ct);
 	u_int8_t l3proto = nfmsg->nfgen_family;
 	if (cb->args[0])
 		return 0;
 	rcu_read_lock();
 	last = (struct nf_conntrack_expect *)cb->args[1];
 restart:
 	hlist_for_each_entry(exp, &help->expectations, lnode) {
 		if (l3proto && exp->tuple.src.l3num != l3proto)
 			continue;
 		if (cb->args[1]) {
 			if (exp != last)
 				continue;
 			cb->args[1] = 0;
 		}
 		if (ctnetlink_exp_fill_info(skb, NETLINK_CB(cb->skb).portid,
 					    cb->nlh->nlmsg_seq,
 					    IPCTNL_MSG_EXP_NEW,
 					    exp) < 0) {
 			if (!atomic_inc_not_zero(&exp->use))
 				continue;
 			cb->args[1] = (unsigned long)exp;
 			goto out;
 		}
 	}
 	if (cb->args[1]) {
 		cb->args[1] = 0;
 		goto restart;
 	}
 	cb->args[0] = 1;
 out:
 	rcu_read_unlock();
 	if (last)
 		nf_ct_expect_put(last);
 	return skb->len;
 }
 static int ctnetlink_dump_exp_ct(struct sock *ctnl, struct sk_buff *skb,
 				 const struct nlmsghdr *nlh,
 				 const struct nlattr * const cda[])
 {
 	int err;
 	struct net *net = sock_net(ctnl);
 	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	u_int8_t u3 = nfmsg->nfgen_family;
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_tuple_hash *h;
 	struct nf_conn *ct;
 	u16 zone = 0;
 	struct netlink_dump_control c = {
 		.dump = ctnetlink_exp_ct_dump_table,
 		.done = ctnetlink_exp_done,
 	};
 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
 	if (err < 0)
 		return err;
 	if (cda[CTA_EXPECT_ZONE]) {
 		err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
 		if (err < 0)
 			return err;
 	}
 	h = nf_conntrack_find_get(net, zone, &tuple);
 	if (!h)
 		return -ENOENT;
 	ct = nf_ct_tuplehash_to_ctrack(h);
 	c.data = ct;
 	err = netlink_dump_start(ctnl, skb, nlh, &c);
 	nf_ct_put(ct);
 	return err;
 }
 static int
 ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
 		     const struct nlmsghdr *nlh,
 		     const struct nlattr * const cda[])
 {
 	struct net *net = sock_net(ctnl);
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_expect *exp;
 	struct sk_buff *skb2;
 	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	u_int8_t u3 = nfmsg->nfgen_family;
 	u16 zone;
 	int err;
 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
 		if (cda[CTA_EXPECT_MASTER])
 			return ctnetlink_dump_exp_ct(ctnl, skb, nlh, cda);
 		else {
 			struct netlink_dump_control c = {
 				.dump = ctnetlink_exp_dump_table,
 				.done = ctnetlink_exp_done,
 			};
 			return netlink_dump_start(ctnl, skb, nlh, &c);
 		}
 	}
 	err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
 	if (err < 0)
 		return err;
 	if (cda[CTA_EXPECT_TUPLE])
 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
 	else if (cda[CTA_EXPECT_MASTER])
 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, u3);
 	else
 		return -EINVAL;
 	if (err < 0)
 		return err;
 	exp = nf_ct_expect_find_get(net, zone, &tuple);
 	if (!exp)
 		return -ENOENT;
 	if (cda[CTA_EXPECT_ID]) {
 		__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
 		if (ntohl(id) != (u32)(unsigned long)exp) {
 			nf_ct_expect_put(exp);
 			return -ENOENT;
 		}
 	}
 	err = -ENOMEM;
 	skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 	if (skb2 == NULL) {
 		nf_ct_expect_put(exp);
 		goto out;
 	}
 	rcu_read_lock();
 	err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid,
 				      nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp);
 	rcu_read_unlock();
 	nf_ct_expect_put(exp);
 	if (err <= 0)
 		goto free;
 	err = netlink_unicast(ctnl, skb2, NETLINK_CB(skb).portid, MSG_DONTWAIT);
 	if (err < 0)
 		goto out;
 	return 0;
 free:
 	kfree_skb(skb2);
 out:
 	/* this avoids a loop in nfnetlink. */
 	return err == -EAGAIN ? -ENOBUFS : err;
 }
 static int
 ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
 		     const struct nlmsghdr *nlh,
 		     const struct nlattr * const cda[])
 {
 	struct net *net = sock_net(ctnl);
 	struct nf_conntrack_expect *exp;
 	struct nf_conntrack_tuple tuple;
 	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	struct hlist_node *next;
 	u_int8_t u3 = nfmsg->nfgen_family;
 	unsigned int i;
 	u16 zone;
 	int err;
 	if (cda[CTA_EXPECT_TUPLE]) {
 		/* delete a single expect by tuple */
 		err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
 		if (err < 0)
 			return err;
 		err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
 		if (err < 0)
 			return err;
 		/* bump usage count to 2 */
 		exp = nf_ct_expect_find_get(net, zone, &tuple);
 		if (!exp)
 			return -ENOENT;
 		if (cda[CTA_EXPECT_ID]) {
 			__be32 id = nla_get_be32(cda[CTA_EXPECT_ID]);
 			if (ntohl(id) != (u32)(unsigned long)exp) {
 				nf_ct_expect_put(exp);
 				return -ENOENT;
 			}
 		}
 		/* after list removal, usage count == 1 */
 		spin_lock_bh(&nf_conntrack_lock);
 		if (del_timer(&exp->timeout)) {
 			nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid,
 						   nlmsg_report(nlh));
 			nf_ct_expect_put(exp);
 		}
 		spin_unlock_bh(&nf_conntrack_lock);
 		/* have to put what we 'get' above.
 		 * after this line usage count == 0 */
 		nf_ct_expect_put(exp);
 	} else if (cda[CTA_EXPECT_HELP_NAME]) {
 		char *name = nla_data(cda[CTA_EXPECT_HELP_NAME]);
 		struct nf_conn_help *m_help;
 		/* delete all expectations for this helper */
 		spin_lock_bh(&nf_conntrack_lock);
 		for (i = 0; i < nf_ct_expect_hsize; i++) {
 			hlist_for_each_entry_safe(exp, next,
 						  &net->ct.expect_hash[i],
 						  hnode) {
 				m_help = nfct_help(exp->master);
 				if (!strcmp(m_help->helper->name, name) &&
 				    del_timer(&exp->timeout)) {
 					nf_ct_unlink_expect_report(exp,
 							NETLINK_CB(skb).portid,
 							nlmsg_report(nlh));
 					nf_ct_expect_put(exp);
 				}
 			}
 		}
 		spin_unlock_bh(&nf_conntrack_lock);
 	} else {
 		/* This basically means we have to flush everything*/
 		spin_lock_bh(&nf_conntrack_lock);
 		for (i = 0; i < nf_ct_expect_hsize; i++) {
 			hlist_for_each_entry_safe(exp, next,
 						  &net->ct.expect_hash[i],
 						  hnode) {
 				if (del_timer(&exp->timeout)) {
 					nf_ct_unlink_expect_report(exp,
 							NETLINK_CB(skb).portid,
 							nlmsg_report(nlh));
 					nf_ct_expect_put(exp);
 				}
 			}
 		}
 		spin_unlock_bh(&nf_conntrack_lock);
 	}
 	return 0;
 }
 static int
 ctnetlink_change_expect(struct nf_conntrack_expect *x,
 			const struct nlattr * const cda[])
 {
 	if (cda[CTA_EXPECT_TIMEOUT]) {
 		if (!del_timer(&x->timeout))
 			return -ETIME;
 		x->timeout.expires = jiffies +
 			ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
 		add_timer(&x->timeout);
 	}
 	return 0;
 }
 static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
 	[CTA_EXPECT_NAT_DIR]	= { .type = NLA_U32 },
 	[CTA_EXPECT_NAT_TUPLE]	= { .type = NLA_NESTED },
 };
 static int
 ctnetlink_parse_expect_nat(const struct nlattr *attr,
 			   struct nf_conntrack_expect *exp,
 			   u_int8_t u3)
 {
 #ifdef CONFIG_NF_NAT_NEEDED
 	struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];
 	struct nf_conntrack_tuple nat_tuple = {};
 	int err;
 	err = nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_nla_policy);
 	if (err < 0)
 		return err;
 	if (!tb[CTA_EXPECT_NAT_DIR] || !tb[CTA_EXPECT_NAT_TUPLE])
 		return -EINVAL;
 	err = ctnetlink_parse_tuple((const struct nlattr * const *)tb,
 					&nat_tuple, CTA_EXPECT_NAT_TUPLE, u3);
 	if (err < 0)
 		return err;
 	exp->saved_addr = nat_tuple.src.u3;
 	exp->saved_proto = nat_tuple.src.u;
 	exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));
 	return 0;
 #else
 	return -EOPNOTSUPP;
 #endif
 }
 static struct nf_conntrack_expect *
 ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
 		       struct nf_conntrack_helper *helper,
 		       struct nf_conntrack_tuple *tuple,
 		       struct nf_conntrack_tuple *mask)
 {
 	u_int32_t class = 0;
 	struct nf_conntrack_expect *exp;
 	struct nf_conn_help *help;
 	int err;
 	if (cda[CTA_EXPECT_CLASS] && helper) {
 		class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
 		if (class > helper->expect_class_max)
 			return ERR_PTR(-EINVAL);
 	}
 	exp = nf_ct_expect_alloc(ct);
 	if (!exp)
 		return ERR_PTR(-ENOMEM);
 	help = nfct_help(ct);
 	if (!help) {
 		if (!cda[CTA_EXPECT_TIMEOUT]) {
 			err = -EINVAL;
 			goto err_out;
 		}
 		exp->timeout.expires =
 		  jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
 		exp->flags = NF_CT_EXPECT_USERSPACE;
 		if (cda[CTA_EXPECT_FLAGS]) {
 			exp->flags |=
 				ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
 		}
 	} else {
 		if (cda[CTA_EXPECT_FLAGS]) {
 			exp->flags = ntohl(nla_get_be32(cda[CTA_EXPECT_FLAGS]));
 			exp->flags &= ~NF_CT_EXPECT_USERSPACE;
 		} else
 			exp->flags = 0;
 	}
 	if (cda[CTA_EXPECT_FN]) {
 		const char *name = nla_data(cda[CTA_EXPECT_FN]);
 		struct nf_ct_helper_expectfn *expfn;
 		expfn = nf_ct_helper_expectfn_find_by_name(name);
 		if (expfn == NULL) {
 			err = -EINVAL;
 			goto err_out;
 		}
 		exp->expectfn = expfn->expectfn;
 	} else
 		exp->expectfn = NULL;
 	exp->class = class;
 	exp->master = ct;
 	exp->helper = helper;
 	exp->tuple = *tuple;
 	exp->mask.src.u3 = mask->src.u3;
 	exp->mask.src.u.all = mask->src.u.all;
 	if (cda[CTA_EXPECT_NAT]) {
 		err = ctnetlink_parse_expect_nat(cda[CTA_EXPECT_NAT],
 						 exp, nf_ct_l3num(ct));
 		if (err < 0)
 			goto err_out;
 	}
 	return exp;
 err_out:
 	nf_ct_expect_put(exp);
 	return ERR_PTR(err);
 }
 static int
 ctnetlink_create_expect(struct net *net, u16 zone,
 			const struct nlattr * const cda[],
 			u_int8_t u3, u32 portid, int report)
 {
 	struct nf_conntrack_tuple tuple, mask, master_tuple;
 	struct nf_conntrack_tuple_hash *h = NULL;
 	struct nf_conntrack_helper *helper = NULL;
 	struct nf_conntrack_expect *exp;
 	struct nf_conn *ct;
 	int err;
 	/* caller guarantees that those three CTA_EXPECT_* exist */
 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
 	if (err < 0)
 		return err;
 	err = ctnetlink_parse_tuple(cda, &mask, CTA_EXPECT_MASK, u3);
 	if (err < 0)
 		return err;
 	err = ctnetlink_parse_tuple(cda, &master_tuple, CTA_EXPECT_MASTER, u3);
 	if (err < 0)
 		return err;
 	/* Look for master conntrack of this expectation */
 	h = nf_conntrack_find_get(net, zone, &master_tuple);
 	if (!h)
 		return -ENOENT;
 	ct = nf_ct_tuplehash_to_ctrack(h);
 	if (cda[CTA_EXPECT_HELP_NAME]) {
 		const char *helpname = nla_data(cda[CTA_EXPECT_HELP_NAME]);
 		helper = __nf_conntrack_helper_find(helpname, u3,
 						    nf_ct_protonum(ct));
 		if (helper == NULL) {
 #ifdef CONFIG_MODULES
 			if (request_module("nfct-helper-%s", helpname) < 0) {
 				err = -EOPNOTSUPP;
 				goto err_ct;
 			}
 			helper = __nf_conntrack_helper_find(helpname, u3,
 							    nf_ct_protonum(ct));
 			if (helper) {
 				err = -EAGAIN;
 				goto err_ct;
 			}
 #endif
 			err = -EOPNOTSUPP;
 			goto err_ct;
 		}
 	}
 	exp = ctnetlink_alloc_expect(cda, ct, helper, &tuple, &mask);
 	if (IS_ERR(exp)) {
 		err = PTR_ERR(exp);
 		goto err_ct;
 	}
 	err = nf_ct_expect_related_report(exp, portid, report);
 	if (err < 0)
 		goto err_exp;
 	return 0;
 err_exp:
 	nf_ct_expect_put(exp);
 err_ct:
 	nf_ct_put(ct);
 	return err;
 }
 static int
 ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
 		     const struct nlmsghdr *nlh,
 		     const struct nlattr * const cda[])
 {
 	struct net *net = sock_net(ctnl);
 	struct nf_conntrack_tuple tuple;
 	struct nf_conntrack_expect *exp;
 	struct nfgenmsg *nfmsg = nlmsg_data(nlh);
 	u_int8_t u3 = nfmsg->nfgen_family;
 	u16 zone;
 	int err;
 	if (!cda[CTA_EXPECT_TUPLE]
 	    || !cda[CTA_EXPECT_MASK]
 	    || !cda[CTA_EXPECT_MASTER])
 		return -EINVAL;
 	err = ctnetlink_parse_zone(cda[CTA_EXPECT_ZONE], &zone);
 	if (err < 0)
 		return err;
 	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
 	if (err < 0)
 		return err;
 	spin_lock_bh(&nf_conntrack_lock);
 	exp = __nf_ct_expect_find(net, zone, &tuple);
 	if (!exp) {
 		spin_unlock_bh(&nf_conntrack_lock);
 		err = -ENOENT;
 		if (nlh->nlmsg_flags & NLM_F_CREATE) {
 			err = ctnetlink_create_expect(net, zone, cda,
 						      u3,
 						      NETLINK_CB(skb).portid,
 						      nlmsg_report(nlh));
 		}
 		return err;
 	}
 	err = -EEXIST;
 	if (!(nlh->nlmsg_flags & NLM_F_EXCL))
 		err = ctnetlink_change_expect(exp, cda);
 	spin_unlock_bh(&nf_conntrack_lock);
 	return err;
 }
 static int
 ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu,
 			     const struct ip_conntrack_stat *st)
 {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfmsg;
 	unsigned int flags = portid ? NLM_F_MULTI : 0, event;
 	event = (NFNL_SUBSYS_CTNETLINK << 8 | IPCTNL_MSG_EXP_GET_STATS_CPU);
 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
 	if (nlh == NULL)
 		goto nlmsg_failure;
 	nfmsg = nlmsg_data(nlh);
 	nfmsg->nfgen_family = AF_UNSPEC;
 	nfmsg->version      = NFNETLINK_V0;
 	nfmsg->res_id	    = htons(cpu);
 	if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) ||
 	    nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) ||
 	    nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete)))
 		goto nla_put_failure;
 	nlmsg_end(skb, nlh);
 	return skb->len;
 nla_put_failure:
 nlmsg_failure:
 	nlmsg_cancel(skb, nlh);
 	return -1;
 }
 static int
 ctnetlink_exp_stat_cpu_dump(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	int cpu;
 	struct net *net = sock_net(skb->sk);
 	if (cb->args[0] == nr_cpu_ids)
 		return 0;
 	for (cpu = cb->args[0]; cpu < nr_cpu_ids; cpu++) {
 		const struct ip_conntrack_stat *st;
 		if (!cpu_possible(cpu))
 			continue;
 		st = per_cpu_ptr(net->ct.stat, cpu);
 		if (ctnetlink_exp_stat_fill_info(skb, NETLINK_CB(cb->skb).portid,
 						 cb->nlh->nlmsg_seq,
 						 cpu, st) < 0)
 			break;
 	}
 	cb->args[0] = cpu;
 	return skb->len;
 }
 static int
 ctnetlink_stat_exp_cpu(struct sock *ctnl, struct sk_buff *skb,
 		       const struct nlmsghdr *nlh,
 		       const struct nlattr * const cda[])
 {
 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
 		struct netlink_dump_control c = {
 			.dump = ctnetlink_exp_stat_cpu_dump,
 		};
 		return netlink_dump_start(ctnl, skb, nlh, &c);
 	}
 	return 0;
 }
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 static struct nf_ct_event_notifier ctnl_notifier = {
 	.fcn = ctnetlink_conntrack_event,
 };
 static struct nf_exp_event_notifier ctnl_notifier_exp = {
 	.fcn = ctnetlink_expect_event,
 };
 #endif
 static const struct nfnl_callback ctnl_cb[IPCTNL_MSG_MAX] = {
 	[IPCTNL_MSG_CT_NEW]		= { .call = ctnetlink_new_conntrack,
 					    .attr_count = CTA_MAX,
 					    .policy = ct_nla_policy },
 	[IPCTNL_MSG_CT_GET] 		= { .call = ctnetlink_get_conntrack,
 					    .attr_count = CTA_MAX,
 					    .policy = ct_nla_policy },
 	[IPCTNL_MSG_CT_DELETE]  	= { .call = ctnetlink_del_conntrack,
 					    .attr_count = CTA_MAX,
 					    .policy = ct_nla_policy },
 	[IPCTNL_MSG_CT_GET_CTRZERO] 	= { .call = ctnetlink_get_conntrack,
 					    .attr_count = CTA_MAX,
 					    .policy = ct_nla_policy },
 	[IPCTNL_MSG_CT_GET_STATS_CPU]	= { .call = ctnetlink_stat_ct_cpu },
 	[IPCTNL_MSG_CT_GET_STATS]	= { .call = ctnetlink_stat_ct },
 	[IPCTNL_MSG_CT_GET_DYING]	= { .call = ctnetlink_get_ct_dying },
 	[IPCTNL_MSG_CT_GET_UNCONFIRMED]	= { .call = ctnetlink_get_ct_unconfirmed },
 };
 static const struct nfnl_callback ctnl_exp_cb[IPCTNL_MSG_EXP_MAX] = {
 	[IPCTNL_MSG_EXP_GET]		= { .call = ctnetlink_get_expect,
 					    .attr_count = CTA_EXPECT_MAX,
 					    .policy = exp_nla_policy },
 	[IPCTNL_MSG_EXP_NEW]		= { .call = ctnetlink_new_expect,
 					    .attr_count = CTA_EXPECT_MAX,
 					    .policy = exp_nla_policy },
 	[IPCTNL_MSG_EXP_DELETE]		= { .call = ctnetlink_del_expect,
 					    .attr_count = CTA_EXPECT_MAX,
 					    .policy = exp_nla_policy },
 	[IPCTNL_MSG_EXP_GET_STATS_CPU]	= { .call = ctnetlink_stat_exp_cpu },
 };
 static const struct nfnetlink_subsystem ctnl_subsys = {
 	.name				= "conntrack",
 	.subsys_id			= NFNL_SUBSYS_CTNETLINK,
 	.cb_count			= IPCTNL_MSG_MAX,
 	.cb				= ctnl_cb,
 };
 static const struct nfnetlink_subsystem ctnl_exp_subsys = {
 	.name				= "conntrack_expect",
 	.subsys_id			= NFNL_SUBSYS_CTNETLINK_EXP,
 	.cb_count			= IPCTNL_MSG_EXP_MAX,
 	.cb				= ctnl_exp_cb,
 };
 MODULE_ALIAS("ip_conntrack_netlink");
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
 static int __net_init ctnetlink_net_init(struct net *net)
 {
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 	int ret;
 	ret = nf_conntrack_register_notifier(net, &ctnl_notifier);
 	if (ret < 0) {
 		pr_err("ctnetlink_init: cannot register notifier.\n");
 		goto err_out;
 	}
 	ret = nf_ct_expect_register_notifier(net, &ctnl_notifier_exp);
 	if (ret < 0) {
 		pr_err("ctnetlink_init: cannot expect register notifier.\n");
 		goto err_unreg_notifier;
 	}
 #endif
 	return 0;
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 err_unreg_notifier:
 	nf_conntrack_unregister_notifier(net, &ctnl_notifier);
 err_out:
 	return ret;
 #endif
 }
 static void ctnetlink_net_exit(struct net *net)
 {
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
 	nf_ct_expect_unregister_notifier(net, &ctnl_notifier_exp);
 	nf_conntrack_unregister_notifier(net, &ctnl_notifier);
 #endif
 }
 static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)
 {
 	struct net *net;
 	list_for_each_entry(net, net_exit_list, exit_list)
 		ctnetlink_net_exit(net);
 }
 static struct pernet_operations ctnetlink_net_ops = {
 	.init		= ctnetlink_net_init,
 	.exit_batch	= ctnetlink_net_exit_batch,
 };
 static int __init ctnetlink_init(void)
 {
 	int ret;
 	pr_info("ctnetlink v%s: registering with nfnetlink.\n", version);
 	ret = nfnetlink_subsys_register(&ctnl_subsys);
 	if (ret < 0) {
 		pr_err("ctnetlink_init: cannot register with nfnetlink.\n");
 		goto err_out;
 	}
 	ret = nfnetlink_subsys_register(&ctnl_exp_subsys);
 	if (ret < 0) {
 		pr_err("ctnetlink_init: cannot register exp with nfnetlink.\n");
 		goto err_unreg_subsys;
 	}
 	ret = register_pernet_subsys(&ctnetlink_net_ops);
 	if (ret < 0) {
 		pr_err("ctnetlink_init: cannot register pernet operations\n");
 		goto err_unreg_exp_subsys;
 	}
 #ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
 	/* setup interaction between nf_queue and nf_conntrack_netlink. */
 	RCU_INIT_POINTER(nfq_ct_hook, &ctnetlink_nfqueue_hook);
 #endif
 	return 0;
 err_unreg_exp_subsys:
 	nfnetlink_subsys_unregister(&ctnl_exp_subsys);
 err_unreg_subsys:
 	nfnetlink_subsys_unregister(&ctnl_subsys);
 err_out:
 	return ret;
 }
 static void __exit ctnetlink_exit(void)
 {
 	pr_info("ctnetlink: unregistering from nfnetlink.\n");
 	unregister_pernet_subsys(&ctnetlink_net_ops);
 	nfnetlink_subsys_unregister(&ctnl_exp_subsys);
 	nfnetlink_subsys_unregister(&ctnl_subsys);
 #ifdef CONFIG_NETFILTER_NETLINK_QUEUE_CT
 	RCU_INIT_POINTER(nfq_ct_hook, NULL);
 #endif
 }
 module_init(ctnetlink_init);
 module_exit(ctnetlink_exit);